aboutsummaryrefslogtreecommitdiffstats
path: root/executor/executor.cc
Commit message (Collapse)AuthorAgeFilesLines
* executor: fix remote coverage collectionAleksandr Nogikh2021-08-261-2/+0
| | | | | | | | | Currently the data_offset field of cover_t is only initialized for per-syscall coverage collection. As a result, remote coverage is read from an invalid location, fails to pass sanity checks and is not returned to syzkaller. Fix the initialization of cover_t fields.
* executor: initial darwin supportPatrick Meyer2021-05-201-3/+20
|
* executor, syz-fuzzer: fix readonly rootJoey Jiao2021-03-181-1/+11
|
* executor: don't fail on "negative running"Dmitry Vyukov2021-03-041-1/+1
| | | | | See #502 This still happens periodically.
* prog: detect copyout overflowDmitry Vyukov2021-03-041-1/+1
| | | | | | Detect the case when a program requires more copyout than executor can handle. Curretnly these result in: "SYZFAIL: command refers to bad result" failures. Now syz-fuzzer should ignore them.
* executor: improve SYZFAIL messageDmitry Vyukov2021-02-261-1/+1
| | | | | | | Print details and errno after SYZFAIL line. pkg/report captures output after SYZFAIL line, so it's better to have details after that line so that they are captured in report.
* pkg/report: detect executor failuresDmitry Vyukov2021-02-211-53/+66
| | | | | | | | | | | | Currently all executor fail errors go into "lost connection" bucket. This is not very useful. First, there are different executor failures. Second, it's not possible to understand what failures happen how frequently. Third, there are not authentic lost connection. Create separate SYZFAIL: bugs for them. Update #573 Update #502 Update #318
* executor: don't fail in syz_genetlink_get_family_idDmitry Vyukov2021-02-191-0/+2
| | | | | | | | | | We used to use our own netlink socket and then fail on any errors. But commit "sys/linux: add ieee802154 descriptions" made it possible to use fuzzer-provided socket, and fuzzer can pass any invalid fd. So don't fail on errors now. Fixes #2444
* sys/linux: add ieee802154 descriptionsDmitry Vyukov2021-02-121-0/+1
|
* all: make timeouts configurableDmitry Vyukov2020-12-281-4/+6
| | | | | | Add sys/targets.Timeouts struct that parametrizes timeouts throughout the system. The struct allows to control syscall/program/no output timeouts for OS/arch/VM/etc. See comment on the struct for more details.
* executor: remove hardcoded timeoutsDmitry Vyukov2020-12-251-10/+21
| | | | | In preparation for making timeouts tunable based on OS/arch/VM/etc de-hardcode all (almost) timeouts in executor.
* executor: don't use coverage edges for gvisorDmitry Vyukov2020-12-161-5/+3
| | | | gvisor coverage is not a trace, so producing edges won't work.
* executor: use coverage filter for comparisonsDmitry Vyukov2020-12-091-1/+1
| | | | | | Filter out all comparisons in non-interesting code. Comparisons are expensive, so it makes lots of sense, these filtered out can't give us any new interesting signal.
* executor: capture outgoing edges from interesting codeDmitry Vyukov2020-12-091-6/+10
| | | | | | | | | | Currently we capture only incoming edges into the interesting code when code coverage filter is used. Also capture outgoing edges. For code without indirect calls this does not matter as we always get the same edge. But for code with indirect edges we can capture more interesting coverage, and presumably different indirect calls are quite important.
* executor: minor coverage filter cleanupDmitry Vyukov2020-12-091-1/+1
| | | | | Slightly reduce number of ifdef's, define coverage_filter only in shmem mode and remove unnecessary cast.
* syz-manager/manager.go, executor/executor.cc: support coverage filterKaipeng Zeng2020-12-061-2/+9
|
* sys/linux, sys/freebsd: apply more ignore_return attributesDmitry Vyukov2020-12-051-6/+3
| | | | | | | | | | | | | | 1. Apply ignore_return to semctl$GETVAL which produces random errno values on linux and freebsd. 2. Apply ignore_return to prctl and remove the custom code in executor. 3. Remove the custom errno ignoring code in fuchsia executor. The calls are already marked as ignore_return, so this is just a leftover. 4. Only reset errno for ignore_return. The syscall can still return a resource (maybe). We only need to reset errno for fallback coverage.
