aboutsummaryrefslogtreecommitdiffstats
path: root/executor
diff options
context:
space:
mode:
authorDmitry Vyukov <dvyukov@google.com>2018-02-19 19:35:04 +0100
committerDmitry Vyukov <dvyukov@google.com>2018-02-19 21:48:20 +0100
commit75a7c5e2d1f09a4a58e7e1f1f4ef0b0f55a33413 (patch)
treed44c2457c44b53192005f0b89cd6633a2a2b0ff9 /executor
parent90fd6503136121e9494761a460898e83bc0b6b3e (diff)
prog: rework address allocation
1. mmap all memory always, without explicit mmap calls in the program. This makes lots of things much easier and removes lots of code. Makes mmap not a special syscall and allows to fuzz without mmap enabled. 2. Change address assignment algorithm. Current algorithm allocates unmapped addresses too frequently and allows collisions between arguments of a single syscall. The new algorithm analyzes actual allocations in the program and places new arguments at unused locations.
Diffstat (limited to 'executor')
-rw-r--r--executor/executor_akaros.cc6
-rw-r--r--executor/executor_bsd.cc3
-rw-r--r--executor/executor_fuchsia.cc3
-rw-r--r--executor/executor_linux.cc6
-rw-r--r--executor/executor_windows.cc4
-rw-r--r--executor/syscalls_akaros.h5
-rw-r--r--executor/syscalls_freebsd.h5
-rw-r--r--executor/syscalls_fuchsia.h10
-rw-r--r--executor/syscalls_linux.h25
-rw-r--r--executor/syscalls_netbsd.h5
-rw-r--r--executor/syscalls_test.h10
-rw-r--r--executor/syscalls_windows.h5
12 files changed, 73 insertions, 14 deletions
diff --git a/executor/executor_akaros.cc b/executor/executor_akaros.cc
index 90b589e77..fc28fb8f7 100644
--- a/executor/executor_akaros.cc
+++ b/executor/executor_akaros.cc
@@ -12,6 +12,8 @@
#include "syscalls_akaros.h"
+#include <sys/mman.h>
+
uint32 output;
int main(int argc, char** argv)
@@ -21,6 +23,10 @@ int main(int argc, char** argv)
return 0;
}
+ if (mmap((void*)SYZ_DATA_OFFSET, SYZ_NUM_PAGES * SYZ_PAGE_SIZE, PROT_READ | PROT_WRITE,
+ MAP_ANON | MAP_PRIVATE | MAP_FIXED, -1, 0) != (void*)SYZ_DATA_OFFSET)
+ fail("mmap of data segment failed");
+
use_temporary_dir();
install_segv_handler();
setup_control_pipes();
diff --git a/executor/executor_bsd.cc b/executor/executor_bsd.cc
index 2500a2a12..ee14d84a6 100644
--- a/executor/executor_bsd.cc
+++ b/executor/executor_bsd.cc
@@ -50,6 +50,9 @@ int main(int argc, char** argv)
output_data = (uint32*)mmap(kOutputDataAddr, kMaxOutput, PROT_READ | PROT_WRITE, MAP_SHARED | MAP_FIXED, kOutFd, 0);
if (output_data != kOutputDataAddr)
fail("mmap of output file failed");
+ if (mmap((void*)SYZ_DATA_OFFSET, SYZ_NUM_PAGES * SYZ_PAGE_SIZE, PROT_READ | PROT_WRITE,
+ MAP_ANON | MAP_PRIVATE | MAP_FIXED, -1, 0) != (void*)SYZ_DATA_OFFSET)
+ fail("mmap of data segment failed");
// Prevent random programs to mess with these fds.
