static void arch_ptraceSaveData(honggfuzz_t * hfuzz, pid_t pid, fuzzer_t * fuzzer) { REG_TYPE pc = 0; /* Local copy since flag is overridden for some crashes */ bool saveUnique = hfuzz->saveUnique; char instr[_HF_INSTR_SZ] = "\x00"; siginfo_t si; bzero(&si, sizeof(si)); if (ptrace(PTRACE_GETSIGINFO, pid, 0, &si) == -1) { PLOG_W("Couldn't get siginfo for pid %d", pid); } arch_getInstrStr(pid, &pc, instr); LOG_D("Pid: %d, signo: %d, errno: %d, code: %d, addr: %p, pc: %" REG_PM ", instr: '%s'", pid, si.si_signo, si.si_errno, si.si_code, si.si_addr, pc, instr); if (!SI_FROMUSER(&si) && pc && si.si_addr < hfuzz->linux.ignoreAddr) { LOG_I("'%s' is interesting (%s), but the si.si_addr is %p (below %p), skipping", fuzzer->fileName, arch_sigs[si.si_signo].descr, si.si_addr, hfuzz->linux.ignoreAddr); return; } /* * Unwind and resolve symbols */ /* *INDENT-OFF* */ funcs_t funcs[_HF_MAX_FUNCS] = { [0 ... (_HF_MAX_FUNCS - 1)].pc = NULL, [0 ... (_HF_MAX_FUNCS - 1)].line = 0, [0 ... (_HF_MAX_FUNCS - 1)].func = {'\0'} , }; /* *INDENT-ON* */ #if !defined(__ANDROID__) size_t funcCnt = arch_unwindStack(pid, funcs); arch_bfdResolveSyms(pid, funcs, funcCnt); #else size_t funcCnt = arch_unwindStack(pid, funcs); #endif /* * If unwinder failed (zero frames), use PC from ptrace GETREGS if not zero. * If PC reg zero, temporarily disable uniqueness flag since callstack * hash will be also zero, thus not safe for unique decisions. */ if (funcCnt == 0) { if (pc) { /* Manually update major frame PC & frames counter */ funcs[0].pc = (void *)(uintptr_t) pc; funcCnt = 1; } else { saveUnique = false; } } /* * Temp local copy of previous backtrace value in case worker hit crashes into multiple * tids for same target master thread. Will be 0 for first crash against target. */ uint64_t oldBacktrace = fuzzer->backtrace; /* * Calculate backtrace callstack hash signature */ arch_hashCallstack(hfuzz, fuzzer, funcs, funcCnt, saveUnique); /* * If fuzzing with sanitizer coverage feedback increase crashes counter used * as metric for dynFile evolution */ if (hfuzz->useSanCov) { fuzzer->sanCovCnts.crashesCnt++; } /* * If unique flag is set and single frame crash, disable uniqueness for this crash * to always save (timestamp will be added to the filename) */ if (saveUnique && (funcCnt == 1)) { saveUnique = false; } /* * If worker crashFileName member is set, it means that a tid has already crashed * from target master thread. */ if (fuzzer->crashFileName[0] != '\0') { LOG_D("Multiple crashes detected from worker against attached tids group"); /* * If stackhashes match, don't re-analyze. This will avoid duplicates * and prevent verifier from running multiple passes. Depth of check is * always 1 (last backtrace saved only per target iteration). */ if (oldBacktrace == fuzzer->backtrace) { return; } } /* Increase global crashes counter */ ATOMIC_POST_INC(hfuzz->crashesCnt); /* * Check if stackhash is blacklisted */ if (hfuzz->blacklist && (fastArray64Search(hfuzz->blacklist, hfuzz->blacklistCnt, fuzzer->backtrace) != -1)) { LOG_I("Blacklisted stack hash '%" PRIx64 "', skipping", fuzzer->backtrace); ATOMIC_POST_INC(hfuzz->blCrashesCnt); return; } /* If non-blacklisted crash detected, zero set two MSB */ ATOMIC_POST_ADD(hfuzz->dynFileIterExpire, _HF_DYNFILE_SUB_MASK); void *sig_addr = si.si_addr; if (hfuzz->linux.disableRandomization == false) { pc = 0UL; sig_addr = NULL; } /* User-induced signals don't set si.si_addr */ if (SI_FROMUSER(&si)) { sig_addr = NULL; } /* If dry run mode, copy file with same name into workspace */ if (hfuzz->origFlipRate == 0.0L && hfuzz->useVerifier) { snprintf(fuzzer->crashFileName, sizeof(fuzzer->crashFileName), "%s/%s", hfuzz->workDir, fuzzer->origFileName); } else if (saveUnique) { snprintf(fuzzer->crashFileName, sizeof(fuzzer->crashFileName), "%s/%s.PC.