aboutsummaryrefslogtreecommitdiffstats
path: root/executor/executor.cc
Commit message (Collapse)AuthorAgeFilesLines
* sys/test/test: add a hanging testDmitry Vyukov2020-09-121-1/+1
| | | | Ensure that we can handle hanging syscalls in all modes.
* executor: warn about C89-style var declarationsDmitry Vyukov2020-08-141-4/+4
| | | | | | | | | | | | | | | | | We generally use the newer C99 var declarations combined with initialization because: - declarations are more local, reduced scope - fewer lines of code - less potential for using uninit vars and other bugs However, we have some relic code from times when we did not understand if we need to stick with C89 or not. Also some external contributions that don't follow style around. Add a static check for C89-style declarations and fix existing precedents. Akaros toolchain uses -std=gnu89 (or something) and does not allow variable declarations inside of for init statement. And we can't switch it to -std=c99 because Akaros headers are C89 themselves. So in common.h we need to declare loop counters outside of for.
* executor: add some code style checksDmitry Vyukov2020-08-061-1/+1
| | | | | | | Move the test from pkg/csource to executor/ in order to be able to (1) run it on *.cc files, (2) run on unprocessed *.h files, (3) produce line numbers. Add a check for missed space after //.
* all: initialize vhci in linuxTheOfficialFloW2020-07-301-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * all: initialize vhci in linux * executor/common_linux.h: improve vhci initialization * pkg/repro/repro.go: add missing vhci options * executor/common_linux.h: fix type and add missing header * executor, pkg: do it like NetInjection * pkg/csource/csource.go: do not emit syz_emit_vhci if vhci is not enabled * executor/common_linux.h: fix format string * executor/common_linux.h: initialize with memset For som reason {0} gets complains about missing braces... * executor/common_linux.h: simplify vhci init * executor/common_linux.h: try to bring all available hci devices up * executor/common_linux.h: find which hci device has been registered * executor/common_linux.h: use HCI_VENDOR_PKT response to retrieve device id * sys/linux/dev_vhci.txt: fix structs of inquiry and report packets * executor/common_linux.h: remove unnecessary return statement and check vendor_pkt read size * executor/common_linux.h: remove unnecessary return statement and check vendor_pkt read size * sys/linux/dev_vhci.txt: pack extended_inquiry_info_t * sys/linux/l2cap.txt: add l2cap_conf_opt struct * executor/common_linux.h: just fill bd addr will 0xaa * executor/common_linux.h: just fill bd addr will 0xaa
* executor: wrap all syscalls into NONFAILINGDmitry Vyukov2020-07-151-2/+5
| | | | | | | | | | | | | | | Currently we sprinkle NONFAILING all over pseudo-syscall code, around all individual accesses to fuzzer-generated pointers. This is tedious manual work and subject to errors. Wrap execute_syscall invocation with NONFAILING in execute_call once instead. Then we can remove NONFAILING from all pseudo-syscalls and never get back to this. Potential downsides: (1) this is coarser-grained and we will skip whole syscall on invalid pointer, but this is how normal syscalls work as well, so should not be a problem; (2) we will skip any clean up (closing of files, etc) as well; but this may be fine as well (programs can perfectly leave open file descriptors as well). Update #1918
* executor: fix bitfields for big-endian archAlexander Egorenkov2020-07-101-1/+11
| | | | | | | | Add bitfield tests for big-endian arch Issue: #1885 Signed-off-by: Alexander Egorenkov <Alexander.Egorenkov@ibm.com>
* executor: clarify debug/debug_verbose useDmitry Vyukov2020-07-081-1/+5
|
* executor: prohibit mallocDmitry Vyukov2020-07-081-0/+7
|
* executor: don't use static_assertDmitry Vyukov2020-06-251-1/+1
| | | | | Use existing way of doing size checks, otherwise akaros build is broken: https://github.com/google/syzkaller/pull/1868/checks?check_run_id=808613616
* executor: fix write_output_64Alexander Egorenkov2020-06-251-1/+7
| | | | | | The output pointer was not updated after writing. Signed-off-by: Alexander Egorenkov <Alexander.Egorenkov@ibm.com>
* ipc: fix endianness issuesAlexander Egorenkov2020-06-231-6/+13
| | | | | | | | Use native byte-order for IPC and program serialization. This way we will be able to support both little- and big-endian architectures. Signed-off-by: Alexander Egorenkov <Alexander.Egorenkov@ibm.com>
* executor: Improve used terminologyMarco Elver2020-06-151-1/+1
| | | | | | | | Improve used terminology by using better verbs to express the effect of the whitelist/blacklist. This also changes executor to exclusively show respectful log messages, and as per recent conversion, converts the last such case.
