aboutsummaryrefslogtreecommitdiffstats
path: root/executor
Commit message (Collapse)AuthorAgeFilesLines
* Makefile: enable clang-tidy in presubmit testsDmitry Vyukov2020-08-042-13/+7
| | | | | Fix all errors it points to. The one in netlink_send_ext is concerning.
* executor: remove block commentsDmitry Vyukov2020-08-044-34/+26
| | | | | | | | | 1. We don't generally use /* */ block comments, few precedents we have are inconsistent with the rest of the code. 2. pkg/csource does not strip them from the resulting code. Remove the cases we have and add a test to prevent new ones being added.
* all: fake hci le conn using handle 201Andy Nguyen2020-08-021-5/+40
|
* Revert "executor: enable extra coverage on OpenBSD"Anton Lindqvist2020-08-021-9/+0
| | | | | | | Forgot that the build machine must be updated with a newer OpenBSD snapshot first in order to make the new kcov stuff available. This reverts commit 96dd36234d97bbf6b403f3a7f03cfc0296422879.
* executor: enable extra coverage on OpenBSDAnton Lindqvist2020-08-021-0/+9
| | | | | | Recently added[1] to the kcov implementation on OpenBSD. [1] https://github.com/openbsd/src/commit/8430bc4bce9f93dce843b53971377b7afd96cdb1
* sys/linux: assorted improvements for vhciDmitry Vyukov2020-07-301-3/+4
| | | | | | | | | | | | | | | | Regenerate const files on next-20200729. Change conn handle to 200 because it also seems to be matches against phy_handle fields which are int8 (current 256 does not fit into int8). Use 200 for all handle's and all phy_handle's. Remove hci_evt_le_cis_req, it does not seem to be used in the kernel. Restrict some event types and statuses. Add rssi field to hci_ev_le_advertising_info. Use bytesize for some of the data length fields.
* all: initialize vhci in linuxTheOfficialFloW2020-07-302-3/+306
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * all: initialize vhci in linux * executor/common_linux.h: improve vhci initialization * pkg/repro/repro.go: add missing vhci options * executor/common_linux.h: fix type and add missing header * executor, pkg: do it like NetInjection * pkg/csource/csource.go: do not emit syz_emit_vhci if vhci is not enabled * executor/common_linux.h: fix format string * executor/common_linux.h: initialize with memset For som reason {0} gets complains about missing braces... * executor/common_linux.h: simplify vhci init * executor/common_linux.h: try to bring all available hci devices up * executor/common_linux.h: find which hci device has been registered * executor/common_linux.h: use HCI_VENDOR_PKT response to retrieve device id * sys/linux/dev_vhci.txt: fix structs of inquiry and report packets * executor/common_linux.h: remove unnecessary return statement and check vendor_pkt read size * executor/common_linux.h: remove unnecessary return statement and check vendor_pkt read size * sys/linux/dev_vhci.txt: pack extended_inquiry_info_t * sys/linux/l2cap.txt: add l2cap_conf_opt struct * executor/common_linux.h: just fill bd addr will 0xaa * executor/common_linux.h: just fill bd addr will 0xaa
* executor: added syz_io_uring_setup to wrap both setup and mmapNecip Fazil Yildiran2020-07-291-1/+85
| | | | | | It is hard for the fuzzer to generate correct programs using mmap calls with fuzzer-provided mmap length. This wrapper ensures correct length computation.
* all: fix marking of auto-generated filesDmitry Vyukov2020-07-292-2/+2
| | | | | Update the copyright checking script and more files for the standard convention of marking auto-generated files.