// Due to races in collider mode, a program can e.g. ftruncate one of these fds,
// which will cause fuzzer to crash.
diff --git a/executor/executor_fuchsia.cc b/executor/executor_fuchsia.cc
index bd66762a7..7fad95f4e 100644
--- a/executor/executor_fuchsia.cc
+++ b/executor/executor_fuchsia.cc
@@ -21,6 +21,9 @@ int main(int argc, char** argv)
return 0;
}
+ if (syz_mmap(SYZ_DATA_OFFSET, SYZ_NUM_PAGES * SYZ_PAGE_SIZE) != ZX_OK)
+ fail("mmap of data segment failed");
+
install_segv_handler();
setup_control_pipes();
receive_execute(true);
diff --git a/executor/executor_linux.cc b/executor/executor_linux.cc
index 8fec5ac6d..4ca358231 100644
--- a/executor/executor_linux.cc
+++ b/executor/executor_linux.cc
@@ -56,9 +56,13 @@ int main(int argc, char** argv)
// If it is corrupted ipc package will fail to parse its contents and panic.
// But fuzzer constantly invents new ways of how to currupt the region,
// so we map the region at a (hopefully) hard to guess address surrounded by unmapped pages.
- output_data = (uint32*)mmap(kOutputDataAddr, kMaxOutput, PROT_READ | PROT_WRITE, MAP_SHARED | MAP_FIXED, kOutFd, 0);
+ output_data = (uint32*)mmap(kOutputDataAddr, kMaxOutput,
+ PROT_READ | PROT_WRITE, MAP_SHARED | MAP_FIXED, kOutFd, 0);
if (output_data != kOutputDataAddr)
fail("mmap of output file failed");
+ if (mmap((void*)SYZ_DATA_OFFSET, SYZ_NUM_PAGES * SYZ_PAGE_SIZE, PROT_READ | PROT_WRITE,
+ MAP_ANON | MAP_PRIVATE | MAP_FIXED, -1, 0) != (void*)SYZ_DATA_OFFSET)
+ fail("mmap of data segment failed");
// Prevent random programs to mess with these fds.
// Due to races in collider mode, a program can e.g. ftruncate one of these fds,
// which will cause fuzzer to crash.
diff --git a/executor/executor_windows.cc b/executor/executor_windows.cc
index 778387b42..374151ef2 100644
--- a/executor/executor_windows.cc
+++ b/executor/executor_windows.cc
@@ -23,6 +23,10 @@ int main(int argc, char** argv)
return 0;
}
+ if (VirtualAlloc((void*)SYZ_DATA_OFFSET, SYZ_NUM_PAGES * SYZ_PAGE_SIZE,
+ MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE) != (void*)SYZ_DATA_OFFSET)
+ fail("mmap of data segment failed");
+
setup_control_pipes();
receive_execute(true);
execute_one();
diff --git a/executor/syscalls_akaros.h b/executor/syscalls_akaros.h
index 238b68cc0..90c1f09b9 100644
--- a/executor/syscalls_akaros.h
+++ b/executor/syscalls_akaros.h
@@ -2,7 +2,10 @@
#if defined(__x86_64__) || 0
#define GOARCH "amd64"
-#define SYZ_REVISION "0e5dbbd94e4838b9729df440c4c53e581768eaf8"
+#define SYZ_REVISION "43f665d2468516ae8ffc137aec39649a4a1dc7ce"
+#define SYZ_PAGE_SIZE 4096
+#define SYZ_NUM_PAGES 4096
+#define SYZ_DATA_OFFSET 536870912
unsigned syscall_count = 35;
call_t syscalls[] = {
{"abort_sysc_fd", 33},
diff --git a/executor/syscalls_freebsd.h b/executor/syscalls_freebsd.h
