aboutsummaryrefslogtreecommitdiffstats
path: root/executor/executor.cc
Commit message (Collapse)AuthorAgeFilesLines
* pkg/csource: setup sysctl's in C reproducersDmitry Vyukov2020-10-281-2/+1
| | | | | | Sysctl's are not captured as part of reproducers. This can result in failure to reproduce a bug on developer machine. Include sysctl setup as part of C reproducers.
* executor: increase prog_extra_cover_timeout for progs that inject 802.11 framesAleksandr Nogikh2020-10-051-1/+3
| | | | | This is required because we can only collect remote kcov coverage for these injected frames.
* executor: msvc support syz-executorSuraj K Suresh2020-10-031-6/+10
|
* executor: check for \n in fail/exitf messagesDmitry Vyukov2020-09-281-1/+1
|
* executor: make exit code during fail() depend on fault injectionAleksandr Nogikh2020-09-221-1/+24
| | | | | | | | | | | | | | | | | | | | | | fail()'s are often used during the validation of kernel reactions to queries that were issued by pseudo syscalls implementations. As fault injection may cause the kernel not to succeed in handling these queries (e.g. socket writes or reads may fail), this could ultimately lead to unwanted "lost connection to test machine" crashes. In order to avoid this and, on the other hand, to still have the ability to signal a disastrous situation, the exit code of this function now depends on the current context. All fail() invocations during system call execution with enabled fault injection lead to termination with zero exit code. In all other cases, the exit code is kFailStatus. This is achieved by introduction of a special thread-specific variable `current_thread` that allows to access information about the thread in which the current code is executing. Also, this commit eliminates current_cover as it is no longer needed.
* all: integrate with mac80211_hwsimAleksandr Nogikh2020-09-221-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Two virtual wireless devices are instantiated during network devices initialization. A new flag (-wifi) is added that controls whether these virtual wifi devices are instantiated and configured during proc initialization. Also, two new pseudo syscalls are added: 1. syz_80211_inject_frame(mac_addr, packet, packet_len) -- injects an arbitrary packet into the wireless stack. It is injected as if it originated from the device identitied by mac_addr. 2. syz_80211_join_ibss(interface_name, ssid, ssid_len, mode) -- puts a specific network interface into IBSS state and joins an IBSS network. Arguments of syz_80211_join_ibss: 1) interface_name -- null-terminated string that identifies a wireless interface 2) ssid, ssid_len -- SSID of an IBSS network to join to 3) mode -- mode of syz_80211_join_ibss operation (see below) Modes of operation: JOIN_IBSS_NO_SCAN (0x0) -- channel scan is not performed and syz_80211_join_ibss waits until the interface reaches IF_OPER_UP. JOIN_IBSS_BG_SCAN (0x1) -- channel scan is performed (takes ~ 9 seconds), syz_80211_join_ibss does not await IF_OPER_UP. JOIN_IBSS_BG_NO_SCAN (0x2) -- channel scan is not performed, syz_80211_join_ibss does not await IF_OPER_UP. Local testing ensured that these syscalls are indeed able to set up an operating network and inject packets into mac80211.
* sys/test/test: add a hanging testDmitry Vyukov2020-09-121-1/+1
| | | | Ensure that we can handle hanging syscalls in all modes.
* executor: warn about C89-style var declarationsDmitry Vyukov2020-08-141-4/+4
| | | | | | | | | | | | | | | | | We generally use the newer C99 var declarations combined with initialization because: - declarations are more local, reduced scope - fewer lines of code - less potential for using uninit vars and other bugs However, we have some relic code from times when we did not understand if we need to stick with C89 or not. Also some external contributions that don't follow style around. Add a static check for C89-style declarations and fix existing precedents. Akaros toolchain uses -std=gnu89 (or something) and does not allow variable declarations inside of for init statement. And we can't switch it to -std=c99 because Akaros headers are C89 themselves. So in common.h we need to declare loop counters outside of for.
* executor: add some code style checksDmitry Vyukov2020-08-061-1/+1
| | | | | | | Move the test from pkg/csource to executor/ in order to be able to (1) run it on *.cc files, (2) run on unprocessed *.h files, (3) produce line numbers. Add a check for missed space after //.
