aboutsummaryrefslogtreecommitdiffstats
path: root/executor
Commit message (Collapse)AuthorAgeFilesLines
...
* syz-manager, pkg/cover: normalize signals between VM instancesLiz Prucka2023-06-121-3/+6
| | | | | | | | | | | | | Adjust signal creation in syz-executor so hash is independent of module offsets. This allows for canonicalization of the signal between VMs. Added signals to canonicalization/decanonicalization between instances. Coverts serialized Signal values as they have already been serialized in rpc.go. Added a function in signal.go to update serial signal elements.
* executor: resolve pseudo syscall compilation problemsAleksandr Nogikh2023-05-046-50/+81
|
* executor: remove openbsd bits out of common_bsd.hGreg Steuck2023-04-271-47/+1
|
* executor: detangle common_openbsd.h out of common_bsd.hGreg Steuck2023-04-272-1/+383
|
* sys/targets: switch openbsd to SyscallNumbers: falseGreg Steuck2023-04-272-2/+27
| | | | | This relies on sendsyslog in sys/syslog.h which will be in OpenBSD HEAD soon.
* executor: use explicit lretl in kvm_amd64.SSpace Meyer2023-04-121-1/+1
| | | | | | | Without this change the following warning is generated: kvm_amd64.S:95: Warning: no instruction mnemonic suffix given and no register operands; using default for `lret' This does not change the generated code in kvm_amd64.S.h
* executor: mark amd64 kvm_gen.cc stack nonexecutableSpace Meyer2023-04-121-1/+1
| | | | | | | | Without this change `go generate ./executor` on gcc 12.2.0 gives: /usr/bin/ld: warning: /tmp/ccmfWMO4.o: missing .note.GNU-stack section implies executable stack /usr/bin/ld: NOTE: This behaviour is deprecated and will be removed in a future version of the linker This does not change the generated code in kvm_amd64.S.h
* sys/linux: add syz_pkey_set syscallsDmitry Vyukov2023-04-031-0/+24
| | | | The syscall sets PKRU register which is part of protection keys (pkey).
* executor: use valid temporary dir on AndroidKris Alder2023-03-211-1/+1
| | | | | | | The call to mkdtemp() will fail when given /data/data/syzkaller/syzkaller-XXXXXX, since /data/data/syzkaller/ doesn't exist. The correct temporary dir on Android is /data/local/tmp, which exists by default.
* all: ioutil is deprecated in go1.19 (#3718)Taras Madan2023-02-231-2/+2
|
* executor: fix initialize_tun() for Android (#3656)kalder2023-02-061-4/+8
| | | | | | | | Android devices often fail during the initial check with the error: SYZFAIL: tun: ioctl(TUNSETIFF) failed We need the same namespacing here that is used for other sandboxing configurations.
* vm/starnix: add support for fuzzing starnix (#3624)juanPabloMiceli2023-01-192-7/+11
| | | | | | | This commit adds a new VM for fuzzing starnix. The VM will boot a fuchsia image using the `ffx` tool and will connect to an adb server inside it. Fuzzing will be done using HostFuzzer mode due to some features not being implemented yet in starnix. Once this is possible, fuzzing will be performed without HostFuzzer mode. Co-authored-by: Juampi Miceli <jpmiceli@google.com>
* executor: better prevent the panic on ext4 errors (#3604)Aleksandr Nogikh2023-01-031-1/+9
| | | | We already suppress them, but the current approach fails if syzkaller slightly corrupts the options string. Do the check more rigorously.
* pkg/image: treat empty compressed image as valid imageDmitry Vyukov2022-12-221-4/+2
| | | | | | | | When we decompress images for mutation or hints, we always specially check for empty compressed data (I assume it can apper after minimization). Treat it as correct compressed and return empty decompressed data. This removes the need in special handling in users.
* pkg/image: optimize image decompressionDmitry Vyukov2022-12-221-0/+1
| | | | | | | | | | | | | | | Benchmark results: name old time/op new time/op delta Decompress-8 24.7ms ± 1% 13.4ms ± 4% -45.81% (p=0.000 n=16+19) name old alloc/op new alloc/op delta Decompress-8 67.2MB ± 0% 0.0MB ± 1% -99.98% (p=0.000 n=18+20) name old allocs/op new allocs/op delta Decompress-8 188 ± 0% 167 ± 0% -11.17% (p=0.000 n=20+20) Test process memory consumption drops from 220MB to 80MB.
* executor: simplify setup_loop_deviceDmitry Vyukov2022-11-231-8/+6
| | | | | We can close memfd as soon as we passed it to LOOP_SET_FD (it holds a reference to the file).
* executor: don't reset loop device on partition scan successDmitry Vyukov2022-11-231-1/+2
| | | | | | We symlink resulting partitions into the test dir. If we do LOOP_CLR_FD, device and partitions disappear. Don't do LOOP_CLR_FD on success.
