github.com/google/syzkaller@v0.0.0-20240517125934-c0f1611a36d6/syz-fuzzer/fuzzer.go

// Copyright 2015 syzkaller project authors. All rights reserved.
// Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file.

package main

import (
	"flag"
	"fmt"
	"net/http"
	_ "net/http/pprof"
	"os"
	"path/filepath"
	"runtime"
	"runtime/debug"
	"sync"
	"sync/atomic"
	"time"

	"github.com/google/syzkaller/pkg/flatrpc"
	"github.com/google/syzkaller/pkg/host"
	"github.com/google/syzkaller/pkg/ipc"
	"github.com/google/syzkaller/pkg/ipc/ipcconfig"
	"github.com/google/syzkaller/pkg/log"
	"github.com/google/syzkaller/pkg/osutil"
	"github.com/google/syzkaller/pkg/rpctype"
	"github.com/google/syzkaller/pkg/signal"
	"github.com/google/syzkaller/pkg/tool"
	"github.com/google/syzkaller/prog"
	_ "github.com/google/syzkaller/sys"
	"github.com/google/syzkaller/sys/targets"
)

type FuzzerTool struct {
	name     string
	executor string
	gate     *ipc.Gate
	manager  *rpctype.RPCClient
	// TODO: repair triagedCandidates logic, it's broken now.
	triagedCandidates uint32
	timeouts          targets.Timeouts
	leakFrames        []string

	noExecRequests atomic.Uint64
	noExecDuration atomic.Uint64

	requests  chan rpctype.ExecutionRequest
	results   chan executionResult
	signalMu  sync.RWMutex
	maxSignal signal.Signal
}

// executionResult offloads some computations from the proc loop
// to the communication thread.
type executionResult struct {
	rpctype.ExecutionRequest
	procID int
	try    int
	info   *ipc.ProgInfo
	output []byte
	err    string
}

// Gate size controls how deep in the log the last executed by every proc
// program may be. The intent is to make sure that, given the output log,
// we always understand what was happening.
// Judging by the logs collected on syzbot, 32 should be a reasonable figure.
// It coincides with prog.MaxPids.
const gateSize = prog.MaxPids

// TODO: split into smaller methods.
// nolint: funlen, gocyclo
func main() {
	debug.SetGCPercent(50)

	var (
		flagName      = flag.String("name", "test", "unique name for manager")
		flagOS        = flag.String("os", runtime.GOOS, "target OS")
		flagArch      = flag.String("arch", runtime.GOARCH, "target arch")
		flagManager   = flag.String("manager", "", "manager rpc address")
		flagProcs     = flag.Int("procs", 1, "number of parallel test processes")
		flagTest      = flag.Bool("test", false, "enable image testing mode") // used by syz-ci
		flagPprofPort = flag.Int("pprof_port", 0, "HTTP port for the pprof endpoint (disabled if 0)")
	)
	defer tool.Init()()
	log.Logf(0, "fuzzer started")

	target, err := prog.GetTarget(*flagOS, *flagArch)
	if err != nil {
		log.SyzFatal(err)
	}

	config, execOpts, err := ipcconfig.Default(target)
	if err != nil {
		log.SyzFatalf("failed to create default ipc config: %v", err)
	}
	timeouts := config.Timeouts
	executor := config.Executor
	shutdown := make(chan struct{})
	osutil.HandleInterrupts(shutdown)
	go func() {
		// Handles graceful preemption on GCE.
		<-shutdown
		log.Logf(0, "SYZ-FUZZER: PREEMPTED")
		os.Exit(1)
	}()

	if *flagPprofPort != 0 {
		setupPprofHandler(*flagPprofPort)
	}

	if *flagTest {
		checkArgs := &checkArgs{
			target:         target,
			sandbox:        ipc.FlagsToSandbox(execOpts.EnvFlags),
			ipcConfig:      config,
			ipcExecOpts:    execOpts,
			gitRevision:    prog.GitRevision,
			targetRevision: target.Revision,
		}
		testImage(*flagManager, checkArgs)
		return
	}

	log.Logf(0, "dialing manager at %v", *flagManager)
	manager, err := rpctype.NewRPCClient(*flagManager)
	if err != nil {
		log.SyzFatalf("failed to create an RPC client: %v ", err)
	}

