Skip to content

Commit 5ee3723

Browse files
WorksButNotTestedWorksButNotTested
authored
Fixes for ASAn (#3308)
* Fix broken Justfile * Rename AsanModule to AsanHostModule * Add asan to publish script
1 parent 0dc6b24 commit 5ee3723

File tree

7 files changed

+91
-36
lines changed

7 files changed

+91
-36
lines changed

‎fuzzers/binary_only/qemu_launcher/src/client.rs

Lines changed: 19 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ use libafl::{
1111
};
1212
use libafl_bolts::{rands::StdRand, tuples::tuple_list};
1313
use libafl_qemu::modules::{
14-
asan::AsanModule, asan_guest::AsanGuestModule, cmplog::CmpLogModule,
14+
asan_guest::AsanGuestModule, asan_host::AsanHostModule, cmplog::CmpLogModule,
1515
utils::filters::StdAddressFilter, DrCovModule, InjectionModule,
1616
};
1717

@@ -138,7 +138,7 @@ impl Client<'_> {
138138
.full_trace(true)
139139
.build(),
140140
unsafe {
141-
AsanModule::builder()
141+
AsanHostModule::builder()
142142
.env(&env)
143143
.filter(asan_filter)
144144
.asan_report()
@@ -167,7 +167,7 @@ impl Client<'_> {
167167
}
168168
} else if is_asan_host {
169169
let modules = tuple_list!(unsafe {
170-
AsanModule::builder()
170+
AsanHostModule::builder()
171171
.env(&env)
172172
.filter(asan_filter)
173173
.asan_report()
@@ -190,7 +190,10 @@ impl Client<'_> {
190190
args,
191191
tuple_list!(
192192
CmpLogModule::default(),
193-
AsanModule::builder().env(&env).filter(asan_filter).build(),
193+
AsanHostModule::builder()
194+
.env(&env)
195+
.filter(asan_filter)
196+
.build(),
194197
injection_module,
195198
),
196199
state,
@@ -200,7 +203,10 @@ impl Client<'_> {
200203
args,
201204
tuple_list!(
202205
CmpLogModule::default(),
203-
AsanModule::builder().env(&env).filter(asan_filter).build()
206+
AsanHostModule::builder()
207+
.env(&env)
208+
.filter(asan_filter)
209+
.build()
204210
),
205211
state,
206212
)
@@ -231,15 +237,21 @@ impl Client<'_> {
231237
instance_builder.build().run(
232238
args,
233239
tuple_list!(
234-
AsanModule::builder().env(&env).filter(asan_filter).build(),
240+
AsanHostModule::builder()
241+
.env(&env)
242+
.filter(asan_filter)
243+
.build(),
235244
injection_module
236245
),
237246
state,
238247
)
239248
} else {
240249
instance_builder.build().run(
241250
args,
242-
tuple_list!(AsanModule::builder().env(&env).filter(asan_filter).build()),
251+
tuple_list!(AsanHostModule::builder()
252+
.env(&env)
253+
.filter(asan_filter)
254+
.build()),
243255
state,
244256
)
245257
}

‎libafl_qemu/libafl_qemu_runner/Justfile

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ build:
77
. {{ DOTENV }}
88
cargo \
99
build \
10-
--package runner \
10+
--package libafl_qemu_runner \
1111
--target x86_64-unknown-linux-gnu \
1212
--profile {{ PROFILE }} \
1313
--target-dir {{ TARGET_DIR }} \
@@ -19,7 +19,7 @@ fix:
1919
. {{ DOTENV }}
2020
cargo \
2121
fix \
22-
--package runner \
22+
--package libafl_qemu_runner \
2323
--target x86_64-unknown-linux-gnu \
2424
--profile {{ PROFILE }} \
2525
--target-dir {{ TARGET_DIR }} \