index 7d72d51f1..437c80a37 100644
--- a/executor/syscalls_freebsd.h
+++ b/executor/syscalls_freebsd.h
@@ -2,7 +2,10 @@
#if defined(__x86_64__) || 0
#define GOARCH "amd64"
-#define SYZ_REVISION "8faf3b6e65172d4a9e098d5eda39563a082f8078"
+#define SYZ_REVISION "b41d0c0723ec3704417120a5a63657cc522f14cf"
+#define SYZ_PAGE_SIZE 4096
+#define SYZ_NUM_PAGES 4096
+#define SYZ_DATA_OFFSET 536870912
unsigned syscall_count = 254;
call_t syscalls[] = {
{"accept", 30},
diff --git a/executor/syscalls_fuchsia.h b/executor/syscalls_fuchsia.h
index 59e941d7a..cb7a68a16 100644
--- a/executor/syscalls_fuchsia.h
+++ b/executor/syscalls_fuchsia.h
@@ -2,7 +2,10 @@
#if defined(__x86_64__) || 0
#define GOARCH "amd64"
-#define SYZ_REVISION "16f8d2a14dffe8465559442d33e3ca296f7ea4bf"
+#define SYZ_REVISION "4eadf9151d47a3744fe9277b15a0447970eba0cb"
+#define SYZ_PAGE_SIZE 4096
+#define SYZ_NUM_PAGES 4096
+#define SYZ_DATA_OFFSET 536870912
unsigned syscall_count = 164;
call_t syscalls[] = {
{"chdir", 0, (syscall_t)chdir},
@@ -175,7 +178,10 @@ call_t syscalls[] = {
#if defined(__aarch64__) || 0
#define GOARCH "arm64"
-#define SYZ_REVISION "c04cb066cf7fc135f9f85388423f3e65aedc5028"
+#define SYZ_REVISION "bb0e27a08caeecf468bb53c76ebf97388e4d3c6d"
+#define SYZ_PAGE_SIZE 4096
+#define SYZ_NUM_PAGES 4096
+#define SYZ_DATA_OFFSET 536870912
unsigned syscall_count = 164;
call_t syscalls[] = {
{"chdir", 0, (syscall_t)chdir},
diff --git a/executor/syscalls_linux.h b/executor/syscalls_linux.h
index 0bbab652a..b1dac1c50 100644
--- a/executor/syscalls_linux.h
+++ b/executor/syscalls_linux.h
@@ -2,7 +2,10 @@
#if defined(__i386__) || 0
#define GOARCH "386"
-#define SYZ_REVISION "1d92abf94e3a94a587c23e34ff517226557eb39b"
+#define SYZ_REVISION "fdfb3bacd26e9af78ca89d10c2c2e06726f2b744"
+#define SYZ_PAGE_SIZE 4096
+#define SYZ_NUM_PAGES 4096
+#define SYZ_DATA_OFFSET 536870912
unsigned syscall_count = 1583;
call_t syscalls[] = {
{"accept4", 364},
@@ -1594,7 +1597,10 @@ call_t syscalls[] = {
#if defined(__x86_64__) || 0
#define GOARCH "amd64"
-#define SYZ_REVISION "c063297cc1f7a742899148ea3e480a503975e1a3"
+#define SYZ_REVISION "3b495371d7017730eef962bb58f8674114796711"
+#define SYZ_PAGE_SIZE 4096
+#define SYZ_NUM_PAGES 4096
+#define SYZ_DATA_OFFSET 536870912
unsigned syscall_count = 1636;
call_t syscalls[] = {
{"accept", 43},
@@ -3239,7 +3245,10 @@ call_t syscalls[] = {
#if defined(__arm__) || 0
#define GOARCH "arm"
-#define SYZ_REVISION "2a035864a56374d1ef4eafcffb968f43fd5b075c"
+#define SYZ_REVISION "1da52823d9d718efc3156b97b25ad96b0e8e7ea9"
+#define SYZ_PAGE_SIZE 4096
+#define SYZ_NUM_PAGES 4096
+#define SYZ_DATA_OFFSET 536870912
unsigned syscall_count = 1593;
call_t syscalls[] = {
{"accept", 285},
@@ -4841,7 +4850,10 @@ call_t syscalls[] = {
#if defined(__aarch64__) || 0
