aboutsummaryrefslogtreecommitdiffstats
path: root/executor/common.h
Commit message (Collapse)AuthorAgeFilesLines
* executor: fail on SEGV during clone()Aleksandr Nogikh2022-01-211-0/+17
| | | | | | | | | | | | | | | As was found out in #2921, fork bombs are still possible in Linux-based instances. One of the possible reasons is described below. An invalid stack can be passed to the clone() call, thus causing it to stumble on an invalid memory access right during returning from the clone() call. This is in turn catched by the NONFAILING() macro and the control actually jumps over it and eventually both the child and the parent continue executing the same code. Prevent it by handling SIGSEGV and SIGBUS differently during the clone process. Co-authored-by: Andrei Vagin <avagin@google.com>
* executor: add extension point for adding non-mainline pseudo-syscallsDmitry Vyukov2022-01-191-0/+2
| | | | | | | | | | Add an empty common_ext.h which is included into executor and C reproducers and can be used to add non-mainline pseudo-syscalls w/o changing any other files (by replacing common_ext.h file). It would be good to finish #2274 which allows to add pseudo-syscalls along with *.txt descriptions, but #2274 is large and there are several open design questions. So add this simple extension point for now.
* executor: move SYSCALL_DEFINES above common_*.h includesAleksandr Nogikh2022-01-131-1/+4
| | | | | Otherwise the pseudo syscalls there won't be able to access those definitions.
* all: replace collide mode by `async` call propertyAleksandr Nogikh2021-12-101-12/+2
| | | | | | | | | | | | | Replace the currently existing straightforward approach to race triggering (that was almost entirely implemented inside syz-executor) with a more flexible one. The `async` call property instructs syz-executor not to block until the call has completed execution and proceed immediately to the next call. The decision on what calls to mark with `async` is made by syz-fuzzer. Ultimately this should let us implement more intelligent race provoking strategies as well as make more fine-grained reproducers.
* executor: setup cgroups onceDmitry Vyukov2021-10-121-0/+3
| | | | | | | Currently we setup cgroups on every test process start (along with sandbox creation). That's unnecessary because that's global per-machine setup. Move cgroup setup into setup section that's executed once per machine from pkg/host.Setup.
* executor: work around clang-format issueDmitry Vyukov2021-10-051-4/+6
| | | | | | | | clang-format mis-formats #elif: https://bugs.llvm.org/show_bug.cgi?id=48664 and then clang fails with: error: misleading indentation; statement is not part of the previous 'if' Split #elif into nested #if/else.
* executor: check for single-line compound statementsDmitry Vyukov2021-10-011-4/+2
| | | | | | Historically the code base does not use single-line compound statements ({} around single-line blocks). But there are few precedents creeped into already. Add a check to keep the code base consistent.
* all: refactor fault injection into call propsAleksandr Nogikh2021-09-221-1/+7
| | | | | | | | | | | | Now that call properties mechanism is implemented, we can refactor fault injection. Unfortunately, it is impossible to remove all traces of the previous apprach. In reprolist and while performing syz-ci jobs, syzkaller still needs to parse the old format. Remove the old prog options-based approach whenever possible and replace it with the use of call properties.
* sys/darwin: initial syscall definitionsPatrick Meyer2021-06-071-1/+1
| | | | Pretty much ripped from freebsd +/- what isn't applicable to darwin.
* executor: initial darwin supportPatrick Meyer2021-05-201-5/+12
|
* sys/linux: add ieee802154 descriptionsDmitry Vyukov2021-02-121-0/+3
|
* executor/common: repair clang complaint about bad indentationGreg Steuck2020-12-301-1/+2
| | | | | dashboard link: https://syzkaller.appspot.com/bug?extid=38fe37bc451a42e6c9a4 Reported-by: syzbot+38fe37bc451a42e6c9a4@syzkaller.appspotmail.com
* executor: remove hardcoded timeoutsDmitry Vyukov2020-12-251-6/+12
| | | | | In preparation for making timeouts tunable based on OS/arch/VM/etc de-hardcode all (almost) timeouts in executor.
* pkg/csource: setup sysctl's in C reproducersDmitry Vyukov2020-10-281-0/+3
| | | | | | Sysctl's are not captured as part of reproducers. This can result in failure to reproduce a bug on developer machine. Include sysctl setup as part of C reproducers.
