aboutsummaryrefslogtreecommitdiffstats
path: root/executor/executor_bsd.h
Commit message (Collapse)AuthorAgeFilesLines
* executor: decouple kcov memory allocation from the traceAlexander Potapenko2025-08-051-10/+12
| | | | | | | | | | | | On different platforms and in different coverage collection modes the pointer to the beginning of kcov buffer may or may not differ from the pointer to the region that mmap() returned. Decouple these two pointers, so that the memory is always allocated and deallocated with cov->mmap_alloc_ptr and cov->mmap_alloc_size, and the buffer is accessed via cov->data and cov->data_size. I tried my best to not break Darwin and BSD, but I did not test them.
* executor: fix cover_protect() on FreeBSDMark Johnston2025-02-211-0/+4
| | | | | | | | | | | | | | | | | During machine checks, syzkaller will execute calls with coverage disabled, in which case per-thread coverage structures are zeroed out. write_output() will temporarily map the coverage data as writeable via CoverAccessScope, whether or not cover is enabled. In effect, write_output() may trigger a call mprotect(0, kCoverSize, PROT_RW). On FreeBSD, mprotect() silently ignores unmapped regions, so this does not result in an error. In fact, kCoverSize is now large enough that this ends up removing the eXecute bit from part of syz-executor's text region. Make CoverAccessScope a no-op if coverage is not enabled. Modify BSD cover_protect() and cover_unprotect() to fail if invoked when coverage is disabled.
* executor: favor MAP_FIXED_NOREPLACE over MAP_FIXEDAleksandr Nogikh2025-02-041-1/+1
| | | | | | | | | | | | MAP_FIXED_NOREPLACE allows to fail early if we happened to overlap with an existing memory mapping. It should help detects bugs #5674 at an earlier stage, before it led to memory corruptions. MAP_FIXED_NOREPLACE is supported from Linux 4.17, which is okay for all syzkaller use cases on syzbot. There's no such option for some of the supported OSes, so set it depending on the configuration we're building for.
* pkg/rpcserver: move kernel test/data range checks from executorDmitry Vyukov2024-07-011-15/+0
| | | | | | | | | | | | | | | | | We see some errors of the form: SYZFAIL: coverage filter is full pc=0x80007000c0008 regions=[0xffffffffbfffffff 0x243fffffff 0x143fffffff 0xc3fffffff] alloc=156 Executor shouldn't send non kernel addresses in signal, but somehow it does. It can happen if the VM memory is corrupted, or if the test program does something very nasty (e.g. discovers the output region and writes to it). It's not possible to reliably filter signal in the tested VM. Move all of the filtering logic to the host. Fixes #4942
* executor: factor out is_kernel_pc helperDmitry Vyukov2024-06-111-0/+5
| | | | Factor out is_kernel_pc helper and add kernel pc range for test OS for testing.
* executor: add end-to-end coverage/signal/comparisons testDmitry Vyukov2024-06-111-0/+5
|
* executor: optimize waiting for child processes exitDmitry Vyukov2024-06-101-0/+5
| | | | | | | Currently we sleep only for 1 ms, which may produce some excessive CPU load (we usually have 6/8 such processes waiting). Make it sleep for 10 ms, but also make the sleep return immediately on child exit. This shuold both improve latency and reduce CPU load.
* pkg/vminfo: move feature checking to hostDmitry Vyukov2024-05-151-2/+2
| | | | | | | | | | | | | | | | | Feature checking procedure is split into 2 phases: 1. syz-fuzzer invokes "syz-executor setup feature" for each feature one-by-one, and checks if executor does not fail. Executor can also return a special "this feature does not need custom setup", this allows to not call setup of these features in each new VM. 2. pkg/vminfo runs a simple program with ipc.ExecOpts specific for a concrete feature, e.g. for wifi injection it will try to run a program with wifi feature enabled, if setup of the feature fails, executor should also exit with an error. For coverage features we also additionally check that we actually got coverage. Then pkg/vminfo combines results of these 2 checks into final result. syz-execprog now also uses vminfo package and mimics the same checking procedure. Update #1541
* sys/targets: switch openbsd to SyscallNumbers: falseGreg Steuck2023-04-271-0/+4
| | | | | This relies on sendsyslog in sys/syslog.h which will be in OpenBSD HEAD soon.
