aboutsummaryrefslogtreecommitdiffstats
path: root/executor
diff options
context:
space:
mode:
authorDmitry Vyukov <dvyukov@google.com>2018-12-27 13:08:02 +0100
committerDmitry Vyukov <dvyukov@google.com>2018-12-27 13:11:57 +0100
commit2b084c988691b067fb5b28a5f9f7693c27670d18 (patch)
tree8e0e93bb9bfcc47e31418f00b1af4a168e8878fb /executor
parent43cf01dd41b16b2aa2840291391031cf0b56b950 (diff)
pkg/csource: use 0 for missing syscall args
We don't specify trailing unused args for some syscalls (e.g. ioctl that does not use its arg). Executor always filled tailing unsed args with 0's but pkg/csource didn't. Some such syscalls actually check that the unsed arg is 0 and as the result failed with C repro. We could statically check and eliminate all such cases, but it turns out the warning fires in 1500+ cases: https://gist.githubusercontent.com/dvyukov/e59ba1d9a211ee32fa0ba94fab86a943/raw/a3ace5a63f7281f0298f51ea9842ead1e4713418/gistfile1.txt So instead fill such args with 0's in pkg/csource too.
Diffstat (limited to 'executor')
-rw-r--r--executor/common_test.h30
-rw-r--r--executor/defs.h26
-rw-r--r--executor/syscalls.h12
3 files changed, 55 insertions, 13 deletions
diff --git a/executor/common_test.h b/executor/common_test.h
index 592fafced..e0390eb68 100644
--- a/executor/common_test.h
+++ b/executor/common_test.h
@@ -51,6 +51,36 @@ static long syz_compare(long want, long want_len, long got, long got_len)
}
#endif
+#if SYZ_EXECUTOR || __NR_syz_compare_int
+#include <errno.h>
+#include <stdarg.h>
+
+// syz_compare_int$4(n const[2], v0 intptr, v1 intptr, v2 intptr, v3 intptr)
+static long syz_compare_int(long n, ...)
+{
+ va_list args;
+ va_start(args, n);
+ long v0 = va_arg(args, long);
+ long v1 = va_arg(args, long);
+ long v2 = va_arg(args, long);
+ long v3 = va_arg(args, long);
+ va_end(args);
+ if (n < 2 || n > 4)
+ return errno = E2BIG, -1;
+ if (n <= 2 && v2 != 0)
+ return errno = EFAULT, -1;
+ if (n <= 3 && v3 != 0)
+ return errno = EFAULT, -1;
+ if (v0 != v1)
+ return errno = EINVAL, -1;
+ if (n > 2 && v0 != v2)
+ return errno = EINVAL, -1;
+ if (n > 3 && v0 != v3)
+ return errno = EINVAL, -1;
+ return 0;
+}
+#endif
+
#if SYZ_EXECUTOR || SYZ_SANDBOX_NONE
static void loop();
static int do_sandbox_none(void)
diff --git a/executor/defs.h b/executor/defs.h
index 9a64c14c6..ab9b6f61a 100644
--- a/executor/defs.h
+++ b/executor/defs.h
@@ -5,7 +5,7 @@
#if GOARCH_amd64
#define GOARCH "amd64"
-#define SYZ_REVISION "f9824f5b26bc0ee36bc1e6debd6e8a8d6eee33ab"
+#define SYZ_REVISION "1b67f82f23d2ba92433b4f6bc3458ce1478d960c"
#define SYZ_EXECUTOR_USES_FORK_SERVER 1
#define SYZ_EXECUTOR_USES_SHMEM 0
#define SYZ_PAGE_SIZE 4096
@@ -20,7 +20,7 @@
#if GOARCH_amd64