* executor: reduce zlib memory consumptionDmitry Vyukov2022-11-231-5/+8
| | | | | | | The images we unpack has huge ranges of 0s. Currently we write all bytes and as the result page in whole unpacked image. Don't write 0s since we just mmaped zero memory. This reduces btrfs_0 seed memory consumption from 130MB to 6MB.
* executor: declare variables locally in zlibDmitry Vyukov2022-11-231-76/+46
| | | | We don't use C89 style.
* executor: don't pass uncompressed zlib sizeDmitry Vyukov2022-11-233-31/+26
| | | | | | This will allow us to mutate the image size. Fixes #3527
* executor: remove support for zlib length calculationDmitry Vyukov2022-11-231-24/+14
| | | | | zlib can calculate uncompressed output size if given NULL destination buffer. We don't use that. Remove.
* executor: add test for zlib decompressionDmitry Vyukov2022-11-231-0/+22
|
* executor: fix puff_zlib_to_file signatureDmitry Vyukov2022-11-232-13/+14
| | | | | | In executor code we commonly use the syscall interface for functions: return -1 on erorr and set errno. Use this interface for puff_zlib_to_file.
* executor: update to match the new `syz_mount_image` callHrutvik Kanabar2022-11-211-27/+35
| | | | | | Update the executor to handle the new `syz_mount_image`/`syz_part_table` pseudo-syscalls. It now expects compressed images, and decompresses them using the new `common_zlib.h` header file before mounting.
* executor: add `zlib` decompression header fileHrutvik Kanabar2022-11-212-1/+536
| | | | | | | | | | | | | | Create a header file to provide a clean entrypoint `puff_zlib_to_file()`, which decompresses `zlib` data from an array to a file. This will be used for pseudo-syscalls which accept compressed data, e.g. `syz_mount_image`. The implementation uses a slightly-modified version of `puff.{c,h}`, found in the `zlib` repository. We have to be careful to ensure the copyright information from `puff.{c,h}` gets included in generated C code and C reproducers. Therefore, introduce the `//%` pattern to indicate comments which should not be removed by code generation, and use this pattern for the copyright notice.
* executor: fix "wrong response packet" in BT fuzzing (#3493)Tamas Koczka2022-11-071-11/+37
| | | | | | | | | | | | | | | | | | Problem: the BT initialization logic (`initialize_vhci()` in `common_linux.h`) expected `HCI_VENDOR_PKT` to be sent first, but this is not always the case as the kernel sends these two packets almost at the same time (both are sent as the result of the `open("/dev/vhci", …)` call): * syscall thread: `HCI_VENDOR_PKT` (in `__vhci_create_device`) * `power_on` queue thread: `HCI_OP_RESET` (from `hci_reset_sync` <- `hci_init1_sync` <- `hci_init_sync` <- `hci_dev_open_sync` <- `hci_dev_do_open` <- `hci_power_on` <- `hdev->power_on` <- (worker queue) <- `hci_register_dev` <- `__vhci_create_device`) Solution: handle both `HCI_OP_RESET` and `HCI_VENDOR_PKT` packets in `initialize_vhci`. Also instead of waiting for the kernel to send `HCI_VENDOR_PKT` after 1 second, we initiate the setup by sending `HCI_VENDOR_PKT` (request) to the kernel first.
* executor: fix TestCommonExt for bigendian archesDmitry Vyukov2022-11-031-1/+1
|
* executor: add setup_ext_test extension pointDmitry Vyukov2022-11-014-0/+42
| | | | | The extension point allows to setup the test process in a custom way without overwriting any of the existing files.
* executor: test extension pointsDmitry Vyukov2022-11-014-2/+52
| | | | Test that extension points keep stable interface and work.
* executor: include sys/mman.h (#3476)glpesk2022-10-281-0/+1
|
* executor: remove a few #defines which are not used any longerGreg Steuck2022-10-251-10/+0
|
* executor: deal with input_data more sensiblyGreg Steuck2022-10-251-16/+22
|
* executor: cope with mimmutable(2) on OpenBSDAnton Lindqvist2022-10-231-2/+7
| | | | | | | Pages residing in the BSS section are by now flagged as immutable on OpenBSD. Meaning that their corresponding permissions cannot change. The input_data therefore needs to be explicitly marked as mutable. Should hopefully bring syzbot on OpenBSD back.
* executor: better errors for failed mmapsDmitry Vyukov2022-10-215-15/+22
| | | | | | A fixed-address mmap can fail completely or return a different address. Log what it was. Based on: https://groups.google.com/g/syzkaller/c/lto00RwlDIQ
* executor: enable core dumpsDmitry Vyukov2022-10-071-1/+2
| | | | | | | | Core dumping known to have bugs. Just few recent kernel commits: [brown paperbag] fix coredump breakage [coredump] don't use __kernel_write() on kmap_local_page() We also also found some info leaks in core dumps before. No reason to not test them.
* executor: move syz_mount_image's sanity checks to syz-fuzzerAleksandr Nogikh2022-09-271-23/+0
| | | | | It will simplify the C code and let us extract the raw images in a more convenient way.
