aboutsummaryrefslogtreecommitdiffstats
path: root/executor
Commit message (Collapse)AuthorAgeFilesLines
* executor: move flatbuffers from vendor to executorTaras Madan2024-05-0831-0/+11895
|
* executor: consistently fail on feature setupDmitry Vyukov2024-05-071-42/+41
| | | | | | Currently we fail in some cases, but ignore errors in other cases. Consistently fail when feature setup fails. This will be required for relying on setup failure to detect feature presence.
* executor: make flatrpc build for C++Dmitry Vyukov2024-05-032-6/+4
|
* pkg/vminfo: check enabled syscalls on the hostDmitry Vyukov2024-05-021-2/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Move the syscall checking logic to the host. Diffing sets of disabled syscalls before/after this change in different configurations (none/setuid sandboxes, amd64/386 arches, large/small kernel configs) shows only some improvements/bug fixes. 1. socket$inet[6]_icmp are now enabled. Previously they were disabled due to net.ipv4.ping_group_range sysctl in the init namespace which prevented creation of ping sockets. In the new net namespace the sysctl gets default value which allows creation. 2. get_thread_area and set_thread_area are now disabled on amd64. They are available only in 32-bit mode, but they are present in /proc/kallsyms, so we enabled them always. 3. socket$bt_{bnep, cmtp, hidp, rfcomm} are now disabled. They cannot be created in non init net namespace. bt_sock_create() checks init_net and returns EAFNOSUPPORT immediately. This is a bug in descriptions we need to fix. Now we see it due to more precise checks. 4. fstat64/fstatat64/lstat64/stat64 are now enabled in 32-bit mode. They are not present in /proc/kallsyms as syscalls, so we have not enabled them. But they are available in 32-bit mode. 5. 78 openat variants + 10 socket variants + mount are now disabled with setuid sandbox. They are not permitted w/o root permissions, but we ignored that. This additionally leads to 700 transitively disabled syscalls. In all cases checking in the actual executor context/sandbox looks very positive, esp. for more restrictive sandboxes. Android sandbox should benefit as well. The additional benefit is full testability of the new code. The change includes only a basic test that covers all checks, and ensures the code does not crash/hang, all generated programs parse successfully, etc. But it's possible to unit-test every condition now. The new version also parallelizes checking across VMs, checking on a slow emulated qemu drops from 210 seconds to 140 seconds.
* pkg/ipc: consistently set ENOSYS for non-executed syscallsDmitry Vyukov2024-05-021-1/+1
| | | | | | | Currently we set errno=999 in executor for non-finished syscalls, but syscalls that were not even started still have errno=0. They also don't have Executed flag, but it's still handy to have a non-0 errno when the call is not successful.
* pkg/ipc: make it possible to change EnvFlags between executionsDmitry Vyukov2024-04-301-1/+1
| | | | | | | | | | | | | | | | Pass EnvFlags into Exec instead of New. This allows to change EnvFlags between executions. Change of EnvFlags forces executor process restart since it uses EnvFlags during setup. Currently this is intended to be NFC since we always pass the same EnvFlags. In future this will allow to (1) reduce part of the VM checking procedure to execution of programs with different options (e.g. we can probe for coverage/comparisons support, probe different sandboxes, etc); (2) use it during fuzzing/reproduction, e.g. we can check if the crash reproduces under setuid sandbox, or execute some fuzzing programs in significantly different modes.
* executor: arm64: call KVM_ARM_PREFERRED_TARGET on vmfd instead of cpufdAlexander Potapenko2024-04-181-1/+3
|
* tools/syz-linter: check t.Logf/Errorf/Fatalf messagesDmitry Vyukov2024-04-171-1/+1
| | | | | Fix checking of Logf, it has string in 0-th arg. Add checking of t.Errorf/Fatalf.
* prog: include number of calls into exec encodingDmitry Vyukov2024-04-161-0/+1
| | | | | | Prepend total number of calls to the exec encoding. This will allow pkg/ipc to better parse executor response without full parsing of the encoded program.