* executor: msvc support syz-executorSuraj K Suresh2020-10-031-3/+17
|
* executor: forbid inlining of 'remove_dir'Alexander Egorenkov2020-09-181-1/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes the issue with gcc 10 on Fedora 32 s390x: In file included from ../../executor/executor.cc:147: ../../executor/common.h: In function ‘void remove_dir(const char*)’: ../../executor/common.h:229:44: error: ‘%s’ directive output may be truncated writing up to 255 bytes into a region of size between 0 and 4095 [-Werror=format-truncation=] 229 | snprintf(filename, sizeof(filename), "%s/%s", dir, ep->d_name); | ^~ ../../executor/common.h:229:11: note: ‘snprintf’ output between 2 and 4352 bytes into a destination of size 4096 229 | snprintf(filename, sizeof(filename), "%s/%s", dir, ep->d_name); ../../executor/common.h:243:1: error: the frame size of 21200 bytes is larger than 16384 bytes [-Werror=frame-larger-than=] 243 | } | ^ cc1plus: all warnings being treated as errors compiler invocation: gcc [-o /tmp/syz-executor383272105 -DGOOS_test=1 -DGOARCH_64_fork=1 -DHOSTGOOS_linux=1 ../../executor/executor.cc -m64 -no-pie -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384] FAIL FAIL github.com/google/syzkaller/pkg/runtest 0.998s FAIL Signed-off-by: Alexander Egorenkov <Alexander.Egorenkov@ibm.com>
* executor: improve opendir(3) error handlingAnton Lindqvist2020-09-121-1/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | While investigating an OpenBSD reproducer[1][2] I discovered the following: * All threads are stuck on the last `sleep(1000000)` syscall in main(), hence no output for the test machine. * Each executor process created in loop() performs one iteration but exits abnormally during the call to remove_dir(). * Calling remove_dir() will eventually invoke itself recursively since one of the executed syscall is `mkdir("./file0", 0)` meaning that it will try to remove the directory created by execute_one(). However, `opendir(3)` fails with `EACCES` due to the permissions passed to `mkdir(2)` is zero. Instead of exiting, trying to remove the problematic directory in a best effort manner makes the reproducer continue executing the generated syscalls. This work around might be considered to narrow. Another option would be to replace the `sleep(1000000)` with `waitpid(-1, NULL, 0)` until ECHILD is hit. [1] https://syzkaller.appspot.com/bug?id=6f7ce2a0536580a94f65f44e478732ec505e88af [2] https://syzkaller.appspot.com/text?tag=ReproC&x=10fd1a71900000
* sys/test/test: add a hanging testDmitry Vyukov2020-09-121-1/+1
| | | | Ensure that we can handle hanging syscalls in all modes.
* executor: warn about C89-style var declarationsDmitry Vyukov2020-08-141-10/+9
| | | | | | | | | | | | | | | | | We generally use the newer C99 var declarations combined with initialization because: - declarations are more local, reduced scope - fewer lines of code - less potential for using uninit vars and other bugs However, we have some relic code from times when we did not understand if we need to stick with C89 or not. Also some external contributions that don't follow style around. Add a static check for C89-style declarations and fix existing precedents. Akaros toolchain uses -std=gnu89 (or something) and does not allow variable declarations inside of for init statement. And we can't switch it to -std=c99 because Akaros headers are C89 themselves. So in common.h we need to declare loop counters outside of for.
* executor: always ignore SIGBUS on FreeBSDMark Johnston2020-08-081-1/+13
| | | | | | | | | | | syz-executor uses a heuristic to help fail closed if an invalid access might corrupt the output region. This heuristic fails on FreeBSD, where SIGBUS is delievered with si_addr equal to address of the faulting instruction, rather than 0 when the fault address cannot be determined (e.g., an amd64 protection fault). Always handle SIGBUS quietly on FreeBSD. This fixes pkg/runtest tests for sys/test/test/nonfailing.
* executor: add some code style checksDmitry Vyukov2020-08-061-1/+1
| | | | | | | Move the test from pkg/csource to executor/ in order to be able to (1) run it on *.cc files, (2) run on unprocessed *.h files, (3) produce line numbers. Add a check for missed space after //.
* executor: remove block commentsDmitry Vyukov2020-08-041-10/+10
| | | | | | | | | 1. We don't generally use /* */ block comments, few precedents we have are inconsistent with the rest of the code. 2. pkg/csource does not strip them from the resulting code. Remove the cases we have and add a test to prevent new ones being added.
