1 /*
2 * Copyright (C) 2022 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 /* Ensure assert() catches logical errors during fuzzing */
18 #ifdef NDEBUG
19 #undef NDEBUG
20 #endif
21
22 #include <inttypes.h>
23 #include <assert.h>
24 #include <stdbool.h>
25 #include <stdint.h>
26 #include <stdio.h>
27 #include <stdlib.h>
28 #include <ctype.h>
29
30 #include <sanitizer/asan_interface.h>
31 #include <sanitizer/msan_interface.h>
32
33 #include "libfdt.h"
34 #include "libfdt_env.h"
35
36 /* check memory region is valid, for the purpose of tooling such as asan */
check_mem(const void * mem,size_t len)37 static void check_mem(const void *mem, size_t len) {
38
39 assert(mem);
40
41 #if __has_feature(memory_sanitizer)
42 /* dumps if check fails */
43 __msan_check_mem_is_initialized((void *)mem, len);
44 #endif
45
46 #if __has_feature(address_sanitizer) || defined(__SANITIZE_ADDRESS__)
47 assert(!__asan_region_is_poisoned((void *)mem, len));
48 #else
49 const volatile uint8_t *mem8 = mem;
50
51 /* Read each byte of memory for instrumentation */
52 for(size_t i = 0; i < len; i++) {
53 (void)mem8[i];
54 }
55 #endif
56 }
57
phandle_is_valid(uint32_t phandle)58 static bool phandle_is_valid(uint32_t phandle) {
59 return phandle != 0 && phandle != UINT32_MAX;
60 }
61
walk_node_properties(const void * device_tree,int node)62 static void walk_node_properties(const void *device_tree, int node) {
63 int property, len = 0;
64
65 fdt_for_each_property_offset(property, device_tree, node) {
66 const struct fdt_property *prop = fdt_get_property_by_offset(device_tree,
67 property, &len);
68 if (!prop)
69 continue;
70 check_mem(prop->data, fdt32_to_cpu(prop->len));
71
72 const char *prop_name = fdt_string(device_tree, prop->nameoff);
73 if (prop_name != NULL) {
74 check_mem(prop_name, strlen(prop_name));
75 }
76 }
77 }
78
79
walk_device_tree(const void * device_tree,int parent_node)80 static void walk_device_tree(const void *device_tree, int parent_node) {
81 int len = 0;
82 const char *node_name = fdt_get_name(device_tree, parent_node, &len);
83 if (node_name != NULL) {
84 check_mem(node_name, len);
85 }
86
87 uint32_t phandle = fdt_get_phandle(device_tree, parent_node);
88 if (phandle_is_valid(phandle)) {
89 int node = fdt_node_offset_by_phandle(device_tree, phandle);
90 assert(node >= 0); // it should at least find parent_node
91 }
92
93 char path_buf[64];
94 if(fdt_get_path(device_tree, parent_node, path_buf, sizeof(path_buf)) == 0) {
95 fdt_path_offset(device_tree, path_buf);
96 }
97
98 fdt_parent_offset(device_tree, parent_node);
99
100 // Exercise sub-node search string functions
101 fdt_subnode_offset(device_tree, parent_node, "a");
102 fdt_get_property(device_tree, parent_node, "reg", &len);
103
104 // Check for a stringlist node called 'stringlist' (added to corpus)
105 const int sl_count = fdt_stringlist_count(device_tree,
106 parent_node, "stringlist");
107 if (sl_count > 0) {
108 for (int i = 0; i < sl_count; i++) {
109 fdt_stringlist_get(device_tree, parent_node, "stringlist", i, &len);
110 }
111
112 fdt_stringlist_search(device_tree, parent_node, "stringlist", "a");
113 }
114
115 walk_node_properties(device_tree, parent_node);
116
117 // recursively walk the node's children
118 for (int node = fdt_first_subnode(device_tree, parent_node); node >= 0;
119 node = fdt_next_subnode(device_tree, node)) {
120 walk_device_tree(device_tree, node);
121 }
122 }
123
124
walk_mem_rsv(const void * device_tree)125 static void walk_mem_rsv(const void *device_tree) {
126 const int n = fdt_num_mem_rsv(device_tree);
127 uint64_t address, size;
128
129 for (int i = 0; i < n; i++) {
130 fdt_get_mem_rsv(device_tree, i, &address, &size);
131 }
132 }
133
134
135 // Information on device tree is available in external/dtc/Documentation/
136 // folder.
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)137 int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
138 int rc;
139
140 // Non-zero return values are reserved for future use.
141 if (size < FDT_V17_SIZE) return 0;
142
143 // Produce coverage of checking function
144 rc = fdt_check_full(data, size);
145 fdt_strerror(rc);
146
147 // Don't continue if the library rejected the input
148 if (rc != 0) return 0;
149
150 // Cover reading functions
151 walk_device_tree(data, /* parent_node */ 0);
152 walk_mem_rsv(data);
153
154 // Cover phandle functions
155 uint32_t phandle;
156 fdt_generate_phandle(data, &phandle);
157
158 // Try and get a path by alias
159 fdt_path_offset(data, "a");
160
161 // Try to get an alias
162 fdt_get_alias(data, "a");
163
164 // Exercise common search functions
165 fdt_node_offset_by_compatible(data, 0, "a");
166 fdt_node_offset_by_prop_value(data, 0, "x", "42", 3);
167
168 return 0;
169 }
170
171