SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #18890 from keszybz/fuzz-bus-match

Browse Source 
Add fuzzers for bus match parsing code
This commit is contained in:
Yu Watanabe
2021-03-06 20:35:38 +09:00
committed by GitHub
parent f6b54e5280 7a39ec2e3e
commit 2541462f1b
13 changed files with 215 additions and 94 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/ENVIRONMENT.md
+12
View File
@@ -301,3 +301,15 @@ installed systemd tests:
* `$SYSTEMD_SYSVRCND_PATH` — Controls where `systemd-sysv-generator` looks for
SysV init script runlevel link farms.
fuzzers:
* `$SYSTEMD_FUZZ_OUTPUT` — A boolean that specifies whether to write output to
stdout. Setting to true is useful in manual invocations, since all output is
suppressed by default.
* `$SYSTEMD_FUZZ_RUNS` — The number of times execution should be repeated in
manual invocations.
Note that is may be also useful to set `$SYSTEMD_LOG_LEVEL`, since all logging
is suppressed by default.
src/fuzz/fuzz-main.c
+14 -3
View File
@@ -1,9 +1,11 @@
/* SPDX-License-Identifier: LGPL-2.1-or-later */
#include "alloc-util.h"
#include "log.h"
#include "fileio.h"
#include "fuzz.h"
#include "log.h"
#include "parse-util.h"
#include "string-util.h"
#include "tests.h"
/* This is a test driver for the systemd fuzzers that provides main function
@@ -15,13 +17,22 @@
/* This one was borrowed from
* https://github.com/google/oss-fuzz/blob/646fca1b506b056db3a60d32c4a1a7398f171c94/infra/base-images/base-runner/bad_build_check#L19
*/
#define MIN_NUMBER_OF_RUNS 4
#define NUMBER_OF_RUNS 4
int main(int argc, char **argv) {
int r;
test_setup_logging(LOG_DEBUG);
unsigned number_of_runs = NUMBER_OF_RUNS;
const char *v = getenv("SYSTEMD_FUZZ_RUNS");
if (!isempty(v)) {
r = safe_atou(v, &number_of_runs);
if (r < 0)
return log_error_errno(r, "Failed to parse SYSTEMD_FUZZ_RUNS=%s: %m", v);
}
for (int i = 1; i < argc; i++) {
_cleanup_free_ char *buf = NULL;
size_t size;
@@ -35,7 +46,7 @@ int main(int argc, char **argv) {
}
printf("%s... ", name);
fflush(stdout);
for (int j = 0; j < MIN_NUMBER_OF_RUNS; j++)
for (unsigned j = 0; j < number_of_runs; j++)
if (LLVMFuzzerTestOneInput((uint8_t*)buf, size) == EXIT_TEST_SKIP)
return EXIT_TEST_SKIP;
printf("ok\n");
src/fuzz/meson.build
-2
View File
@@ -1,8 +1,6 @@
# SPDX-License-Identifier: LGPL-2.1-or-later
fuzzers += [
[['src/fuzz/fuzz-bus-message.c']],
[['src/fuzz/fuzz-catalog.c']],
[['src/fuzz/fuzz-json.c']],
src/libsystemd/meson.build
+8
View File
@@ -315,3 +315,11 @@ if cxx_cmd != ''
[['src/libsystemd/sd-bus/test-bus-vtable-cc.cc']],
]
endif
############################################################
fuzzers += [
[['src/libsystemd/sd-bus/fuzz-bus-message.c']],
[['src/libsystemd/sd-bus/fuzz-bus-match.c']],
]
src/libsystemd/sd-bus/bus-internal.h
+2 -2
View File
@@ -44,8 +44,8 @@ struct match_callback {
unsigned last_iteration;
/* Don't dispatch this slot with messages that arrived in any iteration before or at the this
* one. We use this to ensure that matches don't apply "retroactively" and thus can confuse the
* caller: matches will only match incoming messages from the moment on the match was installed. */
* one. We use this to ensure that matches don't apply "retroactively" and confuse the caller:
* only messages received after the match was installed will be considered. */
uint64_t after;
char *match_string;
src/libsystemd/sd-bus/bus-match.c
+63 -76
View File
@@ -408,12 +408,9 @@ int bus_match_run(
if (r != 0)
return r;
}
} else {
struct bus_match_node *c;
} else
/* No hash table, so let's iterate manually... */
