aboutsummaryrefslogtreecommitdiffstats
path: root/executor/common_linux.h
Commit message (Collapse)AuthorAgeFilesLines
* executor: ignore EBADF when reading tunDmitry Vyukov2024-04-161-1/+2
| | | | | | | | | | | | Fuzzer managed to do: executing program 0: ... close_range(r5, 0xffffffffffffffff, 0x0) ... SYZFATAL: executor 0 failed 11 times: executor 0: exit status 67 SYZFAIL: tun read failed (errno 9: Bad file descriptor)
* executor: ignore socketpair error in syz_usbip_server_initDmitry Vyukov2024-04-161-2/+5
| | | | | | | | | | | | | | Fuzzer managed to do: executing program 4: ... prlimit64(0x0, 0x7, &(0x7f0000000000), 0x0) ... syz_usbip_server_init(0x3) ... SYZFATAL: executor 4 failed 11 times: executor 4: exit status 67 SYZFAIL: syz_usbip_server_init: socketpair failed (errno 24: Too many open files)
* executor: cleanup mounts with MNT_FORCEAleksandr Nogikh2024-04-101-4/+9
| | | | | | | | | | Starting from v6.9, we can no longer reuse a loop device while some filesystem is mounted on it. It conflicts with the MNT_DETACH approach we were previously using. Let's umount synchronously instead, but also with a MNT_FORCE flag to abort potentially long graceful cleanup operations. We don't need them for the filesystems mounted only for fuzzing purposes.
* executor: ignore ENOENT for socket callsDmitry Vyukov2024-04-021-0/+12
| | | | | | Don't treat ENOENT from socket call as fatal. Fuzzer manages to make all socket calls for a particular protocol fail using NLBL_MGMT_C_REMOVE netlink function.
* executor: temporarily disable IORING_SETUP_CQE32 and IORING_SETUP_SQE128Alexander Potapenko2024-03-051-1/+5
| | | | | | | | | | IORING_SETUP_CQE32 and IORING_SETUP_SQE128 may lead to incorrect assumptions about the ring buffer size, causing the kernel to write outside of the mapped memory, smashing whatever follows it. This is a hotfix for https://github.com/google/syzkaller/issues/4531 that will stop the ci-upstream-gce-arm64 from generating random coverage.
* executor: don't fail on setns() in pseudo syscallsAleksandr Nogikh2024-02-081-4/+10
| | | | | | | The fd may be closed by an async close() call, it's not a reason to report a failure. Reported-by: Andrei Vagin <avagin@google.com>
* executor: don't hold a loop device fdAleksandr Nogikh2024-01-121-5/+26
| | | | | | When BLK_DEV_WRITE_MOUNTED is enabled, the kernel treats the loopfd reference as a writer and does not let us issue mount() calls over the same block device.
* executor: prevent netlink_send_ext with dofail=trueAleksandr Nogikh2024-01-051-0/+7
| | | | | This should never be happening during fuzzing. Otherwise we let syz-executor silently crash and restart insane number of times.
* syz-executor: don't fail on netlink errors during fuzzingAleksandr Nogikh2024-01-051-21/+23
| | | | | | During fuzzing, it's expected that certain operations might return errors. Don't abort the whole syz-executor process in this case, this is too expensive.
* executor: introduce syz_pidfd_open()Aleksandr Nogikh2023-12-191-0/+18
| | | | | | | | | | | This kernel interface provides access to fds of other processes, which is readily abused by the fuzzer to mangle parent syz-executor fds. Pid=1 is the parent syz-executor process when PID namespace is created. Sanitize it in the new syz_pidfd_open() pseudo-syscall. We could not patch the argument in sys/linux/init.go because the first argument is a resource.
* sys/linux, pkg/host, executor: add NVMe-oF/TCP subsystem supportAlon Zahavi2023-12-071-2/+46
| | | | | Add new pseudo-syscall for creating a socket in init netns and connecting to NVMe-oF/TCP server on 127.0.0.1:4420. Also add descriptions for NVMe-oF/TCP.
* sys/io_uring, executor/common_linux: remove sqes_index in syz_io_uring_submitDylan Yudaken2023-07-301-17/+12
| | | | | | | | This parameter barely increases coverage since the tail is always set to the entry that is written, but it does increase the complexity of the api and seems to reduce coverage when I run it locally. Remove it.