* sys/linux: enhanced descs for io_uringNecip Fazil Yildiran2020-07-241-0/+147
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * sys/linux: enhanced descs for io_uring Introduced pseudo-call "syz_io_uring_put_sqes_on_ring()" for writing submission queue entries (sqes) on sq_ring, which was obtained by mmap'ping the offsets obtained from io_uring_setup(). Added descriptions for io_ring_register operations that were missing earlier. Did misc changes to adapt the descriptions for the updates on the io_uring subsystem. * pkg/host: add io_uring pseudo-syscall * executor/common_linux.h: fix issues with io_uring pseudo-syscall * executor: fixed io_uring offset computation * executor: fixes and refactorings in syz_io_uring_submit() * executor: added syz_io_uring_complete() pseudo-syscall for io_uring * sys/linux: added descriptions for io_uring operations Each operation requires a different struct io_uring_sqe set up. Those are described to be submitted to the sq ring. * executor: use uint32 instead of uint32_t * executor: remove nonfailing from pseudo-calls * sys/linux: fix io_uring epoll_ctl sqe * prog: fix TestTransitivelyEnabledCallsLinux() The newly introduced syscall, syz_io_uring_submit$IORING_OP_EPOLL_CTL, uses fd_epoll. Adapt TestTransitivelyEnabledCallsLinux() to account for this. * sys/linux: add IORING_OP_PROVIDE_BUFFERS and IORING_OP_REMOVE_BUFFERS * sys/linux: fix IORING_OP_WRITE_FIXED and IORING_OP_READ_FIXED addr and len are for the buffer located at buf_index * sys/linux: io_uring: use reg. bufs for READ, READV, RECV, RECVMSG As a result, IOSQE_BUFFER_SELECT_BIT is included in the iosqe_flags. * sys/linux: io_uring: misc fixes * sys/linux: io_uring: add IORING_SETUP_ATTACH_WQ * executor: refactorings on io_uring pseudo syscalls * sys/linux: io_uring: fix desc for params.cq_entries * executor: fix SQ_ARRAY_OFFSET computation This is required with the fix in io_uring kernel code. https://lore.kernel.org/io-uring/CACT4Y+bgTCMXi3eU7xV+W0ZZNceZFUWRTkngojdr0G_yuY8w9w@mail.gmail.com/T/#t * executor: added pseudosyscall syz_io_uring_cq_eventfd_toggle() The usage of cq_ring->flags is only for manipulating IORING_CQ_EVENTFD_DISABLED bit. This is achieved by a pseudo-syscall, which toggles the bit. * executor: added pseudocall syz_io_uring_put_ring_metadata Removed syz_io_uring_cq_eventfd_toggle() and introduced syz_io_uring_put_ring_metadata() instead. We have many pieces of metadata for both sq_ring and cq_ring, for which we are given the offsets, and some of are not supposed to be manipulated by the application. Among them, both sq and cq flags can be changed. Both valid and invalid cases might cause interesting outcomes. Use the newly introduced pseudo syscall to manipulate them randomly while also manipulating the flags to their special values. * executor: added pseudo-syscall syz_memcpy_off Removed syz_io_uring_put_ring_metadata() and instead added a much more generic pseudo systemcall to achieve the task. This should benefit other subsystems as well. * sys/linux: refactored io_uring descriptions syz_io_uring_submit() is called with a union of sqes to reduce duplication of other parameters of the function. io_uring_sqe is templated with io_uring_sqe_t, and this template type is used to describe sqes for different ops. The organization of io_uring.txt is changed. * sys/linux: io_uring: improved descs to utilize registered files The files are registered using io_uring_register$IORING_REGISTER_FILES(). When IOSQE_FIXED_FILE_BIT is enabled in iosqe_flags in sqe, a variety of operations can use those registered files using the index of the file instead of fd. Changed the sqe descriptions for the eligible operations to utilize this. * sys/linux: io_uring: improved the descs to utilize personality_id in sqes A personality_id can be registered for a io_uring fd using io_uring_register$IORING_REGISTER_PERSONALITY(). This id can be utilized within sqes. This commit improves the descs