aboutsummaryrefslogtreecommitdiffstats
path: root/executor/common_linux.h
Commit message (Collapse)AuthorAgeFilesLines
* executor/common_linux.h: add missing FUSE opcodesStefano Duo2020-08-271-1/+5
| | | | | | Add the following missing FUSE opcodes to the syz_fuse_handle_req pseudo-syscall: FUSE_COPY_FILE_RANGE, FUSE_UNLINK, FUSE_DESTROY and FUSE_BATCH_FORGET.
* executor/linux: change mount propagation type to privateTetsuo Handa2020-08-261-0/+3
| | | | | | | unshare(CLONE_NEWNS) might not be sufficient for making all test processes run in separate mount namespace, for "mount --make-rshared /" request issued by systemd causes mount operations issued by test processes visible from outside of test processes. Issue "mount --make-rprivate /" request after unshare(CLONE_NEWNS).
* executor/common_linux.h: make rfkill_unblock_all staticAndy Nguyen2020-08-231-1/+1
|
* executor/common_linux.h: unblock rfkill and retry HCIDEVUP on ERFKILLAndy Nguyen2020-08-231-2/+27
|
* tools/docker: add old-envDmitry Vyukov2020-08-221-1/+1
| | | | | | | old-env is based on Ubuntu 16.04 and allows to test executor build on older distributions. Fixes #2055
* executor/common_linux.go: fix build breakage for Linux 4.14Stefano Duo2020-08-181-5/+87
| | | | | | | Locally define structures and constants required by syz_fuse_handle_req() and remove linux/fuse.h. dependency. Reported-by: syzbot+f5f98e1608b272285aa5@syzkaller.appspotmail.com
* executor/common_linux.h: open target dir inside syz_mount_image()Stefano Duo2020-08-141-72/+79
| | | | | | | | | | Refactor syz_mount_image() to support filesystems not requiring a backing device and filesystem image (e.g. FUSE). To do that, we check for the presence of the pointer to the array of struct fs_image_segment: if missingi, there is no need to setup the loop device and we can proceed directly with the mount() syscall. Add syz_mount_image$fuse() (specialization for FUSE) inside sys/linux/fs_fuse.txt.
* executor/common_linux.h: add syz_fuse_handle_req()Stefano Duo2020-08-141-0/+181
| | | | | | | | | | | | | | | | | | | | | | At the moment syzkaller is able to respond to FUSE with a syntactically correct response using the specific write$FUSE_*() syscalls, but most of the times these responses are not related to the type of request that was received. With this pseudo-syscall we are able to provide the correct response type while still allowing the fuzzer to fuzz its content. This is done by requiring each type of response as an input parameter and then choosing the correct one based on the request opcode. Notice that the fuzzer is still free to mix write$FUSE_*() and syz_fuse_handle_req() syscalls, so it is not losing any degree of freedom. syz_fuse_handle_req() retrieves the FUSE request and resource fuse_unique internally (by performing a read() on the /dev/fuse file descriptor provided as input). For this reason, a new template argument has been added to fuse_out (renamed to _fuse_out) so that the unique field can be both an int64 (used by syz_fuse_handle_req()) and a fuse_unique resource (used by the write$FUSE_*() syscalls) without any code duplication.
* executor: fix use of SYZ_SANDBOX_ANDROID defineDmitry Vyukov2020-08-141-8/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | "#if not" does not seem to be a thing in C: $ cpp -undef -fdirectives-only -dDI -E -P -DSYZ_REPEAT -DSYZ_USE_TMP_DIR executor/common_linux.h 1>/dev/null executor/common_linux.h:3776:9: error: missing binary operator before token "SYZ_SANDBOX_ANDROID" 3776 | #if not SYZ_SANDBOX_ANDROID | ^~~~~~~~~~~~~~~~~~~ executor/common_linux.h:3801:9: error: missing binary operator before token "SYZ_SANDBOX_ANDROID" 3801 | #if not SYZ_SANDBOX_ANDROID | ^~~~~~~~~~~~~~~~~~~ executor/common_linux.h:3837:9: error: missing binary operator before token "SYZ_SANDBOX_ANDROID" 3837 | #if not SYZ_SANDBOX_ANDROID | ^~~~~~~~~~~~~~~~~~~ executor/common_linux.h:3868:9: error: missing binary operator before token "SYZ_SANDBOX_ANDROID" 3868 | #if not SYZ_SANDBOX_ANDROID | ^~~~~~~~~~~~~~~~~~~ Currently parts under "#if not SYZ_SANDBOX_ANDROID" are always stripped from reproducers under all sandboxes. Use the standard !SYZ_SANDBOX_ANDROID. We also need SYZ_EXECUTOR part because sandbox is not statically known when we are building syz-executor. And we also need to remove the use of flag_sandbox_android for C reproducers because for these sandbox is statically known and we don't have flag_sandbox_*.
