aboutsummaryrefslogtreecommitdiffstats
path: root/executor
Commit message (Collapse)AuthorAgeFilesLines
* executor: retry pselect() when interruptedCameron Finucane2024-08-301-1/+4
| | | | | | Occasionally a SIGCHLD would cause EINTR to be returned by pselect(), and then the runner would become hung by attempting to read a socket that was not in fact ready.
* executor: fix corner case of misinterpreting comparison dataDmitry Vyukov2024-08-281-0/+12
| | | | | Reset coverage right before scheduling next syscall for execution. See the added comment for details.
* executor: protect kcov/output regions with pkeysDmitry Vyukov2024-08-164-10/+84
| | | | | | | Protect KCOV regions with pkeys if they are available. Protect output region with pkeys in snapshot mode. Snapshot mode is especially sensitive to output buffer corruption since its location is not randomized.
* executor: keep SYZFAIL messages during machine checkDmitry Vyukov2024-08-161-3/+6
| | | | | Replace just the SYZFAIL part instead of the whole message. This makes debugging of things easier.
* executor: simplify mapping of kcov guard pagesDmitry Vyukov2024-08-141-9/+1
|
* executor: set process name before taking snapshotDmitry Vyukov2024-08-131-7/+6
| | | | | It's not necessary to set process name in snapshot mode since we execute only 1 program each time.
* executor: arm64: add SYZOS_API_HVCAlexander Potapenko2024-08-071-8/+36
| | | | | Make the necessary changes to support HVC in addition to SMC. These two may subtly differ, so they are handled separately.
* executor: arm64: add SYZOS_API_SMCAlexander Potapenko2024-08-071-0/+36
| | | | | | | | Provide an API call to invoke the ARM64 Secure Monitor Call instruction with user-supplied function id and 5 parameters passed in registers x1-x5. For now only `smc #0` is invoked, although in the future we may want to pass other (reserved) immediate values to SMC.
* executor: fix coverage collection in snapshot modeDmitry Vyukov2024-08-061-3/+5
| | | | Fixes #5143
* executor: arm64: add SYZOS_API_MSRAlexander Potapenko2024-08-053-0/+46
| | | | | | | | | | | | | MSR is an ARM64 instruction that writes a value from a GP register to one of the system CPU registers. Exposing those registers to a fuzzer will let us trigger unexpected behavior in handling them on the kernel side. The SYZOS_API_MSR call has two int64 arguments, register ID and value. Register IDs are 64-bit values obtained from ARM64_SYS_REG() in the Linux asm/kvm.h UAPI header. Same register IDs are used by ioctl$KVM_GET_ONE_REG and ioctl$KVM_SET_ONE_REG. Also add sys/linux/test/syz_kvm_setup_cpu_arm64-msr
* executor: arm64: kvm: exit from guest_main() using guest_uexit()Alexander Potapenko2024-08-051-0/+1
| | | | | Call guest_uexit(-1) to break from ioctl(KVM_RUN), otherwise the VM will be running infinitely until it is killed.
* executor: add missing static declarations in common_kvm_arm64_syzos.hAlexander Potapenko2024-08-051-4/+4
|
* pkg/rpcserver: use dense VM indices instead of string namesDmitry Vyukov2024-08-021-8/+11
| | | | | | Using actual VM indices for VM identification allows to match these indices to VMs in the pool, allows to use dense arrays to store information about runners (e.g. in queue.Distributor), and just removes string names as unnecessary additional entities.
* executor: restart procs more deterministicallyDmitry Vyukov2024-08-021-9/+41
| | | | | | | | | | | | | | | | | | | | Currently we force restart in rpcserver, but this has 2 problems: 1. It does not know the proc where the requets will land. 2. It does not take into account if the proc has already restarted recently for other reasons. Restart procs in executor only if they haven't restarted recenlty. Also make it deterministic. Given all other randomess we have, there does not seem to be a reason to use randomized restarts and restart after fewer/more runs. Also restart only after corpus triage. Corpus triage is slow already and there does not seem to be enough benefit to restart during corpus triage. Also restart at most 1 proc at a time, since there are lots of serial work in the kernel.
* pkg/fuzzer: try to triage on different VMsDmitry Vyukov2024-08-022-1/+3
| | | | Distribute triage requests to different VMs.
* executor: handle EINTR in connectGreg Steuck2024-07-301-1/+23
| | | | ConnectWait is directly from OpenBSD man page.
* executor: arm64: sys/linux: introduce syzos APIAlexander Potapenko2024-07-293-12/+76
| | | | | | | | | | | | | | | | | | | | | | Allow guest payload to call syzos API functions. The available calls are enumerated by SYZOS_API_* constants, and have a form of: struct api_call { uint64 call; uint64 struct_size; /* arbitrary call-related data here */ }; Complex instruction sequences are too easy to break, so most of the time fuzzer won't be able to efficiently mutate them. We replace kvm_text_arm64 with a sequence of `struct api_call`, making it possible to intermix assembly instructions (SYZOS_API_CODE) with higher-level constructs. Right now the supported calls are: - SYZOS_API_UEXIT - abort from KVM_RUN (1 argument: exit code, uint64) - SYZOS_API_CODE - execute an ARM64 assembly blob (1 argument: inline array of int32's)
* executor: more precise detection of exit/_exit in the linterAlexander Potapenko2024-07-291-1/+1
| | | | Do not report errors when a function name contains '[_]exit' as a substring.