%" REG_PM ".STACK.%" PRIx64 ".CODE.%d.ADDR.%p.INSTR.%s.%s", hfuzz->workDir, arch_sigs[si.si_signo].descr, pc, fuzzer->backtrace, si.si_code, sig_addr, instr, hfuzz->fileExtn); } else { char localtmstr[PATH_MAX]; util_getLocalTime("%F.%H:%M:%S", localtmstr, sizeof(localtmstr), time(NULL)); snprintf(fuzzer->crashFileName, sizeof(fuzzer->crashFileName), "%s/%s.PC.%" REG_PM ".STACK.%" PRIx64 ".CODE.%d.ADDR.%p.INSTR.%s.%s.%d.%s", hfuzz->workDir, arch_sigs[si.si_signo].descr, pc, fuzzer->backtrace, si.si_code, sig_addr, instr, localtmstr, pid, hfuzz->fileExtn); } if (files_exists(fuzzer->crashFileName)) { LOG_I("It seems that '%s' already exists, skipping", fuzzer->crashFileName); // Clear filename so that verifier can understand we hit a duplicate memset(fuzzer->crashFileName, 0, sizeof(fuzzer->crashFileName)); return; } if (files_writeBufToFile (fuzzer->crashFileName, fuzzer->dynamicFile, fuzzer->dynamicFileSz, O_CREAT | O_EXCL | O_WRONLY | O_CLOEXEC) == false) { LOG_E("Couldn't copy '%s' to '%s'", fuzzer->fileName, fuzzer->crashFileName); return; } LOG_I("Ok, that's interesting, saved '%s' as '%s'", fuzzer->fileName, fuzzer->crashFileName); ATOMIC_POST_INC(hfuzz->uniqueCrashesCnt); /* If unique crash found, reset dynFile counter */ ATOMIC_CLEAR(hfuzz->dynFileIterExpire); arch_ptraceGenerateReport(pid, fuzzer, funcs, funcCnt, &si, instr); }
/* * Returns true if a process exited (so, presumably, we can delete an input * file) */ static bool arch_analyzeSignal(honggfuzz_t * hfuzz, int status, fuzzer_t * fuzzer) { /* * Resumed by delivery of SIGCONT */ if (WIFCONTINUED(status)) { return false; } if (WIFEXITED(status) || WIFSIGNALED(status)) { sancov_Analyze(hfuzz, fuzzer); } /* * Boring, the process just exited */ if (WIFEXITED(status)) { LOG_D("Process (pid %d) exited normally with status %d", fuzzer->pid, WEXITSTATUS(status)); return true; } /* * Shouldn't really happen, but, well.. */ if (!WIFSIGNALED(status)) { LOG_E("Process (pid %d) exited with the following status %d, please report that as a bug", fuzzer->pid, status); return true; } int termsig = WTERMSIG(status); LOG_D("Process (pid %d) killed by signal %d '%s'", fuzzer->pid, termsig, strsignal(termsig)); if (!arch_sigs[termsig].important) { LOG_D("It's not that important signal, skipping"); return true; } /* * Signal is interesting */ /* * Increase crashes counter presented by ASCII display */ ATOMIC_POST_INC(hfuzz->crashesCnt); /* * Get data from exception handler */ fuzzer->pc = g_fuzzer_crash_information[fuzzer->pid].pc; fuzzer->exception = g_fuzzer_crash_information[fuzzer->pid].exception; fuzzer->access = g_fuzzer_crash_information[fuzzer->pid].access; fuzzer->backtrace = g_fuzzer_crash_information[fuzzer->pid].backtrace; defer { if (g_fuzzer_crash_callstack[fuzzer->pid]) { free(g_fuzzer_crash_callstack[fuzzer->pid]); g_fuzzer_crash_callstack[fuzzer->pid] = NULL; } }; /* * Check if stackhash is blacklisted */ if (hfuzz->blacklist && (fastArray64Search(hfuzz->blacklist, hfuzz->blacklistCnt, fuzzer->backtrace) != -1)) { LOG_I("Blacklisted stack hash '%" PRIx64 "', skipping", fuzzer->backtrace); ATOMIC_POST_INC(hfuzz->blCrashesCnt); return true; } /* If dry run mode, copy file with same name into workspace */ if (hfuzz->origFlipRate == 0.0L && hfuzz->useVerifier) { snprintf(fuzzer->crashFileName, sizeof(fuzzer->crashFileName), "%s/%s", hfuzz->workDir, fuzzer->origFileName); } else if (hfuzz->saveUnique) { snprintf(fuzzer->crashFileName, sizeof(fuzzer->crashFileName), "%s/%s.