* executor: remove NONFAILING from pseudo-syscallsDmitry Vyukov2020-07-151-1/+1
| | | | | | This is not needed anymore afer the previous commit. Fixes #1918
* executor: fix endianness problem in internet checksumAlexander Egorenkov2020-06-191-1/+1
| | | | | | | | | | | | | | | | csum_inet_update does not handle odd number of bytes on big-endian architectures correctly. When calculating the checksum of odd number of bytes, the last byte must be interpreted as LSB on little-endian architectures and as MSB on big-endian ones in a 16-bit half-word. Futhermore, the checksum tests assume that the underlying architecture is always little-endian. When a little-endian machine stores a calculated checksum into memory, then the checksum's bytes are automatically swapped. But this is NOT true on a big-endian architecture. Signed-off-by: Alexander Egorenkov <Alexander.Egorenkov@ibm.com>
* sys/netbsd: add support for fault injection (#1817)m00nbsd2020-06-111-1/+1
|
* executor: fix typo (#1737)Michael Tüxen2020-05-131-1/+1
|
* executor: fix #ifdef condition for remove_dir()Michael Tuexen2020-05-131-1/+1
|
* csource, executor: add usb emulation featureAndrey Konovalov2020-04-031-0/+3
| | | | | | | | | The feature gets enabled when /dev/raw-gadget is present and accessible. With this feature enabled, executor will do chmod 0666 /dev/raw-gadget on startup, which makes it possible to do USB fuzzing in setuid and namespace sandboxes. There should be no backwards compatibility issues with syz reproducers that don't explicitly enable this feature, as they currently only work in none sandbox.
* executor, sys/linux: add ath9k usb descriptionsAndrey Konovalov2020-03-131-2/+3
| | | | | | | Among other things this changes timeout for USB programs from 2 to 3 seconds. ath9k fuzzing also requires ath9k firmware to be present, so system images need to be regenerated with the updated script.
* executor: fix clang-tidy warningsDmitry Vyukov2020-03-111-1/+1
|
* executor: rename some macrosDmitry Vyukov2019-11-161-17/+17
| | | | | Rename some macros in preparation for subsequent changes which will align names across the code base.
* executor, host, csource: Add support to enable KCSANMarco Elver2019-10-041-0/+3
| | | | | | | | | By default, the current KCSAN .config does not enable KCSAN during boot, since we encounter races during boot which would prevent syzkaller from ever executing. This adds support to detect if KCSAN is available, and enables it on the fuzzer host.
* all: convert Fuchsia to use "host fuzzing" modeMatthew Dempsky2019-08-271-0/+2
| | | | | | | | | Go support is not a priority for Fuchsia at the moment, so it's preferable to use host fuzzing mode for Fuchsia like currently done for Akaros. This commit basically looks for all the places where there was special logic for OS=="akaros" and extends the same logic for OS=="fuchsia".
* executor: fix procid not declared properly for netbsd (#1358)Andrey Konovalov2019-08-221-1/+1
|
* executor: make errors during thread creation exit zeroAnton Lindqvist2019-07-041-2/+2
| | | | | | | | | | | | | On OpenBSD, the executor sometimes manages to set the memory resource limit 0 causing any following memory allocation to fail. Since threads are potentially created from such a thread which cannot allocate any memory, the executor will exit non-zero which in turn will cause false-positive panics to be reported. For more info see the discussion[1] in PR #1243. Instead, if hitting a fatal error during thread creation exit zero. [1] https://github.com/google/syzkaller/pull/1243
* pkg/csource: generate timeouts for USB syzcallsAndrey Konovalov2019-05-311-1/+2
| | | | This patch only covers per call timeouts, per prog one is not adjusted yet.
* executor: implement support for leak checkingDmitry Vyukov2019-05-201-2/+21
| | | | | | | | | | | | | | | | | | | | | | | | | Leak checking support was half done and did not really work. This is heavy-lifting to make it work. 1. Move leak/fault setup into executor. pkg/host was a wrong place for them because we need then in C repros too. The pkg/host periodic callback functionality did not work too, we need it in executor so that we can reuse it in C repros too. Remove setup/callback functions in pkg/host entirely. 2. Do leak setup/checking in C repros. The way leak checking is invoked is slightly different from fuzzer, but much better then no support at all. At least the checking code is shared. 3. Add Leak option to pkg/csource and -leak flag to syz-prog2c. 4. Don't enalbe leak checking in fuzzer while we are triaging initial corpus. It's toooo slow. 5. Fix pkg/repro to do something more sane for leak bugs. Few other minor fixes here and there.
* all: add basic USB fuzzing supportAndrey Konovalov2019-04-111-2/+3
| | | | | | | | | | | | This commits implements 4 syzcalls: syz_usb_connect, syz_usb_io_control, syz_usb_ep_write and syz_usb_disconnect. Those syzcalls are used to emit USB packets through a custom GadgetFS-like interface (currently exposed at /sys/kernel/debug/usb-fuzzer), which requires special kernel patches. USB fuzzing support is quite basic, as it mostly covers only the USB device enumeration process. Even though the syz_usb_ep_write syzcall does allow to communicate with USB endpoints after the device has been enumerated, no coverage is collected from that code yet.
