Add FMQ test to hwasan-postsubmit. am: 331b20e54d am: 21a063588d am: 4aa77d8efe
Original change: https://android-review.googlesource.com/c/platform/system/libfmq/+/2028749
Change-Id: Id5ce539ade6e94ea06370a5665583263b0dafc2e
diff --git a/Android.bp b/Android.bp
index 5889a9c..f37f1c6 100644
--- a/Android.bp
+++ b/Android.bp
@@ -30,7 +30,10 @@
],
apex_available: [
"//apex_available:platform",
+ "com.android.bluetooth",
+ "com.android.media.swcodec",
"com.android.neuralnetworks",
+ "test_com.android.media.swcodec",
"test_com.android.neuralnetworks",
],
export_include_dirs: ["include"],
diff --git a/fuzzer/Android.bp b/fuzzer/Android.bp
index 8b33d83..0926c09 100644
--- a/fuzzer/Android.bp
+++ b/fuzzer/Android.bp
@@ -56,9 +56,9 @@
host_supported: true,
sanitize: {
- hwaddress: true,
scs: true,
cfi: true,
+ address: true,
memtag_heap: true,
// undefined behavior is expected
all_undefined: false,
diff --git a/fuzzer/fmq_fuzzer.cpp b/fuzzer/fmq_fuzzer.cpp
index 844188f..79ce5fc 100644
--- a/fuzzer/fmq_fuzzer.cpp
+++ b/fuzzer/fmq_fuzzer.cpp
@@ -35,6 +35,9 @@
typedef int32_t payload_t;
+// The reader will wait for 10 ms
+static constexpr int kBlockingTimeoutNs = 10000000;
+
/*
* MessageQueueBase.h contains asserts when memory allocation fails. So we need
* to set a reasonable limit if we want to avoid those asserts.
@@ -55,6 +58,7 @@
static constexpr int kMaxNumSyncReaders = 1;
static constexpr int kMaxNumUnsyncReaders = 5;
+static constexpr int kMaxDataPerReader = 5;
typedef android::AidlMessageQueue<payload_t, SynchronizedReadWrite> AidlMessageQueueSync;
typedef android::AidlMessageQueue<payload_t, UnsynchronizedWrite> AidlMessageQueueUnsync;
@@ -67,14 +71,19 @@
typedef android::hardware::MQDescriptorSync<payload_t> MQDescSync;
typedef android::hardware::MQDescriptorUnsync<payload_t> MQDescUnsync;
+static inline uint64_t* getCounterPtr(payload_t* start, int byteOffset) {
+ return reinterpret_cast<uint64_t*>(reinterpret_cast<uint8_t*>(start) - byteOffset);
+}
+
template <typename Queue, typename Desc>
-void reader(const Desc& desc, std::vector<uint8_t> readerData) {
+void reader(const Desc& desc, std::vector<uint8_t> readerData, bool userFd) {
Queue readMq(desc);
if (!readMq.isValid()) {
LOG(ERROR) << "read mq invalid";
return;
}
FuzzedDataProvider fdp(&readerData[0], readerData.size());
+ payload_t* ring = nullptr;
while (fdp.remaining_bytes()) {
typename Queue::MemTransaction tx;
size_t numElements = fdp.ConsumeIntegralInRange<size_t>(0, kMaxNumElements);
@@ -84,19 +93,52 @@
const auto& region = tx.getFirstRegion();
payload_t* firstStart = region.getAddress();
- // TODO add the debug function to get pointer to the ring buffer
- uint64_t* writeCounter = reinterpret_cast<uint64_t*>(
- reinterpret_cast<uint8_t*>(firstStart) - kWriteCounterOffsetBytes);
- *writeCounter = fdp.ConsumeIntegral<uint64_t>();
-
+ // the ring buffer is only next to the read/write counters when there is
+ // no user supplied fd
+ if (!userFd) {
+ if (ring == nullptr) {
+ ring = firstStart;
+ }
+ if (fdp.ConsumeIntegral<uint8_t>() == 1) {
+ uint64_t* writeCounter = getCounterPtr(ring, kWriteCounterOffsetBytes);
+ *writeCounter = fdp.ConsumeIntegral<uint64_t>();
+ }
+ }
(void)std::to_string(*firstStart);
readMq.commitRead(numElements);
}
}
+template <typename Queue, typename Desc>
+void readerBlocking(const Desc& desc, std::vector<uint8_t> readerData) {
+ Queue readMq(desc);