* sys/linux/io_uring, executor/common_linux: fix io_uring segfaultDylan Yudaken2023-07-301-9/+7
| | | | | | | | | | In Linux 6.4+ it is not allowed to provide a vma to mmap(2) [1]. Change the API to request the address from the Kernel. Note I do not know why this was done in the first place, but it seems not to be useful. [1]: https://github.com/torvalds/linux/commit/d808459b2e31bd5123a14258a7a529995db974c8
* executor: include missing linux/falloc.hKhem Raj2023-06-201-0/+1
| | | | | | | | | | | | | | Its needed for FALLOC_FL_ZERO_RANGE which needs this header, it works with glibc because fcntl.h includes this header indirectly, however the failure comes to fore with musl C library where this header is not included indirectly by other system headers, therefore include it as required. Fixes In file included from executor/common.h:505: executor/common_linux.h:5604:16: error: use of undeclared identifier 'FALLOC_FL_ZERO_RANGE' fallocate(fd, FALLOC_FL_ZERO_RANGE, 0, SWAP_FILE_SIZE); ^
* all: support swap feature on LinuxAleksandr Nogikh2023-06-151-9/+52
| | | | | If the feature is supported on the device, allocate a 128MB swap file after VM boot and activate it.
* executor: use exitf instead of fail outside of setup sequence (#3959)Andrei Vagin2023-06-151-1/+1
| | | | | | | | | | | | | | | We have a long history of executor managing to corrupt itself in various interesting ways (e.g. using read with a pointer pointing to some global/stack variable and then kernel overwrites it). Or rt_sigreturn can corrupt other registers which won't cause immediate SIGSEGV, but rather some random behavior later. This is the race we can't win. We can't rely on memory consistency when the test already started, so we should use exitf instead of fail outside of setup sequence (and relying more on unit testing to ensure that executor works as expected for sane programs). Suggested-by: Dmitry Vyukov <dvyukov@google.com> Signed-off-by: Andrei Vagin <avagin@google.com>
* executor: use v1 memory cgroup controllerAleksandr Nogikh2023-06-141-16/+14
| | | | | | | Given that we must chose only one version, fuzzing v1 of itseems to be of higher value at the moment. Later we might make it a configurable option and do both version.
* executor: resolve pseudo syscall compilation problemsAleksandr Nogikh2023-05-041-1/+6
|
* sys/linux: add syz_pkey_set syscallsDmitry Vyukov2023-04-031-0/+24
| | | | The syscall sets PKRU register which is part of protection keys (pkey).
* executor: fix initialize_tun() for Android (#3656)kalder2023-02-061-4/+8
| | | | | | | | Android devices often fail during the initial check with the error: SYZFAIL: tun: ioctl(TUNSETIFF) failed We need the same namespacing here that is used for other sandboxing configurations.
* vm/starnix: add support for fuzzing starnix (#3624)juanPabloMiceli2023-01-191-7/+7
| | | | | | | This commit adds a new VM for fuzzing starnix. The VM will boot a fuchsia image using the `ffx` tool and will connect to an adb server inside it. Fuzzing will be done using HostFuzzer mode due to some features not being implemented yet in starnix. Once this is possible, fuzzing will be performed without HostFuzzer mode. Co-authored-by: Juampi Miceli <jpmiceli@google.com>
* executor: better prevent the panic on ext4 errors (#3604)Aleksandr Nogikh2023-01-031-1/+9
| | | | We already suppress them, but the current approach fails if syzkaller slightly corrupts the options string. Do the check more rigorously.
* executor: simplify setup_loop_deviceDmitry Vyukov2022-11-231-8/+6
| | | | | We can close memfd as soon as we passed it to LOOP_SET_FD (it holds a reference to the file).
* executor: don't reset loop device on partition scan successDmitry Vyukov2022-11-231-1/+2
| | | | | | We symlink resulting partitions into the test dir. If we do LOOP_CLR_FD, device and partitions disappear. Don't do LOOP_CLR_FD on success.
* executor: don't pass uncompressed zlib sizeDmitry Vyukov2022-11-231-17/+10
| | | | | | This will allow us to mutate the image size. Fixes #3527
* executor: fix puff_zlib_to_file signatureDmitry Vyukov2022-11-231-3/+3
| | | | | | In executor code we commonly use the syscall interface for functions: return -1 on erorr and set errno. Use this interface for puff_zlib_to_file.
* executor: update to match the new `syz_mount_image` callHrutvik Kanabar2022-11-211-27/+35
| | | | | | Update the executor to handle the new `syz_mount_image`/`syz_part_table` pseudo-syscalls. It now expects compressed images, and decompresses them using the new `common_zlib.h` header file before mounting.