* all: add optional close_fds feature to reproducersAndrey Konovalov2019-04-091-2/+12
| | | | | | | | Instead of always closing open fds (number 3 to 30) after each program, add an options called EnableCloseFds. It can be passed to syz-execprog, syz-prog2c and syz-stress via the -enable and -disable flags. Set the default value to true. Also minimize C repros over it, except for when repeat is enabled.
* csource: use /*FOO*/ instead of [[FOO]]Andrey Konovalov2019-04-091-13/+10
| | | | The latter differently confuses different versions of clang-format.
* executor: move syz_execute_func after os imports. (#1107)Marco Vanotti2019-04-031-16/+16
| | | | | | | | | | | | | | | | | This commit moves the definition of the `syz_execute_func` after the block of code that imports all the OS specific common headers. This is required because after commit dfd3394d42ddd333c68cf355273b312da8c65a51 `syz_execute_func` started using the `NONFAILING` macro, which is defined in those header files for each OS. I also ran `make generate`. TEST=I only tested that the executor works for Fuchsia with: ```shell $ make executor TARGETOS=fuchsia TARGETARCH=amd64 SOURCEDIR=~/fuchsia ```
* executor: try to prevent machine outbreakDmitry Vyukov2019-04-021-1/+13
| | | | | | | | | The fuzzer gained control over host machines again with something like: syz_execute_func(&(0x7f00000000c0)="c4827d5a6e0d5e57c3c3b7d95a91914e424a2664f0ff065b460f343030062e67660f50e900004681e400000100440fe531feabc4aba39d6c450754ddea420fae9972b571112d02") Let's see if perturbing syz_execute_func a bit and wiping registers will stop the outbreak.
* executor: prevent non-null expected warningsDmitry Vyukov2019-03-211-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | The added test triggers warnings like these: <stdin>: In function ‘syz_mount_image.constprop’: <stdin>:298:3: error: argument 1 null where non-null expected [-Werror=nonnull] In file included from <stdin>:26:0: /usr/include/x86_64-linux-gnu/sys/stat.h:320:12: note: in a call to function ‘mkdir’ declared here extern int mkdir (const char *__path, __mode_t __mode) ^~~~~ cc1: all warnings being treated as errors <stdin>: In function ‘syz_open_procfs.constprop’: <stdin>:530:41: error: ‘%s’ directive argument is null [-Werror=format-truncation=] <stdin>:85:110: note: in definition of macro ‘NONFAILING’ <stdin>:532:41: error: ‘%s’ directive argument is null [-Werror=format-truncation=] <stdin>:85:110: note: in definition of macro ‘NONFAILING’ <stdin>:534:41: error: ‘%s’ directive argument is null [-Werror=format-truncation=] <stdin>:85:110: note: in definition of macro ‘NONFAILING’ Use volatile for all arguments of syz_ functions to prevent compiler from treating the arguments as constants in reproducers. Popped up during bisection that used a repro that previously worked. Update #501
* pkg/runtest: make tests pass on freebsdDmitry Vyukov2019-03-071-1/+1
| | | | | | The problem is stupid: <endian.h> should be included as <sys/endian.h> on freebsd. Pass actual host OS to executor build as HOSTGOOS and use it to figure out how we should include this header.
* execprog, stress, prog2c: unify flags to enable additional featuresAndrey Konovalov2019-03-051-0/+1
| | | | | | | | | | | This change makes all syz-execprog, syz-prog2c and syz-stress accept -enable and -disable flags to enable or disable additional features (tun, net_dev, net_reset, cgroups and binfmt_misc) instead of having a separate flag for each of them. The default (without any flags) behavior isn't changed: syz-execprog and syz-stress enabled all the features (provided the runtime supports them) and syz-prog2c disables all of them.
* executor: add missing includeDmitry Vyukov2019-02-011-0/+1
| | | | thread_start now uses errno, so include <errno.h>
* executor, pkg/ipc: simplify retry handlingDmitry Vyukov2019-01-311-2/+3
| | | | | | Remove kRetryStatus, it's effectively the same as exiting with 0. Remove ipc.ExecutorFailure, nobody uses it. Simplify few other minor things around exit status handling.
* executor: remove ability to detect kernel bugsDmitry Vyukov2019-01-311-3/+1
| | | | | | | | This ability was never used but we maintain a bunch of code for it. syzkaller also recently learned to spoof this error code with some ptrace magic (probably intercepted control flow again and exploited executor binary). Drop all of it.
* executor: fix do_sandbox_none on akaros and testDmitry Vyukov2019-01-311-2/+0
| | | | do_sandbox_none must not exit, it needs to return.
* executor: handle pthread_create errors betterDmitry Vyukov2019-01-311-3/+16
| | | | See the added comment for explanation.
generated by ggit (джигит) mrf-deployment (git 2.46.0) at 2026-03-12 08:49:36 +0000