afl-tmpfs.diff

--- afl-fuzz.c	2018-06-20 15:56:46.816337163 +0300
+++ afl-fuzz.c	2018-06-20 17:21:57.846392733 +0300
@@ -60,6 +60,23 @@
 #  include <sys/sysctl.h>
 #endif /* __APPLE__ || __FreeBSD__ || __OpenBSD__ */
 
+#if defined(__linux__)
+#  include <mntent.h>
+#  include <sys/statfs.h>
+/* Not all Linux distros have linux/magic.h include available where */
+/* TMPFS_MAGIC is defined. */
+#  define TMPFS_MAGIC 0x01021994
+#elif defined(__FreeBSD__) || defined(__OpenBSD__)
+#  include <sys/mount.h>
+#  include <sys/statvfs.h>
+#elif defined(__NetBSD__)
+#  include <sys/statvfs.h>
+#elif defined(__sun)
+#  include <sys/mnttab.h>
+#  include <sys/statvfs.h>
+#  include <sys/vfstab.h>
+#endif /* __linux__ */
+
 /* For systems that have sched_setaffinity; right now just Linux, but one
    can hope... */
 
@@ -82,6 +99,7 @@
 
 EXP_ST u8 *in_dir,                    /* Input directory with test cases  */
           *out_file,                  /* File to fuzz, if any             */
+          *out_file_dir,              /* Directory to write out file      */
           *out_dir,                   /* Working & output directory       */
           *sync_dir,                  /* Synchronization directory        */
           *sync_id,                   /* Fuzzer ID                        */
@@ -142,7 +160,7 @@
 
 static u8  var_bytes[MAP_SIZE];       /* Bytes that appear to be variable */
 
-static s32 shm_id;                    /* ID of the SHM region             */
+static s32 shm_id = -1;               /* ID of the SHM region             */
 
 static volatile u8 stop_soon,         /* Ctrl-C pressed?                  */
                    clear_screen = 1,  /* Window resized?                  */
@@ -223,6 +241,12 @@
 
 static FILE* plot_file;               /* Gnuplot output file              */
 
+struct tmpfs_candidate {
+    uint64_t required_fs_free;        /* Free tmpfs space in bytes        */
+    uint64_t fs_free;                 /* Best tmpfs candidate free space  */
+    char fs_path[512];                /* Best tmpfs candidate root        */
+};
+
 struct queue_entry {
 
   u8* fname;                          /* File name for the test case      */
@@ -1196,12 +1220,20 @@
 #endif /* ^__x86_64__ */
 
 
-/* Get rid of shared memory (atexit handler). */
-
-static void remove_shm(void) {
-
-  shmctl(shm_id, IPC_RMID, NULL);
+/* Get rid of shared memory and temporary directories (atexit handler). */
 
+static void cleanup_tmpallocs(void) {
+  if (out_file_dir != NULL && strcmp(out_file_dir, out_dir) != 0) {
+    /* On stdin case we do not have out_file */
+    u8* fn = alloc_printf("%s/.cur_input", out_file_dir);
+    /* Ignore errors */
+    unlink(fn);
+    rmdir(out_file_dir);
+    ck_free(fn);
+  }
+  if (shm_id >= 0) {
+    shmctl(shm_id, IPC_RMID, NULL);
+  }
 }
 
 
@@ -1352,8 +1384,6 @@
 
   if (shm_id < 0) PFATAL("shmget() failed");
 
-  atexit(remove_shm);
-
   shm_str = alloc_printf("%d", shm_id);
 
   /* If somebody is asking us to fuzz instrumented binaries in dumb mode,
@@ -7199,12 +7229,296 @@
 
