aboutsummaryrefslogtreecommitdiffstats
path: root/executor
Commit message (Collapse)AuthorAgeFilesLines
* pkg/ifuzz/powerpc: add some RTAS fuzzingAlexey Kardashevskiy2021-07-191-0/+17
| | | | | | | | | | | | | | | RunTime Abstraction Services (RTAS) is an API used by the Linux powerpc/pseries platform to talk to the hypervisor. Under KVM, this is implemented as a custom hypercall (which we have support for) and an in memory array of parameters. The hypercall is H_RTAS and its only parameter is a pointer to the mentioned array. The vast majority of RTAS calls are handled normally by QEMU and only a handful by KVM. This adds fuzzing of 4 RTAS calls. This uses a chunk from main 256MB RAM for parameters. The parameters are big endian hence "<<24" for the token. To allow more targeted fuzzing, use iset.GenerateInt(). Signed-off-by: Alexey Kardashevskiy <aik@linux.ibm.com>
* executor/common_kvm_ppc64: run with enabled MMUAlexey Kardashevskiy2021-07-192-1/+147
| | | | | | | | | | | | | | | | | | | | | This sets up a page table to map the text in order to exercise more code paths in the KVM. This defines flags to control the MMU state. When enabled, this creates a simple page table at the 64K offset and maps all the RAM. The fuzzer code is placed right after the table. The flags are: IR - enables MMU for instruction fetches DR - enables MMU for data loads/stores PR - "problem state", i.e. userspace (implies DR and IR) PID1 - initializes a process table for PID>0 (PID#0 is used by the VM OS normally) This adds a simple "syz_kvm_setup_cpu_ppc64" syz-test with MSR=IR|DR|LE which is a typical Linux kernel mode. Signed-off-by: Alexey Kardashevskiy <aik@linux.ibm.com>
* executor/common_kvm_ppc64: fix KVM supportAlexey Kardashevskiy2021-07-196-12/+256
| | | | | | | | | | | | | | | | | | | | | | | | | | Turns out the ifuzz on powerpc did not ever properly work. This fixes syz_kvm_setup_cpu$ppc64: Enable the PAPR KVM capability (otherwise KVM_RUN fails right away). Finish generated sequences with the software debug breakpoint as there is no x86's "hlt" variant on POWER and otherwise KVM won't exit. Add exception handlers, use the software debug breakpoint instruction to trigger immediate exit from KVM with the only exception of the decrementer interrupt handler (timer) to recharge the timer and continue. Define and use endianness selection flag (Big vs. Little endian). Define the code generator similar to kvm_gen.cc which for now contains 2 simple tests and the decrementer interrupt handler code. Add test cases to the executor so "bin/linux_ppc64le/syz-executor test" can run some sensible tests. The tests copy 0xbadc0de around similar to x86 and uses gpr[3] is a return value register (similar to EAX). Signed-off-by: Alexey Kardashevskiy <aik@linux.ibm.com>
* executor: prepare for proper powerpc testingAlexey Kardashevskiy2021-07-191-5/+13
| | | | | | | | | | | | | | | This moves x86 instructions under GOARCH_amd64 and makes some cross-platforms changes. This allocates as much memory for a VM as syzkaller normally does so we are testing here what syzkaller itself runs. This should not cause any behavioral change for x86. Other arches are not properly supported anyway. Follow-up patches will use these changes for PPC64. Signed-off-by: Alexey Kardashevskiy <aik@linux.ibm.com>
* executor: prepare code generator to allow other achitecturesAlexey Kardashevskiy2021-07-196-11/+11
| | | | | | | At the moment only AMD64 is supported, change file names to emphasise this. Signed-off-by: Alexey Kardashevskiy <aik@linux.ibm.com>
* executor/common_kvm_ppc64: header comment cleanupAlexey Kardashevskiy2021-07-191-2/+0
| | | | Signed-off-by: Alexey Kardashevskiy <aik@linux.ibm.com>
* pkg: update generated files to go 1.17Alexey Kardashevskiy2021-07-071-0/+1
| | | | | | | | | | | "make generate" produces this diff when go 1.17 (go1.17-c95464f0ea3f==upstream) is used. Seems compatible with >=1.16. https://github.com/golang/go/commit/4d2d89ff42ca documents the syntax. https://github.com/golang/go/commit/eeadce2d8713 enforces "ignore" for unsatisfiable tags hence the pkg/csource/gen.go change. Signed-off-by: Alexey Kardashevskiy <aik@linux.ibm.com>
* executor: initialize scope in fault_ioc_infoChuck Silvers2021-07-021-0/+1
| | | | | The "scope" field of struct fault_ioc_info is an input to the ioctl, so initialize it to FAULT_SCOPE_LWP to match other fault_ioc_* usage.
