xref: /freebsd/contrib/llvm-project/compiler-rt/lib/fuzzer/FuzzerUtilFuchsia.cpp (revision 6ba2210ee039f2f12878c217bcf058e9c8b26b29)
1 //===- FuzzerUtilFuchsia.cpp - Misc utils for Fuchsia. --------------------===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 // Misc utils implementation using Fuchsia/Zircon APIs.
9 //===----------------------------------------------------------------------===//
10 #include "FuzzerPlatform.h"
11 
12 #if LIBFUZZER_FUCHSIA
13 
14 #include "FuzzerInternal.h"
15 #include "FuzzerUtil.h"
16 #include <cassert>
17 #include <cerrno>
18 #include <cinttypes>
19 #include <cstdint>
20 #include <fcntl.h>
21 #include <lib/fdio/fdio.h>
22 #include <lib/fdio/spawn.h>
23 #include <string>
24 #include <sys/select.h>
25 #include <thread>
26 #include <unistd.h>
27 #include <zircon/errors.h>
28 #include <zircon/process.h>
29 #include <zircon/sanitizer.h>
30 #include <zircon/status.h>
31 #include <zircon/syscalls.h>
32 #include <zircon/syscalls/debug.h>
33 #include <zircon/syscalls/exception.h>
34 #include <zircon/syscalls/object.h>
35 #include <zircon/types.h>
36 
37 #include <vector>
38 
39 namespace fuzzer {
40 
41 // Given that Fuchsia doesn't have the POSIX signals that libFuzzer was written
42 // around, the general approach is to spin up dedicated threads to watch for
43 // each requested condition (alarm, interrupt, crash).  Of these, the crash
44 // handler is the most involved, as it requires resuming the crashed thread in
45 // order to invoke the sanitizers to get the needed state.
46 
47 // Forward declaration of assembly trampoline needed to resume crashed threads.
48 // This appears to have external linkage to  C++, which is why it's not in the
49 // anonymous namespace.  The assembly definition inside MakeTrampoline()
50 // actually defines the symbol with internal linkage only.
51 void CrashTrampolineAsm() __asm__("CrashTrampolineAsm");
52 
53 namespace {
54 
55 // Helper function to handle Zircon syscall failures.
56 void ExitOnErr(zx_status_t Status, const char *Syscall) {
57   if (Status != ZX_OK) {
58     Printf("libFuzzer: %s failed: %s\n", Syscall,
59            _zx_status_get_string(Status));
60     exit(1);
61   }
62 }
63 
64 void AlarmHandler(int Seconds) {
65   while (true) {
66     SleepSeconds(Seconds);
67     Fuzzer::StaticAlarmCallback();
68   }
69 }
70 
71 // CFAOffset is used to reference the stack pointer before entering the
72 // trampoline (Stack Pointer + CFAOffset = prev Stack Pointer). Before jumping
73 // to the trampoline we copy all the registers onto the stack. We need to make
74 // sure that the new stack has enough space to store all the registers.
75 //
76 // The trampoline holds CFI information regarding the registers stored in the
77 // stack, which is then used by the unwinder to restore them.
78 #if defined(__x86_64__)
79 // In x86_64 the crashing function might also be using the red zone (128 bytes
80 // on top of their rsp).
81 constexpr size_t CFAOffset = 128 + sizeof(zx_thread_state_general_regs_t);
82 #elif defined(__aarch64__)
83 // In aarch64 we need to always have the stack pointer aligned to 16 bytes, so we
84 // make sure that we are keeping that same alignment.
85 constexpr size_t CFAOffset = (sizeof(zx_thread_state_general_regs_t) + 15) & -(uintptr_t)16;
86 #endif
87 
88 // For the crash handler, we need to call Fuzzer::StaticCrashSignalCallback
89 // without POSIX signal handlers.  To achieve this, we use an assembly function
90 // to add the necessary CFI unwinding information and a C function to bridge
91 // from that back into C++.
92 
93 // FIXME: This works as a short-term solution, but this code really shouldn't be
94 // architecture dependent. A better long term solution is to implement remote
95 // unwinding and expose the necessary APIs through sanitizer_common and/or ASAN
96 // to allow the exception handling thread to gather the crash state directly.