%s.PC.%.16llx.STACK.%.16llx.ADDR.%.16llx.%s", hfuzz->workDir, arch_sigs[termsig].descr, exception_to_string(fuzzer->exception), fuzzer->pc, fuzzer->backtrace, fuzzer->access, hfuzz->fileExtn); } else { char localtmstr[PATH_MAX]; util_getLocalTime("%F.%H.%M.%S", localtmstr, sizeof(localtmstr), time(NULL)); snprintf(fuzzer->crashFileName, sizeof(fuzzer->crashFileName), "%s/%s.%s.PC.%.16llx.STACK.%.16llx.ADDR.%.16llx.TIME.%s.PID.%.5d.%s", hfuzz->workDir, arch_sigs[termsig].descr, exception_to_string(fuzzer->exception), fuzzer->pc, fuzzer->backtrace, fuzzer->access, localtmstr, fuzzer->pid, hfuzz->fileExtn); } if (files_exists(fuzzer->crashFileName)) { LOG_I("It seems that '%s' already exists, skipping", fuzzer->crashFileName); // Clear filename so that verifier can understand we hit a duplicate memset(fuzzer->crashFileName, 0, sizeof(fuzzer->crashFileName)); return true; } if (files_writeBufToFile (fuzzer->crashFileName, fuzzer->dynamicFile, fuzzer->dynamicFileSz, O_CREAT | O_EXCL | O_WRONLY) == false) { LOG_E("Couldn't copy '%s' to '%s'", fuzzer->fileName, fuzzer->crashFileName); return true; } LOG_I("Ok, that's interesting, saved '%s' as '%s'", fuzzer->fileName, fuzzer->crashFileName); ATOMIC_POST_INC(hfuzz->uniqueCrashesCnt); /* If unique crash found, reset dynFile counter */ ATOMIC_CLEAR(hfuzz->dynFileIterExpire); arch_generateReport(fuzzer, termsig); return true; }
/* * Special book keeping for cases where crashes are detected based on exitcode and not * a raised signal. Such case is the ASan fuzzing for Android. Crash file name maintains * the same format for compatibility with post campaign tools. */ static void arch_ptraceExitSaveData(honggfuzz_t * hfuzz, pid_t pid, fuzzer_t * fuzzer, int exitCode) { REG_TYPE pc = 0; void *crashAddr = 0; char *op = "UNKNOWN"; pid_t targetPid = (hfuzz->linux.pid > 0) ? hfuzz->linux.pid : fuzzer->pid; /* Save only the first hit for each worker */ if (fuzzer->crashFileName[0] != '\0') { return; } /* Increase global crashes counter */ ATOMIC_POST_INC(hfuzz->crashesCnt); ATOMIC_POST_AND(hfuzz->dynFileIterExpire, _HF_DYNFILE_SUB_MASK); /* * If fuzzing with sanitizer coverage feedback increase crashes counter used * as metric for dynFile evolution */ if (hfuzz->useSanCov) { fuzzer->sanCovCnts.crashesCnt++; } /* Get sanitizer string tag based on exitcode */ const char *sanStr = arch_sanCodeToStr(exitCode); /* If sanitizer produces reports with stack traces (e.g. ASan), they're parsed manually */ int funcCnt = 0; /* *INDENT-OFF* */ funcs_t funcs[_HF_MAX_FUNCS] = { [0 ... (_HF_MAX_FUNCS - 1)].pc = NULL, [0 ... (_HF_MAX_FUNCS - 1)].line = 0, [0 ... (_HF_MAX_FUNCS - 1)].func = {'\0'} , }; /* *INDENT-ON* */ /* If ASan crash, parse report */ if (exitCode == HF_ASAN_EXIT_CODE) { /* ASan is saving reports against parent PID */ if (targetPid != pid) { return; } funcCnt = arch_parseAsanReport(hfuzz, pid, funcs, &crashAddr, &op); /* * -1 error indicates a file not found for report. This is expected to happen often since * ASan report is generated once for crashing TID. Ptrace arch is not guaranteed to parse * that TID first. Not setting the 'crashFileName' variable will ensure that this branch * is executed again for all TIDs until the matching report is found */ if (funcCnt == -1) { return; } /* Since crash address is available, apply ignoreAddr filters */ if (crashAddr < hfuzz->linux.ignoreAddr) { LOG_I("'%s' is interesting, but the crash addr