* pkg/csource: setup sysctl's in C reproducersDmitry Vyukov2020-10-281-2/+1
| | | | | | Sysctl's are not captured as part of reproducers. This can result in failure to reproduce a bug on developer machine. Include sysctl setup as part of C reproducers.
* executor: increase prog_extra_cover_timeout for progs that inject 802.11 framesAleksandr Nogikh2020-10-051-1/+3
| | | | | This is required because we can only collect remote kcov coverage for these injected frames.
* executor: msvc support syz-executorSuraj K Suresh2020-10-031-6/+10
|
* executor: check for \n in fail/exitf messagesDmitry Vyukov2020-09-281-1/+1
|
* executor: make exit code during fail() depend on fault injectionAleksandr Nogikh2020-09-221-1/+24
| | | | | | | | | | | | | | | | | | | | | | fail()'s are often used during the validation of kernel reactions to queries that were issued by pseudo syscalls implementations. As fault injection may cause the kernel not to succeed in handling these queries (e.g. socket writes or reads may fail), this could ultimately lead to unwanted "lost connection to test machine" crashes. In order to avoid this and, on the other hand, to still have the ability to signal a disastrous situation, the exit code of this function now depends on the current context. All fail() invocations during system call execution with enabled fault injection lead to termination with zero exit code. In all other cases, the exit code is kFailStatus. This is achieved by introduction of a special thread-specific variable `current_thread` that allows to access information about the thread in which the current code is executing. Also, this commit eliminates current_cover as it is no longer needed.
* all: integrate with mac80211_hwsimAleksandr Nogikh2020-09-221-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Two virtual wireless devices are instantiated during network devices initialization. A new flag (-wifi) is added that controls whether these virtual wifi devices are instantiated and configured during proc initialization. Also, two new pseudo syscalls are added: 1. syz_80211_inject_frame(mac_addr, packet, packet_len) -- injects an arbitrary packet into the wireless stack. It is injected as if it originated from the device identitied by mac_addr. 2. syz_80211_join_ibss(interface_name, ssid, ssid_len, mode) -- puts a specific network interface into IBSS state and joins an IBSS network. Arguments of syz_80211_join_ibss: 1) interface_name -- null-terminated string that identifies a wireless interface 2) ssid, ssid_len -- SSID of an IBSS network to join to 3) mode -- mode of syz_80211_join_ibss operation (see below) Modes of operation: JOIN_IBSS_NO_SCAN (0x0) -- channel scan is not performed and syz_80211_join_ibss waits until the interface reaches IF_OPER_UP. JOIN_IBSS_BG_SCAN (0x1) -- channel scan is performed (takes ~ 9 seconds), syz_80211_join_ibss does not await IF_OPER_UP. JOIN_IBSS_BG_NO_SCAN (0x2) -- channel scan is not performed, syz_80211_join_ibss does not await IF_OPER_UP. Local testing ensured that these syscalls are indeed able to set up an operating network and inject packets into mac80211.
* sys/test/test: add a hanging testDmitry Vyukov2020-09-121-1/+1
| | | | Ensure that we can handle hanging syscalls in all modes.
* executor: warn about C89-style var declarationsDmitry Vyukov2020-08-141-4/+4
| | | | | | | | | | | | | | | | | We generally use the newer C99 var declarations combined with initialization because: - declarations are more local, reduced scope - fewer lines of code - less potential for using uninit vars and other bugs However, we have some relic code from times when we did not understand if we need to stick with C89 or not. Also some external contributions that don't follow style around. Add a static check for C89-style declarations and fix existing precedents. Akaros toolchain uses -std=gnu89 (or something) and does not allow variable declarations inside of for init statement. And we can't switch it to -std=c99 because Akaros headers are C89 themselves. So in common.h we need to declare loop counters outside of for.