* executor: arm64: add syzos headerAlexander Potapenko2024-07-293-1/+29
| | | | | | | | | | For KVM fuzzing we are going to need some library code that will be running inside KVM to perform common tasks (e.g. register accesses, device setup etc.) This code will reside in a special ".guest" section that the executor will map at address 0xeeee8000. For now it contains just the main function, but will be extended in further patches.
* executor: arm64: more flexible physical page allocationAlexander Potapenko2024-07-292-14/+78
| | | | | | | Refactor phys page allocation in syz_kvm_setup_cpu$arm64 to prepare for more address ranges. Load user-supplied code at ARM64_ADDR_USER_CODE and allocate EL1 stack at ARM64_ADDR_EL1_STACK_BOTTOM.
* all: add qemu snapshotting modeDmitry Vyukov2024-07-255-37/+341
|
* executor: increase kExtraCoverSize to 1024kAndrey Konovalov2024-07-231-1/+1
| | | | | | | | | | | | | | | Running the vusb_ath9k runtest (with [1] and [2] applied) produces ~100k of extra coverage, which is somewhat close to the current 256k limit. A more complicated program might produce more extra coverage and overflow the coverage buffer. Increase kExtraCoverSize to 1024k. As the extra coverage buffer is maintained per-executor and not per-thread, the total increase of the coverage mapping is ~9%, which is not too bad. [1] https://lore.kernel.org/all/eaf54b8634970b73552dcd38bf9be6ef55238c10.1718092070.git.dvyukov@google.com/ [2] https://lore.kernel.org/all/20240722223726.194658-1-andrey.konovalov@linux.dev/T/#u
* executor: fix writing of remote coverageDmitry Vyukov2024-07-223-3/+26
| | | | | | | | We never reset remote coverage, so if there is one block, we will write it after every call and multiple times at the end. It can lead to "too many calls in output" and just writes quadratic amount of coverage/signal. Reset remote coverage after writing.
* executor: refactor argument parsingDmitry Vyukov2024-07-221-4/+8
| | | | Check that we have at least command argument in the beginning.
* prog: restricts hints to at most 10 attempts per single kernel PCDmitry Vyukov2024-07-221-16/+10
| | | | | | | | | We are getting too many generated candidates, the fuzzer may not keep up with them at all (hints jobs keep growing infinitely). If a hint indeed came from the input w/o transformation, then we should guess it on the first attempt (or at least after few attempts). If it did not come from the input, or came with a non-trivial transformation, then any number of attempts won't help. So limit the total number of attempts (until the next restart).
* executor: deduplicate signal per-callAleksandr Nogikh2024-07-181-13/+15
| | | | | | | | | | | This kind of deduplication is confusing for the fuzzer, which expects to control the process itself (by MaxSignal and by specifying the calls for which full signal must be returned). There's also a chance that it may contribute to the difficulties during program triage and minimization. Let's err on the safe side and deduplicate signal only per-call.
* executor: fix localhost handling for machines with only ipv6Konstantin Bogomolov2024-07-181-7/+15
| | | | | In case only ipv6 is supported, we should try ipv4-localhost first and see if it fails, and then go on to trying ipv6.
* executor: manually replace localhost with equivalent ipv4/6 addressKonstantin Bogomolov2024-07-171-0/+5
| | | | | | | It should fix errors like this one: SYZFAIL: failed to resolve manager addr addr=localhost h_errno=2 (errno 11: Resource temporarily unavailable
* executor: avoid setsid() errorsMark Johnston2024-07-171-1/+1
| | | | | See commit bc144f9a58782daa2399d417b56aad80e82a219e. The justification applies to other BSDs as well, so apply the same workaround.
* executor: print signal info for SIGILL/SIGFPE as wellDmitry Vyukov2024-07-171-9/+24
| | | | | There are also synchnous fatal signals that can happen due to bugs in executor code. So handle them as SIGSEGV.
* executor: fix setup of cad_pidDmitry Vyukov2024-07-161-5/+20
| | | | | | | cad_pid must not point to a persistent runner process, b/c it will be killed on ctrl+alt+del. Fixes #5027
* executor: factor output finishing into separate functionDmitry Vyukov2024-07-112-37/+46
| | | | | This will allow to reuse finish_output function for snapshot mode as well. NFC
* executor: retry read in case of known restartable errorsGreg Steuck2024-07-101-1/+5
|
* executor: only report unknown setsid errorsGreg Steuck2024-07-091-1/+1
| | | | | | | | | | | | | | Unlike linux the BSDs used to check the result of setsid. This suddenly became a problem a couple of weeks ago. It's hard to figure out why because there was a number of problems in the area preventing the test from working: gmake executor execprog && \ ./bin/openbsd_amd64/syz-execprog -stress -executor ./bin/openbsd_amd64/syz-executor At least with this change the test above successfully executes some coverage and exits cleanly.