is %p (below %p), skipping", fuzzer->fileName, crashAddr, hfuzz->linux.ignoreAddr); return; } /* If frames successfully recovered, calculate stack hash & populate crash PC */ arch_hashCallstack(hfuzz, fuzzer, funcs, funcCnt, false); pc = (uintptr_t) funcs[0].pc; /* Since stack hash is available apply blacklist filters */ if (hfuzz->blacklist && (fastArray64Search(hfuzz->blacklist, hfuzz->blacklistCnt, fuzzer->backtrace) != -1)) { LOG_I("Blacklisted stack hash '%" PRIx64 "', skipping", fuzzer->backtrace); ATOMIC_POST_INC(hfuzz->blCrashesCnt); return; } } /* If dry run mode, copy file with same name into workspace */ if (hfuzz->origFlipRate == 0.0L && hfuzz->useVerifier) { snprintf(fuzzer->crashFileName, sizeof(fuzzer->crashFileName), "%s/%s", hfuzz->workDir, fuzzer->origFileName); } else { /* Keep the crashes file name format identical */ if (fuzzer->backtrace != 0ULL && hfuzz->saveUnique) { snprintf(fuzzer->crashFileName, sizeof(fuzzer->crashFileName), "%s/%s.PC.%" REG_PM ".STACK.%" PRIx64 ".CODE.%s.ADDR.%p.INSTR.%s.%s", hfuzz->workDir, sanStr, pc, fuzzer->backtrace, op, crashAddr, "[UNKNOWN]", hfuzz->fileExtn); } else { /* If no stack hash available, all crashes treated as unique */ char localtmstr[PATH_MAX]; util_getLocalTime("%F.%H:%M:%S", localtmstr, sizeof(localtmstr), time(NULL)); snprintf(fuzzer->crashFileName, sizeof(fuzzer->crashFileName), "%s/%s.PC.%" REG_PM ".STACK.%" PRIx64 ".CODE.%s.ADDR.%p.INSTR.%s.%s.%s", hfuzz->workDir, sanStr, pc, fuzzer->backtrace, op, crashAddr, "[UNKNOWN]", localtmstr, hfuzz->fileExtn); } } bool dstFileExists = false; if (files_copyFile(fuzzer->fileName, fuzzer->crashFileName, &dstFileExists)) { LOG_I("Ok, that's interesting, saved '%s' as '%s'", fuzzer->fileName, fuzzer->crashFileName); /* Increase unique crashes counters */ ATOMIC_POST_INC(hfuzz->uniqueCrashesCnt); ATOMIC_CLEAR(hfuzz->dynFileIterExpire); } else { if (dstFileExists) { LOG_I("It seems that '%s' already exists, skipping", fuzzer->crashFileName); /* Clear stack hash so that verifier can understand we hit a duplicate */ fuzzer->backtrace = 0ULL; } else { LOG_E("Couldn't copy '%s' to '%s'", fuzzer->fileName, fuzzer->crashFileName); /* In case of write error, clear crashFileName to so that other monitored TIDs can retry */ memset(fuzzer->crashFileName, 0, sizeof(fuzzer->crashFileName)); } /* Don't bother generating reports for duplicate or non-saved crashes */ return; } /* Generate report */ fuzzer->report[0] = '\0'; util_ssnprintf(fuzzer->report, sizeof(fuzzer->report), "ORIG_FNAME: %s\n", fuzzer->origFileName); util_ssnprintf(fuzzer->report, sizeof(fuzzer->report), "FUZZ_FNAME: %s\n", fuzzer->crashFileName); util_ssnprintf(fuzzer->report, sizeof(fuzzer->report), "PID: %d\n", pid); util_ssnprintf(fuzzer->report, sizeof(fuzzer->report), "EXIT CODE: %d (%s)\n", exitCode, sanStr); util_ssnprintf(fuzzer->report, sizeof(fuzzer->report), "OPERATION: %s\n", op); util_ssnprintf(fuzzer->report, sizeof(fuzzer->report), "FAULT ADDRESS: %p\n", crashAddr); if (funcCnt > 0) { util_ssnprintf(fuzzer->report, sizeof(fuzzer->report), "STACK HASH: %016llx\n", fuzzer->backtrace); util_ssnprintf(fuzzer->report, sizeof(fuzzer->report), "STACK:\n"); for (int i = 0; i < funcCnt; i++) { util_ssnprintf(fuzzer->report, sizeof(fuzzer->report), " <" REG_PD REG_PM "> ", (REG_TYPE) (long)funcs[i].pc, funcs[i].func, funcs[i].line); if (funcs[i].func[0] != '\0') { util_ssnprintf(fuzzer->report, sizeof(fuzzer->report), "[%s + 0x%x]\n", funcs[i].func, funcs[i].line); } else { util_ssnprintf(fuzzer->report, sizeof(fuzzer->report), "[]\n"); } } } }