 }
 
+/* Functions to detect an usable memory based file system. */
+
+static u8 try_create_directory(const u8* path) {
+  const u8* path_end;
+  u8* template_path_end;
+  const char suffix[] = "/.afl-fuzz.XXXXXX";
+  u8 template[sizeof(((struct tmpfs_candidate*)0)->fs_path) + sizeof(suffix)] = {0};
+
+  /* Strip the last slash */
+  path_end = path + strlen(path);
+  while (path < path_end && *(path_end - 1) == '/') {
+    path_end--;
+  }
+  if (path_end == path) {
+    return 0;
+  }
+
+  if (sizeof(template) < (path_end - path) + sizeof(suffix)) {
+    return 0;
+  }
+
+  memcpy(template, path, path_end - path);
+  template_path_end = template + (path_end - path);
+  memcpy(template_path_end, suffix, sizeof(suffix));
+
+  {
+    u8* result = mkdtemp(template);
+    if (result == NULL) {
+      return 0;
+    }
+    rmdir(result);
+  }
+  return 1;
+}
+
+static u8 is_path_tmpfs(const u8* fs_path) {
+#if defined(__linux__)
+  struct statfs stats = {0};
+  if (statfs(fs_path, &stats) != 0) {
+    return 0;
+  }
+  if (stats.f_type == TMPFS_MAGIC) {
+    return 1;
+  }
+#elif defined(__FreeBSD__) || defined(__OpenBSD__)
+  struct statfs stats = {0};
+  if (statfs(fs_path, &stats) != 0) {
+    return 0;
+  }
+  if (strcmp(stats.f_fstypename, "tmpfs") == 0) {
+    return 1;
+  }
+#  ifdef __OpenBSD__
+  if (strcmp(stats.f_fstypename, "mfs") == 0) {
+    return 1;
+  }
+#  endif /* __OpenBSD */
+#elif defined(__NetBSD__)
+  struct statvfs stats = {0};
+  if (statvfs(fs_path, &stats) != 0) {
+    return 0;
+  }
+  if (strcmp(stats.f_fstypename, "tmpfs") == 0) {
+    return 1;
+  }
+#elif defined(__sun)
+  struct statvfs stats = {0};
+  if (statvfs(fs_path, &stats) != 0) {
+    return 0;
+  }
+  if (strcmp(stats.f_basetype, "tmpfs") == 0) {
+    return 1;
+  }
+#endif
+  return 0;
+}
+
+static u64 get_fs_size(const u8* fs_path) {
+#if defined(__linux__)
+  struct statfs stats = {0};
+  statfs(fs_path, &stats);
+  return (u64)stats.f_bavail * (u64)stats.f_frsize;
+#elif defined(__FreeBSD__) || defined(__NetBSD__) || defined(__OpenBSD__)
+  struct statvfs stats = {0};
+  statvfs(fs_path, &stats);
+  return (u64)stats.f_bavail * (u64)stats.f_frsize;
+#elif defined(__sun)
+  struct statvfs stats = {0};
+  statvfs(fs_path, &stats);
+  return (u64)stats.f_bavail * (u64)stats.f_frsize;
+#else
+  return 0;
+#endif
+}
+
+static u64 read_tmpfs_free(const u8* fs_path) {
+  if (!is_path_tmpfs(fs_path)) {
+    return 0;
+  }
+  return get_fs_size(fs_path);
+}
+
+static u8 assign_if_freer_fs_path(
+  const u8* fs_path, struct tmpfs_candidate* largest_candidate) {
+  u64 fs_free = read_tmpfs_free(fs_path);
+  if (fs_free < largest_candidate->required_fs_free) {
+    return 0;
+  }
+  if (fs_free <= largest_candidate->fs_free) {
+    return 0;
+  }
+  if (!try_create_directory(fs_path)) {
+    return 0;
+  }
+  {
+    size_t fs_path_len = strlen(fs_path);
+    if (sizeof(largest_candidate->fs_path) <= fs_path_len) {
+      return 0;
+    }
+    largest_candidate->fs_free = fs_free;
+    memcpy(largest_candidate->fs_path, fs_path, fs_path_len);
+    largest_candidate->fs_path[fs_path_len] = '\0';
+  }
+  return 1;
+}
+
+static void iterate_proc_mounts(const u8* proc_mounts, struct tmpfs_candidate* largest_candidate) {
+  u8 mount_line[512] = "";
+
+  /* Try to figure out other tmpfs locations based on device
+     mountpoints. This is Linux specific thing: */
+  FILE* mounts_fp = fopen(proc_mounts, "r");
+  if (mounts_fp == NULL) {
+    return;
+  }
+
+  while (fgets(mount_line, sizeof(mount_line), mounts_fp) != NULL) {
+    u8* path_end;
+    u8* fs_path = strchr(mount_line, ' ');
+    if (fs_path == NULL) {
+      continue;
+    }
+    fs_path++;
+    path_end = strchr(fs_path, ' ');
+    if (path_end == NULL) {
+      continue;
+    }
+    *path_end = '\0';
+    assign_if_freer_fs_path(fs_path, largest_candidate);