* executor: add NIC PCI pass-through VF supportGeorge Kennedy2022-09-212-76/+219
| | | | | | | | | | | | | | | Add support for moving a NIC PCI pass-through VF into Syzkaller's network namespace so that it will tested. As DEVLINK support is triggered by setting the pass-through device to "addr=0x10", NIC PCI pass-through VF support will be triggered by setting the device to "addr=0x11". If a NIC PCI pass-through VF is detected in do_sandbox, setup a staging namespace before the fork() and transfer the NIC VF interface to it. After the fork() and in the child transfer the NIC VF interface to Syzkaller's network namespace and rename the interface to netpci0 so that it will be tested. Signed-off-by: George Kennedy <george.kennedy@oracle.com>
* pkg/csource: fix const sock_filterGeorge Kennedy2022-09-212-2/+2
| | | | | | const sock_filter needs to be const struct sock_filter Signed-off-by: George Kennedy <george.kennedy@oracle.com>
* sys/linux, tools/syz-imagegen: allow `syz_mount_image` to change directoryHrutvik Kanabar2022-09-131-2/+10
| | | | | | | | | | | | | | | | | | | | Add a boolean argument to the `syz_mount_image` pseudo-syscall. When this is true, `syz_mount_image` will change directory to the mountpoint after mounting the image passed. Experimentation suggests that to reproduce many non-`ext4` filesystem bugs, it is sufficient to mount the filesystem within an `ext4`-based VM and then change directory to the mountpoint before executing code. This change aims to increase the probability that a mount operation will be succeeded by the corresponding change in directory, and so increase the probability of finding non-`ext4` bugs. We also have to update the `syz-imagegen` tool. Now it generates seed `syz_mount_image` calls with change of directory enabled. The previous behaviour (i.e. no change of directory) will be recovered by use of existing corpuses and fuzzing the change-of-directory argument. The next commit will regenerate all `syz_mount_image` seeds.
* executor: fix setup of netdevsim deviceDmitry Vyukov2022-09-091-7/+8
| | | | | | | | | | 2 fixed: 1. netdevsim devices cannot be created via NETLINK anymore: https://elixir.bootlin.com/linux/v6.0-rc4/source/drivers/net/netdevsim/netdev.c#L397 But we already create them via /sys/bus/netdevsim/new_device, so just remove the netlink creation. 2. These devices are sticky and are not removed on net namspace destruction, so delete the previous version explicitly.
* executor: fix setup of xfrm deviceDmitry Vyukov2022-09-091-12/+29
| | | | | | | | | | XFRM device creation will fail w/o IFLA_XFRM_IF_ID attribute: https://elixir.bootlin.com/linux/v6.0-rc4/source/net/xfrm/xfrm_interface.c#L648 Add this attribute. This ID is also present in descriptions in at least 2 places. In one we got it wrong, it's not ifindex (easy to confuse because of the name). Fix it as well.
* Revert "pkg/csource: inline void* cast into generated code"Dmitry Vyukov2022-09-062-0/+8
| | | | | | | This reverts commit 922294abb4c0bc72b24d8526d625110d73fa1b5a. The commit reported to cause old warnings on s390x: https://github.com/google/syzkaller/commit/922294abb4c0bc72b24d8526d625110d73fa1b5a#commitcomment-83096994
* pkg/csource: inline void* cast into generated codeGreg Steuck2022-09-052-7/+0
| | | | | The previous indirection via conditional macros in platform specific places was needless obfuscation.
* executor: revert errno logic for fuchsia (#3306)Marco Vanotti2022-08-121-0/+9
| | | | | | Commit 4ce69996ec362f8dd9762dcc1643d13cebaab44a changed the logic for processing results for fuchsia system calls. That change seems to be fault, as it sets syscalls that return with ZX_OK to return -1 instead. I am reverting that commit for now.
* pkg/csource, pkg/instance, pkg/ipc, pkg/mgrconfig, tools/syz-prog2c, ↵Andrey Artemiev2022-08-062-6/+11
| | | | syz-manager: introduce a new setting 'sandbox_arg' (#3263)
* executor: fixed fuzzing with System account in Android sandbox (#3275)Andrey Artemiev2022-08-051-1/+2
|
* vm/adb: wait for Android boot to finishAndrey Artemiev2022-07-251-5/+1
| | | | executor: removed condition around tun init
* executor: fix mounting of cgroups on read-only fsDmitry Vyukov2022-07-211-23/+33
| | | | | | If root fs is read-only, mkdir(/syzcgroup) will fail and a later rmdir(/syzcgroup/unified) will fail with ENOENT which we don't expect and fail. Return early if mkdir(/syzcgroup) fails.
* executor: added code to run Android with System accountAndrey Artemiev2022-07-197-19/+535
|
* executor: prevent ENOSPC if cgroup mount failsDmitry Vyukov2022-07-151-1/+15
| | | | | | Remove /syzcgroup/* if cgroup mount fails. See #3241 for context. Fixes #3241
generated by ggit (джигит) mrf-deployment (git 2.46.0) at 2026-03-19 06:09:52 +0000