aboutsummaryrefslogtreecommitdiffstats
path: root/executor
Commit message (Collapse)AuthorAgeFilesLines
...
* executor: better handling for hanged test processesDmitry Vyukov2024-10-243-16/+75
| | | | | | | | | | | | | | | Currently we kill hanged processes and consider the corresponding test finished. We don't kill/wait for the actual test subprocess (we don't know its pid to kill, and waiting will presumably hang). This has 2 problems: 1. If the hanged process causes "task hung" report, we can't reproduce it, since the test finished too long ago (manager thinks its finished and discards the request). 2. The test process still consumed per-pid resources. Explicitly detect and handle such cases: Manager keeps these hanged tests forever, and we assign a new proc id for future processes (don't reuse the hanged one).
* executor: check ppid after setting PR_SET_PDEATHSIG for sandbox processDmitry Vyukov2024-10-241-0/+4
| | | | This helps to avoid leaking processes when killing races with PR_SET_PDEATHSIG.
* executor: don't create new session for sandbox processDmitry Vyukov2024-10-241-1/+0
| | | | | | | | It's unclear why we need a new session. Sessions group process groups, but we don't use that. Setsid also creates a new process group, but we don't kill this process group, so also unclear why this is needed.
* executor: don't kill executor exec process groupDmitry Vyukov2024-10-241-1/+0
| | | | | | | | | Killing a process group (negative pid) only makes sense when the process is a group leader (called setsid/setpgrp/setpgid). Executor exec process is not a group leader, so don't try to kill its group. For our controlled executor subprocesses we rely on PR_SET_PDEATHSIG for reliable killing of all child subprocesses.
* executor: sys/linux: arm64: reserve address for ITS, add a seed for ITS creationAlexander Potapenko2024-10-211-1/+4
| | | | | | | Reserve SYZOS address for the ITS redistributor at 0x08080000, add it to the list of kvm_guest_addrs. Also implement a syzlang test for the host part of ITS configuration as per https://www.kernel.org/doc/html/v6.1/virt/kvm/devices/arm-vgic-its.html
* executor: fix mounting of debugfs/smackfs/fusectl/binfmt_miscDmitry Vyukov2024-09-271-9/+14
| | | | | | | | All these broke when we started mounting new tmpfs for sandbox=root. Some are not mounted at all, some are mounted in the outer root and are not accessible from the new root. Mount then inside of the new root tmpfs. Other file systems (binderfs, cgroups) seem to be ok.
* executor: arm64: rename SYZ_KVM_* to KVM_*Alexander Potapenko2024-09-251-16/+16
| | | | | It is more common for the constants in the executor to not have the SYZ_ prefix.
* executor: arm64: store CPU ID in TPIDR_EL1Alexander Potapenko2024-09-252-4/+20
| | | | | | | | | Let SYZOS distinguish CPUs inside VM by storing their ID in TPIDR_EL1. Make sure existing code uses that ID: - in guest_handle_msr(), to ensure concurrent calls do not write to the same cache line; - in gicv3_irq_enable(), to ensure proper CPU ID is being used for IRQ setup.
* executor: arm64: sys/linux: implement syz_kvm_setup_syzos_vm and ↵Alexander Potapenko2024-09-253-54/+135
| | | | | | | | | | | | | | | | | | | | | | | syz_kvm_add_vcpu The old syz_kvm_setup_cpu() API mixed together VM and VCPU setup, making it harder to create and fuzz two VCPUs in the same VM. Introduce two new pseudo-syscalls, syz_kvm_setup_syzos_vm() and syz_kvm_add_vcpu(), that will simplify this task. syz_kvm_setup_syzos_vm() takes a VM file descriptor, performs VM setup (allocates guest memory and installs SYZOS code into it) and returns a new kvm_syz_vm resource, which is in fact a pointer to `struct kvm_syz_vm` encapsulating VM-specific data in the C code. syz_kvm_add_vcpu() takes the VM ID denoted by kvm_syz_vm and creates a new VCPU within that VM with a proper CPU number. It then stores the fuzzer-supplied SYZOS API sequence into the corresponding part (indexed by CPU number) of the VM memory slot, and sets up the CPU registers to interpret that sequence. The new pseudo-syscall let the fuzzer create independent CPUs that run different code sequences without interfering with each other.