* executor: better errors for failed mmapsDmitry Vyukov2022-10-211-2/+3
| | | | | | A fixed-address mmap can fail completely or return a different address. Log what it was. Based on: https://groups.google.com/g/syzkaller/c/lto00RwlDIQ
* executor: delay kcov mmap until it is neededAleksandr Nogikh2021-12-031-13/+10
| | | | | | | | | The previous strategy (delay kcov instance creation) seems not to work very well in carefully sandboxed environments. Let's see if the new approach is more versatile. Open a kcov handle for each thread at syz-executor's initialization, but don't mmap it right away.
* executor: reserve fds that will belong to kcovAleksandr Nogikh2021-12-031-0/+8
| | | | | | | | | As now kcov instances may get set up during fuzzing, performing dup2 in cover_open is no longer safe as it may close some important resource. Prevent that by reserving most of fds that belong to the kcov fds range. Unfortunately we must duplicate the code because of the way kcov implementations are organized.
* executor: setup cgroups onceDmitry Vyukov2021-10-121-0/+4
| | | | | | | Currently we setup cgroups on every test process start (along with sandbox creation). That's unnecessary because that's global per-machine setup. Move cgroup setup into setup section that's executed once per machine from pkg/host.Setup.
* executor: fix remote coverage collectionAleksandr Nogikh2021-08-261-0/+2
| | | | | | | | | Currently the data_offset field of cover_t is only initialized for per-syscall coverage collection. As a result, remote coverage is read from an invalid location, fails to pass sanity checks and is not returned to syzkaller. Fix the initialization of cover_t fields.
* executor: remove unreachable nocover.h includePatrick Meyer2021-05-201-10/+1
|
* pkg/report: detect executor failuresDmitry Vyukov2021-02-211-1/+1
| | | | | | | | | | | | Currently all executor fail errors go into "lost connection" bucket. This is not very useful. First, there are different executor failures. Second, it's not possible to understand what failures happen how frequently. Third, there are not authentic lost connection. Create separate SYZFAIL: bugs for them. Update #573 Update #502 Update #318
* executor: don't use coverage edges for gvisorDmitry Vyukov2020-12-161-6/+1
| | | | gvisor coverage is not a trace, so producing edges won't work.
* pkg/csource: setup sysctl's in C reproducersDmitry Vyukov2020-10-281-1/+1
| | | | | | Sysctl's are not captured as part of reproducers. This can result in failure to reproduce a bug on developer machine. Include sysctl setup as part of C reproducers.
* executor: warn about C89-style var declarationsDmitry Vyukov2020-08-141-4/+2
| | | | | | | | | | | | | | | | | We generally use the newer C99 var declarations combined with initialization because: - declarations are more local, reduced scope - fewer lines of code - less potential for using uninit vars and other bugs However, we have some relic code from times when we did not understand if we need to stick with C89 or not. Also some external contributions that don't follow style around. Add a static check for C89-style declarations and fix existing precedents. Akaros toolchain uses -std=gnu89 (or something) and does not allow variable declarations inside of for init statement. And we can't switch it to -std=c99 because Akaros headers are C89 themselves. So in common.h we need to declare loop counters outside of for.
* executor: fix style checking testDmitry Vyukov2020-08-131-1/+0
| | | | | The regexp for empty suppressions matches _everything_... Don't match suppression if it's empty.
* executor: enable extra coverage on OpenBSDAnton Lindqvist2020-08-111-0/+9
| | | | This reverts commit 63a7334112fa63edb0c0a3f317d3d92135a6ead9.
* executor: use MAP_EXCL to map the data region on FreeBSDMark Johnston2020-08-081-1/+7
| | | | | | We've had some problems where the default SYZ_DATA_OFFSET collides with a mapping created by the C runtime. MAP_EXCL ensures that mmap() will fail in this case, so such problems become a bit easier to diagnose.
* Revert "executor: enable extra coverage on OpenBSD"Anton Lindqvist2020-08-021-9/+0
| | | | | | | Forgot that the build machine must be updated with a newer OpenBSD snapshot first in order to make the new kcov stuff available. This reverts commit 96dd36234d97bbf6b403f3a7f03cfc0296422879.
* executor: enable extra coverage on OpenBSDAnton Lindqvist2020-08-021-0/+9
| | | | | | Recently added[1] to the kcov implementation on OpenBSD. [1] https://github.com/openbsd/src/commit/8430bc4bce9f93dce843b53971377b7afd96cdb1
* sys/netbsd: support multiple vHCI buses (#1822)m00nbsd2020-06-131-1/+1
|
* sys/netbsd: add support for fault injection (#1817)m00nbsd2020-06-111-0/+1
|
* executor: add support for extra coverage on NetBSDm00nbsd2020-05-201-11/+22
|
* executor: add support for USB fuzzing on NetBSDm00nbsd2020-05-191-0/+12
|
* pkg/report: use cover protect on NetBSD alsoR3x2019-06-131-2/+2
|
* executor: add cover protection support to OpenBSD (#1215)Anton Lindqvist2019-06-051-0/+17
|
* executor: Protect the coverage bufferAndrew Turner2019-06-041-0/+19
| | | | | | | | | Add functions to protect and unprotect the coverage buffer. The buffer is protected from being written to while tracing. When the trace data is sorted we need to make it read/write, but can return it to read only after this has completed. Leave the first page as read/write as we need to clear the length field.