* all: initialize vhci in linuxTheOfficialFloW2020-07-301-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * all: initialize vhci in linux * executor/common_linux.h: improve vhci initialization * pkg/repro/repro.go: add missing vhci options * executor/common_linux.h: fix type and add missing header * executor, pkg: do it like NetInjection * pkg/csource/csource.go: do not emit syz_emit_vhci if vhci is not enabled * executor/common_linux.h: fix format string * executor/common_linux.h: initialize with memset For som reason {0} gets complains about missing braces... * executor/common_linux.h: simplify vhci init * executor/common_linux.h: try to bring all available hci devices up * executor/common_linux.h: find which hci device has been registered * executor/common_linux.h: use HCI_VENDOR_PKT response to retrieve device id * sys/linux/dev_vhci.txt: fix structs of inquiry and report packets * executor/common_linux.h: remove unnecessary return statement and check vendor_pkt read size * executor/common_linux.h: remove unnecessary return statement and check vendor_pkt read size * sys/linux/dev_vhci.txt: pack extended_inquiry_info_t * sys/linux/l2cap.txt: add l2cap_conf_opt struct * executor/common_linux.h: just fill bd addr will 0xaa * executor/common_linux.h: just fill bd addr will 0xaa
* executor: wrap all syscalls into NONFAILINGDmitry Vyukov2020-07-151-2/+5
| | | | | | | | | | | | | | | Currently we sprinkle NONFAILING all over pseudo-syscall code, around all individual accesses to fuzzer-generated pointers. This is tedious manual work and subject to errors. Wrap execute_syscall invocation with NONFAILING in execute_call once instead. Then we can remove NONFAILING from all pseudo-syscalls and never get back to this. Potential downsides: (1) this is coarser-grained and we will skip whole syscall on invalid pointer, but this is how normal syscalls work as well, so should not be a problem; (2) we will skip any clean up (closing of files, etc) as well; but this may be fine as well (programs can perfectly leave open file descriptors as well). Update #1918
* executor: fix bitfields for big-endian archAlexander Egorenkov2020-07-101-1/+11
| | | | | | | | Add bitfield tests for big-endian arch Issue: #1885 Signed-off-by: Alexander Egorenkov <Alexander.Egorenkov@ibm.com>
* executor: clarify debug/debug_verbose useDmitry Vyukov2020-07-081-1/+5
|
* executor: prohibit mallocDmitry Vyukov2020-07-081-0/+7
|
* executor: don't use static_assertDmitry Vyukov2020-06-251-1/+1
| | | | | Use existing way of doing size checks, otherwise akaros build is broken: https://github.com/google/syzkaller/pull/1868/checks?check_run_id=808613616
* executor: fix write_output_64Alexander Egorenkov2020-06-251-1/+7
| | | | | | The output pointer was not updated after writing. Signed-off-by: Alexander Egorenkov <Alexander.Egorenkov@ibm.com>
* ipc: fix endianness issuesAlexander Egorenkov2020-06-231-6/+13
| | | | | | | | Use native byte-order for IPC and program serialization. This way we will be able to support both little- and big-endian architectures. Signed-off-by: Alexander Egorenkov <Alexander.Egorenkov@ibm.com>
* executor: Improve used terminologyMarco Elver2020-06-151-1/+1
| | | | | | | | Improve used terminology by using better verbs to express the effect of the whitelist/blacklist. This also changes executor to exclusively show respectful log messages, and as per recent conversion, converts the last such case.
* all: use more respective languageDmitry Vyukov2020-06-111-2/+2
| | | | | | | | Some terms are normalised on the technical level but may be oppressive on a societal level. Replace them with more technically neutral terms. See the following doc for a longer version: https://tools.ietf.org/id/draft-knodel-terminology-00.html
* prog: add ignore_return and breaks_returns call attribtuesDmitry Vyukov2020-04-191-0/+4
| | | | | We had these hard-coded for fuchsia and linux accordingly. Replace with call attributes.
* sys/linux: sync call timeouts with executorDmitry Vyukov2020-04-191-1/+2
| | | | Timeouts in executor and sys/linux get out of sync. Sync them.
* sys/linux: add timeout call attributesDmitry Vyukov2020-04-191-24/+7
| | | | | | | Move additional call/prog timeouts to descriptions. Due to this logic duplication executor used 50ms for syz_mount_image, while pkg/csource used 100ms.
* prog: introduce call attributesDmitry Vyukov2020-04-191-0/+4
| | | | | | Add common infrastructure for syscall attributes. Add few attributes we want, but they are not implemented for now (don't affect behavior, this will follow).
