Add fuzz_assert() macro that calls _exit(0) instead of abort()
so AFL++ treats assertion failures as normal exits rather than
crashes.
Add deterministic replacements for clock_gettime() and
getsockopt() that eliminate non-determinism from kernel state:
- fuzz_clock_gettime(): returns a monotonically incrementing
timestamp from a fixed baseline, reset each AFL++ iteration
- fuzz_getsockopt(): returns fuzzer-controlled TCP_INFO from
AFL++ shared memory (region d), and fixed values for
SO_ERROR/SO_RCVBUF/SO_SNDBUF
Signed-off-by: Anshu Kumari
---
Makefile | 17 ++++++----
fuzz.c | 102 +++++++++++++++++++++++++++++++++++++++++++++++++++++++
fuzz.h | 37 ++++++++++++++++++++
3 files changed, 149 insertions(+), 7 deletions(-)
create mode 100644 fuzz.c
create mode 100644 fuzz.h
diff --git a/Makefile b/Makefile
index 97c27f7c..cce9ffd0 100644
--- a/Makefile
+++ b/Makefile
@@ -39,6 +39,9 @@ PASST_SRCS = arch.c arp.c bitmap.c checksum.c conf.c dhcp.c dhcpv6.c \
parse.c passt.c pasta.c pcap.c pif.c repair.c serialise.c tap.c tcp.c \
tcp_buf.c tcp_splice.c tcp_vu.c udp.c udp_flow.c udp_vu.c util.c \
vhost_user.c virtio.c vu_common.c
+ifneq ($(findstring FUZZING,$(CPPFLAGS)),)
+PASST_SRCS += fuzz.c
+endif
PASST_REPAIR_SRCS = passt-repair.c
PESTO_SRCS = pesto.c bitmap.c fwd_rule.c inany.c ip.c lineread.c parse.c \
serialise.c
@@ -47,13 +50,13 @@ SRCS = $(PASST_SRCS) $(PASST_REPAIR_SRCS) $(PESTO_SRCS)
MANPAGES = passt.1 pasta.1 pesto.1 passt-repair.1
PASST_HEADERS = arch.h arp.h bitmap.h checksum.h conf.h dhcp.h dhcpv6.h \
- epoll_ctl.h flow.h fwd.h fwd_rule.h flow_table.h fuzz-testbuf.h \
- icmp.h icmp_flow.h inany.h iov.h ip.h isolation.h lineread.h \
- linux_dep.h log.h migrate.h ndp.h netlink.h packet.h parse.h \
- passt.h pasta.h pcap.h pif.h repair.h serialise.h siphash.h tap.h \
- tcp.h tcp_buf.h tcp_conn.h tcp_internal.h tcp_splice.h tcp_vu.h \
- udp.h udp_flow.h udp_internal.h udp_vu.h util.h vhost_user.h \
- virtio.h vu_common.h
+ epoll_ctl.h flow.h fwd.h fwd_rule.h flow_table.h fuzz.h \
+ fuzz-testbuf.h icmp.h icmp_flow.h inany.h iov.h ip.h isolation.h \
+ lineread.h linux_dep.h log.h migrate.h ndp.h netlink.h packet.h \
+ parse.h passt.h pasta.h pcap.h pif.h repair.h serialise.h siphash.h \
+ tap.h tcp.h tcp_buf.h tcp_conn.h tcp_internal.h tcp_splice.h \
+ tcp_vu.h udp.h udp_flow.h udp_internal.h udp_vu.h util.h \
+ vhost_user.h virtio.h vu_common.h
PASST_REPAIR_HEADERS = linux_dep.h
PESTO_HEADERS = bitmap.h common.h fwd_rule.h inany.h ip.h log.h parse.h \
pesto.h serialise.h
diff --git a/fuzz.c b/fuzz.c
new file mode 100644
index 00000000..89a47d76
--- /dev/null
+++ b/fuzz.c
@@ -0,0 +1,102 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+/* fuzz.c - AFL++ fuzzing support: deterministic wrappers for
+ * clock_gettime() and getsockopt()
+ *
+ * Copyright Red Hat
+ * Author: Anshu Kumari
+ */
+
+#include
+#include
+#include
+#include
+#include "passt.h"
+#include "fuzz.h"
+
+/* Undo macros so definitions here call the real syscalls */
+#undef clock_gettime
+#undef getsockopt
+
+#define FUZZ_CLOCK_BASE_SEC 10000
+
+static struct timespec fuzz_clock;
+
+/**
+ * fuzz_clock_reset() - Reset clock to fixed baseline
+ *
+ * Called at the start of every __AFL_LOOP iteration so
+ * the clock is identical regardless of iteration number.
