| Commit message (Collapse) | Author | Age | Files | Lines |
| |
|
|
| |
Update #533
|
| |
|
|
|
|
|
|
|
|
| |
Since the OpenBSD target does not make use of syz_execute_func yet, just drop
PROT_EXEC for now.
Supporting write and exec would require one to edit /etc/fstab during
installation.
Regression introduced in commit a4718693 ("sys/linux: add syz_execute_func").
|
| |
|
|
|
|
| |
The function executes random code.
Update #310
|
| |
|
|
| |
Update #533
|
| | |
|
| |
|
|
|
|
|
|
| |
* create a response handle structure for each FIDL method
* generate zx_channel_write for requests having no response
* generate zx_channel_read for events (no request but just response)
* translate FIDL union types to syzkaller union types
(see fuchsia_io_ObjectInfoHandles)
|
| |
|
|
| |
Update #533
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
all: add openbsd support
squash of the following commits:
* openbsd: add mandatory bits
* report: add OpenBSD support
* executor: skip building kvm on OpenBSD
* executor: add OpenBSD support
Linking against libutil is necessary due to usage of openpty(3).
* executor: fix typo in fail() message
* fixup! report: add OpenBSD support
* fixup! openbsd: add mandatory bits
* fixup! openbsd: add mandatory bits
* fixup! openbsd: add mandatory bits
* fixup! report: add OpenBSD support
* gometalinter: skip sys/openbsd
|
| | |
|
| | |
|
| | |
|
| |
|
|
|
|
| |
It's mostly fuse.
Also regenerate consts on latest kernel.
|
| | |
|
| |
|
|
| |
Update #533
|
| |
|
|
|
| |
zx_clock_get_monotonic was added,
zx_debuglog_read was renamed (or we forgot to add it earlier).
|
| |
|
|
| |
zx_time_t type change (unsigned -> signed)
|
| |
|
|
|
| |
seccomp filter can produce arbitrary errno values for subsequent syscalls.
Don't trust anything afterwards.
|
| |
|
|
|
|
| |
gcc complains about function declarations not being prototypes,
signed/unsigned cast mismatch and casts between incompatible functions.
Fix them.
|
| | |
|
| | |
|
| | |
|
| | |
|
| |
|
|
| |
FS_IOC_FSSETXATTR is not supported in compat mode, use FS_IOC_SETFLAGS instead.
|
| |
|
|
|
|
|
| |
1. Create per-proc cgroup in executor.
2. Setup cgroups after chdir into test dir
(it assumes relative paths against test dir).
3. Add test.
|
| |
|
|
|
|
| |
We forgot to mount binfmt_misc. Mount it. Add a test.
Increase per-call timeout, otherwise last execve timesout.
Fix csource waiting for call completion at the end of program.
|
| |
|
|
|
|
| |
Turns out dirs can be immutable too.
Update #650
|
| |
|
|
| |
These are not needed now.
|
| | |
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
It should be in <linux/fs.h> but is not there on some distros/arches as expected.
Travis build fails with:
<stdin>: In function ‘remove_dir’:
<stdin>:152:13: error: variable ‘attr’ has initializer but incomplete type
<stdin>:152:13: error: excess elements in struct initializer [-Werror]
<stdin>:152:13: error: (near initialization for ‘attr’) [-Werror]
<stdin>:152:21: error: storage size of ‘attr’ isn’t known
<stdin>:153:20: error: ‘FS_IOC_FSSETXATTR’ undeclared (first use in this function)
<stdin>:153:20: note: each undeclared identifier is reported only once for each function it appears in
<stdin>:152:21: error: unused variable ‘attr’ [-Werror=unused-variable]
cc1: all warnings being treated as errors
https://travis-ci.org/google/syzkaller/jobs/413574080
|
| |
|
|
| |
Fixes #650
|
| |
|
|
|
|
| |
Remap cover fd's to 24x range to prevent interference
with fd's used during fuzzing and also to make
fd number consistent with/without cover enabled.
|
| |
|
|
|
|
| |
After setuid the process won't have rights to reset net namespace,
but it should not be able to change it during fuzzing too.