* all: use more respective languageDmitry Vyukov2020-06-111-2/+2
| | | | | | | | Some terms are normalised on the technical level but may be oppressive on a societal level. Replace them with more technically neutral terms. See the following doc for a longer version: https://tools.ietf.org/id/draft-knodel-terminology-00.html
* prog: add ignore_return and breaks_returns call attribtuesDmitry Vyukov2020-04-191-0/+4
| | | | | We had these hard-coded for fuchsia and linux accordingly. Replace with call attributes.
* sys/linux: sync call timeouts with executorDmitry Vyukov2020-04-191-1/+2
| | | | Timeouts in executor and sys/linux get out of sync. Sync them.
* sys/linux: add timeout call attributesDmitry Vyukov2020-04-191-24/+7
| | | | | | | Move additional call/prog timeouts to descriptions. Due to this logic duplication executor used 50ms for syz_mount_image, while pkg/csource used 100ms.
* prog: introduce call attributesDmitry Vyukov2020-04-191-0/+4
| | | | | | Add common infrastructure for syscall attributes. Add few attributes we want, but they are not implemented for now (don't affect behavior, this will follow).
* executor: surround the data mapping with PROT_NONE pagesDmitry Vyukov2020-04-181-1/+1
| | | | | | | | | | | Surround the main data mapping with PROT_NONE pages to make virtual address layout more consistent across different configurations (static/non-static build) and C repros. One observed case before: executor had a mapping above the data mapping (output region), while C repros did not have that mapping above, as the result in one case VMA had next link, while in the other it didn't and it caused a bug to not reproduce with the C repro. The bug that reproduces only with the mapping above: https://lkml.org/lkml/2020/4/17/819
* executor: fix format warningDmitry Vyukov2020-03-131-2/+2
|
* executor: add more debugging output for running=-1Dmitry Vyukov2020-03-131-1/+13
| | | | | | | | The running=-1 check fires periodically for the past 2 years. I can't reproduce nor understand how this happens. Add more debugging output, maybe it will shed some light. Update #502
* executor, sys/linux: add ath9k usb descriptionsAndrey Konovalov2020-03-131-2/+2
| | | | | | | Among other things this changes timeout for USB programs from 2 to 3 seconds. ath9k fuzzing also requires ath9k firmware to be present, so system images need to be regenerated with the updated script.
* executor: prevent "NMI handler took too long" messagesDmitry Vyukov2020-03-061-0/+4
| | | | | | | | nmi_check_duration() prints "INFO: NMI handler took too long" on slow debug kernels. It happens a lot in qemu, and the messages are frequently corrupted (intermixed with other kernel output as they are printed from NMI) and are not matched against the suppression in pkg/report. This write prevents these messages from being printed.
* executor: refactor extra cover handlingDmitry Vyukov2020-02-171-18/+16
| | | | | | | | | | | | | | | | | | | | | | | | | One observation is that checking for extra cover is very fast (effectively a memory load), so we can simplify code by removing th->extra_cover and just check for it always. Additionally, we may grab some coverage that we would miss otherwise. Don't sleep for 500 ms at the end if colliding, we are not going to use the extra coverage in that case anyway. Check for extra coverage at the end every 100ms to avoid being killed on timeout before we write any. Make the 500ms sleep at the end parametrizable. Enable it for syz_usb syscalls, so we get the same behavior for usb. But this also allows to get extra coverage for other subsystems. Some subsystems don't have a good way to detect if we will get any extra coverage or not. Sleeping for 500ms for all programs slows down fuzzing too much. So we check for extra coverage at the end for all programs (cheap anyway), but sleep only for usb program. This allows to collect extra coverage for vhost and maybe wireguard in future. Update #806
* executor: increase input buffer sizeDmitry Vyukov2020-02-101-1/+1
| | | | | | | I bumped input buffer size on Go side in: a2af37f0 prog: increase encodingexec buffer size But I forgot to increase the size on the executor side. Do this and add comments re keeping them in sync.
