aboutsummaryrefslogtreecommitdiffstats
path: root/executor/common.h
Commit message (Collapse)AuthorAgeFilesLines
* executor: add missing includeDmitry Vyukov2019-02-011-0/+1
| | | | thread_start now uses errno, so include <errno.h>
* executor, pkg/ipc: simplify retry handlingDmitry Vyukov2019-01-311-2/+3
| | | | | | Remove kRetryStatus, it's effectively the same as exiting with 0. Remove ipc.ExecutorFailure, nobody uses it. Simplify few other minor things around exit status handling.
* executor: remove ability to detect kernel bugsDmitry Vyukov2019-01-311-3/+1
| | | | | | | | This ability was never used but we maintain a bunch of code for it. syzkaller also recently learned to spoof this error code with some ptrace magic (probably intercepted control flow again and exploited executor binary). Drop all of it.
* executor: fix do_sandbox_none on akaros and testDmitry Vyukov2019-01-311-2/+0
| | | | do_sandbox_none must not exit, it needs to return.
* executor: handle pthread_create errors betterDmitry Vyukov2019-01-311-3/+16
| | | | See the added comment for explanation.
* pkg/csource: write tracing output to stderrDmitry Vyukov2019-01-311-1/+1
| | | | stdout is not flushed on abnormal exit.
* sys/linux: extend AX25/ROSE/NETROM descriptionsDmitry Vyukov2018-12-241-2/+2
|
* pkg/csource: support tun and setuid repros on {free,open}bsdGreg Steuck2018-12-131-1/+2
| | | | | | * expose procid on BSD for tun, always declare loop() * deal with terrible bsd includes * replicate loop() declaration
* executor: fix handling of big-endian bitfieldsDmitry Vyukov2018-12-081-13/+4
| | | | | Currently we apply big-endian-ness and bitfield-ness in the wrong order in copyin. This leads to totally bogus result. Fix this.
* executor: FreeBSD: fixed endian.h pathmsvoelker2018-11-231-0/+4
| | | | The include statement for endian.h failed on FreeBSD. Changed include statement to syz/endian.h for FreeBSD.
* Android: Fix sandbox implementationZach Riggle2018-10-121-2/+6
| | | | | | | | | | | My test harness for this code performed some steps that are not performed when syz-executor is invoked directy. Specifcally, we need to operate from a directory under /data/data, and have the correct UID/GID set as the owner of the directory. My test harness now correctly sets these, all sandbox operations succeed, and loop() is invoked.
* executor: make the debug output useful for race condition debuggingAlexander Popov2018-09-241-2/+1
| | | | | | | | | | | | | | | Sometimes race conditions are reproduced by syz-execprog and are not reproduced by the programs generated with syz-prog2c. In such cases it's very helpful to know when exactly the fuzzing syscalls are executed. Unfortunately, adding timestamps to the output of the original 'debug' mode doesn't work. This mode provides very verbose output, which slows down executor and breaks the repro. So let's make the executor debug output less verbose and add the timestamps. Signed-off-by: Alexander Popov <alex.popov@linux.com>
* RFC: android: Add support for untrusted_app sandboxing (#697)Zach Riggle2018-09-171-1/+1
| | | | | | | | | | | | | | | | | | | | | executor: add support for android_untrusted_app sandbox This adds a new sandbox type, 'android_untrusted_app', which restricts syz-executor to the privileges which are available to third-party applications, e.g. those installed from the Google Play store. In particular, this uses the UID space reserved for applications (instead of the 'setuid' sandbox, which uses the traditional 'nobody' user / 65534) as well as a set of groups which the Android-specific kernels are aware of, and finally ensures that the SELinux context is set appropriately. Dependencies on libselinux are avoided by manually implementing the few functions that are needed to change the context of the current process, and arbitrary files. The underlying mechanisms are relatively simple. Fixes google/syzkaller#643 Test: make presubmit Bug: http://b/112900774
* sys/linux: add syz_execute_funcDmitry Vyukov2018-08-301-0/+9
| | | | | | The function executes random code. Update #310
* Add mandatory OpenBSD bits (#689)Anton Lindqvist2018-08-281-3/+3
| | | | | | | | | | | | | | | | | | all: add openbsd support squash of the following commits: * openbsd: add mandatory bits * report: add OpenBSD support * executor: skip building kvm on OpenBSD * executor: add OpenBSD support Linking against libutil is necessary due to usage of openpty(3). * executor: fix typo in fail() message * fixup! report: add OpenBSD support * fixup! openbsd: add mandatory bits * fixup! openbsd: add mandatory bits * fixup! openbsd: add mandatory bits * fixup! report: add OpenBSD support * gometalinter: skip sys/openbsd
* executor: fix gcc warnings in fuchsia generated codeDmitry Vyukov2018-08-191-13/+13
| | | | | | gcc complains about function declarations not being prototypes, signed/unsigned cast mismatch and casts between incompatible functions. Fix them.