* executor: warn about C89-style var declarationsDmitry Vyukov2020-08-141-90/+57
| | | | | | | | | | | | | | | | | We generally use the newer C99 var declarations combined with initialization because: - declarations are more local, reduced scope - fewer lines of code - less potential for using uninit vars and other bugs However, we have some relic code from times when we did not understand if we need to stick with C89 or not. Also some external contributions that don't follow style around. Add a static check for C89-style declarations and fix existing precedents. Akaros toolchain uses -std=gnu89 (or something) and does not allow variable declarations inside of for init statement. And we can't switch it to -std=c99 because Akaros headers are C89 themselves. So in common.h we need to declare loop counters outside of for.
* executor: fix style checking testDmitry Vyukov2020-08-131-1/+1
| | | | | The regexp for empty suppressions matches _everything_... Don't match suppression if it's empty.
* executor: initialize vhci earlyDmitry Vyukov2020-08-121-21/+18
| | | | | | | | | We added initialize_vhci to all sandboxes so that we don't have unused function warnings. We assumed it will fail silently, but it fails loudly and crashes the whole machine on init, so no fuzzing can happen with sandboxes other than none. Initialize vhci earlier while we still have CAP_ADMIN. As a nice side effect we now don't need to use syz_init_net_socket.
* sys/linux: add descriptions for BPF LSMCheng-Min Chiang2020-08-071-0/+188
| | | | | | | | | | | | | | This commit includes the following changes: * executor: add a new syz_btf_id_by_name psuedo-syscall * sys/linux: add descriptions for BPF LSM subsystem * sys/linux: add instructions on how to dump vmlinux and install bpftool * sys/linux/test: add tests for the new psuedo-syscall * pkg/host: add support detection for the new psuedo-syscall * pkg/runtest: skip the coverage test when invoking the new psuedo-syscall Update #533.
* executor: add some code style checksDmitry Vyukov2020-08-061-3/+3
| | | | | | | Move the test from pkg/csource to executor/ in order to be able to (1) run it on *.cc files, (2) run on unprocessed *.h files, (3) produce line numbers. Add a check for missed space after //.
* Makefile: enable clang-tidy in presubmit testsDmitry Vyukov2020-08-041-11/+5
| | | | | Fix all errors it points to. The one in netlink_send_ext is concerning.
* executor: remove block commentsDmitry Vyukov2020-08-041-12/+12
| | | | | | | | | 1. We don't generally use /* */ block comments, few precedents we have are inconsistent with the rest of the code. 2. pkg/csource does not strip them from the resulting code. Remove the cases we have and add a test to prevent new ones being added.
* all: fake hci le conn using handle 201Andy Nguyen2020-08-021-5/+40
|
* sys/linux: assorted improvements for vhciDmitry Vyukov2020-07-301-3/+4
| | | | | | | | | | | | | | | | Regenerate const files on next-20200729. Change conn handle to 200 because it also seems to be matches against phy_handle fields which are int8 (current 256 does not fit into int8). Use 200 for all handle's and all phy_handle's. Remove hci_evt_le_cis_req, it does not seem to be used in the kernel. Restrict some event types and statuses. Add rssi field to hci_ev_le_advertising_info. Use bytesize for some of the data length fields.
