aboutsummaryrefslogtreecommitdiffstats
path: root/executor/common.h
Commit message (Collapse)AuthorAgeFilesLines
...
* executor: fix #ifdef condition for remove_dir()Michael Tuexen2020-05-131-1/+1
|
* csource, executor: add usb emulation featureAndrey Konovalov2020-04-031-0/+3
| | | | | | | | | The feature gets enabled when /dev/raw-gadget is present and accessible. With this feature enabled, executor will do chmod 0666 /dev/raw-gadget on startup, which makes it possible to do USB fuzzing in setuid and namespace sandboxes. There should be no backwards compatibility issues with syz reproducers that don't explicitly enable this feature, as they currently only work in none sandbox.
* executor, sys/linux: add ath9k usb descriptionsAndrey Konovalov2020-03-131-2/+3
| | | | | | | Among other things this changes timeout for USB programs from 2 to 3 seconds. ath9k fuzzing also requires ath9k firmware to be present, so system images need to be regenerated with the updated script.
* executor: fix clang-tidy warningsDmitry Vyukov2020-03-111-1/+1
|
* executor: rename some macrosDmitry Vyukov2019-11-161-17/+17
| | | | | Rename some macros in preparation for subsequent changes which will align names across the code base.
* executor, host, csource: Add support to enable KCSANMarco Elver2019-10-041-0/+3
| | | | | | | | | By default, the current KCSAN .config does not enable KCSAN during boot, since we encounter races during boot which would prevent syzkaller from ever executing. This adds support to detect if KCSAN is available, and enables it on the fuzzer host.
* all: convert Fuchsia to use "host fuzzing" modeMatthew Dempsky2019-08-271-0/+2
| | | | | | | | | Go support is not a priority for Fuchsia at the moment, so it's preferable to use host fuzzing mode for Fuchsia like currently done for Akaros. This commit basically looks for all the places where there was special logic for OS=="akaros" and extends the same logic for OS=="fuchsia".
* executor: fix procid not declared properly for netbsd (#1358)Andrey Konovalov2019-08-221-1/+1
|
* executor: make errors during thread creation exit zeroAnton Lindqvist2019-07-041-2/+2
| | | | | | | | | | | | | On OpenBSD, the executor sometimes manages to set the memory resource limit 0 causing any following memory allocation to fail. Since threads are potentially created from such a thread which cannot allocate any memory, the executor will exit non-zero which in turn will cause false-positive panics to be reported. For more info see the discussion[1] in PR #1243. Instead, if hitting a fatal error during thread creation exit zero. [1] https://github.com/google/syzkaller/pull/1243
* pkg/csource: generate timeouts for USB syzcallsAndrey Konovalov2019-05-311-1/+2
| | | | This patch only covers per call timeouts, per prog one is not adjusted yet.
* executor: implement support for leak checkingDmitry Vyukov2019-05-201-2/+21
| | | | | | | | | | | | | | | | | | | | | | | | | Leak checking support was half done and did not really work. This is heavy-lifting to make it work. 1. Move leak/fault setup into executor. pkg/host was a wrong place for them because we need then in C repros too. The pkg/host periodic callback functionality did not work too, we need it in executor so that we can reuse it in C repros too. Remove setup/callback functions in pkg/host entirely. 2. Do leak setup/checking in C repros. The way leak checking is invoked is slightly different from fuzzer, but much better then no support at all. At least the checking code is shared. 3. Add Leak option to pkg/csource and -leak flag to syz-prog2c. 4. Don't enalbe leak checking in fuzzer while we are triaging initial corpus. It's toooo slow. 5. Fix pkg/repro to do something more sane for leak bugs. Few other minor fixes here and there.
* all: add basic USB fuzzing supportAndrey Konovalov2019-04-111-2/+3
| | | | | | | | | | | | This commits implements 4 syzcalls: syz_usb_connect, syz_usb_io_control, syz_usb_ep_write and syz_usb_disconnect. Those syzcalls are used to emit USB packets through a custom GadgetFS-like interface (currently exposed at /sys/kernel/debug/usb-fuzzer), which requires special kernel patches. USB fuzzing support is quite basic, as it mostly covers only the USB device enumeration process. Even though the syz_usb_ep_write syzcall does allow to communicate with USB endpoints after the device has been enumerated, no coverage is collected from that code yet.