* make changes to prevent failing buildR3x2019-05-211-2/+11
|
* executor: change syscall argument type to intptr_tmunjinoo2019-05-071-1/+1
| | | | | The type size of long depends on compiler. Therefore, changing to intptr_t makes it depends on architecture.
* pkg/host: enable FeatureComparisons on OpenBSDAnton Lindqvist2019-01-211-12/+2
|
* all: support extra coverageAndrey Konovalov2019-01-161-2/+2
| | | | | | | | | | | | | | | Right now syzkaller only supports coverage collected from the threads that execute syscalls. However some useful things happen in background threads, and it would be nice to collect coverage from those threads as well. This change adds extra coverage support to syzkaller. This coverage is not associated with a particular syscall, but rather with the whole program. Executor passes extra coverage over the same ipc mechanism to syz-fuzzer with syscall number set to -1. syz-fuzzer then passes this coverage to syz-manager with the call name "extra". This change requires the following kcov patch: https://github.com/xairy/linux/pull/2
* executor: update KCOV support for FreeBSDMichael Tuexen2019-01-141-17/+4
| | | | | | KCOV support has been added to FreeBSD in r342962. Use the header file and update the code to latest changes introduced in the review process.
* executor: adapt os_init() to NetBSD with PaX MPROTECTKamil Rytarowski2019-01-091-0/+3
| | | | | | Initialize syz data segment with protection allowed by PaX MPROTECT. PROT_MPROTECT() registers future potential protection that is allowed to be enabled in future.
* executor: Fix FreeBSD such all platforms use same number of entriesMichael Tuexen2018-12-291-1/+2
| | | | | | | FreeBSD sets the kcov buffer as number of bytes instead of number of entries. This also fixes the mmap() call, which was failing due to inconsistent sizes. The failing was hidden due to wrong error handling.
* executor: fix error handling of mmap()Michael Tuexen2018-12-291-6/+5
| | | | | mmap() returns MAP_FAILED, which is (void *)(-1), in case of an error. This is different from NULL.
* executor: add clarifying comment for FreeBSD.Michael Tuexen2018-12-291-0/+6
|
* executor: add a clarifying commentMichael Tuexen2018-12-291-0/+2
|
* executor: use function argument instead of global variable.Michael Tuexen2018-12-291-1/+1
|
* executor: improve kcov compatibility with upcoming supportMichael Tuexen2018-12-281-3/+8
| | | | | Get ioctl() definitions and usage in sync with the upcoming support reviewed in https://reviews.freebsd.org/D14599.
* executor: KIOENABLE accepts a mode argument on OpenBSDAnton Lindqvist2018-12-281-5/+3
|
* executor: include sys/kcov.h on OpenBSDAnton Lindqvist2018-12-271-3/+6
| | | | Since we no longer cross-compile, there's no need to repeat the defines.
* executor: move setrlimit from setup_control_pipes to bsd os_initDmitry Vyukov2018-12-141-0/+5
| | | | This broke fuchsia build. We need setrlimit only for bsd.
* executor: reapply setuid sandbox for bsdGreg Steuck2018-12-111-19/+0
| | | | | | | | | | * Revert "Revert "executor: add setuid sandbox for openbsd"" The problem is the low file descriptor limit. This reverts commit 4093e33b1338f274ae0062f555de9d6af8640d61. * executor/executor make sure the file descriptor limit is sufficient
* Revert "executor: add setuid sandbox for openbsd"Greg Steuck2018-12-101-0/+19
| | | | This reverts commit 6565f24da9f4eb36702339ba290213995fcc902f.
* executor: add setuid sandbox for openbsdGreg Steuck2018-12-101-19/+0
| | | | | | | | | | * executor/common_bsd: add setuid sandbox Fixes #833 cc @mptre * Reduced duplications, resolved TODO.
* openbsd: repair pkg/csource_testGreg Steuck2018-11-301-5/+0
|
generated by ggit (джигит) mrf-deployment (git 2.46.0) at 2026-03-11 17:42:20 +0000