* executor: fix syz_mount_imageDmitry Vyukov2019-12-101-0/+2
| | | | | | | 1. It always crashed in cover_reset when coverage is disabled. 2. Use NONFAILING when accessing image segments. 3. Give it additional 100 ms as it may be slow. 4. Add a test for syz_mount_image.
* executor: refactor sandbox flagsDmitry Vyukov2019-11-161-25/+17
| | | | In preparation for future changes.
* executor: rename some flagsDmitry Vyukov2019-11-161-39/+39
| | | | | Rename some flags in preparation for subsequent changes which will align names across the code base.
* executor: move fixed pci devlink handle into network namespaceJiri Pirko2019-11-031-0/+2
| | | | | | | | In case there is a fixed pci devlink handle "pci/pci/0000:00:10.0" on the system (initial network namespace), it is moved to a working network namespace. Signed-off-by: Jiri Pirko <jiri@mellanox.com>
* syz-fuzzer, executor: Add support for blacklisting data race framesMarco Elver2019-10-221-0/+8
| | | | | This adds support to add frames that have already been in data races, to the KCSAN report blacklist.
* executor, csource: adjust syz_open_dev$hiddev timeoutAndrey Konovalov2019-09-241-0/+2
| | | | Looks like opening hiddev can take up to ~100 ms.
* executor: fix out-of-bounds access to syscalls arrayAndrey Konovalov2019-09-171-20/+20
| | | | | Move accessing syscalls array to check for USB syscalls after we validate the call_num value (it can be e.g. instr_copyin/out).
* executor: add some USB realted TODOs (#1319)Andrey Konovalov2019-08-071-14/+7
| | | Also simplify timeout related code a bit.
* sys/linux, executor: add syz_usb_ep_read syzkallAndrey Konovalov2019-07-011-2/+10
| | | | syz_usb_ep_read reads data from USB endpoints other than #0.
* sys/linux, executor: add basic USB HID fuzzing supportAndrey Konovalov2019-06-241-6/+14
| | | | | This commit adds the necessary descriptions and executor adjustments to enable targeted fuzzing of the enumeration process of USB HID devices.
* executor: improve usb coverage attributionAndrey Konovalov2019-06-121-9/+18
| | | | | Always call write_extra_output() only if the current program or call can produce extra coverage (== is a syz_usb* syzcall).
* executor: Protect the coverage bufferAndrew Turner2019-06-041-0/+6
| | | | | | | | | Add functions to protect and unprotect the coverage buffer. The buffer is protected from being written to while tracing. When the trace data is sorted we need to make it read/write, but can return it to read only after this has completed. Leave the first page as read/write as we need to clear the length field.
* pkg/csource: generate timeouts for USB syzcallsAndrey Konovalov2019-05-311-0/+1
| | | | This patch only covers per call timeouts, per prog one is not adjusted yet.
* executor: implement support for leak checkingDmitry Vyukov2019-05-201-9/+43
| | | | | | | | | | | | | | | | | | | | | | | | | Leak checking support was half done and did not really work. This is heavy-lifting to make it work. 1. Move leak/fault setup into executor. pkg/host was a wrong place for them because we need then in C repros too. The pkg/host periodic callback functionality did not work too, we need it in executor so that we can reuse it in C repros too. Remove setup/callback functions in pkg/host entirely. 2. Do leak setup/checking in C repros. The way leak checking is invoked is slightly different from fuzzer, but much better then no support at all. At least the checking code is shared. 3. Add Leak option to pkg/csource and -leak flag to syz-prog2c. 4. Don't enalbe leak checking in fuzzer while we are triaging initial corpus. It's toooo slow. 5. Fix pkg/repro to do something more sane for leak bugs. Few other minor fixes here and there.
* executor: fix 32-bit buildDmitry Vyukov2019-05-071-3/+3
| | | | | Syscall args can't be printed with %lx now. Cast them to uint64 for now since we have only 2 such places.