* all: add optional close_fds feature to reproducersAndrey Konovalov2019-04-091-2/+12
| | | | | | | | Instead of always closing open fds (number 3 to 30) after each program, add an options called EnableCloseFds. It can be passed to syz-execprog, syz-prog2c and syz-stress via the -enable and -disable flags. Set the default value to true. Also minimize C repros over it, except for when repeat is enabled.
* csource: use /*FOO*/ instead of [[FOO]]Andrey Konovalov2019-04-091-13/+10
| | | | The latter differently confuses different versions of clang-format.
* executor: move syz_execute_func after os imports. (#1107)Marco Vanotti2019-04-031-16/+16
| | | | | | | | | | | | | | | | | This commit moves the definition of the `syz_execute_func` after the block of code that imports all the OS specific common headers. This is required because after commit dfd3394d42ddd333c68cf355273b312da8c65a51 `syz_execute_func` started using the `NONFAILING` macro, which is defined in those header files for each OS. I also ran `make generate`. TEST=I only tested that the executor works for Fuchsia with: ```shell $ make executor TARGETOS=fuchsia TARGETARCH=amd64 SOURCEDIR=~/fuchsia ```
* executor: try to prevent machine outbreakDmitry Vyukov2019-04-021-1/+13
| | | | | | | | | The fuzzer gained control over host machines again with something like: syz_execute_func(&(0x7f00000000c0)="c4827d5a6e0d5e57c3c3b7d95a91914e424a2664f0ff065b460f343030062e67660f50e900004681e400000100440fe531feabc4aba39d6c450754ddea420fae9972b571112d02") Let's see if perturbing syz_execute_func a bit and wiping registers will stop the outbreak.
* executor: prevent non-null expected warningsDmitry Vyukov2019-03-211-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | The added test triggers warnings like these: <stdin>: In function ‘syz_mount_image.constprop’: <stdin>:298:3: error: argument 1 null where non-null expected [-Werror=nonnull] In file included from <stdin>:26:0: /usr/include/x86_64-linux-gnu/sys/stat.h:320:12: note: in a call to function ‘mkdir’ declared here extern int mkdir (const char *__path, __mode_t __mode) ^~~~~ cc1: all warnings being treated as errors <stdin>: In function ‘syz_open_procfs.constprop’: <stdin>:530:41: error: ‘%s’ directive argument is null [-Werror=format-truncation=] <stdin>:85:110: note: in definition of macro ‘NONFAILING’ <stdin>:532:41: error: ‘%s’ directive argument is null [-Werror=format-truncation=] <stdin>:85:110: note: in definition of macro ‘NONFAILING’ <stdin>:534:41: error: ‘%s’ directive argument is null [-Werror=format-truncation=] <stdin>:85:110: note: in definition of macro ‘NONFAILING’ Use volatile for all arguments of syz_ functions to prevent compiler from treating the arguments as constants in reproducers. Popped up during bisection that used a repro that previously worked. Update #501
* pkg/runtest: make tests pass on freebsdDmitry Vyukov2019-03-071-1/+1
| | | | | | The problem is stupid: <endian.h> should be included as <sys/endian.h> on freebsd. Pass actual host OS to executor build as HOSTGOOS and use it to figure out how we should include this header.
* execprog, stress, prog2c: unify flags to enable additional featuresAndrey Konovalov2019-03-051-0/+1
| | | | | | | | | | | This change makes all syz-execprog, syz-prog2c and syz-stress accept -enable and -disable flags to enable or disable additional features (tun, net_dev, net_reset, cgroups and binfmt_misc) instead of having a separate flag for each of them. The default (without any flags) behavior isn't changed: syz-execprog and syz-stress enabled all the features (provided the runtime supports them) and syz-prog2c disables all of them.
* executor: add missing includeDmitry Vyukov2019-02-011-0/+1
| | | | thread_start now uses errno, so include <errno.h>
* executor, pkg/ipc: simplify retry handlingDmitry Vyukov2019-01-311-2/+3
| | | | | | Remove kRetryStatus, it's effectively the same as exiting with 0. Remove ipc.ExecutorFailure, nobody uses it. Simplify few other minor things around exit status handling.
