1f0720e69Skamil# Copyright (c) 2018 The NetBSD Foundation, Inc. 2f0720e69Skamil# All rights reserved. 3f0720e69Skamil# 4f0720e69Skamil# This code is derived from software contributed to The NetBSD Foundation 5f0720e69Skamil# by Yang Zheng. 6f0720e69Skamil# 7f0720e69Skamil# Redistribution and use in source and binary forms, with or without 8f0720e69Skamil# modification, are permitted provided that the following conditions 9f0720e69Skamil# are met: 10f0720e69Skamil# 1. Redistributions of source code must retain the above copyright 11f0720e69Skamil# notice, this list of conditions and the following disclaimer. 12f0720e69Skamil# 2. Redistributions in binary form must reproduce the above copyright 13f0720e69Skamil# notice, this list of conditions and the following disclaimer in the 14f0720e69Skamil# documentation and/or other materials provided with the distribution. 15f0720e69Skamil# 16f0720e69Skamil# THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 17f0720e69Skamil# ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 18f0720e69Skamil# TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 19f0720e69Skamil# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 20f0720e69Skamil# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 21f0720e69Skamil# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 22f0720e69Skamil# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 23f0720e69Skamil# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 24f0720e69Skamil# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 25f0720e69Skamil# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 26f0720e69Skamil# POSSIBILITY OF SUCH DAMAGE. 27f0720e69Skamil# 28f0720e69Skamil 29f0720e69Skamiltest_target() 30f0720e69Skamil{ 31f0720e69Skamil SUPPORT='n' 32f0720e69Skamil if uname -m | grep -q "amd64" && command -v c++ >/dev/null 2>&1 && \ 33f0720e69Skamil ! echo __clang__ | c++ -E - | grep -q __clang__; then 34f0720e69Skamil # only clang with major version newer than 7 is supported 35f0720e69Skamil CLANG_MAJOR=`echo __clang_major__ | c++ -E - | grep -o '^[[:digit:]]'` 36f0720e69Skamil if [ "$CLANG_MAJOR" -ge "7" ]; then 37f0720e69Skamil SUPPORT='y' 38f0720e69Skamil fi 39f0720e69Skamil fi 40f0720e69Skamil} 41f0720e69Skamil 42f0720e69Skamilatf_test_case timeout 43f0720e69Skamiltimeout_head() { 44f0720e69Skamil atf_set "descr" "Test thread sanitizer for timeout condition" 45f0720e69Skamil atf_set "require.progs" "c++ paxctl" 46f0720e69Skamil} 47f0720e69Skamil 48f0720e69Skamilatf_test_case timeout_profile 49f0720e69Skamiltimeout_profile_head() { 50f0720e69Skamil atf_set "descr" "Test thread sanitizer for timeout with profiling option" 51f0720e69Skamil atf_set "require.progs" "c++ paxctl" 52f0720e69Skamil} 53f0720e69Skamilatf_test_case timeout_pic 54f0720e69Skamiltimeout_pic_head() { 55f0720e69Skamil atf_set "descr" "Test thread sanitizer for timeout with position independent code (PIC) flag" 56f0720e69Skamil atf_set "require.progs" "c++ paxctl" 57f0720e69Skamil} 58f0720e69Skamilatf_test_case timeout_pie 59f0720e69Skamiltimeout_pie_head() { 60f0720e69Skamil atf_set "descr" "Test thread sanitizer for timeout with position independent execution (PIE) flag" 61f0720e69Skamil atf_set "require.progs" "c++ paxctl" 62f0720e69Skamil} 63f0720e69Skamil 64f0720e69Skamiltimeout_body(){ 65f0720e69Skamil cat > test.cc << EOF 66f0720e69Skamil#include <stddef.h> 67f0720e69Skamil#include <stdint.h> 68f0720e69Skamil 69f0720e69Skamilextern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { 70f0720e69Skamil if (size > 0 && data[0] == 'b') while (1) ; 71f0720e69Skamil return 0; 72f0720e69Skamil} 73f0720e69SkamilEOF 74f0720e69Skamil 