for io_uring to utilize it. In addition, the descriptions for the misc field in io_uring_sqe_t is refactored as most are shared among sqes. * sys/linux: io_uring: utilized cqe.res io_uring_cqe.res is used to carry the return value of operations achieved through io_uring. The only operations with meaningful return values (in terms of their possible usage) are openat and openat2. The pseudo-syscall syz_io_uring_complete() is modified to account for this and return those fds. The description for sqe_user_data is splitted into two to identify openat and non-openat io_uring ops. IORING_OP_IOCTL was suggested but never supported in io_uring. Thus, the note on this is removed in the descriptions. tee() expects pipefds, thus, IORING_OP_TEE. The descriptions for the pipe r/w fds are written as ordinary fd. Thus, in the description for IORING_OP_TEE, which is io_uring_sqe_tee, fd is used in the place where pipefds are expected. The note on this is removed in the descriptions. * sys/linux/test: added test for io_uring This is not tested yet. * sys/linux/test: fixed the test for io_uring The changes successfully pass the sys/linux/test/io_uring test. sys/linux/io_uring.txt: sq_ring_ptr and cq_ring_ptr are really the same. Thus, they are replaced with ring_ptr. executor/common_linux.h: thanks to io_uring test, a bug is found in where the sq_array's address is computed in syz_io_uring_submit(). Fixed. In addition, similar to the descriptions, the naming for the ring_ptr is changed from {sq,cq}_ring_ptr to ring_ptr. * sys/linux: io_uring: misc fixes * sys/linux: io_uring: changed the sqe_user_data enum Used a smaller range to ease the collisions. Used comperatively unique and magic numbers for openat user_data to avoid thinking as if the cqe belongs to openat while the user_data is coming from some random location. * pkg/host: added checks for io_uring syscall * pkg/host: fixed checks for io_uring syscall * sys/linux: fixed io_uring test
* executor: fix build errors in setup_32bit_idt()Denis Efremov2020-07-211-1/+1
| | | | | | | | | | GCC10 fails to build the code with errors: executor/common_kvm_amd64.h:143:64: error: ‘gate.kvm_segment::type’ may be used uninitialized in this function [-Werror=maybe-uninitialized] executor/common_kvm_amd64.h:143:56: error: ‘gate.kvm_segment::base’ may be used uninitialized in this function [-Werror=maybe-uninitialized] Replace 'case 6' with 'case 5' since 'i % 6' results in [0..5]. Signed-off-by: Denis Efremov <efremov@linux.com>
* executor: remove NONFAILING from pseudo-syscallsDmitry Vyukov2020-07-158-106/+80
| | | | | | This is not needed anymore afer the previous commit. Fixes #1918
* executor: wrap all syscalls into NONFAILINGDmitry Vyukov2020-07-151-2/+5
| | | | | | | | | | | | | | | Currently we sprinkle NONFAILING all over pseudo-syscall code, around all individual accesses to fuzzer-generated pointers. This is tedious manual work and subject to errors. Wrap execute_syscall invocation with NONFAILING in execute_call once instead. Then we can remove NONFAILING from all pseudo-syscalls and never get back to this. Potential downsides: (1) this is coarser-grained and we will skip whole syscall on invalid pointer, but this is how normal syscalls work as well, so should not be a problem; (2) we will skip any clean up (closing of files, etc) as well; but this may be fine as well (programs can perfectly leave open file descriptors as well). Update #1918
* executor: fix bitfields for big-endian archAlexander Egorenkov2020-07-102-3/+22
| | | | | | | | Add bitfield tests for big-endian arch Issue: #1885 Signed-off-by: Alexander Egorenkov <Alexander.Egorenkov@ibm.com>
* executor: clarify debug/debug_verbose useDmitry Vyukov2020-07-081-1/+5
|
* executor: prohibit mallocDmitry Vyukov2020-07-081-0/+7
|
* executor: enable cgroup/cpuset memory pressure calc.Necip Fazil Yildiran2020-06-291-0/+1
| | | | Enable the cpuset.memory_pressure_enabled flag in the root cpuset.