‎libafl_qemu/libafl_qemu_runner/src/fuzz.rs

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,9 @@ use libafl_qemu::{
66
Emulator, GuestAddr, NopEmulatorDriver, NopSnapshotManager, QemuExitError, QemuInitError,
77
command::NopCommandManager,
88
elf::EasyElf,
9-
modules::{AsanGuestModule, AsanModule, EmulatorModuleTuple, utils::filters::StdAddressFilter},
9+
modules::{
10+
AsanGuestModule, AsanHostModule, EmulatorModuleTuple, utils::filters::StdAddressFilter,
11+
},
1012
};
1113
use log::{error, info};
1214
use thiserror::Error;
@@ -123,7 +125,12 @@ pub fn fuzz() {
123125

124126
let ret = if options.asan_host {
125127
info!("Enabling ASAN");
126-
let modules = tuple_list!(AsanModule::builder().env(&env).filter(asan_filter).build());
128+
let modules = tuple_list!(
129+
AsanHostModule::builder()
130+
.env(&env)
131+
.filter(asan_filter)
132+
.build()
133+
);
127134
info!("Modules: {:#?}", modules);
128135
run(options, modules)
129136
} else if options.asan_guest {

‎libafl_qemu/src/modules/usermode/asan.rs renamed to ‎libafl_qemu/src/modules/usermode/asan_host.rs

Lines changed: 21 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,7 @@ pub const SHADOW_PAGE_MASK: GuestAddr = !(SHADOW_PAGE_SIZE as GuestAddr - 1);
5454
pub const DEFAULT_REDZONE_SIZE: usize = 128;
5555

5656
#[derive(Debug)]
57-
pub struct AsanModule {
57+
pub struct AsanHostModule {
5858
env: Vec<(String, String)>,
5959
enabled: bool,
6060
detect_leaks: bool,
@@ -76,7 +76,7 @@ pub struct AsanGiovese {
7676
pub error_found: bool,
7777
}
7878

79-
pub struct AsanModuleBuilder {
79+
pub struct AsanHostModuleBuilder {
8080
env: Vec<(String, String)>,
8181
detect_leaks: bool,
8282
snapshot: bool,
@@ -240,7 +240,7 @@ impl Debug for AsanGiovese {
240240
}
241241
}
242242

243-
impl AsanModuleBuilder {
243+
impl AsanHostModuleBuilder {
244244
#[must_use]
245245
pub fn new(
246246
env: Vec<(String, String)>,
@@ -351,8 +351,8 @@ impl AsanModuleBuilder {
351351
}
352352

353353
#[must_use]
354-
pub fn build(self) -> AsanModule {
355-
AsanModule::new(
354+
pub fn build(self) -> AsanHostModule {
355+
AsanHostModule::new(
356356
self.env.as_ref(),
357357
self.detect_leaks,
358358
self.snapshot,
@@ -363,7 +363,7 @@ impl AsanModuleBuilder {
363363
}
364364
}
365365

366-
impl Default for AsanModuleBuilder {
366+
impl Default for AsanHostModuleBuilder {
367367
fn default() -> Self {
368368
let env = env::vars()
369369
.filter(|(k, _v)| k != "LD_LIBRARY_PATH")
@@ -379,10 +379,10 @@ impl Default for AsanModuleBuilder {
379379
}
380380
}
381381

382-
impl AsanModule {
382+
impl AsanHostModule {
383383
#[must_use]
384-
pub fn builder() -> AsanModuleBuilder {
385-
AsanModuleBuilder::default()
384+
pub fn builder() -> AsanHostModuleBuilder {
385+
AsanHostModuleBuilder::default()
386386
}
387387

388388
#[must_use]
@@ -967,7 +967,7 @@ impl AsanGiovese {
967967
}
968968
}
969969

970-
impl<I, S> EmulatorModule<I, S> for AsanModule
970+
impl<I, S> EmulatorModule<I, S> for AsanHostModule
971971
where
972972
I: Unpin,
973973
S: Unpin,
@@ -1155,7 +1155,7 @@ where
11551155
}
11561156
}
11571157