* all: initialize vhci in linuxTheOfficialFloW2020-07-301-3/+304
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * all: initialize vhci in linux * executor/common_linux.h: improve vhci initialization * pkg/repro/repro.go: add missing vhci options * executor/common_linux.h: fix type and add missing header * executor, pkg: do it like NetInjection * pkg/csource/csource.go: do not emit syz_emit_vhci if vhci is not enabled * executor/common_linux.h: fix format string * executor/common_linux.h: initialize with memset For som reason {0} gets complains about missing braces... * executor/common_linux.h: simplify vhci init * executor/common_linux.h: try to bring all available hci devices up * executor/common_linux.h: find which hci device has been registered * executor/common_linux.h: use HCI_VENDOR_PKT response to retrieve device id * sys/linux/dev_vhci.txt: fix structs of inquiry and report packets * executor/common_linux.h: remove unnecessary return statement and check vendor_pkt read size * executor/common_linux.h: remove unnecessary return statement and check vendor_pkt read size * sys/linux/dev_vhci.txt: pack extended_inquiry_info_t * sys/linux/l2cap.txt: add l2cap_conf_opt struct * executor/common_linux.h: just fill bd addr will 0xaa * executor/common_linux.h: just fill bd addr will 0xaa
* executor: added syz_io_uring_setup to wrap both setup and mmapNecip Fazil Yildiran2020-07-291-1/+85
| | | | | | It is hard for the fuzzer to generate correct programs using mmap calls with fuzzer-provided mmap length. This wrapper ensures correct length computation.
* sys/linux: enhanced descs for io_uringNecip Fazil Yildiran2020-07-241-0/+147
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * sys/linux: enhanced descs for io_uring Introduced pseudo-call "syz_io_uring_put_sqes_on_ring()" for writing submission queue entries (sqes) on sq_ring, which was obtained by mmap'ping the offsets obtained from io_uring_setup(). Added descriptions for io_ring_register operations that were missing earlier. Did misc changes to adapt the descriptions for the updates on the io_uring subsystem. * pkg/host: add io_uring pseudo-syscall * executor/common_linux.h: fix issues with io_uring pseudo-syscall * executor: fixed io_uring offset computation * executor: fixes and refactorings in syz_io_uring_submit() * executor: added syz_io_uring_complete() pseudo-syscall for io_uring * sys/linux: added descriptions for io_uring operations Each operation requires a different struct io_uring_sqe set up. Those are described to be submitted to the sq ring. * executor: use uint32 instead of uint32_t * executor: remove nonfailing from pseudo-calls * sys/linux: fix io_uring epoll_ctl sqe * prog: fix TestTransitivelyEnabledCallsLinux() The newly introduced syscall, syz_io_uring_submit$IORING_OP_EPOLL_CTL, uses fd_epoll. Adapt TestTransitivelyEnabledCallsLinux() to account for this. * sys/linux: add IORING_OP_PROVIDE_BUFFERS and IORING_OP_REMOVE_BUFFERS * sys/linux: fix IORING_OP_WRITE_FIXED and IORING_OP_READ_FIXED addr and len are for the buffer located at buf_index * sys/linux: io_uring: use reg. bufs for READ, READV, RECV, RECVMSG As a result, IOSQE_BUFFER_SELECT_BIT is included in the iosqe_flags. * sys/linux: io_uring: misc fixes * sys/linux: io_uring: add IORING_SETUP_ATTACH_WQ * executor: refactorings on io_uring pseudo syscalls * sys/linux: io_uring: fix desc for params.cq_entries * executor: fix SQ_ARRAY_OFFSET computation This is required with the fix in io_uring kernel code. https://lore.kernel.org/io-uring/CACT4Y+bgTCMXi3eU7xV+W0ZZNceZFUWRTkngojdr0G_yuY8w9w@mail.gmail.com/T/#t * executor: added pseudosyscall syz_io_uring_cq_eventfd_toggle() The usage of cq_ring->flags is only for manipulating IORING_CQ_EVENTFD_DISABLED bit. This is achieved by a pseudo-syscall, which toggles the bit. * executor: added pseudocall syz_io_uring_put_ring_metadata Removed syz_io_uring_cq_eventfd_toggle() and introduced syz_io_uring_put_ring_metadata() instead. We have many pieces of metadata for both sq_ring and cq_ring, for which we are given the offsets, and some of are not supposed to be manipulated by the application. Among them, both sq and cq flags can be changed. Both valid and invalid cases might cause interesting outcomes. Use the newly introduced pseudo syscall to manipulate them randomly while also manipulating the flags to their special values. * executor: added pseudo-syscall syz_memcpy_off Removed syz_io_uring_put_ring_metadata() and instead added a much more generic pseudo systemcall to achieve the