	log.Logf(1, "connecting to manager...")
	a := &rpctype.ConnectArgs{
		Name:        *flagName,
		GitRevision: prog.GitRevision,
		SyzRevision: target.Revision,
	}
	a.ExecutorArch, a.ExecutorSyzRevision, a.ExecutorGitRevision, err = executorVersion(executor)
	if err != nil {
		log.SyzFatalf("failed to run executor version: %v ", err)
	}
	r := &rpctype.ConnectRes{}
	if err := manager.Call("Manager.Connect", a, r); err != nil {
		log.SyzFatalf("failed to call Manager.Connect(): %v ", err)
	}
	checkReq := &rpctype.CheckArgs{
		Name:  *flagName,
		Files: host.ReadFiles(r.ReadFiles),
		Globs: make(map[string][]string),
	}
	features, err := host.SetupFeatures(target, executor, r.Features, nil)
	if err != nil {
		log.SyzFatalf("failed to setup features: %v ", err)
	}
	checkReq.Features = features
	for _, glob := range r.ReadGlobs {
		files, err := filepath.Glob(filepath.FromSlash(glob))
		if err != nil && checkReq.Error == "" {
			checkReq.Error = fmt.Sprintf("failed to read glob %q: %v", glob, err)
		}
		checkReq.Globs[glob] = files
	}
	checkRes := new(rpctype.CheckRes)
	if err := manager.Call("Manager.Check", checkReq, checkRes); err != nil {
		log.SyzFatalf("Manager.Check call failed: %v", err)
	}
	if checkReq.Error != "" {
		log.SyzFatalf("%v", checkReq.Error)
	}

	if checkRes.CoverFilterBitmap != nil {
		if err := osutil.WriteFile("syz-cover-bitmap", checkRes.CoverFilterBitmap); err != nil {
			log.SyzFatalf("failed to write syz-cover-bitmap: %v", err)
		}
	}

	inputsCount := *flagProcs * 2
	fuzzerTool := &FuzzerTool{
		name:       *flagName,
		executor:   executor,
		manager:    manager,
		timeouts:   timeouts,
		leakFrames: r.MemoryLeakFrames,

		requests: make(chan rpctype.ExecutionRequest, 2*inputsCount),
		results:  make(chan executionResult, 2*inputsCount),
	}
	fuzzerTool.filterDataRaceFrames(r.DataRaceFrames)
	var gateCallback func()
	for _, feat := range features {
		if feat.Id == flatrpc.FeatureLeak && feat.Reason == "" {
			gateCallback = fuzzerTool.leakGateCallback
		}
	}
	fuzzerTool.gate = ipc.NewGate(gateSize, gateCallback)

	log.Logf(0, "starting %v executor processes", *flagProcs)
	for pid := 0; pid < *flagProcs; pid++ {
		startProc(fuzzerTool, pid, config)
	}

	// Query enough inputs at the beginning.
	fuzzerTool.exchangeDataCall(nil, 0)
	go fuzzerTool.exchangeDataWorker()
	fuzzerTool.exchangeDataWorker()
}

func (tool *FuzzerTool) leakGateCallback() {
	// Leak checking is very slow so we don't do it while triaging the corpus
	// (otherwise it takes infinity). When we have presumably triaged the corpus
	// (triagedCandidates == 1), we run leak checking bug ignore the result
	// to flush any previous leaks. After that (triagedCandidates == 2)
	// we do actual leak checking and report leaks.
	triagedCandidates := atomic.LoadUint32(&tool.triagedCandidates)
	if triagedCandidates == 0 {
		return
	}
	args := append([]string{"leak"}, tool.leakFrames...)
	timeout := tool.timeouts.NoOutput * 9 / 10
	output, err := osutil.RunCmd(timeout, "", tool.executor, args...)
	if err != nil && triagedCandidates == 2 {
		// If we exit right away, dying executors will dump lots of garbage to console.
		os.Stdout.Write(output)
		fmt.Printf("BUG: leak checking failed\n")
		time.Sleep(time.Hour)
		os.Exit(1)
	}
	if triagedCandidates == 1 {
		atomic.StoreUint32(&tool.triagedCandidates, 2)
	}
}

func (tool *FuzzerTool) filterDataRaceFrames(frames []string) {
	if len(frames) == 0 {
		return
	}
	args := append([]string{"setup_kcsan_filterlist"}, frames...)
	timeout := time.Minute * tool.timeouts.Scale
	output, err := osutil.RunCmd(timeout, "", tool.executor, args...)
	if err != nil {
		log.SyzFatalf("failed to set KCSAN filterlist: %v", err)
	}
	log.Logf(0, "%s", output)
}