for (c = node->child; c; c = c->next) {
for (struct bus_match_node *c = node->child; c; c = c->next) {
if (!value_node_test(c, node->type, test_u8, test_str, test_strv, m))
continue;
@@ -424,7 +421,6 @@ int bus_match_run(
if (bus && bus->match_callbacks_modified)
return 0;
}
}
if (bus && bus->match_callbacks_modified)
return 0;
@@ -440,7 +436,7 @@ static int bus_match_add_compare_value(
const char *value_str,
struct bus_match_node **ret) {
struct bus_match_node *c = NULL, *n = NULL;
struct bus_match_node *c, *n = NULL;
int r;
assert(where);
@@ -452,25 +448,22 @@ static int bus_match_add_compare_value(
;
if (c) {
/* Comparison node already exists? Then let's see if
* the value node exists too. */
/* Comparison node already exists? Then let's see if the value node exists too. */
if (t == BUS_MATCH_MESSAGE_TYPE)
n = hashmap_get(c->compare.children, UINT_TO_PTR(value_u8));
else if (BUS_MATCH_CAN_HASH(t))
n = hashmap_get(c->compare.children, value_str);
else {
else
for (n = c->child; n && !value_node_same(n, t, value_u8, value_str); n = n->next)
;
}
if (n) {
*ret = n;
return 0;
}
} else {
/* Comparison node, doesn't exist yet? Then let's
* create it. */
/* Comparison node, doesn't exist yet? Then let's create it. */
c = new0(struct bus_match_node, 1);
if (!c) {
@@ -706,9 +699,7 @@ static int match_component_compare(const struct bus_match_component *a, const st
}
void bus_match_parse_free(struct bus_match_component *components, unsigned n_components) {
unsigned i;
for (i = 0; i < n_components; i++)
for (unsigned i = 0; i < n_components; i++)
free(components[i].value_str);
free(components);
@@ -716,51 +707,54 @@ void bus_match_parse_free(struct bus_match_component *components, unsigned n_com
int bus_match_parse(
const char *match,
struct bus_match_component **_components,
unsigned *_n_components) {
struct bus_match_component **ret_components,
unsigned *ret_n_components) {
const char *p = match;
struct bus_match_component *components = NULL;
size_t components_allocated = 0;
unsigned n_components = 0, i;
_cleanup_free_ char *value = NULL;
unsigned n_components = 0;
int r;
assert(match);
assert(_components);
assert(_n_components);
assert(ret_components);
assert(ret_n_components);
while (*p != 0) {
while (*match != '\0') {
const char *eq, *q;
enum bus_match_node_type t;
unsigned j = 0;
_cleanup_free_ char *value = NULL;
size_t value_allocated = 0;
bool escaped = false, quoted;
uint8_t u;
/* Avahi's match rules appear to include whitespace, skip over it */
p += strspn(p, " ");
match += strspn(match, " ");
eq = strchr(p, '=');
if (!eq)
return -EINVAL;
eq = strchr(match, '=');
if (!eq) {
r = -EINVAL;
goto fail;
}
t = bus_match_node_type_from_string(p, eq - p);
if (t < 0)
return -EINVAL;
t = bus_match_node_type_from_string(match, eq - match);
if (t < 0) {
r = -EINVAL;
goto fail;
}
quoted = eq[1] == '\'';
for (q = eq + 1 + quoted;; q++) {
if (*q == 0) {
if (*q == '\0') {
if (quoted) {
r = -EINVAL;
goto fail;
} else {
if (value)
value[j] = 0;
value[j] = '\0';
break;
}
}
@@ -774,14 +768,13 @@ int bus_match_parse(
if (quoted) {
if (*q == '\'') {
if (value)
value[j] = 0;
value[j] = '\0';
break;
}
} else {
if (*q == ',') {
if (value)
value[j] = 0;
value[j] = '\0';
break;
}
}
@@ -818,10 +811,11 @@ int bus_match_parse(
goto fail;
}
components[n_components].type = t;
components[n_components].value_str = TAKE_PTR(value);
components[n_components].value_u8 = u;
n_components++;
components[n_components++] = (struct bus_match_component) {
.type = t,
.value_str = TAKE_PTR(value),