+ if (!readMq.isValid()) {
+ LOG(ERROR) << "read mq invalid";
+ return;
+ }
+ FuzzedDataProvider fdp(&readerData[0], readerData.size());
+ bool success;
+ do {
+ size_t count = fdp.remaining_bytes()
+ ? fdp.ConsumeIntegralInRange<size_t>(1, readMq.getQuantumCount())
+ : 1;
+ std::vector<payload_t> data;
+ data.resize(count);
+ success = readMq.readBlocking(data.data(), count, kBlockingTimeoutNs);
+ } while (success == true || fdp.remaining_bytes() > sizeof(size_t));
+}
+
+// Can't use blocking calls with Unsync queues(there is a static_assert)
+template <>
+void readerBlocking<AidlMessageQueueUnsync, AidlMQDescUnsync>(const AidlMQDescUnsync&,
+ std::vector<uint8_t>) {}
+template <>
+void readerBlocking<MessageQueueUnsync, MQDescUnsync>(const MQDescUnsync&, std::vector<uint8_t>) {}
+
template <typename Queue>
-void writer(Queue& writeMq, FuzzedDataProvider& fdp) {
+void writer(Queue& writeMq, FuzzedDataProvider& fdp, bool userFd) {
+ payload_t* ring = nullptr;
while (fdp.remaining_bytes()) {
typename Queue::MemTransaction tx;
size_t numElements = 1;
@@ -108,23 +150,56 @@
const auto& region = tx.getFirstRegion();
payload_t* firstStart = region.getAddress();
-
- // TODO add the debug function to get pointer to the ring buffer
- uint64_t* readCounter = reinterpret_cast<uint64_t*>(reinterpret_cast<uint8_t*>(firstStart) -
- kReadCounterOffsetBytes);
- *readCounter = fdp.ConsumeIntegral<uint64_t>();
-
+ // the ring buffer is only next to the read/write counters when there is
+ // no user supplied fd
+ if (!userFd) {
+ if (ring == nullptr) {
+ ring = firstStart;
+ }
+ if (fdp.ConsumeIntegral<uint8_t>() == 1) {
+ uint64_t* readCounter = getCounterPtr(ring, kReadCounterOffsetBytes);
+ *readCounter = fdp.ConsumeIntegral<uint64_t>();
+ }
+ }
*firstStart = fdp.ConsumeIntegral<payload_t>();
writeMq.commitWrite(numElements);
}
}
+template <typename Queue>
+void writerBlocking(Queue& writeMq, FuzzedDataProvider& fdp) {
+ while (fdp.remaining_bytes() > sizeof(size_t)) {
+ size_t count = fdp.ConsumeIntegralInRange<size_t>(1, writeMq.getQuantumCount());
+ std::vector<payload_t> data;
+ for (int i = 0; i < count; i++) {
+ data.push_back(fdp.ConsumeIntegral<payload_t>());
+ }
+ writeMq.writeBlocking(data.data(), count, kBlockingTimeoutNs);
+ }
+}
+
+// Can't use blocking calls with Unsync queues(there is a static_assert)
+template <>
+void writerBlocking<AidlMessageQueueUnsync>(AidlMessageQueueUnsync&, FuzzedDataProvider&) {}
+template <>
+void writerBlocking<MessageQueueUnsync>(MessageQueueUnsync&, FuzzedDataProvider&) {}
+
template <typename Queue, typename Desc>
void fuzzAidlWithReaders(std::vector<uint8_t>& writerData,
- std::vector<std::vector<uint8_t>>& readerData) {
+ std::vector<std::vector<uint8_t>>& readerData, bool blocking) {
FuzzedDataProvider fdp(&writerData[0], writerData.size());
- Queue writeMq(fdp.ConsumeIntegralInRange<size_t>(1, kMaxNumElements), fdp.ConsumeBool());
+ bool evFlag = blocking || fdp.ConsumeBool();
+ android::base::unique_fd dataFd;
+ size_t bufferSize = 0;
+ size_t numElements = fdp.ConsumeIntegralInRange<size_t>(1, kMaxNumElements);
+ bool userFd = fdp.ConsumeBool();
+ if (userFd) {
+ // run test with our own data region
+ bufferSize = numElements * sizeof(payload_t);
+ dataFd.reset(::ashmem_create_region("SyncReadWrite", bufferSize));
+ }
+ Queue writeMq(numElements, evFlag, std::move(dataFd), bufferSize);
if (!writeMq.isValid()) {