* sys/darwin: initial syscall definitionsPatrick Meyer2021-06-071-1/+1
| | | | Pretty much ripped from freebsd +/- what isn't applicable to darwin.
* executor: remove unreachable nocover.h includePatrick Meyer2021-05-201-10/+1
|
* executor: initial darwin supportPatrick Meyer2021-05-205-21/+170
|
* executor: move vm.nr_overcommit_hugepages into configDmitry Vyukov2021-05-121-2/+0
| | | | | Move the sysctl into config, so that kernels can opt out of it if necessary (not all kernels enable it and interested in testing).
* executor: set ctrl-alt-del sysctl to 0Dmitry Vyukov2021-04-221-1/+11
| | | | | | | This blocks some of the ways the fuzzer can trigger a reboot. ctrl-alt-del=0 tells kernel to signal cad_pid instead of rebooting and setting cad_pid to the current pid (transient "syz-executor setup") makes it a no-op. For context see: https://groups.google.com/g/syzkaller-bugs/c/WqOY4TiRnFg/m/6P9u8lWZAQAJ
* executor: fix driver.h import path in common_fuchsia.hMarco Vanotti2021-04-091-1/+1
| | | | The `driver.h` header moved from `ddk/driver.h` to `lib/ddk/driver.h`.
* syz-manager, executor: fix out-of-bound accessJoey Jiao2021-03-231-1/+1
| | | | There is an out-of-bound array access when cov filter enabled.
* executor, syz-fuzzer: fix readonly rootJoey Jiao2021-03-182-5/+15
|
* dashboard/config/linux: disable BPF_JIT on subset of instancesDmitry Vyukov2021-03-091-2/+0
| | | | | Currently we enable JIT always and don't test interpreter. Enable JIT on subset of instances and disable on others using kernel config.
* executor: don't setup x86-specific sysctl on non-x86Dmitry Vyukov2021-03-071-32/+34
| | | | | /sys/kernel/debug/x86/nmi_longest_ns is x86 specific, don't set it on non-x86 arches.
* executor: disable rfkill during setupDmitry Vyukov2021-03-041-0/+18
| | | | | If rfkill is enabled by the fuzzer, wifi setup will fail. Disable rfkill to initial state during setup.
* executor: don't fail on "negative running"Dmitry Vyukov2021-03-041-1/+1
| | | | | See #502 This still happens periodically.
* prog: detect copyout overflowDmitry Vyukov2021-03-041-1/+1
| | | | | | Detect the case when a program requires more copyout than executor can handle. Curretnly these result in: "SYZFAIL: command refers to bad result" failures. Now syz-fuzzer should ignore them.
* executor: improve SYZFAIL messageDmitry Vyukov2021-02-261-1/+1
| | | | | | | Print details and errno after SYZFAIL line. pkg/report captures output after SYZFAIL line, so it's better to have details after that line so that they are captured in report.
* pkg/report: detect executor failuresDmitry Vyukov2021-02-2111-177/+183
| | | | | | | | | | | | Currently all executor fail errors go into "lost connection" bucket. This is not very useful. First, there are different executor failures. Second, it's not possible to understand what failures happen how frequently. Third, there are not authentic lost connection. Create separate SYZFAIL: bugs for them. Update #573 Update #502 Update #318
* executor: don't fail in syz_genetlink_get_family_idDmitry Vyukov2021-02-192-82/+116
| | | | | | | | | | We used to use our own netlink socket and then fail on any errors. But commit "sys/linux: add ieee802154 descriptions" made it possible to use fuzzer-provided socket, and fuzzer can pass any invalid fd. So don't fail on errors now. Fixes #2444
* sys/linux: add ieee802154 descriptionsDmitry Vyukov2021-02-124-18/+77
|
* executor: don't include kvm on armDmitry Vyukov2021-01-261-1/+1
| | | | | | KVM was removed for arm architecture. Latest Linux headers don't contain <asm/kvm.h> for arm. So don't even include them.