.value_u8 = u,
};
if (q[quoted] == 0)
break;
@@ -831,21 +825,21 @@ int bus_match_parse(
goto fail;
}
p = q + 1 + quoted;
match = q + 1 + quoted;
}
/* Order the whole thing, so that we always generate the same tree */
typesafe_qsort(components, n_components, match_component_compare);
/* Check for duplicates */
for (i = 0; i+1 < n_components; i++)
for (unsigned i = 0; i+1 < n_components; i++)
if (components[i].type == components[i+1].type) {
r = -EINVAL;
goto fail;
}
*_components = components;
*_n_components = n_components;
*ret_components = components;
*ret_n_components = n_components;
return 0;
@@ -855,10 +849,8 @@ fail:
}
char *bus_match_to_string(struct bus_match_component *components, unsigned n_components) {
_cleanup_fclose_ FILE *f = NULL;
char *buffer = NULL;
_cleanup_free_ char *buffer = NULL;
size_t size = 0;
unsigned i;
int r;
if (n_components <= 0)
@@ -866,11 +858,11 @@ char *bus_match_to_string(struct bus_match_component *components, unsigned n_com
assert(components);
f = open_memstream_unlocked(&buffer, &size);
FILE *f = open_memstream_unlocked(&buffer, &size);
if (!f)
return NULL;
for (i = 0; i < n_components; i++) {
for (unsigned i = 0; i < n_components; i++) {
char buf[32];
if (i != 0)
@@ -889,10 +881,10 @@ char *bus_match_to_string(struct bus_match_component *components, unsigned n_com
}
r = fflush_and_check(f);
safe_fclose(f);
if (r < 0)
return NULL;
return buffer;
return TAKE_PTR(buffer);
}
int bus_match_add(
@@ -901,23 +893,22 @@ int bus_match_add(
unsigned n_components,
struct match_callback *callback) {
unsigned i;
struct bus_match_node *n;
int r;
assert(root);
assert(callback);
n = root;
for (i = 0; i < n_components; i++) {
r = bus_match_add_compare_value(
n, components[i].type,
components[i].value_u8, components[i].value_str, &n);
for (unsigned i = 0; i < n_components; i++) {
r = bus_match_add_compare_value(root,
components[i].type,
components[i].value_u8,
components[i].value_str,
&root);
if (r < 0)
return r;
}
return bus_match_add_leaf(n, callback);
return bus_match_add_leaf(root, callback);
}
int bus_match_remove(
@@ -1028,42 +1019,39 @@ const char* bus_match_node_type_to_string(enum bus_match_node_type t, char buf[]
}
}
void bus_match_dump(struct bus_match_node *node, unsigned level) {
struct bus_match_node *c;
_cleanup_free_ char *pfx = NULL;
void bus_match_dump(FILE *out, struct bus_match_node *node, unsigned level) {
char buf[32];
if (!node)
return;
pfx = strrep(" ", level);
printf("%s[%s]", strempty(pfx), bus_match_node_type_to_string(node->type, buf, sizeof(buf)));
fprintf(out, "%*s[%s]", 2 * level, "", bus_match_node_type_to_string(node->type, buf, sizeof(buf)));
if (node->type == BUS_MATCH_VALUE) {
if (node->parent->type == BUS_MATCH_MESSAGE_TYPE)
printf(" <%u>\n", node->value.u8);
fprintf(out, " <%u>\n", node->value.u8);
else
printf(" <%s>\n", node->value.str);
fprintf(out, " <%s>\n", node->value.str);
} else if (node->type == BUS_MATCH_ROOT)
puts(" root");
fputs(" root\n", out);
else if (node->type == BUS_MATCH_LEAF)
printf(" %p/%p\n", node->leaf.callback->callback, container_of(node->leaf.callback, sd_bus_slot, match_callback)->userdata);
fprintf(out, " %p/%p\n", node->leaf.callback->callback,
container_of(node->leaf.callback, sd_bus_slot, match_callback)->userdata);
else
putchar('\n');
putc('\n', out);
if (BUS_MATCH_CAN_HASH(node->type)) {
struct bus_match_node *c;
HASHMAP_FOREACH(c, node->compare.children)
bus_match_dump(c, level + 1);
bus_match_dump(out, c, level + 1);
}
for (c = node->child; c; c = c->next)
bus_match_dump(c, level + 1);