* executor: change syscall argument type to intptr_tmunjinoo2019-05-071-4/+4
| | | | | The type size of long depends on compiler. Therefore, changing to intptr_t makes it depends on architecture.
* executor: adjust waiting time for all usb syzcallsAndrey Konovalov2019-04-231-8/+14
| | | | | | Allow 2000 ms of waiting time for syz_usb_connect and and the same time for the whole program is this syzkall is present. Allow 200 ms of waiting time for syz_usb_disconnect. Remove sleep from syz_usb_control_io.
* all: add basic USB fuzzing supportAndrey Konovalov2019-04-111-1/+14
| | | | | | | | | | | | This commits implements 4 syzcalls: syz_usb_connect, syz_usb_io_control, syz_usb_ep_write and syz_usb_disconnect. Those syzcalls are used to emit USB packets through a custom GadgetFS-like interface (currently exposed at /sys/kernel/debug/usb-fuzzer), which requires special kernel patches. USB fuzzing support is quite basic, as it mostly covers only the USB device enumeration process. Even though the syz_usb_ep_write syzcall does allow to communicate with USB endpoints after the device has been enumerated, no coverage is collected from that code yet.
* all: add optional close_fds feature to reproducersAndrey Konovalov2019-04-091-0/+6
| | | | | | | | Instead of always closing open fds (number 3 to 30) after each program, add an options called EnableCloseFds. It can be passed to syz-execprog, syz-prog2c and syz-stress via the -enable and -disable flags. Set the default value to true. Also minimize C repros over it, except for when repeat is enabled.
* execprog, stress, prog2c: unify flags to enable additional featuresAndrey Konovalov2019-03-051-6/+12
| | | | | | | | | | | This change makes all syz-execprog, syz-prog2c and syz-stress accept -enable and -disable flags to enable or disable additional features (tun, net_dev, net_reset, cgroups and binfmt_misc) instead of having a separate flag for each of them. The default (without any flags) behavior isn't changed: syz-execprog and syz-stress enabled all the features (provided the runtime supports them) and syz-prog2c disables all of them.
* executor: fix detection of blocked callsDmitry Vyukov2019-02-131-2/+1
| | | | | Unfinished calls are always blocked too, so set the blocked flag for unfinished calls.
* executor, pkg/ipc: simplify retry handlingDmitry Vyukov2019-01-311-16/+8
| | | | | | Remove kRetryStatus, it's effectively the same as exiting with 0. Remove ipc.ExecutorFailure, nobody uses it. Simplify few other minor things around exit status handling.
* executor: remove ability to detect kernel bugsDmitry Vyukov2019-01-311-16/+1
| | | | | | | | This ability was never used but we maintain a bunch of code for it. syzkaller also recently learned to spoof this error code with some ptrace magic (probably intercepted control flow again and exploited executor binary). Drop all of it.
* executor: unbreak on OpenBSDAnton Lindqvist2019-01-191-1/+0
| | | | | | | Commit b5df78dc ("all: support extra coverage") broke the executor on OpenBSD: executor/executor.cc:61:11: error: unused variable 'kExtraCoverSize' [-Werror,-Wunused-const-variable] const int kExtraCoverSize = 256 << 10;
* all: detect extra coverage supportAndrey Konovalov2019-01-161-4/+9
| | | | Based on whether the kernel supports KCOV_REMOTE_ENABLE ioctl.
* all: support extra coverageAndrey Konovalov2019-01-161-16/+55
| | | | | | | | | | | | | | | Right now syzkaller only supports coverage collected from the threads that execute syscalls. However some useful things happen in background threads, and it would be nice to collect coverage from those threads as well. This change adds extra coverage support to syzkaller. This coverage is not associated with a particular syscall, but rather with the whole program. Executor passes extra coverage over the same ipc mechanism to syz-fuzzer with syscall number set to -1. syz-fuzzer then passes this coverage to syz-manager with the call name "extra". This change requires the following kcov patch: https://github.com/xairy/linux/pull/2
generated by ggit (джигит) mrf-deployment (git 2.46.0) at 2026-03-12 01:14:44 +0000