* executor: fix kcov_remote_arg declarationDmitry Vyukov2020-12-301-41/+18
| | | | | kcov_remote_arg was changed to a portable format so we don't need to handle differences between 64/32-bits anymore.
* executor/common: repair clang complaint about bad indentationGreg Steuck2020-12-301-1/+2
| | | | | dashboard link: https://syzkaller.appspot.com/bug?extid=38fe37bc451a42e6c9a4 Reported-by: syzbot+38fe37bc451a42e6c9a4@syzkaller.appspotmail.com
* all: make timeouts configurableDmitry Vyukov2020-12-281-4/+6
| | | | | | Add sys/targets.Timeouts struct that parametrizes timeouts throughout the system. The struct allows to control syscall/program/no output timeouts for OS/arch/VM/etc. See comment on the struct for more details.
* executor: remove hardcoded timeoutsDmitry Vyukov2020-12-252-16/+33
| | | | | In preparation for making timeouts tunable based on OS/arch/VM/etc de-hardcode all (almost) timeouts in executor.
* executor: don't use coverage edges for gvisorDmitry Vyukov2020-12-164-22/+14
| | | | gvisor coverage is not a trace, so producing edges won't work.
* executor: use coverage filter for comparisonsDmitry Vyukov2020-12-091-1/+1
| | | | | | Filter out all comparisons in non-interesting code. Comparisons are expensive, so it makes lots of sense, these filtered out can't give us any new interesting signal.
* executor: capture outgoing edges from interesting codeDmitry Vyukov2020-12-091-6/+10
| | | | | | | | | | Currently we capture only incoming edges into the interesting code when code coverage filter is used. Also capture outgoing edges. For code without indirect calls this does not matter as we always get the same edge. But for code with indirect edges we can capture more interesting coverage, and presumably different indirect calls are quite important.
* executor: minor coverage filter cleanupDmitry Vyukov2020-12-093-8/+16
| | | | | Slightly reduce number of ifdef's, define coverage_filter only in shmem mode and remove unnecessary cast.
* executor: skip setsid() for threaded reproducersAnton Lindqvist2020-12-091-2/+7
| | | | | | | | | | | | Lately, I've been looking into why such low amount of syz reproducers on OpenBSD are turned into C reproducers. One thing I did notice is that such syz reproducers have one thing in common: they use the threaded=true and sandbox=none parameters. Such C reproducer always exits non-zero early on since the call to setsid() fails with EPERM. Meaning, the calling process is already a process group leader. Not sure if the preprocessor conditional should be tweaked in order to avoid unwanted side effects on other BSDs or configurations.
* syz-manager/manager.go, executor/executor.cc: support coverage filterKaipeng Zeng2020-12-063-2/+101
|
* sys/linux, sys/freebsd: apply more ignore_return attributesDmitry Vyukov2020-12-053-22/+4
| | | | | | | | | | | | | | 1. Apply ignore_return to semctl$GETVAL which produces random errno values on linux and freebsd. 2. Apply ignore_return to prctl and remove the custom code in executor. 3. Remove the custom errno ignoring code in fuchsia executor. The calls are already marked as ignore_return, so this is just a leftover. 4. Only reset errno for ignore_return. The syscall can still return a resource (maybe). We only need to reset errno for fallback coverage.
* executor: tune few more sysctl'sDmitry Vyukov2020-12-011-0/+7
| | | | | | | | | | | | | Faster gc (1 second) is intended to make tests more repeatable. {"/proc/sys/kernel/keys/gc_delay", "1"}, Huge page overcommit is disabled by default, allowing some overcommit is intended to give more coverage. {"/proc/sys/vm/nr_overcommit_hugepages", "4"}, We always want to prefer killing the allocating test process rather than somebody else (sshd or another random test process). {"/proc/sys/vm/oom_kill_allocating_task", "1"},
* tools/create-gce-image.sh: move sysctl's to executorDmitry Vyukov2020-11-211-0/+6
| | | | | | | | | Move the remaining sysctls from image creation scripts into executor. We have the rest in executor now, and these are captured in reproducers and are not duplicated. It seems that ping_group_range was accidentially lost along the way, re-add it.
