Skip to content

Fix android shmem #3229

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 2 commits into from
Closed

Fix android shmem #3229

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
efd0ea1
Fix android shmem
Evian-Zhang May 15, 2025
ddaff24
Fix silly typo
Evian-Zhang May 15, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
81 changes: 0 additions & 81 deletions libafl_targets/src/android-ashmem.h
View file
Open in desktop

This file was deleted.

42 changes: 40 additions & 2 deletions libafl_targets/src/forkserver.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,11 +9,15 @@ use std::{
use libafl::{
Error,
executors::forkserver::{
FORKSRV_FD, FS_ERROR_SHM_OPEN, FS_NEW_OPT_AUTODTCT, FS_NEW_OPT_MAPSIZE,
FS_NEW_OPT_SHDMEM_FUZZ, FS_NEW_VERSION_MAX, FS_OPT_ERROR, SHM_CMPLOG_ENV_VAR, SHM_ENV_VAR,
FORKSRV_FD, FS_ERROR_SHM_OPEN, FS_NEW_OPT_MAPSIZE,
FS_NEW_OPT_SHDMEM_FUZZ, FS_NEW_VERSION_MAX, FS_OPT_ERROR, SHM_ENV_VAR,
SHM_FUZZ_ENV_VAR,
},
};
#[cfg(feature = "cmplog")]
use libafl::executors::forkserver::SHM_CMPLOG_ENV_VAR;
#[cfg(any(target_os = "linux", target_vendor = "apple"))]
use libafl::executors::forkserver::FS_NEW_OPT_AUTODTCT;
use libafl_bolts::os::{ChildHandle, ForkResult};
use nix::{
sys::signal::{SigHandler, Signal},
Expand Down Expand Up @@ -51,6 +55,7 @@ fn write_to_forkserver(message: &[u8]) -> Result<(), Error> {
}
Ok(())
}
#[cfg(any(target_os = "linux", target_vendor = "apple"))]
fn write_all_to_forkserver(message: &[u8]) -> Result<(), Error> {
let mut remain_len = message.len();
while remain_len > 0 {
Expand Down Expand Up @@ -86,6 +91,30 @@ fn read_u32_from_forkserver() -> Result<u32, Error> {
Ok(u32::from_ne_bytes(buf))
}

#[cfg(target_os = "android")]
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

these guys has nothing to do with forkserver. so i think it should go into libafl_bolts

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, and this is exactly what the above discussions are about: Shall we reuse the logic in libafl_bolt's shmem, and how?🤔 Since we cannot get size properly, it is not a trivial modification.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Let's reuse the logic, add an env to the forkserver in libafl and aflpp, if the env is not set, default to the default of MAX_FILE + sizeof(u32) (see link above)

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sure, make sense. However, I am a bit busy til this weekend. Maybe handle this next week :)

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

let's just make that page-aligned MAX_FILE instead of adding 4 bytes

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nah that's a bad idea for the future

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Inputs might be larger, and everything will have 1 meg hard coded

I mean that's how it is today but it's also bad

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

for that part i don't have strong opinion. what i think is bad is that you are trying to mmap for a non-page aligned size.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Don't think it matters, it's just an extra entry in the page table
The kernel aligns it internally anyway

const ASHMEM_GET_SIZE: core::ffi::c_int = 0x00007704;
#[cfg(target_os = "android")]
unsafe fn android_shmat(shm_id: i32) -> *mut core::ffi::c_void {
let size = unsafe { libc::ioctl(shm_id, ASHMEM_GET_SIZE) };
if size < 0 {
return core::ptr::null_mut();
}
let ptr = unsafe {
libc::mmap(
core::ptr::null_mut(),
size as usize,
libc::PROT_READ | libc::PROT_WRITE,
libc::MAP_SHARED,
shm_id,
0,
)
};
if core::ptr::eq(ptr, libc::MAP_FAILED) {
return core::ptr::null_mut();
}
ptr
}

/// Guard [`map_shared_memory`] is invoked only once
static SHM_MAP_GUARD: OnceLock<()> = OnceLock::new();

Expand All @@ -112,7 +141,10 @@ fn map_shared_memory_internal() -> Result<(), Error> {
write_error_to_forkserver(FS_ERROR_SHM_OPEN)?;
return Err(Error::illegal_argument("Invalid __AFL_SHM_ID value"));
};
#[cfg(not(target_os = "android"))]
let map = unsafe { libc::shmat(shm_id, core::ptr::null(), 0) };
#[cfg(target_os = "android")]
let map = unsafe { android_shmat(shm_id) };
if map.is_null() || core::ptr::eq(map, libc::MAP_FAILED) {
write_error_to_forkserver(FS_ERROR_SHM_OPEN)?;
return Err(Error::illegal_state("shmat for map"));
Expand Down Expand Up @@ -149,7 +181,10 @@ fn map_input_shared_memory_internal() -> Result<(), Error> {
write_error_to_forkserver(FS_ERROR_SHM_OPEN)?;
return Err(Error::illegal_argument("Invalid __AFL_SHM_FUZZ_ID value"));
};
#[cfg(not(target_os = "android"))]
let map = unsafe { libc::shmat(shm_id, core::ptr::null(), 0) };
#[cfg(target_os = "android")]
let map = unsafe { android_shmat(shm_id) };
if map.is_null() || core::ptr::eq(map, libc::MAP_FAILED) {
write_error_to_forkserver(FS_ERROR_SHM_OPEN)?;
return Err(Error::illegal_state(
Expand Down Expand Up @@ -193,7 +228,10 @@ fn map_cmplog_shared_memory_internal() -> Result<(), Error> {
write_error_to_forkserver(FS_ERROR_SHM_OPEN)?;
return Err(Error::illegal_argument("Invalid __AFL_CMPLOG_SHM_ID value"));
};
#[cfg(not(target_os = "android"))]
let map = unsafe { libc::shmat(shm_id, core::ptr::null(), 0) };
#[cfg(target_os = "android")]
let map = unsafe { android_shmat(shm_id) };
if map.is_null() || core::ptr::eq(map, libc::MAP_FAILED) {
write_error_to_forkserver(FS_ERROR_SHM_OPEN)?;
return Err(Error::illegal_state("shmat for map"));
Expand Down
Loading