From f5f96c70a12b94349bb6f431dd4c3cd3a0baf302 Mon Sep 17 00:00:00 2001 From: gong-guilin Date: Thu, 4 Sep 2025 11:29:31 +0800 Subject: [PATCH] fix fuzz crash Signed-off-by: gong-guilin --- .../test/unittest/src/mock_ffrt_handler.cpp | 162 ++++++++++++++++++ test/fuzztest/samgr_fuzzer/BUILD.gn | 2 +- test/fuzztest/samgrcoverage_fuzzer/BUILD.gn | 2 +- test/fuzztest/samgrdumper_fuzzer/BUILD.gn | 2 +- .../systemabilitymanager_fuzzer/BUILD.gn | 2 +- 5 files changed, 166 insertions(+), 4 deletions(-) create mode 100644 services/samgr/native/test/unittest/src/mock_ffrt_handler.cpp diff --git a/services/samgr/native/test/unittest/src/mock_ffrt_handler.cpp b/services/samgr/native/test/unittest/src/mock_ffrt_handler.cpp new file mode 100644 index 00000000..510ca36d --- /dev/null +++ b/services/samgr/native/test/unittest/src/mock_ffrt_handler.cpp @@ -0,0 +1,162 @@ +/* +* Copyright (C) 2025 Huawei Device Co., Ltd. +* Licensed under the Apache License, Version 2.0 (the "License"); +* you may not use this file except in compliance with the License. +* You may obtain a copy of the License at +* +* http://www.apache.org/licenses/LICENSE-2.0 +* +* Unless required by applicable law or agreed to in writing, software +* distributed under the License is distributed on an "AS IS" BASIS, +* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +* See the License for the specific language governing permissions and +* limitations under the License. +*/ + +#include "ffrt_handler.h" + +#include + +#include "sam_log.h" + +namespace OHOS { +using namespace ffrt; +namespace { + constexpr uint64_t CONVERSION_FACTOR = 1000; // ms to us +} + +FFRTHandler::FFRTHandler(const std::string& name) +{ + queue_ = std::make_shared(name.c_str()); +} + +void FFRTHandler::CleanFfrt() +{ + std::unique_lock lock(mutex_); + for (auto iter = taskMap_.begin(); iter != taskMap_.end(); ++iter) { + HILOGI("CleanFfrt taskMap_ %{public}s", iter->first.c_str()); + if (queue_ != nullptr && iter->second != nullptr) { + auto ret = queue_->cancel(iter->second); + if (ret != 0) { + HILOGE("cancel task failed, error code %{public}d", ret); + } + } + iter->second = nullptr; + } + taskMap_.clear(); + if (queue_ != nullptr) { + queue_.reset(); + } +} + +void FFRTHandler::SetFfrt(const std::string& name) +{ + std::unique_lock lock(mutex_); + queue_ = std::make_shared(name.c_str()); +} + +bool FFRTHandler::PostTask(std::function func) +{ + if (!func) { + HILOGE("FFRTHandler post task failed, func is null"); + return false; + } + std::unique_lock lock(mutex_); + if (queue_ == nullptr) { + return false; + } + task_handle handler = queue_->submit_h(func); + if (handler == nullptr) { + HILOGE("FFRTHandler post task failed"); + return false; + } + return true; +} + +bool FFRTHandler::PostTask(std::function func, uint64_t delayTime) +{ + if (!func) { + HILOGE("FFRTHandler post delay task failed, func is null"); + return false; + } + if (delayTime > std::numeric_limits::max() / CONVERSION_FACTOR) { + HILOGE("invalid delay time"); + return false; + } + std::unique_lock lock(mutex_); + if (queue_ == nullptr) { + return false; + } + task_handle handler = queue_->submit_h(func, task_attr().delay(delayTime * CONVERSION_FACTOR)); + if (handler == nullptr) { + HILOGE("FFRTHandler