aboutsummaryrefslogtreecommitdiffstats
path: root/executor
Commit message (Collapse)AuthorAgeFilesLines
...
* sys/linux: add usbmon add vfio descriptionsVeronicaRadu2019-07-262-5/+80
|
* sys/linux: extract USB HID ids (#1294)Andrey Konovalov2019-07-221-5/+5
| | | | | | | | | | | | | | | | | | * sys/linux: extract USB HID ids As it turns out the HID kernel subsystem registers only one USB driver that checks that the interface of the connected device has HID class and then looks up its own list of vendor/device ids to find a matching driver. This means that we currently don't generate proper vendor/device ids for USB HID devices. This patch updates the syz-usbgen tool to also extract USB HID vendor/device ids from a running kernel and makes the generated descriptions for HID devices to be patched using the extracted ids. This patch also contains some minor improvements to USB descriptions (better HID descriptions and more replies for some USB classes/drivers). * sys/linux: run make generate
* sys/linux: use AT_FDCWD only for directoriesDmitry Vyukov2019-07-221-5/+5
| | | | | | Currently we use AT_FDCWD as a special value for all file descriptors, but it does not make sense for almost all of them (sockets, bpf, etc). Use it as a special value only for fd_dir.
* executor: drop CAP_SYS_NICEDmitry Vyukov2019-07-221-4/+12
| | | | | | | | | | A process with CAP_SYS_NICE can bring kernel down by asking for too high SCHED_DEADLINE priority, as the result rcu and other system services that use kernel threads will stop functioning. Some parameters for SCHED_DEADLINE should be OK, but we don't have means to enforce values of indirect syscall arguments. Peter Zijlstra proposed sysctl_deadline_period_{min,max} which could be used to enfore safe limits without droppping CAP_SYS_NICE, but we don't have it yet. See the following bug for details: https://groups.google.com/forum/#!topic/syzkaller-bugs/G6Wl_PKPIWI
* sys/linux: improve sched_attr descriptionDmitry Vyukov2019-07-221-5/+5
| | | | Today we have means to properly describe parent size.
* executor: drop CAP_SYS_PTRACE with sandbox=noneDmitry Vyukov2019-07-221-17/+25
| | | | | | We only drop CAP_SYS_PTRACE for sandbox=namespace, but it can equally affect testing with sandbox=none. Drop it for sandbox=none, add a test.
* sys/fuchsia: update zx_clock_get syscall (#1292)Marco Vanotti2019-07-163-5/+4
| | | | | | | | | | | | * sys/fuchsia: update zx_clock_get. zx_clock_get was deprecated and replaced by zx_clock_get_new. In a recent CL[0], they replaced the zx_clock_get by zx_clock_get_new and moved all client. This commit updates syzkaller to use the new function. [0]: https://fuchsia-review.googlesource.com/c/fuchsia/+/298575 * run make extract && make generate
* run make extract and make generate for fuchsiaMarco Vanotti2019-07-162-22/+6
|
* sys/linux, executor: improve USB descriptionsAndrey Konovalov2019-07-162-11/+54
| | | | | 1. Change HID descriptions to allow devices to have two interrupt endpoints. 2. Remove unneeded responses to OUT control requests from descriptions. 3. Add some debugging code to detect and report missing descriptions.
* sys/linux: update fs-verity descriptionsEric Biggers2019-07-161-5/+5
| | | | | | | | The fs-verity API was redesigned, and we're planning to re-add the fs-verity patches to linux-next soon. Get the syzkaller descriptions up to date with the new API [1] [1] https://lkml.kernel.org/linux-fsdevel/20190701153237.1777-4-ebiggers@kernel.org
* sys/linux: update BPF constantsPaul Chaignon2019-07-161-5/+5
| | | | Signed-off-by: Paul Chaignon <paul.chaignon@orange.com>
* sys/linux: update for v5.3 againEric Biggers2019-07-162-10/+5
| | | | | | | | | | | | | | | | | | Update descriptions to be compatible with latest linux-next (next-20190715), which in theory will match v5.3-rc1 when the merge window closes. - KEYCTL_GRANT_PERMISSION was reverted. So remove its description. - CRYPTO_ALG_TYPE_DIGEST was removed. So remove its description. - IB_QP_CREATE_SIGNATURE_EN was renamed to IB_QP_CREATE_INTEGRITY_EN. Also remove the sys/linux/rdma_*.const files which were incorrectly checked into git. The real copies of those files are in sys/linux/dev_infiniband_rdma_*.const. For now I did *not* check for other new APIs that need to be described.