* executor: fix "wrong response packet" in BT fuzzing (#3493)Tamas Koczka2022-11-071-11/+37
| | | | | | | | | | | | | | | | | | Problem: the BT initialization logic (`initialize_vhci()` in `common_linux.h`) expected `HCI_VENDOR_PKT` to be sent first, but this is not always the case as the kernel sends these two packets almost at the same time (both are sent as the result of the `open("/dev/vhci", …)` call): * syscall thread: `HCI_VENDOR_PKT` (in `__vhci_create_device`) * `power_on` queue thread: `HCI_OP_RESET` (from `hci_reset_sync` <- `hci_init1_sync` <- `hci_init_sync` <- `hci_dev_open_sync` <- `hci_dev_do_open` <- `hci_power_on` <- `hdev->power_on` <- (worker queue) <- `hci_register_dev` <- `__vhci_create_device`) Solution: handle both `HCI_OP_RESET` and `HCI_VENDOR_PKT` packets in `initialize_vhci`. Also instead of waiting for the kernel to send `HCI_VENDOR_PKT` after 1 second, we initiate the setup by sending `HCI_VENDOR_PKT` (request) to the kernel first.
* executor: enable core dumpsDmitry Vyukov2022-10-071-1/+2
| | | | | | | | Core dumping known to have bugs. Just few recent kernel commits: [brown paperbag] fix coredump breakage [coredump] don't use __kernel_write() on kmap_local_page() We also also found some info leaks in core dumps before. No reason to not test them.
* executor: move syz_mount_image's sanity checks to syz-fuzzerAleksandr Nogikh2022-09-271-23/+0
| | | | | It will simplify the C code and let us extract the raw images in a more convenient way.
* executor: add NIC PCI pass-through VF supportGeorge Kennedy2022-09-211-76/+217
| | | | | | | | | | | | | | | Add support for moving a NIC PCI pass-through VF into Syzkaller's network namespace so that it will tested. As DEVLINK support is triggered by setting the pass-through device to "addr=0x10", NIC PCI pass-through VF support will be triggered by setting the device to "addr=0x11". If a NIC PCI pass-through VF is detected in do_sandbox, setup a staging namespace before the fork() and transfer the NIC VF interface to it. After the fork() and in the child transfer the NIC VF interface to Syzkaller's network namespace and rename the interface to netpci0 so that it will be tested. Signed-off-by: George Kennedy <george.kennedy@oracle.com>
* sys/linux, tools/syz-imagegen: allow `syz_mount_image` to change directoryHrutvik Kanabar2022-09-131-2/+10
| | | | | | | | | | | | | | | | | | | | Add a boolean argument to the `syz_mount_image` pseudo-syscall. When this is true, `syz_mount_image` will change directory to the mountpoint after mounting the image passed. Experimentation suggests that to reproduce many non-`ext4` filesystem bugs, it is sufficient to mount the filesystem within an `ext4`-based VM and then change directory to the mountpoint before executing code. This change aims to increase the probability that a mount operation will be succeeded by the corresponding change in directory, and so increase the probability of finding non-`ext4` bugs. We also have to update the `syz-imagegen` tool. Now it generates seed `syz_mount_image` calls with change of directory enabled. The previous behaviour (i.e. no change of directory) will be recovered by use of existing corpuses and fuzzing the change-of-directory argument. The next commit will regenerate all `syz_mount_image` seeds.
* executor: fix setup of netdevsim deviceDmitry Vyukov2022-09-091-7/+8
| | | | | | | | | | 2 fixed: 1. netdevsim devices cannot be created via NETLINK anymore: https://elixir.bootlin.com/linux/v6.0-rc4/source/drivers/net/netdevsim/netdev.c#L397 But we already create them via /sys/bus/netdevsim/new_device, so just remove the netlink creation. 2. These devices are sticky and are not removed on net namspace destruction, so delete the previous version explicitly.
* executor: fix setup of xfrm deviceDmitry Vyukov2022-09-091-12/+29
| | | | | | | | | | XFRM device creation will fail w/o IFLA_XFRM_IF_ID attribute: https://elixir.bootlin.com/linux/v6.0-rc4/source/net/xfrm/xfrm_interface.c#L648 Add this attribute. This ID is also present in descriptions in at least 2 places. In one we got it wrong, it's not ifindex (easy to confuse because of the name). Fix it as well.
* Revert "pkg/csource: inline void* cast into generated code"Dmitry Vyukov2022-09-061-0/+4
| | | | | | | This reverts commit 922294abb4c0bc72b24d8526d625110d73fa1b5a. The commit reported to cause old warnings on s390x: https://github.com/google/syzkaller/commit/922294abb4c0bc72b24d8526d625110d73fa1b5a#commitcomment-83096994
* pkg/csource: inline void* cast into generated codeGreg Steuck2022-09-051-3/+0
| | | | | The previous indirection via conditional macros in platform specific places was needless obfuscation.