* executor/netbsd: base nth on 2 (#1874)m00nbsd2020-06-271-2/+2
|
* executor: add support for linux/riscv64Tobias Klauser2020-06-261-0/+5
| | | | Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
* pkg/csource: fix casting of parameters for trampolinesAlexander Egorenkov2020-06-261-0/+7
| | | | Signed-off-by: Alexander Egorenkov <Alexander.Egorenkov@ibm.com>
* sys/linux: first 64bit big-endian architecture s390xAlexander Egorenkov2020-06-251-0/+2
| | | | | | | | | | | | | | | * mmap syscall is special on Linux s390x because the parameters for this syscall are passed as a struct on user stack instead of registers. * Introduce the SyscallTrampolines table into targets.Target to address the above problem. * There is a bug in Linux kernel s390x which causes QEMU TCG to hang when KASAN is enabled. The bug has been fixed in the forthcoming Linux 5.8 version. Until then do not enable KASAN when using QEMU TCG, QEMU KVM shall have no problems with KASAN. Signed-off-by: Alexander Egorenkov <Alexander.Egorenkov@ibm.com>
* executor: don't use static_assertDmitry Vyukov2020-06-251-1/+1
| | | | | Use existing way of doing size checks, otherwise akaros build is broken: https://github.com/google/syzkaller/pull/1868/checks?check_run_id=808613616
* executor: fix write_output_64Alexander Egorenkov2020-06-251-1/+7
| | | | | | The output pointer was not updated after writing. Signed-off-by: Alexander Egorenkov <Alexander.Egorenkov@ibm.com>
* ipc: fix endianness issuesAlexander Egorenkov2020-06-233-10/+19
| | | | | | | | Use native byte-order for IPC and program serialization. This way we will be able to support both little- and big-endian architectures. Signed-off-by: Alexander Egorenkov <Alexander.Egorenkov@ibm.com>
* executor: fix endianness problem in internet checksumAlexander Egorenkov2020-06-192-19/+19
| | | | | | | | | | | | | | | | csum_inet_update does not handle odd number of bytes on big-endian architectures correctly. When calculating the checksum of odd number of bytes, the last byte must be interpreted as LSB on little-endian architectures and as MSB on big-endian ones in a 16-bit half-word. Futhermore, the checksum tests assume that the underlying architecture is always little-endian. When a little-endian machine stores a calculated checksum into memory, then the checksum's bytes are automatically swapped. But this is NOT true on a big-endian architecture. Signed-off-by: Alexander Egorenkov <Alexander.Egorenkov@ibm.com>
* executor: enable KVM generator only on AMD64 archAlexander Egorenkov2020-06-171-1/+1
| | | | | | Executor KVM generator works only on amd64 linux machines. Signed-off-by: Alexander Egorenkov <Alexander.Egorenkov@ibm.com>
* executor: Improve used terminologyMarco Elver2020-06-152-5/+6
| | | | | | | | Improve used terminology by using better verbs to express the effect of the whitelist/blacklist. This also changes executor to exclusively show respectful log messages, and as per recent conversion, converts the last such case.
* sys/netbsd: support multiple vHCI buses (#1822)m00nbsd2020-06-133-19/+30
|
* all: use more respective languageDmitry Vyukov2020-06-112-4/+4
| | | | | | | | Some terms are normalised on the technical level but may be oppressive on a societal level. Replace them with more technically neutral terms. See the following doc for a longer version: https://tools.ietf.org/id/draft-knodel-terminology-00.html
* sys/netbsd: add support for fault injection (#1817)m00nbsd2020-06-113-1/+51
|
* executor/fuchsia: Don't map memory as executable.Marco Vanotti2020-06-052-21/+17
| | | | | | | | | | | | | | | | | | | Fuchsia has strict controls over who can map memory as executable. Refactoring syz-executor to be able to do that involves a non trivial amount of work: it needs to run as a fuchsia component and replace stdin for some other mechanism to communicate with syz-fuzzer (probably a fidl service and a thin client that proxies stdin/stdout to syz-fuzzer via ssh). Mapping memory as executable doesn't seem to be used or needed in syz-executor at all. After talking with Dmitry, he mentioned that it was used in a deprecated feature: `syz_execute_func` which would execute random code. It also allows more scenarios during fuzzing. For now, I'm removing that option to allow syzkaller continue fuzzing. This change also refactors all of the error messages adding a string representation of the `zx_status_t` in error logs.
* .golangci.yml: enable godot checkerDmitry Vyukov2020-06-051-1/+1
| | | | | A good one. Lots of fixed comments are contributed by episodic contributors. So it's good to catch these earlier.