* executor: arm64: accept cpu id in guest_main()Alexander Potapenko2024-09-251-2/+2
| | | | | Use the cpu id to choose the SYZOS API commands to be executed by this particular CPU.
* executor: arm64: factor out install_user_code()Alexander Potapenko2024-09-251-22/+42
| | | | | | | | Prepare to let multiple (up to 4) CPUs run different pieces of code by allocating 4 pages for ARM64_ADDR_USER_CODE. Pass the CPU id to guest_main(), so that it can pick the correct starting addres. syz_kvm_setup_cpu() will implicitly use cpuid=0 to retain its current functionality.
* executor: arm64: factor out setup_vm()Alexander Potapenko2024-09-251-34/+41
| | | | | | | | | No functional change. For multiple CPUs within the same VM, calls to syz_kvm_setup_cpu() will set up the VM memory space multiple times, so only the last one will take effect. Prepare to decouple VM setup from CPU setup by factoring this code out of syz_kvm_setup_cpu().
* sys/linux: add syz_create_resourceDmitry Vyukov2024-09-191-0/+13
| | | | | | | | syz_create_resource allows to turn any value into a resource. Improve binfmt descriptions using syz_create_resource: we need to pass the same file name to write syscalls and execve. Use syz_create_resource to improve binfmt descriptions.
* executor: fix mounting of binfmt_miscDmitry Vyukov2024-09-191-1/+2
|
* executor: arm64: reserve a dedicated dirty page regionAlexander Potapenko2024-09-112-3/+12
| | | | | To ease fuzzing the dirty ring, explicitly reserve two pages with the KVM_MEM_LOG_DIRTY_PAGES flag at known address.
* executor: sys/linux: arm64: implement SYZOS_API_MEMWRITEAlexander Potapenko2024-09-061-0/+43
| | | | | | | | The new API call will be used to write values to guest memory specified by base+offset. Writing to e.g. MMIO registers for VGIC (or any other MMIO ranges) may result in new coverage.
* executor: arm64: sys/linux: add SYZOS_API_IRQ_SETUPAlexander Potapenko2024-09-031-0/+459
| | | | | | | | Implement basic IRQ controller setup for VMs with a single CPU. SYZOS_API_IRQ_SETUP sets up the VGICv3 distributor/redistributor and enables the specified number of SPIs starting from 32. The default IRQ handler is set up to perform a uexit(-2).
* executor: pkg/vminfo: sys/linux: define syz_kvm_vgic_v3_setupAlexander Potapenko2024-09-033-3/+90
| | | | | The new pseudo-syscall sets up VGICv3 IRQ controller on the host. That still requires guest setup code, which will be submitted separately.
* executor: retry pselect() when interruptedCameron Finucane2024-08-301-1/+4
| | | | | | Occasionally a SIGCHLD would cause EINTR to be returned by pselect(), and then the runner would become hung by attempting to read a socket that was not in fact ready.
* executor: fix corner case of misinterpreting comparison dataDmitry Vyukov2024-08-281-0/+12
| | | | | Reset coverage right before scheduling next syscall for execution. See the added comment for details.
* executor: protect kcov/output regions with pkeysDmitry Vyukov2024-08-164-10/+84
| | | | | | | Protect KCOV regions with pkeys if they are available. Protect output region with pkeys in snapshot mode. Snapshot mode is especially sensitive to output buffer corruption since its location is not randomized.
* executor: keep SYZFAIL messages during machine checkDmitry Vyukov2024-08-161-3/+6
| | | | | Replace just the SYZFAIL part instead of the whole message. This makes debugging of things easier.
* executor: simplify mapping of kcov guard pagesDmitry Vyukov2024-08-141-9/+1
|
* executor: set process name before taking snapshotDmitry Vyukov2024-08-131-7/+6
| | | | | It's not necessary to set process name in snapshot mode since we execute only 1 program each time.
* executor: arm64: add SYZOS_API_HVCAlexander Potapenko2024-08-071-8/+36
| | | | | Make the necessary changes to support HVC in addition to SMC. These two may subtly differ, so they are handled separately.