1158-
impl HasAddressFilter for AsanModule {
1158+
impl HasAddressFilter for AsanHostModule {
11591159
type AddressFilter = StdAddressFilter;
11601160
fn address_filter(&self) -> &Self::AddressFilter {
11611161
&self.filter
@@ -1175,7 +1175,7 @@ pub fn oncrash_asan<ET, I, S>(
11751175
I: Unpin,
11761176
S: Unpin,
11771177
{
1178-
let h = emulator_modules.get_mut::<AsanModule>().unwrap();
1178+
let h = emulator_modules.get_mut::<AsanHostModule>().unwrap();
11791179
let pc: GuestAddr = qemu.read_reg(Regs::Pc).unwrap();
11801180
h.rt.report(qemu, pc, AsanError::Signal(target_sig));
11811181
}
@@ -1193,7 +1193,7 @@ where
11931193
I: Unpin,
11941194
S: Unpin,
11951195
{
1196-
let h = emulator_modules.get_mut::<AsanModule>().unwrap();
1196+
let h = emulator_modules.get_mut::<AsanHostModule>().unwrap();
11971197
if !h.must_instrument(pc) {
11981198
return None;
11991199
}
@@ -1223,7 +1223,7 @@ pub fn trace_read_asan<ET, I, S, const N: usize>(
12231223
I: Unpin,
12241224
S: Unpin,
12251225
{
1226-
let h = emulator_modules.get_mut::<AsanModule>().unwrap();
1226+
let h = emulator_modules.get_mut::<AsanHostModule>().unwrap();
12271227
h.read::<N>(qemu, id as GuestAddr, addr);
12281228
}
12291229

@@ -1240,7 +1240,7 @@ pub fn trace_read_n_asan<ET, I, S>(
12401240
I: Unpin,
12411241
S: Unpin,
12421242
{
1243-
let h = emulator_modules.get_mut::<AsanModule>().unwrap();
1243+
let h = emulator_modules.get_mut::<AsanHostModule>().unwrap();
12441244
h.read_n(qemu, id as GuestAddr, addr, size);
12451245
}
12461246

@@ -1256,7 +1256,7 @@ pub fn trace_write_asan<ET, I, S, const N: usize>(
12561256
I: Unpin,
12571257
S: Unpin,
12581258
{
1259-
let h = emulator_modules.get_mut::<AsanModule>().unwrap();
1259+
let h = emulator_modules.get_mut::<AsanHostModule>().unwrap();
12601260
h.write::<N>(qemu, id as GuestAddr, addr);
12611261
}
12621262

@@ -1273,7 +1273,7 @@ pub fn trace_write_n_asan<ET, I, S>(
12731273
I: Unpin,
12741274
S: Unpin,
12751275
{
1276-
let h = emulator_modules.get_mut::<AsanModule>().unwrap();
1276+
let h = emulator_modules.get_mut::<AsanHostModule>().unwrap();
12771277
h.read_n(qemu, id as GuestAddr, addr, size);
12781278
}
12791279