#define GOARCH "arm64"
-#define SYZ_REVISION "033a3d40f0ba2f8c5ebeb2a344a44e89db17e105"
+#define SYZ_REVISION "8747be63243fed6597fc673a88611c56b9be61ec"
+#define SYZ_PAGE_SIZE 4096
+#define SYZ_NUM_PAGES 4096
+#define SYZ_DATA_OFFSET 536870912
unsigned syscall_count = 1565;
call_t syscalls[] = {
{"accept", 202},
@@ -6415,7 +6427,10 @@ call_t syscalls[] = {
#if defined(__ppc64__) || defined(__PPC64__) || defined(__powerpc64__) || 0
#define GOARCH "ppc64le"
-#define SYZ_REVISION "c996439d4a7c1dc76b269b6869f8bb2b505550b3"
+#define SYZ_REVISION "1b0002aaf7519f39f849b6abcc3c35add0d6f112"
+#define SYZ_PAGE_SIZE 4096
+#define SYZ_NUM_PAGES 4096
+#define SYZ_DATA_OFFSET 536870912
unsigned syscall_count = 1555;
call_t syscalls[] = {
{"accept", 330},
diff --git a/executor/syscalls_netbsd.h b/executor/syscalls_netbsd.h
index 04c9c6d7a..aa16f0644 100644
--- a/executor/syscalls_netbsd.h
+++ b/executor/syscalls_netbsd.h
@@ -2,7 +2,10 @@
#if defined(__x86_64__) || 0
#define GOARCH "amd64"
-#define SYZ_REVISION "8a10b163677425b6f340b2e4e277358c7c1a4237"
+#define SYZ_REVISION "350c03f12de803ca8775df640249eae7e2425419"
+#define SYZ_PAGE_SIZE 4096
+#define SYZ_NUM_PAGES 4096
+#define SYZ_DATA_OFFSET 536870912
unsigned syscall_count = 188;
call_t syscalls[] = {
{"accept", 30},
diff --git a/executor/syscalls_test.h b/executor/syscalls_test.h
index 13e643dfc..9ea69df00 100644
--- a/executor/syscalls_test.h
+++ b/executor/syscalls_test.h
@@ -2,7 +2,10 @@
#if 0
#define GOARCH "32"
-#define SYZ_REVISION "229a33891b79d4c76384836d58be89caaab83684"
+#define SYZ_REVISION "6f7cae371c55b5afdfbc7f518e21c58894cfce5b"
+#define SYZ_PAGE_SIZE 8192
+#define SYZ_NUM_PAGES 2048
+#define SYZ_DATA_OFFSET 536870912
unsigned syscall_count = 85;
call_t syscalls[] = {
{"mmap", 0, (syscall_t)mmap},
@@ -96,7 +99,10 @@ call_t syscalls[] = {
#if 0
#define GOARCH "64"
-#define SYZ_REVISION "72bf9b428d7ccdf1adbb2ef093b656ca3564ee14"
+#define SYZ_REVISION "e5ba3c9ee8fe997bfacae016e4bbebd8ecb2f573"
+#define SYZ_PAGE_SIZE 4096
+#define SYZ_NUM_PAGES 4096
+#define SYZ_DATA_OFFSET 536870912
unsigned syscall_count = 85;
call_t syscalls[] = {
{"mmap", 0, (syscall_t)mmap},
diff --git a/executor/syscalls_windows.h b/executor/syscalls_windows.h
index c5b61339d..d62aa9d6c 100644
--- a/executor/syscalls_windows.h
+++ b/executor/syscalls_windows.h
@@ -2,7 +2,10 @@
#if defined(_M_X64) || 0
#define GOARCH "amd64"
-#define SYZ_REVISION "5d63c10c1e139f4a33dae8f94809285dae73a415"
+#define SYZ_REVISION "38e754fb8319bf26f8642703cab9d9acbcec5109"
+#define SYZ_PAGE_SIZE 4096
+#define SYZ_NUM_PAGES 4096
+#define SYZ_DATA_OFFSET 536870912
unsigned syscall_count = 2955;
call_t syscalls[] = {
{"AbortDoc", 0, (syscall_t)AbortDoc},
generated by ggit (джигит) mrf-deployment (git 2.46.0) at 2026-03-11 23:56:29 +0000