* sys/linux: update key descriptionsEric Biggers2019-07-152-5/+20
| | | | | | | | - Add KEYCTL_MOVE (new in v5.3) - Add KEYCTL_CAPABILITIES (new in v5.3) - Add KEYCTL_GRANT_PERMISSION (new in v5.3) - Remove KEY_PERM_UNDEF (was only ever in an internal kernel header, not in UAPI; removed in v5.3)
* executor: add network packet injection for NetBSDSiddharth M2019-07-143-7/+26
| | | | | | | | | | | | * Initial Commit * working build of network packet fuzzing * Add missed csource file * pkg/csource: fix build * executor/common_bsd.h: Add comment stating reason for ifconfig create
* executor: fix out-of-bounds in USB fuzzing codeAndrey Konovalov2019-07-111-5/+9
| | | | | We might not have any string descriptors provided at all, use a hardcoded string in this case.
* executor: update USB fuzzing code to use new kernel APIAndrey Konovalov2019-07-111-42/+68
| | | | | The kernel API has changed and now differentiates between IN and OUT control requests.
* sys/openbsd: add diskmap descriptionsAnton Lindqvist2019-07-102-1/+3
|
* sys/linux: fix floppy descriptionDenis Efremov2019-07-051-5/+5
| | | | | | | | | | * sys/linux: fix floppy description Fix typo in the FDGETPRM ioctl. * sys/linux: extract && generate for floppy Signed-off-by: Denis Efremov <efremov@linux.com>
* executor: make errors during thread creation exit zeroAnton Lindqvist2019-07-041-2/+2
| | | | | | | | | | | | | On OpenBSD, the executor sometimes manages to set the memory resource limit 0 causing any following memory allocation to fail. Since threads are potentially created from such a thread which cannot allocate any memory, the executor will exit non-zero which in turn will cause false-positive panics to be reported. For more info see the discussion[1] in PR #1243. Instead, if hitting a fatal error during thread creation exit zero. [1] https://github.com/google/syzkaller/pull/1243
* sys/linux, executor: run make extract and generateAndrey Konovalov2019-07-012-5/+10
|
* sys/linux, executor: add syz_usb_ep_read syzkallAndrey Konovalov2019-07-012-21/+81
| | | | syz_usb_ep_read reads data from USB endpoints other than #0.
* sys/netbsd: Adding more syscallsSiddharth M2019-07-012-1/+21
| | | | | | | | | | | | | | * sys/netbsd: Adding more syscalls * Added lwp create structures * Added a few lwp flags * completed _lwp* syscalls * add clone syscall * fix errors, recheck arguments
* sys/openbsd: add missing WSDISPLAYIO_SBURNER ioctl commandAnton Lindqvist2019-06-302-1/+2
|
* sys/linux: update mpls_lable and rta typesHangbin Liu2019-06-261-5/+5
| | | | | | | | | | | | | | Kernel get mpls lable like ``` unsigned entry = be32_to_cpu(hdr->label_stack_entry); result.label = (entry & MPLS_LS_LABEL_MASK) >> MPLS_LS_LABEL_SHIFT; ``` So we just need to store the label in big endian order. For mpls rta types, kernel accpet only one lable for RTA_DST and multi labels for RTA_NEWDST. Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
* sys/netbsd: Add new syscalls exit and ptraceR3x2019-06-262-1/+3
|
* sys/linux, executor: run make extract and generateAndrey Konovalov2019-06-242-5/+15
|
* sys/linux, executor: add basic USB HID fuzzing supportAndrey Konovalov2019-06-242-36/+87
| | | | | This commit adds the necessary descriptions and executor adjustments to enable targeted fuzzing of the enumeration process of USB HID devices.
* sys/linux: update BPF constantsPaul Chaignon2019-06-231-5/+5
| | | | Signed-off-by: Paul Chaignon <paul.chaignon@orange.com>
* sys/freebsd: fix sockaddr structuresMichael Tuexen2019-06-231-2/+2
| | | | FreeBSD uses in sockaddr_{in,in6,un} structures a length field.
* pkg/report: use cover protect on NetBSD alsoR3x2019-06-131-2/+2
|
* executor: improve usb coverage attributionAndrey Konovalov2019-06-121-9/+18
| | | | | Always call write_extra_output() only if the current program or call can produce extra coverage (== is a syz_usb* syzcall).