func (tool *FuzzerTool) startExecutingCall(progID int64, pid, try int) {
	tool.manager.AsyncCall("Manager.StartExecuting", &rpctype.ExecutingRequest{
		Name:   tool.name,
		ID:     progID,
		ProcID: pid,
		Try:    try,
	})
}

func (tool *FuzzerTool) exchangeDataCall(results []rpctype.ExecutionResult, latency time.Duration) time.Duration {
	needProgs := max(0, cap(tool.requests)/2-len(tool.requests))
	a := &rpctype.ExchangeInfoRequest{
		Name:       tool.name,
		NeedProgs:  needProgs,
		Results:    results,
		StatsDelta: tool.grabStats(),
		Latency:    latency,
	}
	r := &rpctype.ExchangeInfoReply{}
	start := osutil.MonotonicNano()
	if err := tool.manager.Call("Manager.ExchangeInfo", a, r); err != nil {
		log.SyzFatalf("Manager.ExchangeInfo call failed: %v", err)
	}
	latency = osutil.MonotonicNano() - start
	tool.updateMaxSignal(r.NewMaxSignal, r.DropMaxSignal)
	if len(r.Requests) == 0 {
		// This is possible during initial checking stage, backoff a bit.
		time.Sleep(100 * time.Millisecond)
	}
	for _, req := range r.Requests {
		tool.requests <- req
	}
	return latency
}

func (tool *FuzzerTool) exchangeDataWorker() {
	var latency time.Duration
	ticker := time.NewTicker(3 * time.Second * tool.timeouts.Scale).C
	for {
		var results []rpctype.ExecutionResult
		select {
		case res := <-tool.results:
			results = append(results, tool.convertExecutionResult(res))
		case <-ticker:
			// This is not expected to happen a lot,
			// but this is required to resolve potential deadlock
			// during initial checking stage when we may get
			// no test requests from the host in some requests.
		}
		// Grab other finished calls, just in case there are any.
	loop:
		for {
			select {
			case res := <-tool.results:
				results = append(results, tool.convertExecutionResult(res))
			default:
				break loop
			}
		}
		// Replenish exactly the finished requests.
		latency = tool.exchangeDataCall(results, latency)
	}
}

func (tool *FuzzerTool) convertExecutionResult(res executionResult) rpctype.ExecutionResult {
	ret := rpctype.ExecutionResult{
		ID:     res.ID,
		ProcID: res.procID,
		Try:    res.try,
		Output: res.output,
		Error:  res.err,
	}
	if res.info != nil {
		if res.NewSignal {
			tool.diffMaxSignal(res.info, res.SignalFilter, res.SignalFilterCall)
		}
		ret.Info = *res.info
	}
	return ret
}

func (tool *FuzzerTool) grabStats() map[string]uint64 {
	return map[string]uint64{
		"no exec requests": tool.noExecRequests.Swap(0),
		"no exec duration": tool.noExecDuration.Swap(0),
	}
}

func (tool *FuzzerTool) diffMaxSignal(info *ipc.ProgInfo, mask signal.Signal, maskCall int) {
	tool.signalMu.RLock()
	defer tool.signalMu.RUnlock()
	diffMaxSignal(info, tool.maxSignal, mask, maskCall)
}

func diffMaxSignal(info *ipc.ProgInfo, max, mask signal.Signal, maskCall int) {
	info.Extra.Signal = diffCallSignal(info.Extra.Signal, max, mask, -1, maskCall)
	for i := 0; i < len(info.Calls); i++ {
		info.Calls[i].Signal = diffCallSignal(info.Calls[i].Signal, max, mask, i, maskCall)
	}
}

func diffCallSignal(raw []uint32, max, mask signal.Signal, call, maskCall int) []uint32 {
	if mask != nil && call == maskCall {
		return signal.FilterRaw(raw, max, mask)
	}
	return max.DiffFromRaw(raw)
}

func (tool *FuzzerTool) updateMaxSignal(add, drop []uint32) {
	tool.signalMu.Lock()
	defer tool.signalMu.Unlock()
	tool.maxSignal.Subtract(signal.FromRaw(drop, 0))
	tool.maxSignal.Merge(signal.FromRaw(add, 0))
}

func setupPprofHandler(port int) {
	// Necessary for pprof handlers.
	go func() {
		err := http.ListenAndServe(fmt.Sprintf("0.0.0.0:%v", port), nil)
		if err != nil {
			log.SyzFatalf("failed to setup a server: %v", err)
		}
	}()
}