* executor: remove ability to detect kernel bugsDmitry Vyukov2019-01-311-3/+1
| | | | | | | | This ability was never used but we maintain a bunch of code for it. syzkaller also recently learned to spoof this error code with some ptrace magic (probably intercepted control flow again and exploited executor binary). Drop all of it.
* executor: fix do_sandbox_none on akaros and testDmitry Vyukov2019-01-311-2/+0
| | | | do_sandbox_none must not exit, it needs to return.
* executor: handle pthread_create errors betterDmitry Vyukov2019-01-311-3/+16
| | | | See the added comment for explanation.
* pkg/csource: write tracing output to stderrDmitry Vyukov2019-01-311-1/+1
| | | | stdout is not flushed on abnormal exit.
* sys/linux: extend AX25/ROSE/NETROM descriptionsDmitry Vyukov2018-12-241-2/+2
|
* pkg/csource: support tun and setuid repros on {free,open}bsdGreg Steuck2018-12-131-1/+2
| | | | | | * expose procid on BSD for tun, always declare loop() * deal with terrible bsd includes * replicate loop() declaration
* executor: fix handling of big-endian bitfieldsDmitry Vyukov2018-12-081-13/+4
| | | | | Currently we apply big-endian-ness and bitfield-ness in the wrong order in copyin. This leads to totally bogus result. Fix this.
* executor: FreeBSD: fixed endian.h pathmsvoelker2018-11-231-0/+4
| | | | The include statement for endian.h failed on FreeBSD. Changed include statement to syz/endian.h for FreeBSD.
* Android: Fix sandbox implementationZach Riggle2018-10-121-2/+6
| | | | | | | | | | | My test harness for this code performed some steps that are not performed when syz-executor is invoked directy. Specifcally, we need to operate from a directory under /data/data, and have the correct UID/GID set as the owner of the directory. My test harness now correctly sets these, all sandbox operations succeed, and loop() is invoked.
* executor: make the debug output useful for race condition debuggingAlexander Popov2018-09-241-2/+1
| | | | | | | | | | | | | | | Sometimes race conditions are reproduced by syz-execprog and are not reproduced by the programs generated with syz-prog2c. In such cases it's very helpful to know when exactly the fuzzing syscalls are executed. Unfortunately, adding timestamps to the output of the original 'debug' mode doesn't work. This mode provides very verbose output, which slows down executor and breaks the repro. So let's make the executor debug output less verbose and add the timestamps. Signed-off-by: Alexander Popov <alex.popov@linux.com>
* RFC: android: Add support for untrusted_app sandboxing (#697)Zach Riggle2018-09-171-1/+1
| | | | | | | | | | | | | | | | | | | | | executor: add support for android_untrusted_app sandbox This adds a new sandbox type, 'android_untrusted_app', which restricts syz-executor to the privileges which are available to third-party applications, e.g. those installed from the Google Play store. In particular, this uses the UID space reserved for applications (instead of the 'setuid' sandbox, which uses the traditional 'nobody' user / 65534) as well as a set of groups which the Android-specific kernels are aware of, and finally ensures that the SELinux context is set appropriately. Dependencies on libselinux are avoided by manually implementing the few functions that are needed to change the context of the current process, and arbitrary files. The underlying mechanisms are relatively simple. Fixes google/syzkaller#643 Test: make presubmit Bug: http://b/112900774
* sys/linux: add syz_execute_funcDmitry Vyukov2018-08-301-0/+9
| | | | | | The function executes random code. Update #310
* Add mandatory OpenBSD bits (#689)Anton Lindqvist2018-08-281-3/+3
| | | | | | | | | | | | | | | | | | all: add openbsd support squash of the following commits: * openbsd: add mandatory bits * report: add OpenBSD support * executor: skip building kvm on OpenBSD * executor: add OpenBSD support Linking against libutil is necessary due to usage of openpty(3). * executor: fix typo in fail() message * fixup! report: add OpenBSD support * fixup! openbsd: add mandatory bits * fixup! openbsd: add mandatory bits * fixup! openbsd: add mandatory bits * fixup! report: add OpenBSD support * gometalinter: skip sys/openbsd
* executor: fix gcc warnings in fuchsia generated codeDmitry Vyukov2018-08-191-13/+13
| | | | | | gcc complains about function declarations not being prototypes, signed/unsigned cast mismatch and casts between incompatible functions. Fix them.