task. This should benefit other subsystems as well. * sys/linux: refactored io_uring descriptions syz_io_uring_submit() is called with a union of sqes to reduce duplication of other parameters of the function. io_uring_sqe is templated with io_uring_sqe_t, and this template type is used to describe sqes for different ops. The organization of io_uring.txt is changed. * sys/linux: io_uring: improved descs to utilize registered files The files are registered using io_uring_register$IORING_REGISTER_FILES(). When IOSQE_FIXED_FILE_BIT is enabled in iosqe_flags in sqe, a variety of operations can use those registered files using the index of the file instead of fd. Changed the sqe descriptions for the eligible operations to utilize this. * sys/linux: io_uring: improved the descs to utilize personality_id in sqes A personality_id can be registered for a io_uring fd using io_uring_register$IORING_REGISTER_PERSONALITY(). This id can be utilized within sqes. This commit improves the descs for io_uring to utilize it. In addition, the descriptions for the misc field in io_uring_sqe_t is refactored as most are shared among sqes. * sys/linux: io_uring: utilized cqe.res io_uring_cqe.res is used to carry the return value of operations achieved through io_uring. The only operations with meaningful return values (in terms of their possible usage) are openat and openat2. The pseudo-syscall syz_io_uring_complete() is modified to account for this and return those fds. The description for sqe_user_data is splitted into two to identify openat and non-openat io_uring ops. IORING_OP_IOCTL was suggested but never supported in io_uring. Thus, the note on this is removed in the descriptions. tee() expects pipefds, thus, IORING_OP_TEE. The descriptions for the pipe r/w fds are written as ordinary fd. Thus, in the description for IORING_OP_TEE, which is io_uring_sqe_tee, fd is used in the place where pipefds are expected. The note on this is removed in the descriptions. * sys/linux/test: added test for io_uring This is not tested yet. * sys/linux/test: fixed the test for io_uring The changes successfully pass the sys/linux/test/io_uring test. sys/linux/io_uring.txt: sq_ring_ptr and cq_ring_ptr are really the same. Thus, they are replaced with ring_ptr. executor/common_linux.h: thanks to io_uring test, a bug is found in where the sq_array's address is computed in syz_io_uring_submit(). Fixed. In addition, similar to the descriptions, the naming for the ring_ptr is changed from {sq,cq}_ring_ptr to ring_ptr. * sys/linux: io_uring: misc fixes * sys/linux: io_uring: changed the sqe_user_data enum Used a smaller range to ease the collisions. Used comperatively unique and magic numbers for openat user_data to avoid thinking as if the cqe belongs to openat while the user_data is coming from some random location. * pkg/host: added checks for io_uring syscall * pkg/host: fixed checks for io_uring syscall * sys/linux: fixed io_uring test
* executor: remove NONFAILING from pseudo-syscallsDmitry Vyukov2020-07-151-23/+17
| | | | | | This is not needed anymore afer the previous commit. Fixes #1918
* executor: enable cgroup/cpuset memory pressure calc.Necip Fazil Yildiran2020-06-291-0/+1
| | | | Enable the cpuset.memory_pressure_enabled flag in the root cpuset.
* executor: add support for linux/riscv64Tobias Klauser2020-06-261-0/+5
| | | | Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
* pkg/csource: fix casting of parameters for trampolinesAlexander Egorenkov2020-06-261-0/+7
| | | | Signed-off-by: Alexander Egorenkov <Alexander.Egorenkov@ibm.com>
* sys/linux: first 64bit big-endian architecture s390xAlexander Egorenkov2020-06-251-0/+2
| | | | | | | | | | | | | | | * mmap syscall is special on Linux s390x because the parameters for this syscall are passed as a struct on user stack instead of registers. * Introduce the SyscallTrampolines table into targets.Target to address the above problem. * There is a bug in Linux kernel s390x which causes QEMU TCG to hang when KASAN is enabled. The bug has been fixed in the forthcoming Linux 5.8 version. Until then do not enable KASAN when using QEMU TCG, QEMU KVM shall have no problems with KASAN. Signed-off-by: Alexander Egorenkov <Alexander.Egorenkov@ibm.com>
* executor: Improve used terminologyMarco Elver2020-06-151-4/+5
| | | | | | | | Improve used terminology by using better verbs to express the effect of the whitelist/blacklist. This also changes executor to exclusively show respectful log messages, and as per recent conversion, converts the last such case.