* executor: fix cgroupsDmitry Vyukov2018-08-091-3/+3
| | | | | | | 1. Create per-proc cgroup in executor. 2. Setup cgroups after chdir into test dir (it assumes relative paths against test dir). 3. Add test.
* executor: mount binfmt_mistDmitry Vyukov2018-08-091-4/+4
| | | | | | We forgot to mount binfmt_misc. Mount it. Add a test. Increase per-call timeout, otherwise last execve timesout. Fix csource waiting for call completion at the end of program.
* executor: check write return valueDmitry Vyukov2018-08-051-1/+5
| | | | | | | | gcc complains: error: ignoring return value of ‘write’, declared with attribute warn_unused_result [-Werror=unused-result] Also fix includes.
* executor: abort fuse connectionDmitry Vyukov2018-08-041-6/+12
| | | | | | | If the test process is not dying after 100ms, abort all fuse connections in the system. This gets rid at least of simple fuse deadlocks, let's see how well this works in all cases.
* executor: make current_time_ms/sleep_msDmitry Vyukov2018-07-301-4/+3
| | | | | Fix conditions for when current_time_ms/sleep_ms are used and make them static.
* executor: disable clang-format for some partsDmitry Vyukov2018-07-271-8/+8
| | | | | clang-format badly mishandles this part, moreover different versions mishandle it differently.
* pkg/csource: add option to trace syscall resultsDmitry Vyukov2018-07-271-0/+11
| | | | This will be needed for testing of generated programs.
* pkg/csource: tidy generated codeDmitry Vyukov2018-07-271-7/+100
| | | | | | | | | | | 1. Remove unnecessary includes. 2. Remove thunk function in threaded mode. 3. Inline syscalls into main for the simplest case. 4. Define main in common.h rather than form with printfs. 5. Fix generation for repeat mode (we had 2 infinite loops: in main and in loop). 6. Remove unused functions (setup/reset_loop, setup/reset_test, sandbox_namespace, etc).
* executor: simplify event_timedwaitDmitry Vyukov2018-07-271-15/+10
| | | | | | We always have current_time_ms in event_timedwait so use it instead of manual clock_gettime calls which tend to be bulkier.
* executor: overhaulDmitry Vyukov2018-07-241-110/+477
| | | | | | | | | | | | | | | | | Make as much code as possible shared between all OSes. In particular main is now common across all OSes. Make more code shared between executor and csource (in particular, loop function and threaded execution logic). Also make loop and threaded logic shared across all OSes. Make more posix/unix code shared across OSes (e.g. signal handling, pthread creation, etc). Plus other changes along similar lines. Also support test OS in executor (based on portable posix) and add 4 arches that cover all execution modes (fork server/no fork server, shmem/no shmem). This change paves way for testing of executor code and allows to preserve consistency across OSes and executor/csource.
* executor: fix typo in commentAnton Lindqvist2018-07-231-1/+1
|
* pkg/csource: support fuchsiaDmitry Vyukov2018-06-291-7/+9
| | | | Lots of assorted heavylifting to support csource on fuchsia.
* executor: make syscall table and number constantDmitry Vyukov2018-06-071-3/+0
| | | | | | | | | We see some crashes that suggest corruption of the syscall number: invalid command number 1296 (errno 11) invalid command number 107 (errno 110) Make the table and the number constant to prevent corruption.
* sys/linux: add cgroup descriptionsDmitry Vyukov2018-03-251-0/+6
|
* executor: fix ifdef's for csourceDmitry Vyukov2018-03-071-1/+2
| | | | | | | There is test failure on travis: https://travis-ci.org/google/syzkaller/jobs/349948391 I can't reproduce it locally, and it only happened on 1.8, but not on 1.9? But this seems to be what could have provoked such failure.
* executor: fix includesDmitry Vyukov2018-03-051-1/+6
| | | | | | We use errno, vaargs, printf in all of fail/error/exitf, but we include the corresponding headers only when SYZ_USE_TMP_DIR. Include them whenever fail/error/exitf are used.
* sys/linux: add syz_init_net_socket syscallDmitry Vyukov2018-03-051-3/+4
| | | | | | | | | | | The new pseudo syscall allows opening sockets that can only be created in init net namespace (BLUETOOTH, NFC, LLC). Use it to open these sockets. Unfortunately this only works with sandbox none at the moment. The problem is that setns of a network namespace requires CAP_SYS_ADMIN in the target namespace, and we've lost all privs in the init namespace during creation of a user namespace.