97 //
98 // Alternatively, Fuchsia may in future actually implement basic signal
99 // handling for the machine trap signals.
100 #if defined(__x86_64__)
101 #define FOREACH_REGISTER(OP_REG, OP_NUM) \
102   OP_REG(rax)                            \
103   OP_REG(rbx)                            \
104   OP_REG(rcx)                            \
105   OP_REG(rdx)                            \
106   OP_REG(rsi)                            \
107   OP_REG(rdi)                            \
108   OP_REG(rbp)                            \
109   OP_REG(rsp)                            \
110   OP_REG(r8)                             \
111   OP_REG(r9)                             \
112   OP_REG(r10)                            \
113   OP_REG(r11)                            \
114   OP_REG(r12)                            \
115   OP_REG(r13)                            \
116   OP_REG(r14)                            \
117   OP_REG(r15)                            \
118   OP_REG(rip)
119 
120 #elif defined(__aarch64__)
121 #define FOREACH_REGISTER(OP_REG, OP_NUM) \
122   OP_NUM(0)                              \
123   OP_NUM(1)                              \
124   OP_NUM(2)                              \
125   OP_NUM(3)                              \
126   OP_NUM(4)                              \
127   OP_NUM(5)                              \
128   OP_NUM(6)                              \
129   OP_NUM(7)                              \
130   OP_NUM(8)                              \
131   OP_NUM(9)                              \
132   OP_NUM(10)                             \
133   OP_NUM(11)                             \
134   OP_NUM(12)                             \
135   OP_NUM(13)                             \
136   OP_NUM(14)                             \
137   OP_NUM(15)                             \
138   OP_NUM(16)                             \
139   OP_NUM(17)                             \
140   OP_NUM(18)                             \
141   OP_NUM(19)                             \
142   OP_NUM(20)                             \
143   OP_NUM(21)                             \
144   OP_NUM(22)                             \
145   OP_NUM(23)                             \
146   OP_NUM(24)                             \
147   OP_NUM(25)                             \
148   OP_NUM(26)                             \
149   OP_NUM(27)                             \
150   OP_NUM(28)                             \
151   OP_NUM(29)                             \
152   OP_REG(sp)
153 
154 #else
155 #error "Unsupported architecture for fuzzing on Fuchsia"
156 #endif
157 
158 // Produces a CFI directive for the named or numbered register.
159 // The value used refers to an assembler immediate operand with the same name
160 // as the register (see ASM_OPERAND_REG).
161 #define CFI_OFFSET_REG(reg) ".cfi_offset " #reg ", %c[" #reg "]\n"
162 #define CFI_OFFSET_NUM(num) CFI_OFFSET_REG(x##num)
163 
164 // Produces an assembler immediate operand for the named or numbered register.
165 // This operand contains the offset of the register relative to the CFA.
166 #define ASM_OPERAND_REG(reg) \
167   [reg] "i"(offsetof(zx_thread_state_general_regs_t, reg) - CFAOffset),
168 #define ASM_OPERAND_NUM(num)                                 \
169   [x##num] "i"(offsetof(zx_thread_state_general_regs_t, r[num]) - CFAOffset),
170 
171 // Trampoline to bridge from the assembly below to the static C++ crash
172 // callback.
173 __attribute__((noreturn))
174 static void StaticCrashHandler() {
175   Fuzzer::StaticCrashSignalCallback();
176   for (;;) {
177     _Exit(1);
178   }
179 }
180 
181 // Creates the trampoline with the necessary CFI information to unwind through
182 // to the crashing call stack:
183 //  * Defining the CFA so that it points to the stack pointer at the point
184 //    of crash.
185 //  * Storing all registers at the point of crash in the stack and refer to them
186 //    via CFI information (relative to the CFA).
187 //  * Setting the return column so the unwinder knows how to continue unwinding.
188 //  * (x86_64) making sure rsp is aligned before calling StaticCrashHandler.
189 //  * Calling StaticCrashHandler that will trigger the unwinder.
190 //
191 // The __attribute__((used)) is necessary because the function
192 // is never called; it's just a container around the assembly to allow it to
193 // use operands for compile-time computed constants.