for (struct bus_match_node *c = node->child; c; c = c->next)
bus_match_dump(out, c, level + 1);
}
enum bus_match_scope bus_match_get_scope(const struct bus_match_component *components, unsigned n_components) {
bool found_driver = false;
unsigned i;
if (n_components <= 0)
return BUS_MATCH_GENERIC;
@@ -1076,7 +1064,7 @@ enum bus_match_scope bus_match_get_scope(const struct bus_match_component *compo
* local messages, then we check if it only matches on the
* driver. */
for (i = 0; i < n_components; i++) {
for (unsigned i = 0; i < n_components; i++) {
const struct bus_match_component *c = components + i;
if (c->type == BUS_MATCH_SENDER) {
@@ -1095,5 +1083,4 @@ enum bus_match_scope bus_match_get_scope(const struct bus_match_component *compo
}
return found_driver ? BUS_MATCH_DRIVER : BUS_MATCH_GENERIC;
}
src/libsystemd/sd-bus/bus-match.h
+4 -2
View File
@@ -1,6 +1,8 @@
/* SPDX-License-Identifier: LGPL-2.1-or-later */
#pragma once
#include <stdio.h>
#include "sd-bus.h"
#include "hashmap.h"
@@ -68,12 +70,12 @@ int bus_match_remove(struct bus_match_node *root, struct match_callback *callbac
void bus_match_free(struct bus_match_node *node);
void bus_match_dump(struct bus_match_node *node, unsigned level);
void bus_match_dump(FILE *out, struct bus_match_node *node, unsigned level);
const char* bus_match_node_type_to_string(enum bus_match_node_type t, char buf[], size_t l);
enum bus_match_node_type bus_match_node_type_from_string(const char *k, size_t n);
int bus_match_parse(const char *match, struct bus_match_component **_components, unsigned *_n_components);
int bus_match_parse(const char *match, struct bus_match_component **ret_components, unsigned *ret_n_components);
void bus_match_parse_free(struct bus_match_component *components, unsigned n_components);
char *bus_match_to_string(struct bus_match_component *components, unsigned n_components);
src/libsystemd/sd-bus/fuzz-bus-match.c
+86
View File
@@ -0,0 +1,86 @@
/* SPDX-License-Identifier: LGPL-2.1-or-later */
#include "alloc-util.h"
#include "bus-internal.h"
#include "bus-match.h"
#include "env-util.h"
#include "fd-util.h"
#include "fileio.h"
#include "fuzz.h"
int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
_cleanup_free_ char *out = NULL; /* out should be freed after g */
size_t out_size;
_cleanup_fclose_ FILE *g = NULL;
_cleanup_(sd_bus_unrefp) sd_bus *bus = NULL;
int r;
/* We don't want to fill the logs with messages about parse errors.
* Disable most logging if not running standalone */
if (!getenv("SYSTEMD_LOG_LEVEL"))
log_set_max_level(LOG_CRIT);
r = sd_bus_new(&bus);
assert_se(r >= 0);
struct bus_match_node root = {
.type = BUS_MATCH_ROOT,
};
/* Note that we use the pointer to match_callback substructure, but the code
* uses container_of() to access outside of the passed-in type. */
sd_bus_slot slot = {
.type = BUS_MATCH_CALLBACK,
.match_callback = {},
};
if (getenv_bool("SYSTEMD_FUZZ_OUTPUT") <= 0)
assert_se(g = open_memstream_unlocked(&out, &out_size));
for (size_t offset = 0; offset < size; ) {
_cleanup_free_ char *line = NULL;
char *end;
end = memchr((char*) data + offset, '\n', size - offset);
line = memdup_suffix0((char*) data + offset,
end ? end - (char*) data - offset : size - offset);
if (!line)
return log_oom_debug();
offset = end ? (size_t) (end - (char*) data + 1) : size;
struct bus_match_component *components;
unsigned n_components;
r = bus_match_parse(line, &components, &n_components);
if (IN_SET(r, -EINVAL, -ENOMEM)) {
log_debug_errno(r, "Failed to parse line: %m");
continue;
}