* all: use more respective languageDmitry Vyukov2020-06-111-2/+2
| | | | | | | | Some terms are normalised on the technical level but may be oppressive on a societal level. Replace them with more technically neutral terms. See the following doc for a longer version: https://tools.ietf.org/id/draft-knodel-terminology-00.html
* executor: fix printing null master in netlink_device_changeAndrey Konovalov2020-05-291-1/+1
| | | | | | | | The issues is only present with verbose debugging enabled. executor/common_linux.h: In function ‘void netlink_device_change(nlmsg*, int, const char*, bool, const char*, const void*, int, const char*)’: executor/common_linux.h:380:7: error: ‘%s’ directive argument is null [-Werror=format-overflow=] 380 | debug("netlink: device %s up master %s: %s\n", name, master, strerror(err));
* executor: add support for USB fuzzing on NetBSDm00nbsd2020-05-191-1/+1
|
* executor: exclude syz_kvm_setup_cpu on armDmitry Vyukov2020-05-181-1/+1
| | | | | KVM was removed for ARM. Improved CI finally allows to catch this.
* executor: remove more code if ENABLE_NAPI_FRAGS is not setDmitry Vyukov2020-04-181-8/+11
| | | | | | In some configurations tun_frags_enabled ends up being unused with a compiler warning and failed build. Remove mode code if ENABLE_NAPI_FRAGS is not enabled.
* csource, executor: add usb emulation featureAndrey Konovalov2020-04-031-0/+8
| | | | | | | | | The feature gets enabled when /dev/raw-gadget is present and accessible. With this feature enabled, executor will do chmod 0666 /dev/raw-gadget on startup, which makes it possible to do USB fuzzing in setuid and namespace sandboxes. There should be no backwards compatibility issues with syz reproducers that don't explicitly enable this feature, as they currently only work in none sandbox.
* executor: fix data raceDmitry Vyukov2020-03-131-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ThreadSanitizer says: WARNING: ThreadSanitizer: data race (pid=3) Atomic read of size 4 at 0x56360e562f08 by main thread: #0 __tsan_atomic32_load <null> (libtsan.so.0+0x64249) #1 event_isset executor/common_linux.h:51 (syz-executor.0+0x2cf1f) #2 handle_completion executor/executor.cc:886 (syz-executor.0+0x2cf1f) #3 execute_one executor/executor.cc:732 (syz-executor.0+0x2da3b) #4 loop executor/common.h:581 (syz-executor.0+0x2f1aa) #5 do_sandbox_none executor/common_linux.h:2694 (syz-executor.0+0x189d6) #6 main executor/executor.cc:407 (syz-executor.0+0x189d6) Previous write of size 4 at 0x56360e562f08 by thread T1: #0 event_reset executor/common_linux.h:32 (syz-executor.0+0x1f5af) #1 worker_thread executor/executor.cc:1048 (syz-executor.0+0x1f5af) #2 <null> <null> (libtsan.so.0+0x2b0b6) Location is global 'threads' of size 2560 at 0x56360e562f00 (syz-executor.0+0x00000008bf08) Thread T1 (tid=6, running) created by main thread at: #0 pthread_create <null> (libtsan.so.0+0x2d55b) #1 thread_start executor/common.h:256 (syz-executor.0+0x2d707) #2 thread_create executor/executor.cc:1037 (syz-executor.0+0x2d707) #3 schedule_call executor/executor.cc:811 (syz-executor.0+0x2d707) #4 execute_one executor/executor.cc:719 (syz-executor.0+0x2d707) #5 loop executor/common.h:581 (syz-executor.0+0x2f1aa) #6 do_sandbox_none executor/common_linux.h:2694 (syz-executor.0+0x189d6) #7 main executor/executor.cc:407 (syz-executor.0+0x189d6)
* executor, sys/linux: add ath9k usb descriptionsAndrey Konovalov2020-03-131-3/+4
| | | | | | | Among other things this changes timeout for USB programs from 2 to 3 seconds. ath9k fuzzing also requires ath9k firmware to be present, so system images need to be regenerated with the updated script.
