1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
|
/*
* Copyright 2020 The Android Open Source Project
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
#define LOG_TAG "RefBaseFuzz"
#include <thread>
#include "fuzzer/FuzzedDataProvider.h"
#include "utils/Log.h"
#include "utils/RWLock.h"
#include "utils/RefBase.h"
#include "utils/StrongPointer.h"
using android::RefBase;
using android::RWLock;
using android::sp;
using android::wp;
static constexpr int kMaxOperations = 100;
static constexpr int kMaxThreads = 10;
struct RefBaseSubclass : public RefBase {
public:
RefBaseSubclass(bool* deletedCheck, RWLock& deletedMtx)
: mDeleted(deletedCheck), mRwLock(deletedMtx) {
RWLock::AutoWLock lock(mRwLock);
*mDeleted = false;
extendObjectLifetime(OBJECT_LIFETIME_WEAK);
}
virtual ~RefBaseSubclass() {
RWLock::AutoWLock lock(mRwLock);
*mDeleted = true;
}
private:
bool* mDeleted;
android::RWLock& mRwLock;
};
// A thread-specific state object for ref
struct RefThreadState {
size_t strongCount = 0;
size_t weakCount = 0;
};
RWLock gRefDeletedLock;
bool gRefDeleted = false;
bool gHasModifiedRefs = false;
RefBaseSubclass* ref;
RefBase::weakref_type* weakRefs;
// These operations don't need locks as they explicitly check per-thread counts before running
// they also have the potential to write to gRefDeleted, so must not be locked.
const std::vector<std::function<void(RefThreadState*)>> kUnlockedOperations = {
[](RefThreadState* refState) -> void {
if (refState->strongCount > 0) {
ref->decStrong(nullptr);
gHasModifiedRefs = true;
refState->strongCount--;
}
},
[](RefThreadState* refState) -> void {
if (refState->weakCount > 0) {
weakRefs->decWeak(nullptr);
gHasModifiedRefs = true;
refState->weakCount--;
}
},
};
const std::vector<std::function<void(RefThreadState*)>> kMaybeLockedOperations = {
// Read-only operations
[](RefThreadState*) -> void { ref->getStrongCount(); },
[](RefThreadState*) -> void { weakRefs->getWeakCount(); },
[](RefThreadState*) -> void { ref->printRefs(); },
// Read/write operations
[](RefThreadState* refState) -> void {
ref->incStrong(nullptr);
gHasModifiedRefs = true;
refState->strongCount++;
},
[](RefThreadState* refState) -> void {
ref->forceIncStrong(nullptr);
gHasModifiedRefs = true;
refState->strongCount++;
},
[](RefThreadState* refState) -> void {
ref->createWeak(nullptr);
gHasModifiedRefs = true;
refState->weakCount++;
},
[](RefThreadState* refState) -> void {
// This will increment weak internally, then attempt to
// promote it to strong. If it fails, it decrements weak.
// If it succeeds, the weak is converted to strong.
// Both cases net no weak reference change.
if (weakRefs->attemptIncStrong(nullptr)) {
refState->strongCount++;
gHasModifiedRefs = true;
}
},
[](RefThreadState* refState) -> void {
if (weakRefs->attemptIncWeak(nullptr)) {
refState->weakCount++;
gHasModifiedRefs = true;
}
},
[](RefThreadState* refState) -> void {
weakRefs->incWeak(nullptr);
gHasModifiedRefs = true;
refState->weakCount++;
},
};
void loop(const std::vector<uint8_t>& fuzzOps) {
RefThreadState state;
uint8_t lockedOpSize = kMaybeLockedOperations.size();
uint8_t totalOperationTypes = lockedOpSize + kUnlockedOperations.size();
for (auto op : fuzzOps) {
auto opVal = op % totalOperationTypes;
if (opVal >= lockedOpSize) {
kUnlockedOperations[opVal % lockedOpSize](&state);
} else {
// We only need to lock if we have no strong or weak count
bool shouldLock = state.strongCount == 0 && state.weakCount == 0;
if (shouldLock) {
gRefDeletedLock.readLock();
// If ref has deleted itself, we can no longer fuzz on this thread.
if (gRefDeleted) {
// Unlock since we're exiting the loop here.
gRefDeletedLock.unlock();
return;
}
}
// Execute the locked operation
kMaybeLockedOperations[opVal](&state);
// Unlock if we locked.
if (shouldLock) {
gRefDeletedLock.unlock();
}
}
}
// Instead of explicitly freeing this, we're going to remove our weak and
// strong references.
for (; state.weakCount > 0; state.weakCount--) {
weakRefs->decWeak(nullptr);
}
// Clean up any strong references
for (; state.strongCount > 0; state.strongCount--) {
ref->decStrong(nullptr);
}
}
void spawnThreads(FuzzedDataProvider* dataProvider) {
std::vector<std::thread> threads = std::vector<std::thread>();
// Get the number of threads to generate
uint8_t count = dataProvider->ConsumeIntegralInRange<uint8_t>(1, kMaxThreads);
// Generate threads
for (uint8_t i = 0; i < count; i++) {
uint8_t opCount = dataProvider->ConsumeIntegralInRange<uint8_t>(1, kMaxOperations);
std::vector<uint8_t> threadOperations = dataProvider->ConsumeBytes<uint8_t>(opCount);
std::thread tmpThread = std::thread(loop, threadOperations);
threads.push_back(std::move(tmpThread));
}
for (auto& th : threads) {
th.join();
}
}
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
gHasModifiedRefs = false;
ref = new RefBaseSubclass(&gRefDeleted, gRefDeletedLock);
weakRefs = ref->getWeakRefs();
// Since we are modifying flags, (flags & OBJECT_LIFETIME_MASK) == OBJECT_LIFETIME_WEAK
// is true. The destructor for RefBase should clean up weakrefs because of this.
FuzzedDataProvider dataProvider(data, size);
spawnThreads(&dataProvider);
LOG_ALWAYS_FATAL_IF(!gHasModifiedRefs && gRefDeleted, "ref(%p) was prematurely deleted!", ref);
// We need to explicitly delete this object
// if no refs have been added or deleted.
if (!gHasModifiedRefs && !gRefDeleted) {
delete ref;
}
LOG_ALWAYS_FATAL_IF(gHasModifiedRefs && !gRefDeleted,
"ref(%p) should be deleted, is it leaking?", ref);
return 0;
}
|