194 __attribute__((used))
195 void MakeTrampoline() {
196   __asm__(".cfi_endproc\n"
197     ".pushsection .text.CrashTrampolineAsm\n"
198     ".type CrashTrampolineAsm,STT_FUNC\n"
199 "CrashTrampolineAsm:\n"
200     ".cfi_startproc simple\n"
201     ".cfi_signal_frame\n"
202 #if defined(__x86_64__)
203     ".cfi_return_column rip\n"
204     ".cfi_def_cfa rsp, %c[CFAOffset]\n"
205     FOREACH_REGISTER(CFI_OFFSET_REG, CFI_OFFSET_NUM)
206     "mov %%rsp, %%rbp\n"
207     ".cfi_def_cfa_register rbp\n"
208     "andq $-16, %%rsp\n"
209     "call %c[StaticCrashHandler]\n"
210     "ud2\n"
211 #elif defined(__aarch64__)
212     ".cfi_return_column 33\n"
213     ".cfi_def_cfa sp, %c[CFAOffset]\n"
214     FOREACH_REGISTER(CFI_OFFSET_REG, CFI_OFFSET_NUM)
215     ".cfi_offset 33, %c[pc]\n"
216     ".cfi_offset 30, %c[lr]\n"
217     "bl %c[StaticCrashHandler]\n"
218     "brk 1\n"
219 #else
220 #error "Unsupported architecture for fuzzing on Fuchsia"
221 #endif
222     ".cfi_endproc\n"
223     ".size CrashTrampolineAsm, . - CrashTrampolineAsm\n"
224     ".popsection\n"
225     ".cfi_startproc\n"
226     : // No outputs
227     : FOREACH_REGISTER(ASM_OPERAND_REG, ASM_OPERAND_NUM)
228 #if defined(__aarch64__)
229       ASM_OPERAND_REG(pc)
230       ASM_OPERAND_REG(lr)
231 #endif
232       [StaticCrashHandler] "i" (StaticCrashHandler),
233       [CFAOffset] "i" (CFAOffset));
234 }
235 
236 void CrashHandler(zx_handle_t *Event) {
237   // This structure is used to ensure we close handles to objects we create in
238   // this handler.
239   struct ScopedHandle {
240     ~ScopedHandle() { _zx_handle_close(Handle); }
241     zx_handle_t Handle = ZX_HANDLE_INVALID;
242   };
243 
244   // Create the exception channel.  We need to claim to be a "debugger" so the
245   // kernel will allow us to modify and resume dying threads (see below). Once
246   // the channel is set, we can signal the main thread to continue and wait
247   // for the exception to arrive.
248   ScopedHandle Channel;
249   zx_handle_t Self = _zx_process_self();
250   ExitOnErr(_zx_task_create_exception_channel(
251                 Self, ZX_EXCEPTION_CHANNEL_DEBUGGER, &Channel.Handle),
252             "_zx_task_create_exception_channel");
253 
254   ExitOnErr(_zx_object_signal(*Event, 0, ZX_USER_SIGNAL_0),
255             "_zx_object_signal");
256 
257   // This thread lives as long as the process in order to keep handling
258   // crashes.  In practice, the first crashed thread to reach the end of the
259   // StaticCrashHandler will end the process.
260   while (true) {
261     ExitOnErr(_zx_object_wait_one(Channel.Handle, ZX_CHANNEL_READABLE,
262                                   ZX_TIME_INFINITE, nullptr),
263               "_zx_object_wait_one");
264 
265     zx_exception_info_t ExceptionInfo;
266     ScopedHandle Exception;
267     ExitOnErr(_zx_channel_read(Channel.Handle, 0, &ExceptionInfo,
268                                &Exception.Handle, sizeof(ExceptionInfo), 1,
269                                nullptr, nullptr),
270               "_zx_channel_read");
271 
272     // Ignore informational synthetic exceptions.