* executor: introduce uint64/32/16/8 typesDmitry Vyukov2017-12-271-8/+12
| | | | | | | | | | | | | | | The "define uint64_t unsigned long long" were too good to work. With a different toolchain I am getting: cstdint:69:11: error: expected unqualified-id using ::uint64_t; ^ executor/common.h:34:18: note: expanded from macro 'uint64_t' Do it the proper way: introduce uint64/32/16/8 types and use them. pkg/csource then does s/uint64/uint64_t/ to not clutter code with additional typedefs.
* executor: check format stringsDmitry Vyukov2017-12-271-7/+11
| | | | | | | | | | | | | | | | | | | I see a crash which says: #0: too much cover 0 (errno 0) while the code is: uint64_t n = ...; if (n >= kCoverSize) fail("#%d: too much cover %u", th->id, n); It seems that the high part of n is set, but we don't see it. Add printf format attribute to fail and friends and fix all similar cases. Caught a bunch of similar cases and a missing argument in: exitf("opendir(%s) failed due to NOFILE, exiting");
* executor: fix macros in common.hAndrey Konovalov2017-12-141-3/+4
|
* executor: fix buildDmitry Vyukov2017-12-061-2/+2
| | | | | | exitf function was not defined with some combinations of options in csource. Fix defines and switch exitf back to fail, fail already checks ENOMEM/EAGAIN, so there is no reason to use exitf in this particular case.
* executor: fix build breakages due to doexitDmitry Vyukov2017-10-191-0/+8
| | | | | Some standard libraries contain "using ::exit;", which breaks with the current redefinition of exit.
* executor, pkg/ipc: unify ipc protocol between linux and other OSesDmitry Vyukov2017-10-161-5/+9
| | | | | | | | | | | | | | | | | We currently use more complex and functional protocol on linux, and a simple ad-hoc protocol on other OSes. This leads to code duplication in both ipc and executor. Linux supports coverage, shared memory communication and fork server, which would also be useful for most other OSes. Unify communication protocol and parametrize it by (1) use of shmem or only pipes, (2) use of fork server. This reduces duplication in ipc and executor and will allow to support the useful features for other OSes easily. Finally, this fixes akaros support as it currently uses syz-stress running on host (linux) and executor running on akaros.
* executor: write debug output to stderrDmitry Vyukov2017-10-161-2/+2
| | | | | | We print all other output to stderr, write debug output to stderr as well. This does not matter for the main use case of running syz-execprog -debug, but can is helpful if we want to communicate with syz-executor via stdin/stdout.
* executor: fix execution of windows syscallsDmitry Vyukov2017-09-271-2/+6
| | | | | First, they must be called with stdcall convention. Second, wrap them in __try/__except because they can crash.
* executor, sys/windows: initial windows supportDmitry Vyukov2017-09-251-63/+4
|
* all: more assorted fuchsia supportDmitry Vyukov2017-09-221-894/+24
|
* executor: sandbox with RLIMIT_MEMLOCKDmitry Vyukov2017-08-081-0/+2
| | | | | | | Locking memory is a reasonably legitimate local DoS vector. E.g. bpf maps allow allocation of large chunks of kernel memory without RLIMIT_MEMLOCK, which leads to hangups. Set RLIMIT_MEMLOCK=8MB in executor.
* pkg/csource: make all usleeps randomAndrey Konovalov2017-07-241-2/+0
| | | | | | We can't know the exact values of those sleeps in advance, they can be different for different bugs. Making them random increases the chance that the C repro executes with the right timings at some point.
* Port console to Darwin (#253)Zach Riggle2017-06-261-0/+2
| | | | | | | | | | | | * Port console to Darwin * Get syz-executor to build correctly * Do not export unix and syscall constants * Add presubmit test * Add myself to contributors
* executor: fix clang-tidy warningsDmitry Vyukov2017-06-131-15/+15
| | | | | A single check is enabled for now (misc-definitions-in-headers). But it's always fixable and found 2 bugs in csource.
* executor: add sys/sysmacros.h include for makedev in newer gccAndrey Konovalov2017-06-131-0/+1
|
* csource: don't use guard macros for debug() and NONFAILING()Andrey Konovalov2017-06-121-33/+0
|
* repro: always minimize over EnableTunAndrey Konovalov2017-06-121-1/+1
|
generated by ggit (джигит) mrf-deployment (git 2.46.0) at 2026-03-13 05:42:55 +0000