* executor: surround the data mapping with PROT_NONE pagesDmitry Vyukov2020-04-181-1/+1
| | | | | | | | | | | Surround the main data mapping with PROT_NONE pages to make virtual address layout more consistent across different configurations (static/non-static build) and C repros. One observed case before: executor had a mapping above the data mapping (output region), while C repros did not have that mapping above, as the result in one case VMA had next link, while in the other it didn't and it caused a bug to not reproduce with the C repro. The bug that reproduces only with the mapping above: https://lkml.org/lkml/2020/4/17/819
* executor: fix format warningDmitry Vyukov2020-03-131-2/+2
|
* executor: add more debugging output for running=-1Dmitry Vyukov2020-03-131-1/+13
| | | | | | | | The running=-1 check fires periodically for the past 2 years. I can't reproduce nor understand how this happens. Add more debugging output, maybe it will shed some light. Update #502
* executor, sys/linux: add ath9k usb descriptionsAndrey Konovalov2020-03-131-2/+2
| | | | | | | Among other things this changes timeout for USB programs from 2 to 3 seconds. ath9k fuzzing also requires ath9k firmware to be present, so system images need to be regenerated with the updated script.
* executor: prevent "NMI handler took too long" messagesDmitry Vyukov2020-03-061-0/+4
| | | | | | | | nmi_check_duration() prints "INFO: NMI handler took too long" on slow debug kernels. It happens a lot in qemu, and the messages are frequently corrupted (intermixed with other kernel output as they are printed from NMI) and are not matched against the suppression in pkg/report. This write prevents these messages from being printed.
* executor: refactor extra cover handlingDmitry Vyukov2020-02-171-18/+16
| | | | | | | | | | | | | | | | | | | | | | | | | One observation is that checking for extra cover is very fast (effectively a memory load), so we can simplify code by removing th->extra_cover and just check for it always. Additionally, we may grab some coverage that we would miss otherwise. Don't sleep for 500 ms at the end if colliding, we are not going to use the extra coverage in that case anyway. Check for extra coverage at the end every 100ms to avoid being killed on timeout before we write any. Make the 500ms sleep at the end parametrizable. Enable it for syz_usb syscalls, so we get the same behavior for usb. But this also allows to get extra coverage for other subsystems. Some subsystems don't have a good way to detect if we will get any extra coverage or not. Sleeping for 500ms for all programs slows down fuzzing too much. So we check for extra coverage at the end for all programs (cheap anyway), but sleep only for usb program. This allows to collect extra coverage for vhost and maybe wireguard in future. Update #806
* executor: increase input buffer sizeDmitry Vyukov2020-02-101-1/+1
| | | | | | | I bumped input buffer size on Go side in: a2af37f0 prog: increase encodingexec buffer size But I forgot to increase the size on the executor side. Do this and add comments re keeping them in sync.
* executor: fix syz_mount_imageDmitry Vyukov2019-12-101-0/+2
| | | | | | | 1. It always crashed in cover_reset when coverage is disabled. 2. Use NONFAILING when accessing image segments. 3. Give it additional 100 ms as it may be slow. 4. Add a test for syz_mount_image.
* executor: refactor sandbox flagsDmitry Vyukov2019-11-161-25/+17
| | | | In preparation for future changes.
* executor: rename some flagsDmitry Vyukov2019-11-161-39/+39
| | | | | Rename some flags in preparation for subsequent changes which will align names across the code base.
* executor: move fixed pci devlink handle into network namespaceJiri Pirko2019-11-031-0/+2
| | | | | | | | In case there is a fixed pci devlink handle "pci/pci/0000:00:10.0" on the system (initial network namespace), it is moved to a working network namespace. Signed-off-by: Jiri Pirko <jiri@mellanox.com>
* syz-fuzzer, executor: Add support for blacklisting data race framesMarco Elver2019-10-221-0/+8
| | | | | This adds support to add frames that have already been in data races, to the KCSAN report blacklist.
* executor, csource: adjust syz_open_dev$hiddev timeoutAndrey Konovalov2019-09-241-0/+2
| | | | Looks like opening hiddev can take up to ~100 ms.
* executor: fix out-of-bounds access to syscalls arrayAndrey Konovalov2019-09-171-20/+20
| | | | | Move accessing syscalls array to check for USB syscalls after we validate the call_num value (it can be e.g. instr_copyin/out).
* executor: add some USB realted TODOs (#1319)Andrey Konovalov2019-08-071-14/+7
| | | Also simplify timeout related code a bit.