* executor: fix printing null master in netlink_device_changeAndrey Konovalov2020-05-291-1/+1
| | | | | | | | The issues is only present with verbose debugging enabled. executor/common_linux.h: In function ‘void netlink_device_change(nlmsg*, int, const char*, bool, const char*, const void*, int, const char*)’: executor/common_linux.h:380:7: error: ‘%s’ directive argument is null [-Werror=format-overflow=] 380 | debug("netlink: device %s up master %s: %s\n", name, master, strerror(err));
* executor: fix a cast in common_usb_netbsd.hm00nbsd2020-05-241-2/+2
|
* executor: fix a USB define on NetBSDm00nbsd2020-05-211-1/+3
|
* executor: use the SYZ_USB define for NetBSDm00nbsd2020-05-211-1/+1
|
* executor: fix the types used in common_usb_netbsd.hm00nbsd2020-05-211-57/+57
|
* executor: add support for extra coverage on NetBSDm00nbsd2020-05-201-11/+22
|
* executor: add support for USB fuzzing on NetBSDm00nbsd2020-05-196-9/+407
|
* executor: exclude syz_kvm_setup_cpu on armDmitry Vyukov2020-05-181-1/+1
| | | | | KVM was removed for ARM. Improved CI finally allows to catch this.
* executor, sys/linux: syz_usb_ep_read/write accept endpoint addressAndrey Konovalov2020-05-152-12/+62
| | | | | This patch changes syz_usb_ep_read/write pseudo-syscalls to accept endpoint address as specified in its endpoint descriptor, instead of endpoint index.
* executor: stall unknown usb requestsAndrey Konovalov2020-05-152-8/+55
| | | | Also don't fail(), leave that to USB_DEBUG and analyze_control_request().
* executor: don't build gen.go on FreeBSDMichael Tuexen2020-05-131-1/+1
|
* executor: don't build gen.go on OpenBSD or NetBSDMichael Tuexen2020-05-131-1/+1
| | | | Use (NOT openbsd) AND (NOT netbsd) instead of (NOT openbsd) OR (NOT netbsd).
* executor: fix typo (#1737)Michael Tüxen2020-05-131-1/+1
|
* executor: fix #ifdef condition for remove_dir()Michael Tuexen2020-05-131-1/+1
|
* Makefile: generate descriptions on-the-flyDmitry Vyukov2020-04-302-26306/+0
| | | | | | | | | | | | | | | | | | Checking in the generated descriptions files makes few things simpler, but causes pain for pull requests: (1) PRs that touch descriptions _always_ conflict, (2) PRs are large and harder to review, (3) people sometimes forget to add auto-generated files. The proposed way does not require us to hardcode lots of dependencies in the Makefile (which is nice) and seem to work. Let's see how it works. The main contributor-visible consequence is that the auto-generated files do not need to be checked-in now. Credit for figuring the Makefile magic goes to @melver. Fixes #1291
* sys: add mldv2 packet structsAndy Nguyen2020-04-291-8/+8
| | | | Use special values for hop limit to increase likelihood of triggering certain paths.
* sys: add more specific ipv6 optionsAndy Nguyen2020-04-292-8/+40
| | | | Additionally fix a type for ipv6_hopopts_ext_header
* pkg/compiler: deduplicate Types in descriptionsDmitry Vyukov2020-04-261-19/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add prog.Ref Type that serves as a proxy for real types and allows to deduplicate Types in generated descriptions. The Ref type is effectively an index in an array of types. Just before serialization pkg/compiler replaces real types with the Ref types and prepares corresponding array of real types. When a Target is registered in prog package, we do the opposite operation and replace Ref's with the corresponding real types. This brings improvements across the board: compiler memory consumption is reduced by 15%, test building time by 25%, descriptions size by 33%. Before: $ du -h sys/linux/gen 54M sys/linux/gen $ time GOMAXPROCS=1 go test -p=1 -c ./prog real 0m54.200s real 0m53.883s $ time GOMAXPROCS=1 go install -p=1 ./tools/syz-execprog real 0m27.911s real 0m27.767s $ TIME="%e %P %M" GOMAXPROCS=1 time go tool compile ./sys/linux/gen 20.59 100% 3200016 20.97 100% 3445976 20.25 100% 3209684 After: $ du -h sys/linux/gen 36M sys/linux/gen $ time GOMAXPROCS=1 go test -p=1 -c ./prog real 0m42.290s real 0m43.230s $ time GOMAXPROCS=1 go install -p=1 ./tools/syz-execprog real 0m24.337s real 0m24.727s $ TIME="%e %P %M" GOMAXPROCS=1 time go tool compile ./sys/linux/gen 19.11 100% 2764952 19.66 100% 2787624 19.35 100% 2749376 Update #1580
generated by ggit (джигит) mrf-deployment (git 2.46.0) at 2026-03-12 03:11:05 +0000