So just skip that part.
|
| |
|
|
|
|
|
| |
With checkpoint_net_namespace moved to setup_common,
and Android fuzzing session terminates prematurely due to
ipv4_tables not being initialized at this time.
Moving the call back to loop fixes this behavior.
|
| |
|
|
|
|
|
|
| |
gcc complains:
error: ignoring return value of ‘write’, declared with attribute warn_unused_result [-Werror=unused-result]
Also fix includes.
|
| |
|
|
|
|
|
| |
If the test process is not dying after 100ms,
abort all fuse connections in the system.
This gets rid at least of simple fuse deadlocks,
let's see how well this works in all cases.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
| |
Add syz_errno syscall which sets errno to the argument,
and add a test with different errno values.
This mostly tests the testing infrastructure itself.
Add syz_compare syscall which compare two blobs,
this can be used for testing of argument memory layout.
Implement syz_mmap and fix Makefile to allow building syz-execprog for test OS.
Useful for debugging.
Update #603
|
| | |
|
| |
|
|
| |
Presumably it causes corrupted console output.
|
| |
|
|
|
| |
We see some failures there, extend logging so that it's least
possible to understand what exactly call has failed.
|
| |
|
|
|
|
|
|
|
|
| |
Currently target binaries contain support for all OS/arch combinations.
However, obviously a fuchsia target binary won't test windows.
For target binaries we need support only for a single target
(with the exception of 386/arm target in amd64/arm64 binaries).
So compile in only _the_ target into target binaries.
This reduces akaros/amd64 fuzzer binary from 33 to 7 MB
and execprog from 28 to 2 MB.
|
| |
|
|
|
| |
Fix conditions for when current_time_ms/sleep_ms are used
and make them static.
|
| |
|
|
|
|
|
|
| |
Write coverage from unfinished syscalls.
Also detect when a syscall was blocked during execution,
even if it finished. Helpful for fallback coverage.
Fixes #580
|
| |
|
|
|
| |
clang-format badly mishandles this part,
moreover different versions mishandle it differently.
|
| |
|
|
| |
This will be needed for testing of generated programs.
|
| |
|
|
|
|
|
|
|
|
|
| |
1. Remove unnecessary includes.
2. Remove thunk function in threaded mode.
3. Inline syscalls into main for the simplest case.
4. Define main in common.h rather than form with printfs.
5. Fix generation for repeat mode
(we had 2 infinite loops: in main and in loop).
6. Remove unused functions (setup/reset_loop, setup/reset_test,
sandbox_namespace, etc).
|
| |
|
|
|
|
| |
We always have current_time_ms in event_timedwait
so use it instead of manual clock_gettime calls
which tend to be bulkier.
|
| |
|
|
| |
We already do this in sandbox=none, but forgot about setuid.
|
| |
|
|
| |
Leftover after "executor: overhaul".
|
| |
|
|
|
|
|
|
|
| |
test_copyin does bad things. Fix that.
executor/test.h: In function ‘int test_copyin()’:
executor/common.h:299:16: error: dereferencing type-punned pointer will break strict-aliasing rules [-Werror=strict-aliasing]
*(type*)(addr) = (type)(val); \
^
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Make as much code as possible shared between all OSes.
In particular main is now common across all OSes.
Make more code shared between executor and csource
(in particular, loop function and threaded execution logic).
Also make loop and threaded logic shared across all OSes.
Make more posix/unix code shared across OSes
(e.g. signal handling, pthread creation, etc).
Plus other changes along similar lines.
Also support test OS in executor (based on portable posix)
and add 4 arches that cover all execution modes
(fork server/no fork server, shmem/no shmem).
This change paves way for testing of executor code
and allows to preserve consistency across OSes and executor/csource.
|