+  }
+
+  fclose(mounts_fp);
+}
+
+static void iterate_getfsstat(struct tmpfs_candidate* largest_candidate) {
+#if defined(__FreeBSD__) || defined(__OpenBSD__)
+  int i;
+  int mounted_fs = getfsstat(NULL, 0, MNT_NOWAIT);
+  int allocated_fs = mounted_fs + 1;
+  struct statfs* fs_list = calloc(allocated_fs, sizeof(struct statfs));
+  if (fs_list == NULL) {
+    return;
+  }
+#  if defined(__FreeBSD__) || defined(__OpenBSD__)
+  int returned_fs = getfsstat(fs_list, sizeof(struct statfs) * allocated_fs, MNT_NOWAIT);
+  const struct statfs* current_fs = fs_list;
+#  elif defined(__NetBSD__)
+  int returned_fs = getvfsstat(fs_list, sizeof(struct statvfs) * allocated_fs, MNT_NOWAIT);
+  const struct statvfs* current_fs = fs_list;
+#  endif
+  if (returned_fs == -1) {
+    free(fs_list);
+    return;
+  }
+  for (i = 0; i < returned_fs; i++, current_fs++) {
+    assign_if_freer_fs_path(current_fs->f_mntonname, largest_candidate);
+  }
+  free(fs_list);
+#else
+  (void)largest_candidate;
+#endif
+}
+
+static void iterate_getmntent(const u8* path, struct tmpfs_candidate* largest_candidate) {
+#if defined(__linux__)
+  struct mntent* mountpoint = NULL;
+  FILE* mnttab = setmntent(path, "r");
+  if (mnttab == NULL) {
+    return;
+  }
+  while ((mountpoint = getmntent(mnttab)) != NULL) {
+    assign_if_freer_fs_path(mountpoint->mnt_dir, largest_candidate);
+  }
+  endmntent(mnttab);
+#elif defined(__sun)
+  struct mnttab mountpoint = {0};
+  struct mnttab tmpfs_mountpoint = { .mnt_fstype = "tmpfs" };
+  FILE* mnttab = fopen(path, "r");
+  if (mnttab == NULL) {
+    return;
+  }
+  while (getmntany(mnttab, &mountpoint, &tmpfs_mountpoint) == 0
+         && mountpoint.mnt_mountp != NULL) {
+    assign_if_freer_fs_path(mountpoint.mnt_mountp, largest_candidate);
+  }
+  fclose(mnttab);
+#else
+  (void)path;
+  (void)largest_candidate;
+#endif
+}
+
+static void iterate_getvfsent(const u8* path, struct tmpfs_candidate* largest_candidate) {
+#if defined(__sun)
+  struct vfstab mountpoint = {0};
+  struct vfstab tmpfs_mountpoint = { .vfs_fstype = "tmpfs" };
+  FILE* vfstab = fopen(path, "r");
+  if (vfstab == NULL) {
+    return;
+  }
+  while (getvfsany(vfstab, &mountpoint, &tmpfs_mountpoint) == 0
+         && mountpoint.vfs_mountp != NULL) {
+    assign_if_freer_fs_path(mountpoint.vfs_mountp, largest_candidate);
+  }
+  fclose(vfstab);
+#else
+  (void)path;
+  (void)largest_candidate;
+#endif
+}
+
+EXP_ST u8* get_tmpfs_workdir(u64 minimum_free_bytes) {
+  size_t i;
+  struct tmpfs_candidate largest_candidate = {0};
+  /* First let's guess couple of locations in case we are inside a */
+  /* container or other faked file system without /proc/ access but */
+  /* possibly with some tmpfs accesses: */
+  const u8* const tmpfs_guesses[] = {
+    "/var/shm",
+    "/dev/shm",
+    "/run/shm",
+    "/tmp"
+  };
+  largest_candidate.required_fs_free = minimum_free_bytes;
+
+  for (i = 0; i < sizeof(tmpfs_guesses) / sizeof(*tmpfs_guesses); i++) {
+    const u8* fs_path = tmpfs_guesses[i];
+    assign_if_freer_fs_path(fs_path, &largest_candidate);
+  }
+
+  /* NetBSD and Linux */
+  iterate_proc_mounts("/proc/mounts", &largest_candidate);
+  /* Just Linux */
+  iterate_proc_mounts("/proc/self/mounts", &largest_candidate);
+
+  iterate_getfsstat(&largest_candidate);
+
+  /* Linux */
+  iterate_getmntent("/etc/mtab", &largest_candidate);
+  iterate_getmntent("/etc/fstab", &largest_candidate);
+  /* SunOS */
+  iterate_getmntent("/etc/mnttab", &largest_candidate);
+
+  iterate_getvfsent("/etc/vfstab", &largest_candidate);
+
+  if (largest_candidate.fs_free == 0) {
+    return NULL;
+  }
+
+  {
+    u8* template = alloc_printf("%s/.afl-fuzz.XXXXXX", largest_candidate.fs_path);
+    u8* result = mkdtemp(template);
+    if (result == NULL) {
+      free(template);
+    }
+    return result;
+  }
+}
 
