diff options
| author | Dmitry Vyukov <dvyukov@google.com> | 2018-12-27 13:08:02 +0100 |
|---|---|---|
| committer | Dmitry Vyukov <dvyukov@google.com> | 2018-12-27 13:11:57 +0100 |
| commit | 2b084c988691b067fb5b28a5f9f7693c27670d18 (patch) | |
| tree | 8e0e93bb9bfcc47e31418f00b1af4a168e8878fb /executor | |
| parent | 43cf01dd41b16b2aa2840291391031cf0b56b950 (diff) | |
pkg/csource: use 0 for missing syscall args
We don't specify trailing unused args for some syscalls
(e.g. ioctl that does not use its arg).
Executor always filled tailing unsed args with 0's
but pkg/csource didn't. Some such syscalls actually
check that the unsed arg is 0 and as the result failed with C repro.
We could statically check and eliminate all such cases,
but it turns out the warning fires in 1500+ cases:
https://gist.githubusercontent.com/dvyukov/e59ba1d9a211ee32fa0ba94fab86a943/raw/a3ace5a63f7281f0298f51ea9842ead1e4713418/gistfile1.txt
So instead fill such args with 0's in pkg/csource too.
Diffstat (limited to 'executor')
| -rw-r--r-- | executor/common_test.h | 30 | ||||
| -rw-r--r-- | executor/defs.h | 26 | ||||
| -rw-r--r-- | executor/syscalls.h | 12 |
3 files changed, 55 insertions, 13 deletions
diff --git a/executor/common_test.h b/executor/common_test.h index 592fafced..e0390eb68 100644 --- a/executor/common_test.h +++ b/executor/common_test.h @@ -51,6 +51,36 @@ static long syz_compare(long want, long want_len, long got, long got_len) } #endif +#if SYZ_EXECUTOR || __NR_syz_compare_int +#include <errno.h> +#include <stdarg.h> + +// syz_compare_int$4(n const[2], v0 intptr, v1 intptr, v2 intptr, v3 intptr) +static long syz_compare_int(long n, ...) +{ + va_list args; + va_start(args, n); + long v0 = va_arg(args, long); + long v1 = va_arg(args, long); + long v2 = va_arg(args, long); + long v3 = va_arg(args, long); + va_end(args); + if (n < 2 || n > 4) + return errno = E2BIG, -1; + if (n <= 2 && v2 != 0) + return errno = EFAULT, -1; + if (n <= 3 && v3 != 0) + return errno = EFAULT, -1; + if (v0 != v1) + return errno = EINVAL, -1; + if (n > 2 && v0 != v2) + return errno = EINVAL, -1; + if (n > 3 && v0 != v3) + return errno = EINVAL, -1; + return 0; +} +#endif + #if SYZ_EXECUTOR || SYZ_SANDBOX_NONE static void loop(); static int do_sandbox_none(void) diff --git a/executor/defs.h b/executor/defs.h index 9a64c14c6..ab9b6f61a 100644 --- a/executor/defs.h +++ b/executor/defs.h @@ -5,7 +5,7 @@ #if GOARCH_amd64 #define GOARCH "amd64" -#define SYZ_REVISION "f9824f5b26bc0ee36bc1e6debd6e8a8d6eee33ab" +#define SYZ_REVISION "1b67f82f23d2ba92433b4f6bc3458ce1478d960c" #define SYZ_EXECUTOR_USES_FORK_SERVER 1 #define SYZ_EXECUTOR_USES_SHMEM 0 #define SYZ_PAGE_SIZE 4096 @@ -20,7 +20,7 @@ #if GOARCH_amd64 #define GOARCH "amd64" -#define SYZ_REVISION "a2e13b0f6d7d5dbce4abfd304a9e7a187eb4224e" +#define SYZ_REVISION "0ac8cd38f3246ddd0a2f5431819157405b8c3624" #define SYZ_EXECUTOR_USES_FORK_SERVER 1 #define SYZ_EXECUTOR_USES_SHMEM 1 #define SYZ_PAGE_SIZE 4096 @@ -60,7 +60,7 @@ #if GOARCH_386 #define GOARCH "386" -#define SYZ_REVISION "7aa5d2021c4912f5e8ad8ece188cd61b1a986041" +#define SYZ_REVISION "346bd490b20910af02a702b7af394ea46343d141" #define SYZ_EXECUTOR_USES_FORK_SERVER 1 #define SYZ_EXECUTOR_USES_SHMEM 1 #define SYZ_PAGE_SIZE 4096 @@ -70,7 +70,7 @@ #if GOARCH_amd64 #define GOARCH "amd64" -#define SYZ_REVISION "1a1c33374821580428bd0182dfdd6e8a3e27db8c" +#define SYZ_REVISION "555da0c9cf19222200e016e53e6687ee1160cecd" #define SYZ_EXECUTOR_USES_FORK_SERVER 1 #define SYZ_EXECUTOR_USES_SHMEM 1 #define SYZ_PAGE_SIZE 4096 @@ -80,7 +80,7 @@ #if GOARCH_arm #define GOARCH "arm" -#define SYZ_REVISION "a952755b0d255be46d4a9c702fbc370ec1cecc58" +#define SYZ_REVISION "1ed5bc8deb8f143f6e5a011adcd4738e6fe75626" #define SYZ_EXECUTOR_USES_FORK_SERVER 1 #define SYZ_EXECUTOR_USES_SHMEM 1 #define SYZ_PAGE_SIZE 4096 @@ -90,7 +90,7 @@ #if GOARCH_arm64 #define GOARCH "arm64" -#define SYZ_REVISION "9dad7b4a6f846956a450e103959543743ff1025f" +#define SYZ_REVISION "a469bc0b9f84b5ca49dedfa07ebe630b76b0582e" #define SYZ_EXECUTOR_USES_FORK_SERVER 1 #define SYZ_EXECUTOR_USES_SHMEM 1 #define SYZ_PAGE_SIZE 4096 @@ -100,7 +100,7 @@ #if GOARCH_ppc64le #define GOARCH "ppc64le" -#define SYZ_REVISION "39821c0267ee7a09834a5d6cbfe4eb6085d50cfe" +#define SYZ_REVISION "373d551d95a3b0fe1245a8f9ebd6c469656c6dda" #define SYZ_EXECUTOR_USES_FORK_SERVER 1 #define SYZ_EXECUTOR_USES_SHMEM 1 #define SYZ_PAGE_SIZE 4096 @@ -115,7 +115,7 @@ #if GOARCH_amd64 #define GOARCH "amd64" -#define SYZ_REVISION "a1a8ff2d3390c03118bf259766cd9af823ea9f9c" +#define SYZ_REVISION "ac2fb81fe359721cebd06da0bf1c893a787fc700" #define SYZ_EXECUTOR_USES_FORK_SERVER 1 #define SYZ_EXECUTOR_USES_SHMEM 1 #define SYZ_PAGE_SIZE 4096 @@ -130,7 +130,7 @@ #if GOARCH_amd64 #define GOARCH "amd64" -#define SYZ_REVISION "ea9d720726fb2c8bf7bed9d5c405e627d5ce3467" +#define SYZ_REVISION "2d0d3f664f6bd0c06c5403484fa99bb7d54d240c" #define SYZ_EXECUTOR_USES_FORK_SERVER 1 #define SYZ_EXECUTOR_USES_SHMEM 1 #define SYZ_PAGE_SIZE 4096 @@ -145,7 +145,7 @@ #if GOARCH_32_fork_shmem #define GOARCH "32_fork_shmem" -#define SYZ_REVISION "1cb234b0ee2b1630b831f86086747c3e008060c2" +#define SYZ_REVISION "3a7d4753ed1b5bb6a280ba2dddd2d21f1fede51e" #define SYZ_EXECUTOR_USES_FORK_SERVER 1 #define SYZ_EXECUTOR_USES_SHMEM 1 #define SYZ_PAGE_SIZE 4096 @@ -155,7 +155,7 @@ #if GOARCH_32_shmem #define GOARCH "32_shmem" -#define SYZ_REVISION "8da90b7592aadc1f08e0ae1cb56ecb1ce2d0ad38" +#define SYZ_REVISION "cb9a1b4377b1cb70d140ff4c857f7780d1b3485b" #define SYZ_EXECUTOR_USES_FORK_SERVER 0 #define SYZ_EXECUTOR_USES_SHMEM 1 #define SYZ_PAGE_SIZE 8192 @@ -165,7 +165,7 @@ #if GOARCH_64 #define GOARCH "64" -#define SYZ_REVISION "d81730cda36dc2946536413b33737c5635fabb71" +#define SYZ_REVISION "fc38ddf141f39b7a0204ba59ff4eeb844fbd72d6" #define SYZ_EXECUTOR_USES_FORK_SERVER 0 #define SYZ_EXECUTOR_USES_SHMEM 0 #define SYZ_PAGE_SIZE 4096 @@ -175,7 +175,7 @@ #if GOARCH_64_fork #define GOARCH "64_fork" -#define SYZ_REVISION "8c3363b9502e6df103438d98f573e2ef70ab34f2" +#define SYZ_REVISION "ca36699a1e8e19e01f848fa7815278bea91ef165" #define SYZ_EXECUTOR_USES_FORK_SERVER 1 #define SYZ_EXECUTOR_USES_SHMEM 0 #define SYZ_PAGE_SIZE 8192 diff --git a/executor/syscalls.h b/executor/syscalls.h index 111ed07de..2de8beca6 100644 --- a/executor/syscalls.h +++ b/executor/syscalls.h @@ -13800,6 +13800,9 @@ const call_t syscalls[] = { #if GOARCH_32_fork_shmem const call_t syscalls[] = { {"syz_compare", 0, (syscall_t)syz_compare}, + {"syz_compare_int$2", 0, (syscall_t)syz_compare_int}, + {"syz_compare_int$3", 0, (syscall_t)syz_compare_int}, + {"syz_compare_int$4", 0, (syscall_t)syz_compare_int}, {"syz_errno", 0, (syscall_t)syz_errno}, {"syz_execute_func", 0, (syscall_t)syz_execute_func}, {"syz_mmap", 0, (syscall_t)syz_mmap}, @@ -13810,6 +13813,9 @@ const call_t syscalls[] = { #if GOARCH_32_shmem const call_t syscalls[] = { {"syz_compare", 0, (syscall_t)syz_compare}, + {"syz_compare_int$2", 0, (syscall_t)syz_compare_int}, + {"syz_compare_int$3", 0, (syscall_t)syz_compare_int}, + {"syz_compare_int$4", 0, (syscall_t)syz_compare_int}, {"syz_errno", 0, (syscall_t)syz_errno}, {"syz_execute_func", 0, (syscall_t)syz_execute_func}, {"syz_mmap", 0, (syscall_t)syz_mmap}, @@ -13842,6 +13848,9 @@ const call_t syscalls[] = { {"serialize0", 0}, {"serialize1", 0}, {"syz_compare", 0, (syscall_t)syz_compare}, + {"syz_compare_int$2", 0, (syscall_t)syz_compare_int}, + {"syz_compare_int$3", 0, (syscall_t)syz_compare_int}, + {"syz_compare_int$4", 0, (syscall_t)syz_compare_int}, {"syz_errno", 0, (syscall_t)syz_errno}, {"syz_execute_func", 0, (syscall_t)syz_execute_func}, {"syz_mmap", 0, (syscall_t)syz_mmap}, @@ -13942,6 +13951,9 @@ const call_t syscalls[] = { #if GOARCH_64_fork const call_t syscalls[] = { {"syz_compare", 0, (syscall_t)syz_compare}, + {"syz_compare_int$2", 0, (syscall_t)syz_compare_int}, + {"syz_compare_int$3", 0, (syscall_t)syz_compare_int}, + {"syz_compare_int$4", 0, (syscall_t)syz_compare_int}, {"syz_errno", 0, (syscall_t)syz_errno}, {"syz_execute_func", 0, (syscall_t)syz_execute_func}, {"syz_mmap", 0, (syscall_t)syz_mmap}, |