* pkg/csource, pkg/instance, pkg/ipc, pkg/mgrconfig, tools/syz-prog2c, ↵Andrey Artemiev2022-08-061-5/+6
| | | | syz-manager: introduce a new setting 'sandbox_arg' (#3263)
* executor: fixed fuzzing with System account in Android sandbox (#3275)Andrey Artemiev2022-08-051-1/+2
|
* vm/adb: wait for Android boot to finishAndrey Artemiev2022-07-251-5/+1
| | | | executor: removed condition around tun init
* executor: fix mounting of cgroups on read-only fsDmitry Vyukov2022-07-211-23/+33
| | | | | | If root fs is read-only, mkdir(/syzcgroup) will fail and a later rmdir(/syzcgroup/unified) will fail with ENOENT which we don't expect and fail. Return early if mkdir(/syzcgroup) fails.
* executor: added code to run Android with System accountAndrey Artemiev2022-07-191-11/+36
|
* executor: prevent ENOSPC if cgroup mount failsDmitry Vyukov2022-07-151-1/+15
| | | | | | Remove /syzcgroup/* if cgroup mount fails. See #3241 for context. Fixes #3241
* executor: fix enabling of ICMP/ping socketsDmitry Vyukov2022-06-201-1/+4
| | | | | | | | | | net/ipv4/ping_group_range sysctl grants access to ICMP sockets to the specified user groups. But it needs to be set inside of the net namespace (it's per-namespace). We were setting it but in the init namespace only (which we don't use). Set it after CLONE_NEWNET. This repairs testing of ICMP sockets. Note: don't set it for setuid sandbox since it's "low privilege".
* executor: fixed sandbox 'android'Andrey Artemiev2022-06-031-1/+2
|
* executor: include sched.h for syz_cloneAndrei Vagin2022-05-271-0/+2
| | | | | | | | | | | | | | | | syzkaller reports the following error when it tries to create a C reproducer: <stdin>: In function ‘syz_clone’: <stdin>:289:48: error: ‘CLONE_VM’ undeclared (first use in this function) <stdin>:289:48: note: each undeclared identifier is reported only once for each function it appears in compiler invocation: gcc [-o /tmp/syz-executor3459695007 -DGOOS_linux=1 -DGOARCH_amd64=1 -DHOSTGOOS_linux=1 -x c - -m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -static-pie -fpermissive -w]
* executor: applied Bionic patchAndrey Artemiev2022-04-131-0/+29
|
* executor: tolerate syz_genetlink_get_family_id failuresAleksandr Nogikh2022-02-251-4/+1
| | | | | | | | | | We cannot expect syscalls to always succeed during fuzzing, especially when the situation involves a complex interaction with the system. For the syz_genetlink_get_family_id case, it leads to numerous SYZFAIL crashes every day. Don't print a SYZFAIL error for this pseudo syscall.
* executor: fail on SEGV during clone()Aleksandr Nogikh2022-01-211-1/+11
| | | | | | | | | | | | | | | As was found out in #2921, fork bombs are still possible in Linux-based instances. One of the possible reasons is described below. An invalid stack can be passed to the clone() call, thus causing it to stumble on an invalid memory access right during returning from the clone() call. This is in turn catched by the NONFAILING() macro and the control actually jumps over it and eventually both the child and the parent continue executing the same code. Prevent it by handling SIGSEGV and SIGBUS differently during the clone process. Co-authored-by: Andrei Vagin <avagin@google.com>
* all: add syz_clone() and syz_clone3() pseudo callsAleksandr Nogikh2022-01-131-0/+59
| | | | | | | | | | | | | | | | | | | | As was pointed out in #2921, the current approach of limiting the number of pids per process does not work on all Linux-based kernels. We could just treat fork, clone and clone3 in a special way (e.g. exit on a zero return). However, in that case we also need to sanitize the arguments for clone and clone3 - if CLONE_VM is passed and stack is 0, the forked child processes (threads) will become nearly unindentifiable and will corrupt syz-executor's memory. While we could sanitize clone's arguments, we cannot do so for clone3 - nothing can guarantee that they will not be changed concurrently. Instead of calling those syscalls directly, introduce a special pseudo syscall syz_clone3. It copies and sanitizes the arguments and then executes clone3 (or fork, if we're on an older kernel) in such a way so as to prevent fork bombs from happening. Also introduce syz_clone() to still be able to fuzz it on older systems.
* executor: remove custom sys_io_uring_setup definitionAleksandr Nogikh2022-01-131-7/+1
|
generated by ggit (джигит) mrf-deployment (git 2.46.0) at 2026-03-12 09:00:35 +0000