add crash exit request.

call crash exit request on crashing signal in usermode.

Author: rmalmain

include/libafl/exit.h

@@ -14,7 +14,8 @@ enum libafl_exit_reason_kind {
     INTERNAL = 0,
     BREAKPOINT = 1,
     CUSTOM_INSN = 2,
-    TIMEOUT = 3,
+    CRASH = 3,
+    TIMEOUT = 4,
 };
 
 enum libafl_custom_insn_kind {
@@ -39,6 +40,10 @@ struct libafl_exit_reason_custom_insn {
     enum libafl_custom_insn_kind kind;
 };
 
+// A timeout occured and we were asked to exit on timeout
+struct libafl_exit_reason_crash {
+};
+
 // A timeout occured and we were asked to exit on timeout
 struct libafl_exit_reason_timeout {
 };
@@ -52,6 +57,7 @@ struct libafl_exit_reason {
         struct libafl_exit_reason_breakpoint breakpoint; // kind == BREAKPOINT
         struct libafl_exit_reason_custom_insn
             custom_insn;                           // kind == CUSTOM_INSN
+        struct libafl_exit_reason_crash crash; // kind == CRASH
         struct libafl_exit_reason_timeout timeout; // kind == TIMEOUT
     } data;
 };
@@ -74,9 +80,7 @@ void libafl_exit_request_internal(CPUState* cpu, uint64_t pc,
 void libafl_exit_request_breakpoint(CPUState* cpu, target_ulong pc);
 void libafl_exit_request_custom_insn(CPUState* cpu, target_ulong pc,
                                      enum libafl_custom_insn_kind kind);
-
-#ifndef CONFIG_USER_ONLY
+void libafl_exit_request_crash(void);
 void libafl_exit_request_timeout(void);
-#endif
 
 struct libafl_exit_reason* libafl_get_exit_reason(void);

libafl/exit.c

@@ -126,6 +126,18 @@ void libafl_exit_request_breakpoint(CPUState* cpu, target_ulong pc)
     prepare_qemu_exit(cpu, pc);
 }
 
+void libafl_exit_request_crash(void)
+{
+    CPUClass* cc = CPU_GET_CLASS(current_cpu);
+
+    expected_exit = true;
+    last_exit_reason.kind = CRASH;
+    last_exit_reason.cpu = current_cpu;
+
+    // TODO: put real PC
+    prepare_qemu_exit(current_cpu, cc->get_pc(current_cpu));
+}
+
 #ifndef CONFIG_USER_ONLY
 void libafl_exit_request_timeout(void)
 {

linux-user/signal.c

@@ -38,6 +38,7 @@
 //// --- Begin LibAFL code ---
 
 #include "libafl/user.h"
+#include "libafl/exit.h"
 
 //// --- End LibAFL code ---
 
@@ -1284,7 +1285,10 @@ static void handle_pending_signal(CPUArchState *cpu_env, int sig,
                    sig != TARGET_SIGURG &&
                    sig != TARGET_SIGWINCH &&
                    sig != TARGET_SIGCONT) {
-            dump_core_and_abort(cpu_env, sig);
+//// --- Start LibAFL code ---
+            // dump_core_and_abort(cpu_env, sig);
+            libafl_exit_request_crash();
+//// --- End LibAFL code ---
         }
     } else if (handler == TARGET_SIG_IGN) {
         /* ignore sig */