1f0720e69Skamil# Copyright (c) 2018 The NetBSD Foundation, Inc. 2f0720e69Skamil# All rights reserved. 3f0720e69Skamil# 4f0720e69Skamil# This code is derived from software contributed to The NetBSD Foundation 5f0720e69Skamil# by Yang Zheng. 6f0720e69Skamil# 7f0720e69Skamil# Redistribution and use in source and binary forms, with or without 8f0720e69Skamil# modification, are permitted provided that the following conditions 9f0720e69Skamil# are met: 10f0720e69Skamil# 1. Redistributions of source code must retain the above copyright 11f0720e69Skamil# notice, this list of conditions and the following disclaimer. 12f0720e69Skamil# 2. Redistributions in binary form must reproduce the above copyright 13f0720e69Skamil# notice, this list of conditions and the following disclaimer in the 14f0720e69Skamil# documentation and/or other materials provided with the distribution. 15f0720e69Skamil# 16f0720e69Skamil# THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 17f0720e69Skamil# ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 18f0720e69Skamil# TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 19f0720e69Skamil# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 20f0720e69Skamil# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 21f0720e69Skamil# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 22f0720e69Skamil# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 23f0720e69Skamil# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 24f0720e69Skamil# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 25f0720e69Skamil# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 26f0720e69Skamil# POSSIBILITY OF SUCH DAMAGE. 27f0720e69Skamil# 28f0720e69Skamil 29f0720e69Skamiltest_target() 30f0720e69Skamil{ 31f0720e69Skamil SUPPORT='n' 32f0720e69Skamil if uname -m | grep -q "amd64" && command -v c++ >/dev/null 2>&1 && \ 33f0720e69Skamil ! echo __clang__ | c++ -E - | grep -q __clang__; then 34f0720e69Skamil # only clang with major version newer than 7 is supported 35f0720e69Skamil CLANG_MAJOR=`echo __clang_major__ | c++ -E - | grep -o '^[[:digit:]]'` 36f0720e69Skamil if [ "$CLANG_MAJOR" -ge "7" ]; then 37f0720e69Skamil SUPPORT='y' 38f0720e69Skamil fi 39f0720e69Skamil fi 40f0720e69Skamil} 41f0720e69Skamil 42f0720e69Skamilatf_test_case simple 43f0720e69Skamilsimple_head() { 44f0720e69Skamil atf_set "descr" "Test thread sanitizer for error exit condition" 45f0720e69Skamil atf_set "require.progs" "c++ paxctl" 46f0720e69Skamil} 47f0720e69Skamil 48f0720e69Skamilatf_test_case simple_profile 49f0720e69Skamilsimple_profile_head() { 50f0720e69Skamil atf_set "descr" "Test thread sanitizer for simple with profiling option" 51f0720e69Skamil atf_set "require.progs" "c++ paxctl" 52f0720e69Skamil} 53f0720e69Skamilatf_test_case simple_pic 54f0720e69Skamilsimple_pic_head() { 55f0720e69Skamil atf_set "descr" "Test thread sanitizer for simple with position independent code (PIC) flag" 56f0720e69Skamil atf_set "require.progs" "c++ paxctl" 57f0720e69Skamil} 58f0720e69Skamilatf_test_case simple_pie 59f0720e69Skamilsimple_pie_head() { 60f0720e69Skamil atf_set "descr" "Test thread sanitizer for simple with position independent execution (PIE) flag" 61f0720e69Skamil atf_set "require.progs" "c++ paxctl" 62f0720e69Skamil} 63f0720e69Skamil 64f0720e69Skamilsimple_body(){ 65f0720e69Skamil cat > test.cc << EOF 66f0720e69Skamil#include <stdlib.h> 67f0720e69Skamil#include <stdio.h> 68f0720e69Skamil#include <stdint.h> 69f0720e69Skamil 70f0720e69Skamilextern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { 71f0720e69Skamil if (size > 0 && data[0] == 'b') { 72f0720e69Skamil fprintf(stderr, "BINGO\n"); 73f0720e69Skamil exit(1); 74f0720e69Skamil } 75f0720e69Skamil 76f0720e69Skamil return 0; 77f0720e69Skamil} 78f0720e69SkamilEOF 79f0720e69Skamil 80f0720e69Skamil c++ -fsanitize=fuzzer -o test test.cc 81f0720e69Skamil paxctl +a test 