* executor: minor cleanup of android sandboxDmitry Vyukov2020-03-111-4/+8
| | | | Fix code formatting, clang-tidy warnings, minor style nits.
* executor: fix clang-tidy warningsDmitry Vyukov2020-03-111-2/+4
|
* executor: add seccomp support for Androidmspectorgoogle2020-03-111-20/+62
| | | | | | | | | | This adds support for the seccomp filters that are part of Android into the sandbox. A process running as untrusted_app in Android has a restricted set of syscalls that it is allow to run. This is accomplished by setting seccomp filters in the zygote process prior to forking into the application process. The seccomp filter list comes directly from the Android source, it cannot be dynamically loaded from an Android phone because libseccomp_policy.so does not exist as a library on the system partition.
* executor: don't exit if NETLINK_GENERIC isnt' supportedAndrei Vagin2020-02-271-2/+4
| | | | | | | NETLINK_GENERIC isn't supported in gVisor. Fixes: c5ed587f4af5 ("wireguard: setup some initial devices in a triangle") Signed-off-by: Andrei Vagin <avagin@google.com>
* executor: uncomment accidentially commented codeDmitry Vyukov2020-02-241-3/+3
| | | | | | | unshare(CLONE_NEWPID) was commented out in 4428511d10687cb446ad705148333478437d3f23 accidentially. Uncomment it. Spotted by @xairy: https://github.com/google/syzkaller/commit/4428511d10687cb446ad705148333478437d3f23#r37456572
* sys/linux: add NETLINK_RDMA descriptionsDmitry Vyukov2020-02-211-3/+3
|
* executor: disable IFF_NAPI_FRAGSDmitry Vyukov2020-02-181-1/+12
| | | | Update #1594
* wireguard: setup some initial devices in a triangleJason A. Donenfeld2020-02-131-0/+272
| | | | | | | | | | | | | | | | | | | | | | | * wireguard: setup some initial devices in a triangle The fuzzer will wind up undoing some of this, which is fine, but at least it now has the chance of hitting some other paths it wasn't before. Closes: #1599 * wireguard: make code ugly after `make generate` pass * wireguard: get rid of unused structs that are still interesting * wireguard: compile in C++ mode with gcc 7 Complex designated initializers are only supported in C++ mode from gcc 8, and for whatever reason syzkaller wants to be compiled in C++ mode. * wireguard: add braces around debug statements for checker * wireguard: regenerate go source
* wireguard: use wg0, wg1, wg2Jason A. Donenfeld2020-02-101-4/+6
| | | | | This matches more closely what people are used to dealing with. We also add one additional device for interesting multi-interface effects.
* sys/linux: add some wireguard descriptionsDmitry Vyukov2020-01-311-0/+4
| | | | Update #806
* sys/linux: add more device descriptions (geneve, lowpan, ipoib, cfhsi)Dmitry Vyukov2020-01-191-4/+33
|
* sys/linux: add some batadv descriptionsDmitry Vyukov2020-01-181-1/+5
|
* executor: create macvtap, macsec devicesDmitry Vyukov2020-01-181-6/+15
|
* executor: setns requires including sched.h on some setupsAndrey Konovalov2020-01-071-0/+1
|
* executor: fix IPVLAN_F_VEPA definition againDmitry Vyukov2020-01-031-2/+1
| | | | | | | | Now other machines failed with redefinition IPVLAN_F_VEPA. The #ifndef does not really work the way it should due to the way pkg/csource preprocesses sources. IPVLAN_F_VEPA is never defined during preprocessing. Let's try this.
generated by ggit (джигит) mrf-deployment (git 2.46.0) at 2026-03-12 05:23:54 +0000