* sys/linux: run make extract and generateAndrey Konovalov2019-06-121-5/+5
| | | | | Forgot to do it after the last changes in hiddev descriptions. Fuse is also updated.
* sys/openbsd: prevent using vio0 as a virtual multicast interfaceAnton Lindqvist2019-06-081-1/+1
| | | | | | | | | | | One of the root causes to reported "lost connection to test machine" is when the egress network interface is being used as a multicast interface: setsockopt$inet6_MRT6_ADD_MIF(r0, 0x29, 0x66, &(0x7f0000000180)={0x2}, 0xc) Prevent such syscalls from being generated by limiting the range of allowed interface indices.
* sys/linux: use template based structure for USB descriptionsAndrey Konovalov2019-06-071-5/+5
| | | | | | | | To allow future extensions of USB descriptions to fuzz particular USB classes this patch changes the structure of USB descriptions to use templates. This will invalidate all existing USB corpus.
* sys/linux: add hidraw and hiddev descriptionsAndrey Konovalov2019-06-072-10/+165
|
* sys/linux: don't inherit fd_usb from fdAndrey Konovalov2019-06-061-5/+5
| | | | This is a special fd, we don't want various ioctls be called on it.
* sys/openbsd: add klog descriptionsAnton Lindqvist2019-06-052-1/+4
|
* sys/openbsd: add missing wsmouse ioctl descriptionsAnton Lindqvist2019-06-052-1/+6
|
* executor: add cover protection support to OpenBSD (#1215)Anton Lindqvist2019-06-051-0/+17
|
* executor: Protect the coverage bufferAndrew Turner2019-06-044-0/+41
| | | | | | | | | Add functions to protect and unprotect the coverage buffer. The buffer is protected from being written to while tracing. When the trace data is sorted we need to make it read/write, but can return it to read only after this has completed. Leave the first page as read/write as we need to clear the length field.
* executor: special-case zx_deadline_after return valueDmitry Vyukov2019-06-041-0/+1
| | | | | zx_deadline_after also returns time, not status. So don't use it as coverage.
* sys/linux: update descriptions of sendmsg/sendmmsgBins942019-06-032-31/+90
| | | | | Add sendmsg$inet, sendmmsg$inet for ip_cmsg_send. Add sendmsg$inet6, sendmmsg$inet6 for ip6_datagram_send_ctl
* sys/linux: add missing BPF constantsPaul Chaignon2019-05-311-5/+5
| | | | Signed-off-by: Paul Chaignon <paul.chaignon@orange.com>
* pkg/csource: generate timeouts for USB syzcallsAndrey Konovalov2019-05-312-1/+3
| | | | This patch only covers per call timeouts, per prog one is not adjusted yet.
* sys/linux: add missing BPF constantsPaul Chaignon2019-05-291-5/+5
| | | | Signed-off-by: Paul Chaignon <paul.chaignon@orange.com>
* sys/freebsd: Add support for fuzzing FreeBSD/i386Andrew Turner2019-05-292-0/+513
| | | | Add support to fuzz 32 bit FreeBSD system calls.
* sys/fuchsia: Updating Fuchsia definitionsPascal Perez2019-05-212-2/+16
| | | | | | Simply make extract TARGETOS=fuchsia SOURCEDIR=<FUCHSIA_DIR>/fuchsia
* make changes to prevent failing buildR3x2019-05-211-2/+11
|
* executor: exit after first detected leak in C reprosDmitry Vyukov2019-05-211-6/+0
| | | | Otherwise C repros print infinite stream of the same leaks again and again.
* executor: implement support for leak checkingDmitry Vyukov2019-05-204-41/+223
| | | | | | | | | | | | | | | | | | | | | | | | | Leak checking support was half done and did not really work. This is heavy-lifting to make it work. 1. Move leak/fault setup into executor. pkg/host was a wrong place for them because we need then in C repros too. The pkg/host periodic callback functionality did not work too, we need it in executor so that we can reuse it in C repros too. Remove setup/callback functions in pkg/host entirely. 2. Do leak setup/checking in C repros. The way leak checking is invoked is slightly different from fuzzer, but much better then no support at all. At least the checking code is shared. 3. Add Leak option to pkg/csource and -leak flag to syz-prog2c. 4. Don't enalbe leak checking in fuzzer while we are triaging initial corpus. It's toooo slow. 5. Fix pkg/repro to do something more sane for leak bugs. Few other minor fixes here and there.
generated by ggit (джигит) mrf-deployment (git 2.46.0) at 2026-03-20 02:35:48 +0000