trinity.c

#include <errno.h>
#include <stdlib.h>
#include <malloc.h>
#include <string.h>
#include <sys/prctl.h>
#include <sys/resource.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <unistd.h>

#include "arch.h"
#include "fd.h"
#include "files.h"
#include "ioctls.h"
#include "kmsg-monitor.h"
#include "maps.h"
#include "objects.h"
#include "pids.h"
#include "params.h"
#include "domains.h"
#include "random.h"
#include "signals.h"
#include "shm.h"
#include "stats.h"
#include "tables.h"
#include "taint.h"
#include "trinity.h"
#include "uid.h"
#include "utils.h"
#include "version.h"

pid_t mainpid;

char *progname = NULL;

unsigned int page_size;
unsigned int num_online_cpus;
bool no_bind_to_cpu;
unsigned int max_children;
struct rlimit max_files_rlimit;

/*
 * just in case we're not using the test.sh harness, we
 * change to the tmp dir if it exists.
 */
static void change_tmp_dir(void)
{
	struct stat sb;
	const char tmpdir[]="tmp/";
	int ret;

	/* Check if it exists, bail early if it doesn't */
	ret = (lstat(tmpdir, &sb));
	if (ret == -1)
		return;

	/* Just in case a previous run screwed the perms. */
	ret = chmod(tmpdir, 0777);
	if (ret == -1)
		output(0, "Couldn't chmod %s to 0777.\n", tmpdir);

	ret = chdir(tmpdir);
	if (ret == -1)
		output(0, "Couldn't change to %s\n", tmpdir);
}

static int set_exit_code(enum exit_reasons reason)
{
	/* Clean exits return 0; everything else returns the reason
	 * code directly so the parent can distinguish failure modes. */
	switch (reason) {
	case STILL_RUNNING:
	case EXIT_REACHED_COUNT:
	case EXIT_SIGINT:
	case EXIT_USER_REQUEST:
	case EXIT_EPOCH_DONE:
		return EXIT_SUCCESS;

	default:
		return (int)reason;
	}
}

/*
 * Epoch-based forking wrapper around main_loop().
 *
 * Forks a child process that runs main_loop() for a bounded number of
 * iterations or wall-clock seconds.  When the epoch limit is reached,
 * the child exits cleanly and the parent resets shared state and forks
 * a new epoch child.  Coverage data (kcov bitmap, cmp_hints, minicorpus,
 * edgepair) lives in MAP_SHARED memory and accumulates across epochs.
 *
 * This periodic restart prevents state accumulation (leaked fds, stale
 * mappings, corrupted objects) from degrading fuzzing effectiveness.
 */
static void epoch_loop(void)
{
	unsigned int epoch_nr = 0;
	pid_t epoch_pid;
	int status;

	while (1) {
		epoch_nr++;
		output(0, "Starting epoch %u\n", epoch_nr);

		epoch_pid = fork();
		if (epoch_pid == -1) {
			outputerr("epoch_loop: fork failed: %s\n", strerror(errno));
			return;
		}

		if (epoch_pid == 0) {
			/* Epoch child: become the effective main process. */
			mainpid = getpid();
			setup_main_signals();
			main_loop();
			_exit(set_exit_code(__atomic_load_n(&shm->exit_reason, __ATOMIC_RELAXED)));
		}

		/* Epoch parent: wait for the epoch child to finish. */
		if (waitpid(epoch_pid, &status, 0) == -1) {
			outputerr("epoch_loop: waitpid failed: %s\n", strerror(errno));
			return;
		}

		if (!WIFEXITED(status) || WEXITSTATUS(status) != EXIT_SUCCESS) {
			output(0, "Epoch %u exited abnormally (status=%d), stopping.\n",
				epoch_nr, status);
			return;
		}

		if (__atomic_load_n(&shm->exit_reason, __ATOMIC_RELAXED) != EXIT_EPOCH_DONE) {
			output(0, "Epoch %u ended with reason %s, stopping.\n",
				epoch_nr,
				decode_exit(__atomic_load_n(&shm->exit_reason, __ATOMIC_RELAXED)));
			return;
		}

		output(0, "Epoch %u complete, resetting for next epoch.\n", epoch_nr);
		reset_epoch_state();
	}
}

int main(int argc, char* argv[])
{
	int ret = EXIT_SUCCESS;
	const char taskname[13]="trinity-main";

	outputstd("Trinity " VERSION "  Dave Jones <davej@codemonkey.org.uk>\n");

	setlinebuf(stdout);

	progname = argv[0];

	mainpid = getpid();

    if (getrlimit(RLIMIT_NOFILE, &max_files_rlimit) != 0) {
		max_files_rlimit.rlim_cur = 1024;
		max_files_rlimit.rlim_max = 1024;
	}

	page_size = getpagesize();
	long ncpus = sysconf(_SC_NPROCESSORS_ONLN);
	num_online_cpus = (ncpus > 0) ? (unsigned int)ncpus : 1;
	max_children = num_online_cpus * 4;	/* possibly overridden in params. */

	select_syscall_tables();

	create_shm();

	parse_args(argc, argv);

	init_uids();

	change_tmp_dir();

	init_shm();

	kmsg_monitor_start();

	init_taint_checking();

	if (munge_tables() == false) {
		ret = EXIT_FAILURE;
		goto out;
	}

	if (show_syscall_list == true) {
		dump_syscall_tables();
		goto out;
	}

	if (show_ioctl_list == true) {
		dump_ioctls();
		goto out;
	}

	if (show_unannotated == true) {
		show_unannotated_args();
		goto out;
	}

	init_syscalls();

	do_uid0_check();

	if (do_specific_domain == true)
		find_specific_domain(specific_domain_optarg);

	pids_init();

	fd_hash_init();
	init_object_lists(OBJ_GLOBAL, NULL);

	setup_initial_mappings();

	parse_devices();

	init_global_objects();

	setup_main_signals();

	no_bind_to_cpu = RAND_BOOL();

	prctl(PR_SET_NAME, (unsigned long) &taskname);

	if (open_fds() == false) {
		if (__atomic_load_n(&shm->exit_reason, __ATOMIC_RELAXED) == STILL_RUNNING)
			panic(EXIT_FD_INIT_FAILURE);

		_exit(EXIT_FD_INIT_FAILURE);
	}

	/*
	 * After open_fds() returns no caller adds new global objects, and
	 * children are rejected from add_object() anyway.  Lock the global
	 * object list heads and parallel arrays read-only before forking
	 * the first fuzz child so stray writes from children SIGSEGV at
	 * the source instead of corrupting list pointers the parent (or a
	 * later child) trips over during init_child_mappings().
	 */
	freeze_global_objects();

	if (epoch_iterations || epoch_timeout)
		epoch_loop();
	else
		main_loop();

	destroy_global_objects();

	output(0, "Ran %ld syscalls. Successes: %ld  Failures: %ld\n",
		shm->stats.op_count + sum_local_op_counts(),
		shm->stats.successes, shm->stats.failures);
	if (show_stats == true)
		dump_stats();

	ret = set_exit_code(__atomic_load_n(&shm->exit_reason, __ATOMIC_RELAXED));
out:
	kmsg_monitor_stop();

	exit(ret);
}