* executor: arm64: add SYZOS_API_SMCAlexander Potapenko2024-08-071-0/+36
| | | | | | | | Provide an API call to invoke the ARM64 Secure Monitor Call instruction with user-supplied function id and 5 parameters passed in registers x1-x5. For now only `smc #0` is invoked, although in the future we may want to pass other (reserved) immediate values to SMC.
* executor: fix coverage collection in snapshot modeDmitry Vyukov2024-08-061-3/+5
| | | | Fixes #5143
* executor: arm64: add SYZOS_API_MSRAlexander Potapenko2024-08-053-0/+46
| | | | | | | | | | | | | MSR is an ARM64 instruction that writes a value from a GP register to one of the system CPU registers. Exposing those registers to a fuzzer will let us trigger unexpected behavior in handling them on the kernel side. The SYZOS_API_MSR call has two int64 arguments, register ID and value. Register IDs are 64-bit values obtained from ARM64_SYS_REG() in the Linux asm/kvm.h UAPI header. Same register IDs are used by ioctl$KVM_GET_ONE_REG and ioctl$KVM_SET_ONE_REG. Also add sys/linux/test/syz_kvm_setup_cpu_arm64-msr
* executor: arm64: kvm: exit from guest_main() using guest_uexit()Alexander Potapenko2024-08-051-0/+1
| | | | | Call guest_uexit(-1) to break from ioctl(KVM_RUN), otherwise the VM will be running infinitely until it is killed.
* executor: add missing static declarations in common_kvm_arm64_syzos.hAlexander Potapenko2024-08-051-4/+4
|
* pkg/rpcserver: use dense VM indices instead of string namesDmitry Vyukov2024-08-021-8/+11
| | | | | | Using actual VM indices for VM identification allows to match these indices to VMs in the pool, allows to use dense arrays to store information about runners (e.g. in queue.Distributor), and just removes string names as unnecessary additional entities.
* executor: restart procs more deterministicallyDmitry Vyukov2024-08-021-9/+41
| | | | | | | | | | | | | | | | | | | | Currently we force restart in rpcserver, but this has 2 problems: 1. It does not know the proc where the requets will land. 2. It does not take into account if the proc has already restarted recently for other reasons. Restart procs in executor only if they haven't restarted recenlty. Also make it deterministic. Given all other randomess we have, there does not seem to be a reason to use randomized restarts and restart after fewer/more runs. Also restart only after corpus triage. Corpus triage is slow already and there does not seem to be enough benefit to restart during corpus triage. Also restart at most 1 proc at a time, since there are lots of serial work in the kernel.
* pkg/fuzzer: try to triage on different VMsDmitry Vyukov2024-08-022-1/+3
| | | | Distribute triage requests to different VMs.
* executor: handle EINTR in connectGreg Steuck2024-07-301-1/+23
| | | | ConnectWait is directly from OpenBSD man page.
* executor: arm64: sys/linux: introduce syzos APIAlexander Potapenko2024-07-293-12/+76
| | | | | | | | | | | | | | | | | | | | | | Allow guest payload to call syzos API functions. The available calls are enumerated by SYZOS_API_* constants, and have a form of: struct api_call { uint64 call; uint64 struct_size; /* arbitrary call-related data here */ }; Complex instruction sequences are too easy to break, so most of the time fuzzer won't be able to efficiently mutate them. We replace kvm_text_arm64 with a sequence of `struct api_call`, making it possible to intermix assembly instructions (SYZOS_API_CODE) with higher-level constructs. Right now the supported calls are: - SYZOS_API_UEXIT - abort from KVM_RUN (1 argument: exit code, uint64) - SYZOS_API_CODE - execute an ARM64 assembly blob (1 argument: inline array of int32's)
* executor: more precise detection of exit/_exit in the linterAlexander Potapenko2024-07-291-1/+1
| | | | Do not report errors when a function name contains '[_]exit' as a substring.
* executor: arm64: add syzos headerAlexander Potapenko2024-07-293-1/+29
| | | | | | | | | | For KVM fuzzing we are going to need some library code that will be running inside KVM to perform common tasks (e.g. register accesses, device setup etc.) This code will reside in a special ".guest" section that the executor will map at address 0xeeee8000. For now it contains just the main function, but will be extended in further patches.