post task failed"); + return false; + } + return true; +} + +bool FFRTHandler::PostTask(std::function func, const std::string& name, uint64_t delayTime) +{ + if (!func) { + HILOGE("FFRTHandler post delay task with name failed, func is null"); + return false; + } + if (delayTime > std::numeric_limits::max() / CONVERSION_FACTOR) { + HILOGE("invalid delay time"); + return false; + } + std::unique_lock lock(mutex_); + if (queue_ == nullptr) { + return false; + } + task_handle handler = queue_->submit_h(func, task_attr().delay(delayTime * CONVERSION_FACTOR)); + if (handler == nullptr) { + HILOGE("FFRTHandler post task failed"); + return false; + } + taskMap_[name] = std::move(handler); + return true; +} + +void FFRTHandler::RemoveTask(const std::string& name) +{ + std::unique_lock lock(mutex_); + auto item = taskMap_.find(name); + if (item == taskMap_.end()) { + HILOGW("rm task %{public}s NF", name.c_str()); + return; + } + if (queue_ == nullptr) { + return; + } + if (item->second != nullptr) { + auto ret = queue_->cancel(item->second); + if (ret != 0) { + HILOGE("cancel task failed, error code %{public}d", ret); + } + } + taskMap_.erase(name); +} + +void FFRTHandler::DelTask(const std::string& name) +{ + std::unique_lock lock(mutex_); + auto item = taskMap_.find(name); + if (item == taskMap_.end()) { + HILOGW("del task %{public}s NF", name.c_str()); + return; + } + HILOGD("erase task %{public}s ", name.c_str()); + taskMap_.erase(name); +} + +bool FFRTHandler::HasInnerEvent(const std::string name) +{ + std::unique_lock lock(mutex_); + auto item = taskMap_.find(name); + if (item == taskMap_.end()) { + return false; + } + return true; +} +} // namespace OHOS \ No newline at end of file diff --git a/test/fuzztest/samgr_fuzzer/BUILD.gn b/test/fuzztest/samgr_fuzzer/BUILD.gn index daae3343..96dee95d 100644 --- a/test/fuzztest/samgr_fuzzer/BUILD.gn +++ b/test/fuzztest/samgr_fuzzer/BUILD.gn @@ -151,7 +151,6 @@ foreach(item, samgr_fuzztests) { "${samgr_services_dir}/source/collect/device_timed_collect.cpp", "${samgr_services_dir}/source/collect/icollect_plugin.cpp", "${samgr_services_dir}/source/collect/ref_count_collect.cpp", - "${samgr_services_dir}/source/ffrt_handler.cpp", "${samgr_services_dir}/source/memory_guard.cpp", "${samgr_services_dir}/source/rpc_callback_imp.cpp", "${samgr_services_dir}/source/samgr_time_handler.cpp", @@ -163,6 +162,7 @@ foreach(item, samgr_fuzztests) { "${samgr_services_dir}/source/system_ability_manager_stub.cpp", "${samgr_services_dir}/source/system_ability_manager_util.cpp", "${samgr_services_dir}/test/unittest/src/mock_accesstoken_kit.cpp", + "${samgr_services_dir}/test/unittest/src/mock_ffrt_handler.cpp", "${samgr_services_dir}/test/unittest/src/mock_permission.cpp", "src/fuzztest_utils.cpp", item.source, diff --git a/test/fuzztest/samgrcoverage_fuzzer/BUILD.gn b/test/fuzztest/samgrcoverage_fuzzer/BUILD.gn index 141bd7ca..b0b8b62f 100644 --- a/test/fuzztest/samgrcoverage_fuzzer/BUILD.gn +++ b/test/fuzztest/samgrcoverage_fuzzer/BUILD.gn @@ -54,7 +54,6 @@ ohos_fuzztest("SamgrCoverageFuzzTest") { "${samgr_services_dir}/source/collect/device_status_collect_manager.cpp", "${samgr_services_dir}/source/collect/device_timed_collect.cpp", "${samgr_services_dir}/source/collect/icollect_plugin.cpp", - "${samgr_services_dir}/source/ffrt_handler.cpp", "${samgr_services_dir}/source/memory_guard.cpp", "${samgr_services_dir}/source/rpc_callback_imp.cpp", "${samgr_services_dir}/source/samgr_time_handler.cpp", @@ -66,6 +65,7 @@ ohos_fuzztest("SamgrCoverageFuzzTest") { "${samgr_services_dir}/source/system_ability_manager_stub.cpp", "${samgr_services_dir}/source/system_ability_manager_util.cpp", "${samgr_services_dir}/test/unittest/src/itest_transaction_service.cpp", + "${samgr_services_dir}/test/unittest/src/mock_ffrt_handler.cpp", "${samgr_services_dir}/test/unittest/src/mock_permission.cpp", "${samgr_services_dir}/test/unittest/src/sa_status_change_mock.cpp", "samgrcoverage_fuzzer.cpp", diff --git a/test/fuzztest/samgrdumper_fuzzer/BUILD.gn b/test/fuzztest/samgrdumper_fuzzer/BUILD.gn index 892965e2..eea1a870 100644 --- a/test/fuzztest/samgrdumper_fuzzer/BUILD.gn +++ b/test/fuzztest/samgrdumper_fuzzer/BUILD.gn @@ -54,7 +54,6 @@ ohos_fuzztest("SamgrDumperFuzzTest") { "${samgr_services_dir}/source/collect/device_status_collect_manager.cpp", "${samgr_services_dir}/source/collect/device_timed_collect.cpp", "${samgr_services_dir}/source/collect/icollect_plugin.cpp", - "${samgr_services_dir}/source/ffrt_handler.cpp", "${samgr_services_dir}/source/memory_guard.cpp", "${samgr_services_dir}/source/rpc_callback_imp.cpp", "${samgr_services_dir}/source/samgr_time_handler.cpp", @@ -65,6 +64,7 @@ ohos_fuzztest("SamgrDumperFuzzTest") { "${samgr_services_dir}/source/system_ability_manager_dumper.cpp", "${samgr_services_dir}/source/system_ability_manager_stub.cpp", "${samgr_services_dir}/source/system_ability_manager_util.cpp", + "${samgr_services_dir}/test/unittest/src/mock_ffrt_handler.cpp", "${samgr_services_dir}/test/unittest/src/mock_permission.cpp", "${samgr_services_dir}/test/unittest/src/sa_status_change_mock.cpp", "samgrdumper_fuzzer.cpp", diff --git a/test/fuzztest/systemabilitymanager_fuzzer/BUILD.gn b/test/fuzztest/systemabilitymanager_fuzzer/BUILD.gn index 0fdc4eb5..9d427bb5 100644 --- a/test/fuzztest/systemabilitymanager_fuzzer/BUILD.gn +++ b/test/fuzztest/systemabilitymanager_fuzzer/BUILD.gn @@ -53,7 +53,6 @@ ohos_fuzztest("SystemAbilityManagerFuzzTest") { "${samgr_services_dir}/source/collect/device_timed_collect.cpp", "${samgr_services_dir}/source/collect/icollect_plugin.cpp", "${samgr_services_dir}/source/collect/ref_count_collect.cpp", - "${samgr_services_dir}/source/ffrt_handler.cpp", "${samgr_services_dir}/source/memory_guard.cpp", "${samgr_services_dir}/source/samgr_time_handler.cpp", "${samgr_services_dir}/source/schedule/system_ability_event_handler.cpp", @@ -63,6 +62,7 @@ ohos_fuzztest("SystemAbilityManagerFuzzTest") { "${samgr_services_dir}/source/system_ability_manager_dumper.cpp", "${samgr_services_dir}/source/system_ability_manager_stub.cpp", "${samgr_services_dir}/source/system_ability_manager_util.cpp", + "${samgr_services_dir}/test/unittest/src/mock_ffrt_handler.cpp", "//foundation/systemabilitymgr/samgr/services/dfx/source/hisysevent_adapter.cpp", "//foundation/systemabilitymgr/samgr/services/samgr/native/source/ability_death_recipient.cpp", "//foundation/systemabilitymgr/samgr/services/samgr/native/source/rpc_callback_imp.cpp", -- Gitee