* executor: fix cgroupsDmitry Vyukov2018-08-091-3/+3
| | | | | | | 1. Create per-proc cgroup in executor. 2. Setup cgroups after chdir into test dir (it assumes relative paths against test dir). 3. Add test.
* executor: mount binfmt_mistDmitry Vyukov2018-08-091-4/+4
| | | | | | We forgot to mount binfmt_misc. Mount it. Add a test. Increase per-call timeout, otherwise last execve timesout. Fix csource waiting for call completion at the end of program.
* executor: check write return valueDmitry Vyukov2018-08-051-1/+5
| | | | | | | | gcc complains: error: ignoring return value of ‘write’, declared with attribute warn_unused_result [-Werror=unused-result] Also fix includes.
* executor: abort fuse connectionDmitry Vyukov2018-08-041-6/+12
| | | | | | | If the test process is not dying after 100ms, abort all fuse connections in the system. This gets rid at least of simple fuse deadlocks, let's see how well this works in all cases.
* executor: make current_time_ms/sleep_msDmitry Vyukov2018-07-301-4/+3
| | | | | Fix conditions for when current_time_ms/sleep_ms are used and make them static.
* executor: disable clang-format for some partsDmitry Vyukov2018-07-271-8/+8
| | | | | clang-format badly mishandles this part, moreover different versions mishandle it differently.
* pkg/csource: add option to trace syscall resultsDmitry Vyukov2018-07-271-0/+11
| | | | This will be needed for testing of generated programs.
* pkg/csource: tidy generated codeDmitry Vyukov2018-07-271-7/+100
| | | | | | | | | | | 1. Remove unnecessary includes. 2. Remove thunk function in threaded mode. 3. Inline syscalls into main for the simplest case. 4. Define main in common.h rather than form with printfs. 5. Fix generation for repeat mode (we had 2 infinite loops: in main and in loop). 6. Remove unused functions (setup/reset_loop, setup/reset_test, sandbox_namespace, etc).
* executor: simplify event_timedwaitDmitry Vyukov2018-07-271-15/+10
| | | | | | We always have current_time_ms in event_timedwait so use it instead of manual clock_gettime calls which tend to be bulkier.
* executor: overhaulDmitry Vyukov2018-07-241-110/+477
| | | | | | | | | | | | | | | | | Make as much code as possible shared between all OSes. In particular main is now common across all OSes. Make more code shared between executor and csource (in particular, loop function and threaded execution logic). Also make loop and threaded logic shared across all OSes. Make more posix/unix code shared across OSes (e.g. signal handling, pthread creation, etc). Plus other changes along similar lines. Also support test OS in executor (based on portable posix) and add 4 arches that cover all execution modes (fork server/no fork server, shmem/no shmem). This change paves way for testing of executor code and allows to preserve consistency across OSes and executor/csource.
* executor: fix typo in commentAnton Lindqvist2018-07-231-1/+1
|
* pkg/csource: support fuchsiaDmitry Vyukov2018-06-291-7/+9
| | | | Lots of assorted heavylifting to support csource on fuchsia.
* executor: make syscall table and number constantDmitry Vyukov2018-06-071-3/+0
| | | | | | | | | We see some crashes that suggest corruption of the syscall number: invalid command number 1296 (errno 11) invalid command number 107 (errno 110) Make the table and the number constant to prevent corruption.
* sys/linux: add cgroup descriptionsDmitry Vyukov2018-03-251-0/+6
|
* executor: fix ifdef's for csourceDmitry Vyukov2018-03-071-1/+2
| | | | | | | There is test failure on travis: https://travis-ci.org/google/syzkaller/jobs/349948391 I can't reproduce it locally, and it only happened on 1.8, but not on 1.9? But this seems to be what could have provoked such failure.
generated by ggit (джигит) mrf-deployment (git 2.46.0) at 2026-03-11 19:35:28 +0000