* executor: add some code style checksDmitry Vyukov2020-08-061-1/+1
| | | | | | | Move the test from pkg/csource to executor/ in order to be able to (1) run it on *.cc files, (2) run on unprocessed *.h files, (3) produce line numbers. Add a check for missed space after //.
* all: initialize vhci in linuxTheOfficialFloW2020-07-301-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * all: initialize vhci in linux * executor/common_linux.h: improve vhci initialization * pkg/repro/repro.go: add missing vhci options * executor/common_linux.h: fix type and add missing header * executor, pkg: do it like NetInjection * pkg/csource/csource.go: do not emit syz_emit_vhci if vhci is not enabled * executor/common_linux.h: fix format string * executor/common_linux.h: initialize with memset For som reason {0} gets complains about missing braces... * executor/common_linux.h: simplify vhci init * executor/common_linux.h: try to bring all available hci devices up * executor/common_linux.h: find which hci device has been registered * executor/common_linux.h: use HCI_VENDOR_PKT response to retrieve device id * sys/linux/dev_vhci.txt: fix structs of inquiry and report packets * executor/common_linux.h: remove unnecessary return statement and check vendor_pkt read size * executor/common_linux.h: remove unnecessary return statement and check vendor_pkt read size * sys/linux/dev_vhci.txt: pack extended_inquiry_info_t * sys/linux/l2cap.txt: add l2cap_conf_opt struct * executor/common_linux.h: just fill bd addr will 0xaa * executor/common_linux.h: just fill bd addr will 0xaa
* executor: wrap all syscalls into NONFAILINGDmitry Vyukov2020-07-151-2/+5
| | | | | | | | | | | | | | | Currently we sprinkle NONFAILING all over pseudo-syscall code, around all individual accesses to fuzzer-generated pointers. This is tedious manual work and subject to errors. Wrap execute_syscall invocation with NONFAILING in execute_call once instead. Then we can remove NONFAILING from all pseudo-syscalls and never get back to this. Potential downsides: (1) this is coarser-grained and we will skip whole syscall on invalid pointer, but this is how normal syscalls work as well, so should not be a problem; (2) we will skip any clean up (closing of files, etc) as well; but this may be fine as well (programs can perfectly leave open file descriptors as well). Update #1918
* executor: fix bitfields for big-endian archAlexander Egorenkov2020-07-101-1/+11
| | | | | | | | Add bitfield tests for big-endian arch Issue: #1885 Signed-off-by: Alexander Egorenkov <Alexander.Egorenkov@ibm.com>
* executor: clarify debug/debug_verbose useDmitry Vyukov2020-07-081-1/+5
|
* executor: prohibit mallocDmitry Vyukov2020-07-081-0/+7
|
* executor: don't use static_assertDmitry Vyukov2020-06-251-1/+1
| | | | | Use existing way of doing size checks, otherwise akaros build is broken: https://github.com/google/syzkaller/pull/1868/checks?check_run_id=808613616
* executor: fix write_output_64Alexander Egorenkov2020-06-251-1/+7
| | | | | | The output pointer was not updated after writing. Signed-off-by: Alexander Egorenkov <Alexander.Egorenkov@ibm.com>
* ipc: fix endianness issuesAlexander Egorenkov2020-06-231-6/+13
| | | | | | | | Use native byte-order for IPC and program serialization. This way we will be able to support both little- and big-endian architectures. Signed-off-by: Alexander Egorenkov <Alexander.Egorenkov@ibm.com>
* executor: Improve used terminologyMarco Elver2020-06-151-1/+1
| | | | | | | | Improve used terminology by using better verbs to express the effect of the whitelist/blacklist. This also changes executor to exclusively show respectful log messages, and as per recent conversion, converts the last such case.
* all: use more respective languageDmitry Vyukov2020-06-111-2/+2
| | | | | | | | Some terms are normalised on the technical level but may be oppressive on a societal level. Replace them with more technically neutral terms. See the following doc for a longer version: https://tools.ietf.org/id/draft-knodel-terminology-00.html
* prog: add ignore_return and breaks_returns call attribtuesDmitry Vyukov2020-04-191-0/+4
| | | | | We had these hard-coded for fuchsia and linux accordingly. Replace with call attributes.