* sys/linux, executor: add syz_usb_ep_read syzkallAndrey Konovalov2019-07-011-2/+10
| | | | syz_usb_ep_read reads data from USB endpoints other than #0.
* sys/linux, executor: add basic USB HID fuzzing supportAndrey Konovalov2019-06-241-6/+14
| | | | | This commit adds the necessary descriptions and executor adjustments to enable targeted fuzzing of the enumeration process of USB HID devices.
* executor: improve usb coverage attributionAndrey Konovalov2019-06-121-9/+18
| | | | | Always call write_extra_output() only if the current program or call can produce extra coverage (== is a syz_usb* syzcall).
* executor: Protect the coverage bufferAndrew Turner2019-06-041-0/+6
| | | | | | | | | Add functions to protect and unprotect the coverage buffer. The buffer is protected from being written to while tracing. When the trace data is sorted we need to make it read/write, but can return it to read only after this has completed. Leave the first page as read/write as we need to clear the length field.
* pkg/csource: generate timeouts for USB syzcallsAndrey Konovalov2019-05-311-0/+1
| | | | This patch only covers per call timeouts, per prog one is not adjusted yet.
* executor: implement support for leak checkingDmitry Vyukov2019-05-201-9/+43
| | | | | | | | | | | | | | | | | | | | | | | | | Leak checking support was half done and did not really work. This is heavy-lifting to make it work. 1. Move leak/fault setup into executor. pkg/host was a wrong place for them because we need then in C repros too. The pkg/host periodic callback functionality did not work too, we need it in executor so that we can reuse it in C repros too. Remove setup/callback functions in pkg/host entirely. 2. Do leak setup/checking in C repros. The way leak checking is invoked is slightly different from fuzzer, but much better then no support at all. At least the checking code is shared. 3. Add Leak option to pkg/csource and -leak flag to syz-prog2c. 4. Don't enalbe leak checking in fuzzer while we are triaging initial corpus. It's toooo slow. 5. Fix pkg/repro to do something more sane for leak bugs. Few other minor fixes here and there.
* executor: fix 32-bit buildDmitry Vyukov2019-05-071-3/+3
| | | | | Syscall args can't be printed with %lx now. Cast them to uint64 for now since we have only 2 such places.
* executor: change syscall argument type to intptr_tmunjinoo2019-05-071-4/+4
| | | | | The type size of long depends on compiler. Therefore, changing to intptr_t makes it depends on architecture.
* executor: adjust waiting time for all usb syzcallsAndrey Konovalov2019-04-231-8/+14
| | | | | | Allow 2000 ms of waiting time for syz_usb_connect and and the same time for the whole program is this syzkall is present. Allow 200 ms of waiting time for syz_usb_disconnect. Remove sleep from syz_usb_control_io.
* all: add basic USB fuzzing supportAndrey Konovalov2019-04-111-1/+14
| | | | | | | | | | | | This commits implements 4 syzcalls: syz_usb_connect, syz_usb_io_control, syz_usb_ep_write and syz_usb_disconnect. Those syzcalls are used to emit USB packets through a custom GadgetFS-like interface (currently exposed at /sys/kernel/debug/usb-fuzzer), which requires special kernel patches. USB fuzzing support is quite basic, as it mostly covers only the USB device enumeration process. Even though the syz_usb_ep_write syzcall does allow to communicate with USB endpoints after the device has been enumerated, no coverage is collected from that code yet.
* all: add optional close_fds feature to reproducersAndrey Konovalov2019-04-091-0/+6
| | | | | | | | Instead of always closing open fds (number 3 to 30) after each program, add an options called EnableCloseFds. It can be passed to syz-execprog, syz-prog2c and syz-stress via the -enable and -disable flags. Set the default value to true. Also minimize C repros over it, except for when repeat is enabled.
* execprog, stress, prog2c: unify flags to enable additional featuresAndrey Konovalov2019-03-051-6/+12
| | | | | | | | | | | This change makes all syz-execprog, syz-prog2c and syz-stress accept -enable and -disable flags to enable or disable additional features (tun, net_dev, net_reset, cgroups and binfmt_misc) instead of having a separate flag for each of them. The default (without any flags) behavior isn't changed: syz-execprog and syz-stress enabled all the features (provided the runtime supports them) and syz-prog2c disables all of them.
generated by ggit (джигит) mrf-deployment (git 2.46.0) at 2026-03-12 07:34:35 +0000