273     if (ZX_EXCP_THREAD_STARTING == ExceptionInfo.type ||
274         ZX_EXCP_THREAD_EXITING == ExceptionInfo.type ||
275         ZX_EXCP_PROCESS_STARTING == ExceptionInfo.type) {
276       continue;
277     }
278 
279     // At this point, we want to get the state of the crashing thread, but
280     // libFuzzer and the sanitizers assume this will happen from that same
281     // thread via a POSIX signal handler. "Resurrecting" the thread in the
282     // middle of the appropriate callback is as simple as forcibly setting the
283     // instruction pointer/program counter, provided we NEVER EVER return from
284     // that function (since otherwise our stack will not be valid).
285     ScopedHandle Thread;
286     ExitOnErr(_zx_exception_get_thread(Exception.Handle, &Thread.Handle),
287               "_zx_exception_get_thread");
288 
289     zx_thread_state_general_regs_t GeneralRegisters;
290     ExitOnErr(_zx_thread_read_state(Thread.Handle, ZX_THREAD_STATE_GENERAL_REGS,
291                                     &GeneralRegisters,
292                                     sizeof(GeneralRegisters)),
293               "_zx_thread_read_state");
294 
295     // To unwind properly, we need to push the crashing thread's register state
296     // onto the stack and jump into a trampoline with CFI instructions on how
297     // to restore it.
298 #if defined(__x86_64__)
299     uintptr_t StackPtr = GeneralRegisters.rsp - CFAOffset;
300     __unsanitized_memcpy(reinterpret_cast<void *>(StackPtr), &GeneralRegisters,
301                          sizeof(GeneralRegisters));
302     GeneralRegisters.rsp = StackPtr;
303     GeneralRegisters.rip = reinterpret_cast<zx_vaddr_t>(CrashTrampolineAsm);
304 
305 #elif defined(__aarch64__)
306     uintptr_t StackPtr = GeneralRegisters.sp - CFAOffset;
307     __unsanitized_memcpy(reinterpret_cast<void *>(StackPtr), &GeneralRegisters,
308                          sizeof(GeneralRegisters));
309     GeneralRegisters.sp = StackPtr;
310     GeneralRegisters.pc = reinterpret_cast<zx_vaddr_t>(CrashTrampolineAsm);
311 
312 #else
313 #error "Unsupported architecture for fuzzing on Fuchsia"
314 #endif
315 
316     // Now force the crashing thread's state.
317     ExitOnErr(
318         _zx_thread_write_state(Thread.Handle, ZX_THREAD_STATE_GENERAL_REGS,
319                                &GeneralRegisters, sizeof(GeneralRegisters)),
320         "_zx_thread_write_state");
321 
322     // Set the exception to HANDLED so it resumes the thread on close.
323     uint32_t ExceptionState = ZX_EXCEPTION_STATE_HANDLED;
324     ExitOnErr(_zx_object_set_property(Exception.Handle, ZX_PROP_EXCEPTION_STATE,
325                                       &ExceptionState, sizeof(ExceptionState)),
326               "zx_object_set_property");
327   }
328 }
329 
330 } // namespace
331 
332 // Platform specific functions.
333 void SetSignalHandler(const FuzzingOptions &Options) {
334   // Make sure information from libFuzzer and the sanitizers are easy to
335   // reassemble. `__sanitizer_log_write` has the added benefit of ensuring the
336   // DSO map is always available for the symbolizer.
337   // A uint64_t fits in 20 chars, so 64 is plenty.
338   char Buf[64];
339   memset(Buf, 0, sizeof(Buf));
340   snprintf(Buf, sizeof(Buf), "==%lu== INFO: libFuzzer starting.\n", GetPid());
341   if (EF->__sanitizer_log_write)
342     __sanitizer_log_write(Buf, sizeof(Buf));
343   Printf("%s", Buf);
344 
345   // Set up alarm handler if needed.
346   if (Options.HandleAlrm && Options.UnitTimeoutSec > 0) {
347     std::thread T(AlarmHandler, Options.UnitTimeoutSec / 2 + 1);
348     T.detach();
349   }
350 
351   // Options.HandleInt and Options.HandleTerm are not supported on Fuchsia
352 
353   // Early exit if no crash handler needed.
354   if (!Options.HandleSegv && !Options.HandleBus && !Options.HandleIll &&
355       !Options.HandleFpe && !Options.HandleAbrt)
356     return;
357 
358   // Set up the crash handler and wait until it is ready before proceeding.