@@ -1290,7 +1290,7 @@ where
12901290
I: Unpin,
12911291
S: Unpin,
12921292
{
1293-
let h = emulator_modules.get_mut::<AsanModule>().unwrap();
1293+
let h = emulator_modules.get_mut::<AsanHostModule>().unwrap();
12941294
if !h.must_instrument(pc) {
12951295
return Some(0);
12961296
}
@@ -1321,7 +1321,7 @@ pub fn trace_write_asan_snapshot<ET, I, S, const N: usize>(
13211321
S: Unpin,
13221322
{
13231323
if id != 0 {
1324-
let h = emulator_modules.get_mut::<AsanModule>().unwrap();
1324+
let h = emulator_modules.get_mut::<AsanHostModule>().unwrap();
13251325
h.write::<N>(qemu, id as GuestAddr, addr);
13261326
}
13271327
let h = emulator_modules.get_mut::<SnapshotModule>().unwrap();
@@ -1342,7 +1342,7 @@ pub fn trace_write_n_asan_snapshot<ET, I, S>(
13421342
S: Unpin,
13431343
{
13441344
if id != 0 {
1345-
let h = emulator_modules.get_mut::<AsanModule>().unwrap();
1345+
let h = emulator_modules.get_mut::<AsanHostModule>().unwrap();
13461346
h.read_n(qemu, id as GuestAddr, addr, size);
13471347
}
13481348
let h = emulator_modules.get_mut::<SnapshotModule>().unwrap();
@@ -1370,7 +1370,7 @@ where
13701370
S: Unpin,
13711371
{
13721372
if sys_num == QASAN_FAKESYS_NR {
1373-
let h = emulator_modules.get_mut::<AsanModule>().unwrap();
1373+
let h = emulator_modules.get_mut::<AsanHostModule>().unwrap();
13741374
match QasanAction::try_from(a0).expect("Invalid QASan action number") {
13751375
QasanAction::CheckLoad => {
13761376
let pc: GuestAddr = qemu.read_reg(Regs::Pc).unwrap();

‎libafl_qemu/src/modules/usermode/mod.rs

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,9 +9,9 @@ pub mod snapshot;
99
pub use snapshot::{IntervalSnapshotFilter, SnapshotModule};
1010

1111
#[cfg(not(cpu_target = "hexagon"))]
12-
pub mod asan;
12+
pub mod asan_host;
1313
#[cfg(not(cpu_target = "hexagon"))]
14-
pub use asan::AsanModule;
14+
pub use asan_host::AsanHostModule;
1515

1616
#[cfg(not(cpu_target = "hexagon"))]
1717
pub mod asan_guest;

‎libafl_qemu/src/modules/usermode/snapshot.rs

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ use crate::{
2525
emu::EmulatorModules,
2626
modules::{
2727
EmulatorModule, EmulatorModuleTuple,
28-
asan::AsanModule,
28+
asan_host::AsanHostModule,
2929
utils::filters::{HasAddressFilter, NOP_ADDRESS_FILTER, NopAddressFilter},
3030
},
3131
qemu::{Hook, SyscallHookResult},
@@ -785,7 +785,7 @@ where
785785
where
786786
ET: EmulatorModuleTuple<I, S>,
787787
{
788-
if emulator_modules.get::<AsanModule>().is_none() {
788+
if emulator_modules.get::<AsanHostModule>().is_none() {
789789
// The ASan module, if present, will call the tracer hook for the snapshot helper as opt
790790
emulator_modules.writes(
791791
Hook::Empty,

‎scripts/publish.sh

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -86,3 +86,39 @@ cd ../.. || exit 1
8686
cd libafl_libfuzzer
8787
cargo publish "$@"
8888
cd .. || exit 1
89+
90+
sleep 20
91+
92+
cd libafl_asan
93+
cargo publish "$@"
94+
cd .. || exit 1
95+
96+
sleep 20
97+
98+
cd libafl_asan/libafl_asan_libc
99+
cargo publish "$@"
100+
cd ../.. || exit 1
101+
102+
sleep 20
103+
104+
cd libafl_qemu/libafl_qemu_asan/libafl_qemu_asan_guest
105+
cargo publish "$@"
106+
cd ../../.. || exit 1
107+
108+
sleep 20
109+
110+
cd libafl_qemu/libafl_qemu_asan/libafl_qemu_asan_host
111+
cargo publish "$@"
112+
cd ../../.. || exit 1
113+
114+
sleep 20
115+
116+
cd libafl_qemu/libafl_qemu_asan/libafl_qemu_asan_nolibc
117+
cargo publish "$@"
118+
cd ../../.. || exit 1
119+
120+
sleep 20
121+
122+
cd libafl_qemu/libafl_qemu_runner
123+
cargo publish "$@"
124+
cd ../.. || exit 1

0 commit comments

Comments
 (0)