diff options
| author | Joey Jiao <quic_jiangenj@quicinc.com> | 2024-05-14 10:51:19 +0800 |
|---|---|---|
| committer | Dmitry Vyukov <dvyukov@google.com> | 2024-05-27 09:44:25 +0000 |
| commit | b75d07e8995d9d6682851c553b23b4d3e9734436 (patch) | |
| tree | 09e80808b88d2f6f576becef41a887eb242f3ce3 /tools/syz-execprog | |
| parent | 339d8cf83c825a88ff6d1c6b5a73e20fffd33010 (diff) | |
all: adapt all cover and sig to 64bit
Taken some arm64 devices for example:
kaslr_offset is diff at bits 12-40, and kernel modules are loaded at 2GB space,
so we have `ffffffd342e10000 T _stext` where uppper 32bit is ffffffd3. However,
if we check modules range, the 1st module is loaded at 0xffffffd2eeb2a000,
while the last module is loaded at 0xffffffd2f42c4000.
We can see the upper 32bits are diff for core kernel and modules.
If we use current 32bits for covered PC, we will get wrong module address
recovered.
So we need to move to 64bit cover and signal:
- change cover/sig to 64bit to fit for syz-executor change
- remove kernel upper base logic as kernel upper base is not a constant when
kaslr enabled for core kernel and modules.
- remove unused pcBase
Diffstat (limited to 'tools/syz-execprog')
| -rw-r--r-- | tools/syz-execprog/execprog.go | 33 |
1 files changed, 1 insertions, 32 deletions
diff --git a/tools/syz-execprog/execprog.go b/tools/syz-execprog/execprog.go index cb51244b3..43146a170 100644 --- a/tools/syz-execprog/execprog.go +++ b/tools/syz-execprog/execprog.go @@ -13,12 +13,10 @@ import ( "math/rand" "os" "runtime" - "strconv" "strings" "sync" "time" - "github.com/google/syzkaller/pkg/cover" "github.com/google/syzkaller/pkg/cover/backend" "github.com/google/syzkaller/pkg/csource" "github.com/google/syzkaller/pkg/db" @@ -125,7 +123,6 @@ func main() { choiceTable = target.BuildChoiceTable(progs, syscalls) } sysTarget := targets.Get(*flagOS, *flagArch) - upperBase := getKernelUpperBase(sysTarget) ctx := &Context{ target: target, progs: progs, @@ -137,7 +134,6 @@ func main() { stress: *flagStress, repeat: *flagRepeat, sysTarget: sysTarget, - upperBase: upperBase, } var wg sync.WaitGroup wg.Add(*flagProcs) @@ -167,7 +163,6 @@ type Context struct { pos int lastPrint time.Time sysTarget *targets.Target - upperBase uint32 } func (ctx *Context) run(pid int) { @@ -296,39 +291,13 @@ func (ctx *Context) printHints(p *prog.Prog, info *flatrpc.ProgInfo) { log.Logf(0, "ncomps=%v ncandidates=%v", ncomps, ncandidates) } -func getKernelUpperBase(target *targets.Target) uint32 { - defaultRet := uint32(0xffffffff) - if target.OS == targets.Linux { - // Read the first 8 bytes from /proc/kallsyms. - f, err := os.Open("/proc/kallsyms") - if err != nil { - log.Logf(1, "could not get kernel fixup address: %v", err) - return defaultRet - } - defer f.Close() - data := make([]byte, 8) - _, err = f.ReadAt(data, 0) - if err != nil { - log.Logf(1, "could not get kernel fixup address: %v", err) - return defaultRet - } - value, err := strconv.ParseUint(string(data), 16, 32) - if err != nil { - log.Logf(1, "could not get kernel fixup address: %v", err) - return defaultRet - } - return uint32(value) - } - return defaultRet -} - func (ctx *Context) dumpCallCoverage(coverFile string, info *flatrpc.CallInfo) { if info == nil || len(info.Cover) == 0 { return } buf := new(bytes.Buffer) for _, pc := range info.Cover { - prev := backend.PreviousInstructionPC(ctx.sysTarget, cover.RestorePC(pc, ctx.upperBase)) + prev := backend.PreviousInstructionPC(ctx.sysTarget, pc) fmt.Fprintf(buf, "0x%x\n", prev) } err := osutil.WriteFile(coverFile, buf.Bytes()) |