* executor: arm64: more flexible physical page allocationAlexander Potapenko2024-07-292-14/+78
| | | | | | | Refactor phys page allocation in syz_kvm_setup_cpu$arm64 to prepare for more address ranges. Load user-supplied code at ARM64_ADDR_USER_CODE and allocate EL1 stack at ARM64_ADDR_EL1_STACK_BOTTOM.
* all: add qemu snapshotting modeDmitry Vyukov2024-07-255-37/+341
|
* executor: increase kExtraCoverSize to 1024kAndrey Konovalov2024-07-231-1/+1
| | | | | | | | | | | | | | | Running the vusb_ath9k runtest (with [1] and [2] applied) produces ~100k of extra coverage, which is somewhat close to the current 256k limit. A more complicated program might produce more extra coverage and overflow the coverage buffer. Increase kExtraCoverSize to 1024k. As the extra coverage buffer is maintained per-executor and not per-thread, the total increase of the coverage mapping is ~9%, which is not too bad. [1] https://lore.kernel.org/all/eaf54b8634970b73552dcd38bf9be6ef55238c10.1718092070.git.dvyukov@google.com/ [2] https://lore.kernel.org/all/20240722223726.194658-1-andrey.konovalov@linux.dev/T/#u
* executor: fix writing of remote coverageDmitry Vyukov2024-07-223-3/+26
| | | | | | | | We never reset remote coverage, so if there is one block, we will write it after every call and multiple times at the end. It can lead to "too many calls in output" and just writes quadratic amount of coverage/signal. Reset remote coverage after writing.
* executor: refactor argument parsingDmitry Vyukov2024-07-221-4/+8
| | | | Check that we have at least command argument in the beginning.
* prog: restricts hints to at most 10 attempts per single kernel PCDmitry Vyukov2024-07-221-16/+10
| | | | | | | | | We are getting too many generated candidates, the fuzzer may not keep up with them at all (hints jobs keep growing infinitely). If a hint indeed came from the input w/o transformation, then we should guess it on the first attempt (or at least after few attempts). If it did not come from the input, or came with a non-trivial transformation, then any number of attempts won't help. So limit the total number of attempts (until the next restart).
* executor: deduplicate signal per-callAleksandr Nogikh2024-07-181-13/+15
| | | | | | | | | | | This kind of deduplication is confusing for the fuzzer, which expects to control the process itself (by MaxSignal and by specifying the calls for which full signal must be returned). There's also a chance that it may contribute to the difficulties during program triage and minimization. Let's err on the safe side and deduplicate signal only per-call.
* executor: fix localhost handling for machines with only ipv6Konstantin Bogomolov2024-07-181-7/+15
| | | | | In case only ipv6 is supported, we should try ipv4-localhost first and see if it fails, and then go on to trying ipv6.
* executor: manually replace localhost with equivalent ipv4/6 addressKonstantin Bogomolov2024-07-171-0/+5
| | | | | | | It should fix errors like this one: SYZFAIL: failed to resolve manager addr addr=localhost h_errno=2 (errno 11: Resource temporarily unavailable
* executor: avoid setsid() errorsMark Johnston2024-07-171-1/+1
| | | | | See commit bc144f9a58782daa2399d417b56aad80e82a219e. The justification applies to other BSDs as well, so apply the same workaround.
* executor: print signal info for SIGILL/SIGFPE as wellDmitry Vyukov2024-07-171-9/+24
| | | | | There are also synchnous fatal signals that can happen due to bugs in executor code. So handle them as SIGSEGV.
* executor: fix setup of cad_pidDmitry Vyukov2024-07-161-5/+20
| | | | | | | cad_pid must not point to a persistent runner process, b/c it will be killed on ctrl+alt+del. Fixes #5027
* executor: factor output finishing into separate functionDmitry Vyukov2024-07-112-37/+46
| | | | | This will allow to reuse finish_output function for snapshot mode as well. NFC
generated by ggit (джигит) mrf-deployment (git 2.46.0) at 2026-03-13 19:16:43 +0000