Skip to content

Commit

Permalink
quic: make fuzzer permissionless
Browse files Browse the repository at this point in the history
Also add LSan APIs to util
  • Loading branch information
riptl committed Feb 20, 2024
1 parent 942eef5 commit bfede4e
Show file tree
Hide file tree
Showing 2 changed files with 38 additions and 19 deletions.
15 changes: 15 additions & 0 deletions src/util/sanitize/fd_asan.h
Original file line number Diff line number Diff line change
Expand Up @@ -92,13 +92,28 @@ static inline void * fd_asan_unpoison( void * addr, ulong sz ) { __asan_unpoison
static inline int fd_asan_test ( void * addr ) { return __asan_address_is_poisoned( addr ); }
static inline void * fd_asan_query ( void * addr, ulong sz ) { return __asan_region_is_poisoned ( addr, sz ); }

int __lsan_is_turned_off(void);
void __lsan_ignore_object(const void *p);
void __lsan_disable(void);
void __lsan_enable(void);

static inline int fd_lsan_enabled( void ) { return !__lsan_is_turned_off(); }
static inline void fd_lsan_ignore ( void const * p ) { __lsan_ignore_object( p ); }
static inline void fd_lsan_disable( void ) { __lsan_disable(); }
static inline void fd_lsan_enable ( void ) { __lsan_enable(); }

#else

static inline void * fd_asan_poison ( void * addr, ulong sz ) { (void)sz; return addr; }
static inline void * fd_asan_unpoison( void * addr, ulong sz ) { (void)sz; return addr; }
static inline int fd_asan_test ( void * addr ) { (void)addr; return 0; }
static inline void * fd_asan_query ( void * addr, ulong sz ) { (void)addr; (void)sz; return NULL; }

static inline int fd_lsan_enabled( void ) { return 0; }
static inline void fd_lsan_ignore ( void const * p ) { (void)p; }
static inline void fd_lsan_disable( void ) {}
static inline void fd_lsan_enable ( void ) {}

#endif

FD_PROTOTYPES_END
Expand Down
42 changes: 23 additions & 19 deletions src/waltz/quic/tests/fuzz_quic.c
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@
#error "This target requires FD_HAS_HOSTED"
#endif

#include <assert.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
Expand Down Expand Up @@ -117,9 +118,9 @@ uint send_packet(uchar const *payload, size_t payload_sz) {
void init_quic(void) {
void *ctx = (void *)0x1234UL;
void *shaio = fd_aio_new(_aio, ctx, test_aio_send_func);
FD_TEST(shaio);
assert( shaio );
fd_aio_t *aio = fd_aio_join(shaio);
FD_TEST(aio);
assert(aio);

server_quic->cb.now = test_clock;
server_quic->cb.now_ctx = NULL;
Expand All @@ -134,29 +135,30 @@ destroy_quic( void ) {
}

int LLVMFuzzerInitialize(int *argc, char ***argv) {
int lsan_enabled = fd_lsan_enabled();
fd_lsan_disable();

/* Set up shell without signal handlers */
putenv("FD_LOG_BACKTRACE=0");
fd_boot(argc, argv);
atexit(fd_halt);

ulong cpu_idx = fd_tile_cpu_id(fd_tile_idx());
if (cpu_idx > fd_shmem_cpu_cnt())
cpu_idx = 0UL;
/* Use unoptimized wksp memory */

ulong wksp_sz = 13107200UL;

uchar * mem = aligned_alloc( 4096UL, wksp_sz );
assert( mem );

char const *_page_sz =
fd_env_strip_cmdline_cstr(argc, argv, "--page-sz", NULL, "normal");
ulong page_cnt =
fd_env_strip_cmdline_ulong(argc, argv, "--page-cnt", NULL, 3200UL);
ulong numa_idx = fd_env_strip_cmdline_ulong(argc, argv, "--numa-idx", NULL,
fd_shmem_numa_idx(cpu_idx));
ulong part_max = fd_wksp_part_max_est( wksp_sz, 64UL<<10 );
assert( part_max );
ulong data_max = fd_wksp_data_max_est( wksp_sz, 64UL<<10 );

ulong page_sz = fd_cstr_to_shmem_page_sz(_page_sz);
if (FD_UNLIKELY(!page_sz))
FD_LOG_ERR(("unsupported --page-sz"));
fd_wksp_t * wksp = fd_wksp_join( fd_wksp_new( mem, "wksp", 42U, part_max, data_max ) );
assert( wksp );

fd_wksp_t *wksp = fd_wksp_new_anonymous(
page_sz, page_cnt, fd_shmem_cpu_idx(numa_idx), "wksp", 0UL);
FD_TEST(wksp);
int shmem_err = fd_shmem_join_anonymous( "wksp", FD_SHMEM_JOIN_MODE_READ_WRITE, wksp, mem, 4096UL, wksp_sz/4096UL );
assert( !shmem_err );

fd_quic_limits_t const quic_limits = {.conn_cnt = 10,
.conn_id_cnt = 10,
Expand All @@ -167,11 +169,11 @@ int LLVMFuzzerInitialize(int *argc, char ***argv) {
.tx_buf_sz = 1 << 14};

ulong quic_footprint = fd_quic_footprint(&quic_limits);
FD_TEST(quic_footprint);
assert( quic_footprint );

fd_rng_t _rng[1]; fd_rng_t * rng = fd_rng_join( fd_rng_new( _rng, 0U, 0UL ) );
server_quic = fd_quic_new_anonymous(wksp, &quic_limits, FD_QUIC_ROLE_SERVER, rng);
FD_TEST(server_quic);
assert( server_quic );
fd_rng_delete( fd_rng_leave( rng ) );

fd_quic_config_t *server_config = &server_quic->config;
Expand All @@ -184,6 +186,8 @@ int LLVMFuzzerInitialize(int *argc, char ***argv) {
server_quic->config.initial_rx_max_stream_data = 1 << 14;
// server_quic->config.retry = 1;

if( lsan_enabled )
fd_lsan_enable();
return 0;
}

Expand Down

0 comments on commit bfede4e

Please sign in to comment.