LOG(ERROR) << "AIDL write mq invalid";
return;
@@ -134,10 +209,20 @@
std::vector<std::thread> clients;
for (int i = 0; i < readerData.size(); i++) {
- clients.emplace_back(reader<Queue, Desc>, std::ref(desc), std::ref(readerData[i]));
+ if (blocking) {
+ clients.emplace_back(readerBlocking<Queue, Desc>, std::ref(desc),
+ std::ref(readerData[i]));
+ } else {
+ clients.emplace_back(reader<Queue, Desc>, std::ref(desc), std::ref(readerData[i]),
+ userFd);
+ }
}
- writer<Queue>(writeMq, fdp);
+ if (blocking) {
+ writerBlocking<Queue>(writeMq, fdp);
+ } else {
+ writer<Queue>(writeMq, fdp, userFd);
+ }
for (auto& client : clients) {
client.join();
@@ -146,9 +231,19 @@
template <typename Queue, typename Desc>
void fuzzHidlWithReaders(std::vector<uint8_t>& writerData,
- std::vector<std::vector<uint8_t>>& readerData) {
+ std::vector<std::vector<uint8_t>>& readerData, bool blocking) {
FuzzedDataProvider fdp(&writerData[0], writerData.size());
- Queue writeMq(fdp.ConsumeIntegralInRange<size_t>(1, kMaxNumElements), fdp.ConsumeBool());
+ bool evFlag = blocking || fdp.ConsumeBool();
+ android::base::unique_fd dataFd;
+ size_t bufferSize = 0;
+ size_t numElements = fdp.ConsumeIntegralInRange<size_t>(1, kMaxNumElements);
+ bool userFd = fdp.ConsumeBool();
+ if (userFd) {
+ // run test with our own data region
+ bufferSize = numElements * sizeof(payload_t);
+ dataFd.reset(::ashmem_create_region("SyncReadWrite", bufferSize));
+ }
+ Queue writeMq(numElements, evFlag, std::move(dataFd), bufferSize);
if (!writeMq.isValid()) {
LOG(ERROR) << "HIDL write mq invalid";
return;
@@ -158,10 +253,20 @@
std::vector<std::thread> clients;
for (int i = 0; i < readerData.size(); i++) {
- clients.emplace_back(reader<Queue, Desc>, std::ref(*desc), std::ref(readerData[i]));
+ if (blocking) {
+ clients.emplace_back(readerBlocking<Queue, Desc>, std::ref(*desc),
+ std::ref(readerData[i]));
+ } else {
+ clients.emplace_back(reader<Queue, Desc>, std::ref(*desc), std::ref(readerData[i]),
+ userFd);
+ }
}
- writer<Queue>(writeMq, fdp);
+ if (blocking) {
+ writerBlocking<Queue>(writeMq, fdp);
+ } else {
+ writer<Queue>(writeMq, fdp, userFd);
+ }
for (auto& client : clients) {
client.join();
@@ -179,16 +284,18 @@
uint8_t numReaders = fuzzSync ? fdp.ConsumeIntegralInRange<uint8_t>(0, kMaxNumSyncReaders)
: fdp.ConsumeIntegralInRange<uint8_t>(0, kMaxNumUnsyncReaders);
for (int i = 0; i < numReaders; i++) {
- readerData.emplace_back(fdp.ConsumeBytes<uint8_t>(5));
+ readerData.emplace_back(fdp.ConsumeBytes<uint8_t>(kMaxDataPerReader));
}
+ bool fuzzBlocking = fdp.ConsumeBool();
std::vector<uint8_t> writerData = fdp.ConsumeRemainingBytes<uint8_t>();
-
if (fuzzSync) {
- fuzzHidlWithReaders<MessageQueueSync, MQDescSync>(writerData, readerData);
- fuzzAidlWithReaders<AidlMessageQueueSync, AidlMQDescSync>(writerData, readerData);
+ fuzzHidlWithReaders<MessageQueueSync, MQDescSync>(writerData, readerData, fuzzBlocking);
+ fuzzAidlWithReaders<AidlMessageQueueSync, AidlMQDescSync>(writerData, readerData,
+ fuzzBlocking);
} else {
- fuzzHidlWithReaders<MessageQueueUnsync, MQDescUnsync>(writerData, readerData);
- fuzzAidlWithReaders<AidlMessageQueueUnsync, AidlMQDescUnsync>(writerData, readerData);
+ fuzzHidlWithReaders<MessageQueueUnsync, MQDescUnsync>(writerData, readerData, false);
+ fuzzAidlWithReaders<AidlMessageQueueUnsync, AidlMQDescUnsync>(writerData, readerData,
+ false);
}
return 0;