#define GOARCH "amd64"
-#define SYZ_REVISION "a2e13b0f6d7d5dbce4abfd304a9e7a187eb4224e"
+#define SYZ_REVISION "0ac8cd38f3246ddd0a2f5431819157405b8c3624"
#define SYZ_EXECUTOR_USES_FORK_SERVER 1
#define SYZ_EXECUTOR_USES_SHMEM 1
#define SYZ_PAGE_SIZE 4096
@@ -60,7 +60,7 @@
#if GOARCH_386
#define GOARCH "386"
-#define SYZ_REVISION "7aa5d2021c4912f5e8ad8ece188cd61b1a986041"
+#define SYZ_REVISION "346bd490b20910af02a702b7af394ea46343d141"
#define SYZ_EXECUTOR_USES_FORK_SERVER 1
#define SYZ_EXECUTOR_USES_SHMEM 1
#define SYZ_PAGE_SIZE 4096
@@ -70,7 +70,7 @@
#if GOARCH_amd64
#define GOARCH "amd64"
-#define SYZ_REVISION "1a1c33374821580428bd0182dfdd6e8a3e27db8c"
+#define SYZ_REVISION "555da0c9cf19222200e016e53e6687ee1160cecd"
#define SYZ_EXECUTOR_USES_FORK_SERVER 1
#define SYZ_EXECUTOR_USES_SHMEM 1
#define SYZ_PAGE_SIZE 4096
@@ -80,7 +80,7 @@
#if GOARCH_arm
#define GOARCH "arm"
-#define SYZ_REVISION "a952755b0d255be46d4a9c702fbc370ec1cecc58"
+#define SYZ_REVISION "1ed5bc8deb8f143f6e5a011adcd4738e6fe75626"
#define SYZ_EXECUTOR_USES_FORK_SERVER 1
#define SYZ_EXECUTOR_USES_SHMEM 1
#define SYZ_PAGE_SIZE 4096
@@ -90,7 +90,7 @@
#if GOARCH_arm64
#define GOARCH "arm64"
-#define SYZ_REVISION "9dad7b4a6f846956a450e103959543743ff1025f"
+#define SYZ_REVISION "a469bc0b9f84b5ca49dedfa07ebe630b76b0582e"
#define SYZ_EXECUTOR_USES_FORK_SERVER 1
#define SYZ_EXECUTOR_USES_SHMEM 1
#define SYZ_PAGE_SIZE 4096
@@ -100,7 +100,7 @@
#if GOARCH_ppc64le
#define GOARCH "ppc64le"
-#define SYZ_REVISION "39821c0267ee7a09834a5d6cbfe4eb6085d50cfe"
+#define SYZ_REVISION "373d551d95a3b0fe1245a8f9ebd6c469656c6dda"
#define SYZ_EXECUTOR_USES_FORK_SERVER 1
#define SYZ_EXECUTOR_USES_SHMEM 1
#define SYZ_PAGE_SIZE 4096
@@ -115,7 +115,7 @@
#if GOARCH_amd64
#define GOARCH "amd64"
-#define SYZ_REVISION "a1a8ff2d3390c03118bf259766cd9af823ea9f9c"
+#define SYZ_REVISION "ac2fb81fe359721cebd06da0bf1c893a787fc700"
#define SYZ_EXECUTOR_USES_FORK_SERVER 1
#define SYZ_EXECUTOR_USES_SHMEM 1
#define SYZ_PAGE_SIZE 4096
@@ -130,7 +130,7 @@
#if GOARCH_amd64
#define GOARCH "amd64"
-#define SYZ_REVISION "ea9d720726fb2c8bf7bed9d5c405e627d5ce3467"
+#define SYZ_REVISION "2d0d3f664f6bd0c06c5403484fa99bb7d54d240c"
#define SYZ_EXECUTOR_USES_FORK_SERVER 1
#define SYZ_EXECUTOR_USES_SHMEM 1
#define SYZ_PAGE_SIZE 4096
@@ -145,7 +145,7 @@
#if GOARCH_32_fork_shmem
#define GOARCH "32_fork_shmem"
-#define SYZ_REVISION "1cb234b0ee2b1630b831f86086747c3e008060c2"
+#define SYZ_REVISION "3a7d4753ed1b5bb6a280ba2dddd2d21f1fede51e"
#define SYZ_EXECUTOR_USES_FORK_SERVER 1
#define SYZ_EXECUTOR_USES_SHMEM 1
#define SYZ_PAGE_SIZE 4096
@@ -155,7 +155,7 @@
#if GOARCH_32_shmem
#define GOARCH "32_shmem"
-#define SYZ_REVISION "8da90b7592aadc1f08e0ae1cb56ecb1ce2d0ad38"