* pkg/ifuzz/powerpc: add powerpc supportAlexey Kardashevskiy2020-11-204-2/+89
| | | | | | | | | | | | | | | | | | | | | | | | This adds KVM's syz_kvm_setup_cpu pseudo syscall. This adds placeholder for options (none implemented yet). This adds instruction generator for ifuzz; this also adds a few pseudo instructions to simulate super/hyper/ultracalls (a PPC64/pseries platform thing). The insns.go is generated from PowerISA_public.v3.0B.pdf [1] by a horrendous python3 script on top of pdftotext. The ISA covers POWER9 which is the latest available POWER CPU at the moment. The next ISA for POWER10 is quite different and we will deal with it later. The // comment after every instruction is a fixed opcode list for verification purposes. This does not define DecodeExt as there is no obvious replacement of the Intel XED library for POWERPC (gapstone-capstone, later, may be). [1] https://openpowerfoundation.org/?resource_lib=power-isa-version-3-0 Signed-off-by: Alexey Kardashevskiy <aik@linux.ibm.com>
* executor: fix linux includesDmitry Vyukov2020-10-301-2/+6
| | | | | write_file() is needed for setup_sysctl() and syz_usbip_server_init(). setup_sysctl() also misses some header includes.
* dashboard/config/linux: set watchdog_thresh via cmdlineDmitry Vyukov2020-10-281-4/+0
| | | | Fixes #1989
* pkg/csource: setup sysctl's in C reproducersDmitry Vyukov2020-10-285-42/+46
| | | | | | Sysctl's are not captured as part of reproducers. This can result in failure to reproduce a bug on developer machine. Include sysctl setup as part of C reproducers.
* executor: setup sysctl's in setup_machineDmitry Vyukov2020-10-281-8/+35
| | | | | | | | | | | Currently we assume that sysctl's are setup as part of machine boot. This introduces a non-trivial dependency on image creation and sysctl's are not captured by as part of C reproducers and are not captured by syzbot dashboard. This can make some reproducers fail on developer machines or on syzbot later when sysctl's change. Setup sysctl's in executor as part of machine setup. It makes it much more controllable and hermetic.
* executor, pkg/csource: remove setpgrp() in sandbox_common()liucy19982020-10-271-1/+0
| | | | Process group leader is not allowed to call setsid, thus remove setpgrp.
* executor: compile fixAlexey Kardashevskiy2020-10-261-1/+1
| | | | | | | | | | | | | | | | | | | | | | This fixes an error in printf() format for __u64: gcc -o ./bin/linux_ppc64le/syz-executor executor/executor.cc \ -D__powerpc64__ -O2 -pthread -Wall -Werror -Wparentheses \ -Wunused-const-variable -Wframe-larger-than=16384 -static -DGOOS_linux=1 -DGOARCH_ppc64le=1 \ -DHOSTGOOS_linux=1 \ -DGIT_REVISION=\"82d2e60626ef1f43e557ca2933aee53bd5265eaf+\" In file included from executor/test.h:5:0, from executor/executor.cc:343: executor/test_linux.h: In function ‘int test_one(int, const char*, int, \ int, unsigned int, bool)’: executor/test_linux.h:74:60: error: format ‘%llx’ expects argument of type \ ‘long long unsigned int’, but argument 2 has type ‘__u64 {aka long unsigned int}’ [-Werror=format=] cpu_mem->fail_entry.hardware_entry_failure_reason); ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^ Signed-off-by: Alexey Kardashevskiy <aik@linux.ibm.com>
* executor: fix arp netfiler tables alignment for armDmitry Vyukov2020-10-151-4/+4
| | | | | | | | | | The arp netfilter entry contains u64, but we used only void* to enforce alignment. This worked everywhere except for arm, which is 32-bits and has 8-byte alignment for u64. Use u64 to enforce correct alignment. Fixes #2188
* executor: set parent-death signal after changing user or group ID-sAndrei Vagin2020-10-091-0/+5
| | | | | | | The parent-death signal is set in sandbox_common, but then setresuid and setresgid clear it and we need to set it again. Signed-off-by: Andrei Vagin <avagin@google.com>
* executor: increase prog_extra_cover_timeout for progs that inject 802.11 framesAleksandr Nogikh2020-10-051-1/+3
| | | | | This is required because we can only collect remote kcov coverage for these injected frames.
* executor: msvc support syz-executorSuraj K Suresh2020-10-035-19/+64
|
generated by ggit (джигит) mrf-deployment (git 2.46.0) at 2026-03-17 00:16:40 +0000