* sys/linux: sync call timeouts with executorDmitry Vyukov2020-04-191-1/+2
| | | | Timeouts in executor and sys/linux get out of sync. Sync them.
* sys/linux: add timeout call attributesDmitry Vyukov2020-04-191-24/+7
| | | | | | | Move additional call/prog timeouts to descriptions. Due to this logic duplication executor used 50ms for syz_mount_image, while pkg/csource used 100ms.
* prog: introduce call attributesDmitry Vyukov2020-04-191-0/+4
| | | | | | Add common infrastructure for syscall attributes. Add few attributes we want, but they are not implemented for now (don't affect behavior, this will follow).
* executor: surround the data mapping with PROT_NONE pagesDmitry Vyukov2020-04-181-1/+1
| | | | | | | | | | | Surround the main data mapping with PROT_NONE pages to make virtual address layout more consistent across different configurations (static/non-static build) and C repros. One observed case before: executor had a mapping above the data mapping (output region), while C repros did not have that mapping above, as the result in one case VMA had next link, while in the other it didn't and it caused a bug to not reproduce with the C repro. The bug that reproduces only with the mapping above: https://lkml.org/lkml/2020/4/17/819
* executor: fix format warningDmitry Vyukov2020-03-131-2/+2
|
* executor: add more debugging output for running=-1Dmitry Vyukov2020-03-131-1/+13
| | | | | | | | The running=-1 check fires periodically for the past 2 years. I can't reproduce nor understand how this happens. Add more debugging output, maybe it will shed some light. Update #502
* executor, sys/linux: add ath9k usb descriptionsAndrey Konovalov2020-03-131-2/+2
| | | | | | | Among other things this changes timeout for USB programs from 2 to 3 seconds. ath9k fuzzing also requires ath9k firmware to be present, so system images need to be regenerated with the updated script.
* executor: prevent "NMI handler took too long" messagesDmitry Vyukov2020-03-061-0/+4
| | | | | | | | nmi_check_duration() prints "INFO: NMI handler took too long" on slow debug kernels. It happens a lot in qemu, and the messages are frequently corrupted (intermixed with other kernel output as they are printed from NMI) and are not matched against the suppression in pkg/report. This write prevents these messages from being printed.
* executor: refactor extra cover handlingDmitry Vyukov2020-02-171-18/+16
| | | | | | | | | | | | | | | | | | | | | | | | | One observation is that checking for extra cover is very fast (effectively a memory load), so we can simplify code by removing th->extra_cover and just check for it always. Additionally, we may grab some coverage that we would miss otherwise. Don't sleep for 500 ms at the end if colliding, we are not going to use the extra coverage in that case anyway. Check for extra coverage at the end every 100ms to avoid being killed on timeout before we write any. Make the 500ms sleep at the end parametrizable. Enable it for syz_usb syscalls, so we get the same behavior for usb. But this also allows to get extra coverage for other subsystems. Some subsystems don't have a good way to detect if we will get any extra coverage or not. Sleeping for 500ms for all programs slows down fuzzing too much. So we check for extra coverage at the end for all programs (cheap anyway), but sleep only for usb program. This allows to collect extra coverage for vhost and maybe wireguard in future. Update #806
* executor: increase input buffer sizeDmitry Vyukov2020-02-101-1/+1
| | | | | | | I bumped input buffer size on Go side in: a2af37f0 prog: increase encodingexec buffer size But I forgot to increase the size on the executor side. Do this and add comments re keeping them in sync.
* executor: fix syz_mount_imageDmitry Vyukov2019-12-101-0/+2
| | | | | | | 1. It always crashed in cover_reset when coverage is disabled. 2. Use NONFAILING when accessing image segments. 3. Give it additional 100 ms as it may be slow. 4. Add a test for syz_mount_image.
* executor: refactor sandbox flagsDmitry Vyukov2019-11-161-25/+17
| | | | In preparation for future changes.
* executor: rename some flagsDmitry Vyukov2019-11-161-39/+39
| | | | | Rename some flags in preparation for subsequent changes which will align names across the code base.
generated by ggit (джигит) mrf-deployment (git 2.46.0) at 2026-03-12 05:37:37 +0000