+#define SYZ_REVISION "cb9a1b4377b1cb70d140ff4c857f7780d1b3485b"
#define SYZ_EXECUTOR_USES_FORK_SERVER 0
#define SYZ_EXECUTOR_USES_SHMEM 1
#define SYZ_PAGE_SIZE 8192
@@ -165,7 +165,7 @@
#if GOARCH_64
#define GOARCH "64"
-#define SYZ_REVISION "d81730cda36dc2946536413b33737c5635fabb71"
+#define SYZ_REVISION "fc38ddf141f39b7a0204ba59ff4eeb844fbd72d6"
#define SYZ_EXECUTOR_USES_FORK_SERVER 0
#define SYZ_EXECUTOR_USES_SHMEM 0
#define SYZ_PAGE_SIZE 4096
@@ -175,7 +175,7 @@
#if GOARCH_64_fork
#define GOARCH "64_fork"
-#define SYZ_REVISION "8c3363b9502e6df103438d98f573e2ef70ab34f2"
+#define SYZ_REVISION "ca36699a1e8e19e01f848fa7815278bea91ef165"
#define SYZ_EXECUTOR_USES_FORK_SERVER 1
#define SYZ_EXECUTOR_USES_SHMEM 0
#define SYZ_PAGE_SIZE 8192
diff --git a/executor/syscalls.h b/executor/syscalls.h
index 111ed07de..2de8beca6 100644
--- a/executor/syscalls.h
+++ b/executor/syscalls.h
@@ -13800,6 +13800,9 @@ const call_t syscalls[] = {
#if GOARCH_32_fork_shmem
const call_t syscalls[] = {
{"syz_compare", 0, (syscall_t)syz_compare},
+ {"syz_compare_int$2", 0, (syscall_t)syz_compare_int},
+ {"syz_compare_int$3", 0, (syscall_t)syz_compare_int},
+ {"syz_compare_int$4", 0, (syscall_t)syz_compare_int},
{"syz_errno", 0, (syscall_t)syz_errno},
{"syz_execute_func", 0, (syscall_t)syz_execute_func},
{"syz_mmap", 0, (syscall_t)syz_mmap},
@@ -13810,6 +13813,9 @@ const call_t syscalls[] = {
#if GOARCH_32_shmem
const call_t syscalls[] = {
{"syz_compare", 0, (syscall_t)syz_compare},
+ {"syz_compare_int$2", 0, (syscall_t)syz_compare_int},
+ {"syz_compare_int$3", 0, (syscall_t)syz_compare_int},
+ {"syz_compare_int$4", 0, (syscall_t)syz_compare_int},
{"syz_errno", 0, (syscall_t)syz_errno},
{"syz_execute_func", 0, (syscall_t)syz_execute_func},
{"syz_mmap", 0, (syscall_t)syz_mmap},
@@ -13842,6 +13848,9 @@ const call_t syscalls[] = {
{"serialize0", 0},
{"serialize1", 0},
{"syz_compare", 0, (syscall_t)syz_compare},
+ {"syz_compare_int$2", 0, (syscall_t)syz_compare_int},
+ {"syz_compare_int$3", 0, (syscall_t)syz_compare_int},
+ {"syz_compare_int$4", 0, (syscall_t)syz_compare_int},
{"syz_errno", 0, (syscall_t)syz_errno},
{"syz_execute_func", 0, (syscall_t)syz_execute_func},
{"syz_mmap", 0, (syscall_t)syz_mmap},
@@ -13942,6 +13951,9 @@ const call_t syscalls[] = {
#if GOARCH_64_fork
const call_t syscalls[] = {
{"syz_compare", 0, (syscall_t)syz_compare},
+ {"syz_compare_int$2", 0, (syscall_t)syz_compare_int},
+ {"syz_compare_int$3", 0, (syscall_t)syz_compare_int},
+ {"syz_compare_int$4", 0, (syscall_t)syz_compare_int},
{"syz_errno", 0, (syscall_t)syz_errno},
{"syz_execute_func", 0, (syscall_t)syz_execute_func},
{"syz_mmap", 0, (syscall_t)syz_mmap},