assert_se(r >= 0); /* We only expect EINVAL and ENOMEM errors, or success. */
log_debug("Parsed %u components.", n_components);
_cleanup_free_ char *again = bus_match_to_string(components, n_components);
if (!again) {
bus_match_parse_free(components, n_components);
log_oom();
break;
}
if (g)
fprintf(g, "%s\n", again);
r = bus_match_add(&root, components, n_components, &slot.match_callback);
bus_match_parse_free(components, n_components);
if (r < 0) {
log_error_errno(r, "Failed to add match: %m");
break;
}
}
bus_match_dump(g ?: stdout, &root, 0); /* We do this even on failure, to check consistency after error. */
bus_match_free(&root);
return 0;
}
src/fuzz/fuzz-bus-message.c → src/libsystemd/sd-bus/fuzz-bus-message.c
View File
src/libsystemd/sd-bus/test-bus-chat.c
+1 -1
View File
@@ -101,7 +101,7 @@ static int server_init(sd_bus **_bus) {
goto fail;
}
bus_match_dump(&bus->match_callbacks, 0);
bus_match_dump(stdout, &bus->match_callbacks, 0);
*_bus = bus;
return 0;
src/libsystemd/sd-bus/test-bus-match.c
+6 -8
View File
@@ -37,13 +37,12 @@ static bool mask_contains(unsigned a[], unsigned n) {
}
static int match_add(sd_bus_slot *slots, struct bus_match_node *root, const char *match, int value) {
struct bus_match_component *components = NULL;
unsigned n_components = 0;
struct bus_match_component *components;
unsigned n_components;
sd_bus_slot *s;
int r;
s = slots + value;
zero(*s);
r = bus_match_parse(match, &components, &n_components);
if (r < 0)
@@ -74,8 +73,7 @@ int main(int argc, char *argv[]) {
_cleanup_(sd_bus_message_unrefp) sd_bus_message *m = NULL;
_cleanup_(sd_bus_flush_close_unrefp) sd_bus *bus = NULL;
enum bus_match_node_type i;
sd_bus_slot slots[19];
sd_bus_slot slots[19] = {};
int r;
test_setup_logging(LOG_INFO);
@@ -105,7 +103,7 @@ int main(int argc, char *argv[]) {
assert_se(match_add(slots, &root, "arg4has='po'", 17) >= 0);
assert_se(match_add(slots, &root, "arg4='pi'", 18) >= 0);
bus_match_dump(&root, 0);
bus_match_dump(stdout, &root, 0);
assert_se(sd_bus_message_new_signal(bus, &m, "/foo/bar", "bar.x", "waldo") >= 0);
assert_se(sd_bus_message_append(m, "ssssas", "one", "two", "/prefix/three", "prefix.four", 3, "pi", "pa", "po") >= 0);
@@ -118,13 +116,13 @@ int main(int argc, char *argv[]) {
assert_se(bus_match_remove(&root, &slots[8].match_callback) >= 0);
assert_se(bus_match_remove(&root, &slots[13].match_callback) >= 0);
bus_match_dump(&root, 0);
bus_match_dump(stdout, &root, 0);
zero(mask);
assert_se(bus_match_run(NULL, &root, m) == 0);
assert_se(mask_contains((unsigned[]) { 9, 5, 10, 12, 14, 7, 15, 16, 17 }, 9));
for (i = 0; i < _BUS_MATCH_NODE_TYPE_MAX; i++) {
for (enum bus_match_node_type i = 0; i < _BUS_MATCH_NODE_TYPE_MAX; i++) {
char buf[32];
const char *x;
test/fuzz/fuzz-bus-match/bugzilla1935084.input
+1
View File
@@ -0,0 +1 @@
type='signal',sender='org.freedesktop.DBus',path='/org/freedesktop/DBus',interface='org.freedesktop.DBus',member='NameOwnerChanged',arg0=':1.134'
test/fuzz/fuzz-bus-match/test.input
+18
View File
@@ -0,0 +1,18 @@
arg2='wal\'do',sender='foo',type='signal',interface='bar.x',
arg2='wal\'do2',sender='foo',type='signal',interface='bar.x',
arg3='test',sender='foo',type='signal',interface='bar.x',
arg3='test',sender='foo',type='method_call',interface='bar.x',
interface='quux.x'
interface='bar.x'
member='waldo',path='/foo/bar'
path='/foo/bar'
path_namespace='/foo'
path_namespace='/foo/quux'
arg1='two'
member='waldo',arg2path='/prefix/'
member=waldo,path='/foo/bar',arg3namespace='prefix'
arg4has='pi'
arg4has='pa'
arg4has='po'
arg4='pi'