75f0720e69Skamil c++ -fsanitize=fuzzer -o test test.cc 76f0720e69Skamil paxctl +a test 77f0720e69Skamil atf_check -s ignore -o ignore -e match:"ERROR: libFuzzer: timeout" ./test -timeout=5 78f0720e69Skamil} 79f0720e69Skamil 80f0720e69Skamiltimeout_profile_body(){ 81f0720e69Skamil cat > test.cc << EOF 82f0720e69Skamil#include <stddef.h> 83f0720e69Skamil#include <stdint.h> 84f0720e69Skamil 85f0720e69Skamilextern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { 86f0720e69Skamil if (size > 0 && data[0] == 'b') while (1) ; 87f0720e69Skamil return 0; 88f0720e69Skamil} 89f0720e69SkamilEOF 90f0720e69Skamil 91*4bb9965cSskrll c++ -fsanitize=fuzzer -static -o test -pg test.cc 92f0720e69Skamil paxctl +a test 93f0720e69Skamil atf_check -s ignore -o ignore -e match:"ERROR: libFuzzer: timeout" ./test -timeout=5 94f0720e69Skamil} 95f0720e69Skamil 96f0720e69Skamiltimeout_pic_body(){ 97f0720e69Skamil cat > test.cc << EOF 98f0720e69Skamil#include <stddef.h> 99f0720e69Skamil#include <stdint.h> 100f0720e69Skamilint help(const uint8_t *data, size_t size); 101f0720e69Skamilextern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { 102f0720e69Skamil return help(data, size); 103f0720e69Skamil} 104f0720e69SkamilEOF 105f0720e69Skamil 106f0720e69Skamil cat > pic.cc << EOF 107f0720e69Skamil#include <stddef.h> 108f0720e69Skamil#include <stdint.h> 109f0720e69Skamil 110f0720e69Skamilint help(const uint8_t *data, size_t size) { 111f0720e69Skamil if (size > 0 && data[0] == 'b') while (1) ; 112f0720e69Skamil return 0; 113f0720e69Skamil} 114f0720e69SkamilEOF 115f0720e69Skamil 116f0720e69Skamil c++ -fsanitize=fuzzer -fPIC -shared -o libtest.so pic.cc 117f0720e69Skamil c++ -o test test.cc -fsanitize=fuzzer -L. -ltest 118f0720e69Skamil paxctl +a test 119f0720e69Skamil 120f0720e69Skamil export LD_LIBRARY_PATH=. 121f0720e69Skamil atf_check -s ignore -o ignore -e match:"ERROR: libFuzzer: timeout" ./test -timeout=5 122f0720e69Skamil} 123f0720e69Skamiltimeout_pie_body(){ 124f0720e69Skamil 125f0720e69Skamil #check whether -pie flag is supported on this architecture 126f0720e69Skamil if ! c++ -pie -dM -E - < /dev/null 2>/dev/null >/dev/null; then 127f0720e69Skamil atf_set_skip "c++ -pie not supported on this architecture" 128f0720e69Skamil fi 129f0720e69Skamil cat > test.cc << EOF 130f0720e69Skamil#include <stddef.h> 131f0720e69Skamil#include <stdint.h> 132f0720e69Skamil 133f0720e69Skamilextern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { 134f0720e69Skamil if (size > 0 && data[0] == 'b') while (1) ; 135f0720e69Skamil return 0; 136f0720e69Skamil} 137f0720e69SkamilEOF 138f0720e69Skamil 139f0720e69Skamil c++ -fsanitize=fuzzer -o test -fpie -pie test.cc 140f0720e69Skamil paxctl +a test 141f0720e69Skamil atf_check -s ignore -o ignore -e match:"ERROR: libFuzzer: timeout" ./test -timeout=5 142f0720e69Skamil} 143f0720e69Skamil 144f0720e69Skamil 145f0720e69Skamilatf_test_case target_not_supported 146f0720e69Skamiltarget_not_supported_head() 147f0720e69Skamil{ 148f0720e69Skamil atf_set "descr" "Test forced skip" 149f0720e69Skamil} 150f0720e69Skamil 1515612f2caSkamiltarget_not_supported_body() 1525612f2caSkamil{ 1535612f2caSkamil atf_skip "Target is not supported" 1545612f2caSkamil} 1555612f2caSkamil 156f0720e69Skamilatf_init_test_cases() 157f0720e69Skamil{ 158f0720e69Skamil test_target 159f0720e69Skamil test $SUPPORT = 'n' && { 160f0720e69Skamil atf_add_test_case target_not_supported 161f0720e69Skamil return 0 162f0720e69Skamil } 163f0720e69Skamil atf_add_test_case timeout 164f0720e69Skamil atf_add_test_case timeout_profile 165f0720e69Skamil atf_add_test_case timeout_pie 166f0720e69Skamil atf_add_test_case timeout_pic 167f0720e69Skamil} 168