82f0720e69Skamil atf_check -s ignore -o ignore -e match:"BINGO" ./test 83f0720e69Skamil} 84f0720e69Skamil 85f0720e69Skamilsimple_profile_body(){ 86f0720e69Skamil cat > test.cc << EOF 87f0720e69Skamil#include <stdlib.h> 88f0720e69Skamil#include <stdio.h> 89f0720e69Skamil#include <stdint.h> 90f0720e69Skamil 91f0720e69Skamilextern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { 92f0720e69Skamil if (size > 0 && data[0] == 'b') { 93f0720e69Skamil fprintf(stderr, "BINGO\n"); 94f0720e69Skamil exit(1); 95f0720e69Skamil } 96f0720e69Skamil 97f0720e69Skamil return 0; 98f0720e69Skamil} 99f0720e69SkamilEOF 100f0720e69Skamil 101*4bb9965cSskrll c++ -fsanitize=fuzzer -static -o test -pg test.cc 102f0720e69Skamil paxctl +a test 103f0720e69Skamil atf_check -s ignore -o ignore -e match:"BINGO" ./test 104f0720e69Skamil} 105f0720e69Skamil 106f0720e69Skamilsimple_pic_body(){ 107f0720e69Skamil cat > test.cc << EOF 108f0720e69Skamil#include <stddef.h> 109f0720e69Skamil#include <stdint.h> 110f0720e69Skamilint help(const uint8_t *data, size_t size); 111f0720e69Skamilextern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { 112f0720e69Skamil return help(data, size); 113f0720e69Skamil} 114f0720e69SkamilEOF 115f0720e69Skamil 116f0720e69Skamil cat > pic.cc << EOF 117f0720e69Skamil#include <stdlib.h> 118f0720e69Skamil#include <stdio.h> 119f0720e69Skamil#include <stdint.h> 120f0720e69Skamil 121f0720e69Skamilint help(const uint8_t *data, size_t size) { 122f0720e69Skamil if (size > 0 && data[0] == 'b') { 123f0720e69Skamil fprintf(stderr, "BINGO\n"); 124f0720e69Skamil exit(1); 125f0720e69Skamil } 126f0720e69Skamil 127f0720e69Skamil return 0; 128f0720e69Skamil} 129f0720e69SkamilEOF 130f0720e69Skamil 131f0720e69Skamil c++ -fsanitize=fuzzer -fPIC -shared -o libtest.so pic.cc 132f0720e69Skamil c++ -o test test.cc -fsanitize=fuzzer -L. -ltest 133f0720e69Skamil paxctl +a test 134f0720e69Skamil 135f0720e69Skamil export LD_LIBRARY_PATH=. 136f0720e69Skamil atf_check -s ignore -o ignore -e match:"BINGO" ./test 137f0720e69Skamil} 138f0720e69Skamilsimple_pie_body(){ 139f0720e69Skamil 140f0720e69Skamil #check whether -pie flag is supported on this architecture 141f0720e69Skamil if ! c++ -pie -dM -E - < /dev/null 2>/dev/null >/dev/null; then 142f0720e69Skamil atf_set_skip "c++ -pie not supported on this architecture" 143f0720e69Skamil fi 144f0720e69Skamil cat > test.cc << EOF 145f0720e69Skamil#include <stdlib.h> 146f0720e69Skamil#include <stdio.h> 147f0720e69Skamil#include <stdint.h> 148f0720e69Skamil 149f0720e69Skamilextern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { 150f0720e69Skamil if (size > 0 && data[0] == 'b') { 151f0720e69Skamil fprintf(stderr, "BINGO\n"); 152f0720e69Skamil exit(1); 153f0720e69Skamil } 154f0720e69Skamil 155f0720e69Skamil return 0; 156f0720e69Skamil} 157f0720e69SkamilEOF 158f0720e69Skamil 159f0720e69Skamil c++ -fsanitize=fuzzer -o test -fpie -pie test.cc 160f0720e69Skamil paxctl +a test 161f0720e69Skamil atf_check -s ignore -o ignore -e match:"BINGO" ./test 162f0720e69Skamil} 163f0720e69Skamil 164f0720e69Skamil 165f0720e69Skamilatf_test_case target_not_supported 166f0720e69Skamiltarget_not_supported_head() 167f0720e69Skamil{ 168f0720e69Skamil atf_set "descr" "Test forced skip" 169f0720e69Skamil} 170f0720e69Skamil 1715612f2caSkamiltarget_not_supported_body() 1725612f2caSkamil{ 1735612f2caSkamil atf_skip "Target is not supported" 1745612f2caSkamil} 1755612f2caSkamil 176f0720e69Skamilatf_init_test_cases() 177f0720e69Skamil{ 178f0720e69Skamil test_target 179f0720e69Skamil test $SUPPORT = 'n' && { 180f0720e69Skamil atf_add_test_case target_not_supported 181f0720e69Skamil return 0 182f0720e69Skamil } 183f0720e69Skamil atf_add_test_case simple 184f0720e69Skamil atf_add_test_case simple_profile 185f0720e69Skamil atf_add_test_case simple_pie 186f0720e69Skamil atf_add_test_case simple_pic 187f0720e69Skamil} 188