 /* Setup the output file for fuzzed data, if not using -f. */
 
 EXP_ST void setup_stdio_file(void) {
-
-  u8* fn = alloc_printf("%s/.cur_input", out_dir);
+  u8* fn;
+  out_file_dir = get_tmpfs_workdir(1024 * 1024);
+  if (out_file_dir != NULL) {
+    fn = alloc_printf("%s/.cur_input", out_file_dir);
+  } else {
+    fn = alloc_printf("%s/.cur_input", out_dir);
+    out_file_dir = out_dir;
+  }
 
   unlink(fn); /* Ignore errors */
 
@@ -7505,7 +7819,6 @@
 
 } 
 
-
 /* Detect @@ in args. */
 
 EXP_ST void detect_file_args(char** argv) {
@@ -7525,8 +7838,15 @@
 
       /* If we don't have a file name chosen yet, use a safe default. */
 
-      if (!out_file)
-        out_file = alloc_printf("%s/.cur_input", out_dir);
+      if (!out_file) {
+        out_file_dir = get_tmpfs_workdir(1024 * 1024);
+        if (out_file_dir != NULL) {
+          out_file = alloc_printf("%s/.cur_input", out_file_dir);
+        } else {
+          out_file = alloc_printf("%s/.cur_input", out_dir);
+          out_file_dir = out_dir;
+        }
+      }
 
       /* Be sure that we're always using fully-qualified paths. */
 
@@ -7952,6 +8272,9 @@
   check_cpu_governor();
 
   setup_post();
+
+  atexit(cleanup_tmpallocs);
+
   setup_shm();
   init_count_class16();