* executor: fix diagnostic message typoGreg Steuck2024-07-091-1/+1
|
* executor: handle EINTR when reading from control pipeDmitry Vyukov2024-07-081-3/+3
| | | | | | | Handle EINTR errors. Sometimes I see them happenning when running in debug mode. Before the previous commit, each such error was printed to output and detected as a bug. Without debug these should be retried by restarting the process, but still better to handle w/o restarting the process (may be expensive).
* executor: repair debug modeDmitry Vyukov2024-07-081-1/+8
| | | | | Don't print SYZFAIL messages during machine check. Otherwise each of them is detected as a bug.
* executor: set `source` for the proc mountAndrei Vagin2024-07-031-1/+1
| | | | | | | | | | mount() in gVisor returns EFAULT if source is NULL. It is a gVisor issue and we will fix it. Let's explicitly sets a string source for the proc mount to unblock gVisor jobs. The source string will additionally be useful for troubleshooting mount-related problems in the future, because it is shown in /prod/pid/mountinfo. Signed-off-by: Andrei Vagin <avagin@google.com>
* executor: linux: bump fs.mount-max to 100000Alexander Potapenko2024-07-031-0/+3
| | | | | | | Android sets fs.mount-max to 100, making it impossible to create new chroots. Relax the limit, setting it to a value used on desktops. Tracking bug: https://github.com/google/syzkaller/issues/4972
* pkg/fuzzer: remove signal rotationDmitry Vyukov2024-07-023-16/+1
| | | | | | | Signal rotation is intended to make the fuzzer re-discover flaky coverage in non flaky way. However, taking into accout that we get effectively the same effect after each manager restart, and that the fuzzer is overloaded with triage/smash jobs, it does not look to be worth it.
* executor: linux: chroot into tmpfs with sandbox=noneAlexander Potapenko2024-07-021-50/+63
| | | | | | | | | | | To prevent the executor from accidentally making the whole root file system immutable (which breaks fuzzing), modify sandbox=none to create a tmpfs mount and chroot into it before executing programs in a process. According to `syz-manager -mode=smoke-test`, the number of enabled syscalls on x86 doesn't change with this patch. Fixes #4939, #2933, #971.
* pkg/mgrconfig: allow to disable remote coverage and coverage edgesDmitry Vyukov2024-07-021-7/+9
|
* pkg/rpcserver: move kernel test/data range checks from executorDmitry Vyukov2024-07-018-219/+80
| | | | | | | | | | | | | | | | | We see some errors of the form: SYZFAIL: coverage filter is full pc=0x80007000c0008 regions=[0xffffffffbfffffff 0x243fffffff 0x143fffffff 0xc3fffffff] alloc=156 Executor shouldn't send non kernel addresses in signal, but somehow it does. It can happen if the VM memory is corrupted, or if the test program does something very nasty (e.g. discovers the output region and writes to it). It's not possible to reliably filter signal in the tested VM. Move all of the filtering logic to the host. Fixes #4942
* pkg/report: suppress executor SIGBUSDmitry Vyukov2024-07-011-2/+3
| | | | | | SIGBUS means OOM on Linux. Most of the crashes that happen during fuzzing are SIGBUS, so separate them from SIGSEGV and suppress.
* executor: fix endianess of size of received flatbuffers root tableAlexander Egorenkov2024-07-011-0/+2
| | | | | | | | | | Flatbuffers represents each scalar in little-endian format (https://flatbuffers.dev/flatbuffers_internals.html). Therefore, the size of the received root table must be converted to the host endianness format before its first usage. Signed-off-by: Alexander Egorenkov <eaibmz@gmail.com> Fixes: e16e2c9a4cb6 ("executor: add runner mode")
* pkg/flatrpc: rename StartLeakChecks to CorpusTriagedDmitry Vyukov2024-07-011-3/+3
| | | | | | It's a more general name that says what happened rather than a detail of what excutor should do. We can use this notification for other things as well.
* executor: always return some coverage for test OSDmitry Vyukov2024-06-281-5/+10
| | | | This allows to enable test executor with coverage.
* executor: don't trace PCs as comparisonsDmitry Vyukov2024-06-282-1/+4
| | | | | | Currnetly we always write PCs into the buffer even if tracing comparisons. Such bogus data will fail comparison consistentcy checks (type/pc) and executor will crash. Don't trace PCs as comparisons.
* executor: fix max signal/cover filter mapping into subprocessesDmitry Vyukov2024-06-282-1/+15
| | | | | | | | | | | There is a quirk related to posix_spawn_file_actions_adddup2: it just executes the specified dup's in order in the child process. In our case we do dups as follows: 20 -> 4 (output region) 4 -> 5 (max signal) So we dup the output region onto 4 first, and then dup the same output region (fd 4 becomes the output region) onto 5 (max signal). So we have output region as both output region and max signal.
* pkg/runtest: test feature detectionDmitry Vyukov2024-06-272-0/+46
| | | | | Fail some features in various ways for test OS, and check that features are detected properly.
generated by ggit (джигит) mrf-deployment (git 2.46.0) at 2026-03-11 22:13:29 +0000