359   zx_handle_t Event;
360   ExitOnErr(_zx_event_create(0, &Event), "_zx_event_create");
361 
362   std::thread T(CrashHandler, &Event);
363   zx_status_t Status =
364       _zx_object_wait_one(Event, ZX_USER_SIGNAL_0, ZX_TIME_INFINITE, nullptr);
365   _zx_handle_close(Event);
366   ExitOnErr(Status, "_zx_object_wait_one");
367 
368   T.detach();
369 }
370 
371 void SleepSeconds(int Seconds) {
372   _zx_nanosleep(_zx_deadline_after(ZX_SEC(Seconds)));
373 }
374 
375 unsigned long GetPid() {
376   zx_status_t rc;
377   zx_info_handle_basic_t Info;
378   if ((rc = _zx_object_get_info(_zx_process_self(), ZX_INFO_HANDLE_BASIC, &Info,
379                                 sizeof(Info), NULL, NULL)) != ZX_OK) {
380     Printf("libFuzzer: unable to get info about self: %s\n",
381            _zx_status_get_string(rc));
382     exit(1);
383   }
384   return Info.koid;
385 }
386 
387 size_t GetPeakRSSMb() {
388   zx_status_t rc;
389   zx_info_task_stats_t Info;
390   if ((rc = _zx_object_get_info(_zx_process_self(), ZX_INFO_TASK_STATS, &Info,
391                                 sizeof(Info), NULL, NULL)) != ZX_OK) {
392     Printf("libFuzzer: unable to get info about self: %s\n",
393            _zx_status_get_string(rc));
394     exit(1);
395   }
396   return (Info.mem_private_bytes + Info.mem_shared_bytes) >> 20;
397 }
398 
399 template <typename Fn>
400 class RunOnDestruction {
401  public:
402   explicit RunOnDestruction(Fn fn) : fn_(fn) {}
403   ~RunOnDestruction() { fn_(); }
404 
405  private:
406   Fn fn_;
407 };
408 
409 template <typename Fn>
410 RunOnDestruction<Fn> at_scope_exit(Fn fn) {
411   return RunOnDestruction<Fn>(fn);
412 }
413 
414 static fdio_spawn_action_t clone_fd_action(int localFd, int targetFd) {
415   return {
416       .action = FDIO_SPAWN_ACTION_CLONE_FD,
417       .fd =
418           {
419               .local_fd = localFd,
420               .target_fd = targetFd,
421           },
422   };
423 }
424 
425 int ExecuteCommand(const Command &Cmd) {
426   zx_status_t rc;
427 
428   // Convert arguments to C array
429   auto Args = Cmd.getArguments();
430   size_t Argc = Args.size();
431   assert(Argc != 0);
432   std::unique_ptr<const char *[]> Argv(new const char *[Argc + 1]);
433   for (size_t i = 0; i < Argc; ++i)
434     Argv[i] = Args[i].c_str();
435   Argv[Argc] = nullptr;
436 
437   // Determine output.  On Fuchsia, the fuzzer is typically run as a component
438   // that lacks a mutable working directory. Fortunately, when this is the case
439   // a mutable output directory must be specified using "-artifact_prefix=...",
440   // so write the log file(s) there.
441   // However, we don't want to apply this logic for absolute paths.
442   int FdOut = STDOUT_FILENO;
443   bool discardStdout = false;
444   bool discardStderr = false;
445 
446   if (Cmd.hasOutputFile()) {
447     std::string Path = Cmd.getOutputFile();
448     if (Path == getDevNull()) {
449       // On Fuchsia, there's no "/dev/null" like-file, so we
450       // just don't copy the FDs into the spawned process.