+ */
+void fuzz_clock_reset(void)
+{
+ fuzz_clock.tv_sec = FUZZ_CLOCK_BASE_SEC;
+ fuzz_clock.tv_nsec = 0;
+}
+
+/**
+ * fuzz_clock_gettime() - Return deterministic time
+ * @clk: Clock ID
+ * @tp: Output timespec
+ *
+ * Return: 0 (always succeeds)
+ */
+int fuzz_clock_gettime(clockid_t clk, struct timespec *tp)
+{
+ (void)clk;
+ *tp = fuzz_clock;
+
+ /* increment the timestamp by 1 micro sec monotonically */
+ fuzz_clock.tv_nsec += 1000;
+ if (fuzz_clock.tv_nsec >= 1000000000) {
+ fuzz_clock.tv_sec++;
+ fuzz_clock.tv_nsec -= 1000000000;
+ }
+ return 0;
+}
+
+/**
+ * fuzz_getsockopt() - Deterministic getsockopt wrapper
+ * @fd: Socket file descriptor
+ * @level: Protocol level
+ * @optname: Option name
+ * @optval: Output buffer
+ * @optlen: In/out option length
+ *
+ * For TCP_INFO: populates optval from the AFL++ shared memory buffer.
+ * For SO_RCVBUF, SO_SNDBUF: returns deterministic values.
+ *
+ * Return: 0 on success, -1 on error
+ */
+int fuzz_getsockopt(int fd, int level, int optname, void *optval,
+ socklen_t *optlen)
+{
+ if (level == SOL_SOCKET) {
+ if (optname == SO_RCVBUF || optname == SO_SNDBUF) {
+ *(int *)optval = 212992; /* default linux buff size */
+ *optlen = sizeof(int);
+ return 0;
+ }
+ }
+
+ if (level == SOL_TCP && optname == TCP_INFO) {
+ size_t fill = *optlen;
+ size_t copy_len;
+
+ memset(optval, 0, fill);
+
+ if (fuzz_sockopt_data && fuzz_sockopt_data_len > 0) {
+ copy_len = MIN(fill, (size_t)fuzz_sockopt_data_len);
+ memcpy(optval, fuzz_sockopt_data, copy_len);
+ fuzz_sockopt_data += copy_len;
+ fuzz_sockopt_data_len -= copy_len;
+ *optlen = copy_len;
+ } else {
+ *optlen = 0;
+ }
+
+ return 0;
+ }
+
+ return getsockopt(fd, level, optname, optval, optlen);
+}
diff --git a/fuzz.h b/fuzz.h
new file mode 100644
index 00000000..311d7e79
--- /dev/null
+++ b/fuzz.h
@@ -0,0 +1,37 @@
+//SPDX-License-Identifier: GPL-2.0-or-later
+
+/* fuzz.h - AFL++ fuzzing support for passt
+ *
+ * Copyright Red Hat
+ * Author: Anshu Kumari
+ */
+
+#ifndef FUZZ_H
+#define FUZZ_H
+
+#ifdef FUZZING
+
+#include
+#include
+#include
+#include "fuzz-testbuf.h"
+
+int fuzz_clock_gettime(clockid_t clk, struct timespec *tp);
+void fuzz_clock_reset(void);
+int fuzz_getsockopt(int fd, int level, int optname, void *optval,
+ socklen_t *optlen);
+
+extern const unsigned char *fuzz_sockopt_data;
+extern int fuzz_sockopt_data_len;
+
+#define clock_gettime(clk, tp) fuzz_clock_gettime(clk, tp)
+#define getsockopt(fd, level, name, val, len) \
+ fuzz_getsockopt(fd, level, name, val, len)
+
+#define fuzz_assert(expr) do { if (!(expr)) _exit(0); } while (0)
+#else /* !FUZZING */
+#include
+#define fuzz_assert(expr) assert(expr)
+#endif /* FUZZING */
+
+#endif /* FUZZ_H */
--
2.55.0