451       discardStdout = true;
452     } else {
453       bool IsAbsolutePath = Path.length() > 1 && Path[0] == '/';
454       if (!IsAbsolutePath && Cmd.hasFlag("artifact_prefix"))
455         Path = Cmd.getFlagValue("artifact_prefix") + "/" + Path;
456 
457       FdOut = open(Path.c_str(), O_WRONLY | O_CREAT | O_TRUNC, 0);
458       if (FdOut == -1) {
459         Printf("libFuzzer: failed to open %s: %s\n", Path.c_str(),
460                strerror(errno));
461         return ZX_ERR_IO;
462       }
463     }
464   }
465   auto CloseFdOut = at_scope_exit([FdOut]() {
466     if (FdOut != STDOUT_FILENO)
467       close(FdOut);
468   });
469 
470   // Determine stderr
471   int FdErr = STDERR_FILENO;
472   if (Cmd.isOutAndErrCombined()) {
473     FdErr = FdOut;
474     if (discardStdout)
475       discardStderr = true;
476   }
477 
478   // Clone the file descriptors into the new process
479   std::vector<fdio_spawn_action_t> SpawnActions;
480   SpawnActions.push_back(clone_fd_action(STDIN_FILENO, STDIN_FILENO));
481 
482   if (!discardStdout)
483     SpawnActions.push_back(clone_fd_action(FdOut, STDOUT_FILENO));
484   if (!discardStderr)
485     SpawnActions.push_back(clone_fd_action(FdErr, STDERR_FILENO));
486 
487   // Start the process.
488   char ErrorMsg[FDIO_SPAWN_ERR_MSG_MAX_LENGTH];
489   zx_handle_t ProcessHandle = ZX_HANDLE_INVALID;
490   rc = fdio_spawn_etc(ZX_HANDLE_INVALID,
491                       FDIO_SPAWN_CLONE_ALL & (~FDIO_SPAWN_CLONE_STDIO), Argv[0],
492                       Argv.get(), nullptr, SpawnActions.size(),
493                       SpawnActions.data(), &ProcessHandle, ErrorMsg);
494 
495   if (rc != ZX_OK) {
496     Printf("libFuzzer: failed to launch '%s': %s, %s\n", Argv[0], ErrorMsg,
497            _zx_status_get_string(rc));
498     return rc;
499   }
500   auto CloseHandle = at_scope_exit([&]() { _zx_handle_close(ProcessHandle); });
501 
502   // Now join the process and return the exit status.
503   if ((rc = _zx_object_wait_one(ProcessHandle, ZX_PROCESS_TERMINATED,
504                                 ZX_TIME_INFINITE, nullptr)) != ZX_OK) {
505     Printf("libFuzzer: failed to join '%s': %s\n", Argv[0],
506            _zx_status_get_string(rc));
507     return rc;
508   }
509 
510   zx_info_process_t Info;
511   if ((rc = _zx_object_get_info(ProcessHandle, ZX_INFO_PROCESS, &Info,
512                                 sizeof(Info), nullptr, nullptr)) != ZX_OK) {
513     Printf("libFuzzer: unable to get return code from '%s': %s\n", Argv[0],
514            _zx_status_get_string(rc));
515     return rc;
516   }
517 
518   return Info.return_code;
519 }
520 
521 bool ExecuteCommand(const Command &BaseCmd, std::string *CmdOutput) {
522   auto LogFilePath = TempPath("SimPopenOut", ".txt");
523   Command Cmd(BaseCmd);
524   Cmd.setOutputFile(LogFilePath);
525   int Ret = ExecuteCommand(Cmd);
526   *CmdOutput = FileToString(LogFilePath);
527   RemoveFile(LogFilePath);
528   return Ret == 0;
529 }
530 
531 const void *SearchMemory(const void *Data, size_t DataLen, const void *Patt,
532                          size_t PattLen) {
533   return memmem(Data, DataLen, Patt, PattLen);
534 }
535 
536 // In fuchsia, accessing /dev/null is not supported. There's nothing
537 // similar to a file that discards everything that is written to it.
538 // The way of doing something similar in fuchsia is by using
539 // fdio_null_create and binding that to a file descriptor.
540 void DiscardOutput(int Fd) {
541   fdio_t *fdio_null = fdio_null_create();
542   if (fdio_null == nullptr) return;
543   int nullfd = fdio_bind_to_fd(fdio_null, -1, 0);
544   if (nullfd < 0) return;
545   dup2(nullfd, Fd);
546 }
547 
548 } // namespace fuzzer
549 
550 #endif // LIBFUZZER_FUCHSIA
551