* executor: ignore EBADF when reading tunDmitry Vyukov2024-04-161-1/+2
| | | | | | | | | | | | Fuzzer managed to do: executing program 0: ... close_range(r5, 0xffffffffffffffff, 0x0) ... SYZFATAL: executor 0 failed 11 times: executor 0: exit status 67 SYZFAIL: tun read failed (errno 9: Bad file descriptor)
* executor: ignore socketpair error in syz_usbip_server_initDmitry Vyukov2024-04-161-2/+5
| | | | | | | | | | | | | | Fuzzer managed to do: executing program 4: ... prlimit64(0x0, 0x7, &(0x7f0000000000), 0x0) ... syz_usbip_server_init(0x3) ... SYZFATAL: executor 4 failed 11 times: executor 4: exit status 67 SYZFAIL: syz_usbip_server_init: socketpair failed (errno 24: Too many open files)
* prog: more compact exec encoding for addressesDmitry Vyukov2024-04-151-5/+21
| | | | | | | | | | 1. Don't write size/flags for addresses. 2. Write address w/o data offset (fewer bytes in leb128 encoding). Median exec size shrinks by 25%: - exec sizes: 10%:584 50%:1423 90%:7076 + exec sizes: 10%:448 50%:1065 90%:6319
* prog: don't pad data in exec encodingDmitry Vyukov2024-04-151-3/+2
| | | | | | | | With leb128 ints it does not make any sense. Reduces exec sizes a bit more: - exec sizes: 10%:597 50%:1438 90%:7145 + exec sizes: 10%:584 50%:1423 90%:7076
* prog: use leb128 for exec encodingDmitry Vyukov2024-04-151-22/+42
| | | | | | | | | | | | Switch from uint64 to leb128 encoding for integers. This almost more than halves serialized size: - exec sizes: 10%:2160 50%:4792 90%:14288 + exec sizes: 10%:597 50%:1438 90%:7145 and makes it smaller than the text serialization: text sizes: 10%:837 50%:1591 90%:10156
* all: remove akaros supportDmitry Vyukov2024-04-154-128/+3
| | | | | | | Akaros support is unused, it was shutdown on syzbot for a while, the akaros development seems to be frozen for years as well. We have a bunch of hacks for Akaros since it supported only super old gcc and haven't supported Go. Remove it.
* executor: cleanup mounts with MNT_FORCEAleksandr Nogikh2024-04-101-4/+9
| | | | | | | | | | Starting from v6.9, we can no longer reuse a loop device while some filesystem is mounted on it. It conflicts with the MNT_DETACH approach we were previously using. Let's umount synchronously instead, but also with a MNT_FORCE flag to abort potentially long graceful cleanup operations. We don't need them for the filesystems mounted only for fuzzing purposes.
* executor: skip executor tests on systems with BrokenCompilerGreg Steuck2024-04-051-0/+5
| | | | | OpenBSD in particular is not compatible with TestOS expectation of having a syscall function.
* executor: fix uninitialized variable when generating kvm codeCookedMelon2024-04-051-0/+4
| | | | | | | | The "avl" fields (variable type is u8) of the kvm_segment structure variables such as seg_cs16 and seg_ldt are not initialized to zero. During creation, there is a chance that they are set to values other than 0 or 1, which can cause the "avl" fields to overwrite other fields when executing the fill_segment_descriptor function, leading to erroneous results.
* executor: add guard pages around the kcov mappingAlexander Potapenko2024-04-041-2/+16
| | | | | | | | | | | Because the executor may place other mappings next to the buffer used by kcov, occasional out-of-bound writes to them may corrupt the coverage, creating garbage PCs (see https://github.com/google/syzkaller/issues/4531). To prevent those, map two extra pages for the kcov buffer, and protect them, so that OOB writes cause a segfault. Fixes https://github.com/google/syzkaller/issues/4532
* executor: ignore ENOENT for socket callsDmitry Vyukov2024-04-021-0/+12
| | | | | | Don't treat ENOENT from socket call as fatal. Fuzzer manages to make all socket calls for a particular protocol fail using NLBL_MGMT_C_REMOVE netlink function.
* pkg/fuzzer: factor out the fuzzing engineAleksandr Nogikh2024-03-121-0/+20
| | | | | | | | | | | | | This is the first step for #1541. Move the fuzzing engine that used to be interleaved with other syz-fuzzer code into a separate package. For now, the algorithm is more or less the same as it was, the only difference is that a pkg/fuzzer instance scales to the available computing power. Add an executor-based test that performs real fuzzing.
* executor: collect coverage for the test OSAleksandr Nogikh2024-03-121-2/+77
| | | | | Collect PC coverage like it's done by KCOV. This will help write better tests for the fuzzer.
* executor: temporarily disable IORING_SETUP_CQE32 and IORING_SETUP_SQE128Alexander Potapenko2024-03-051-1/+5
| | | | | | | | | | IORING_SETUP_CQE32 and IORING_SETUP_SQE128 may lead to incorrect assumptions about the ring buffer size, causing the kernel to write outside of the mapped memory, smashing whatever follows it. This is a hotfix for https://github.com/google/syzkaller/issues/4531 that will stop the ci-upstream-gce-arm64 from generating random coverage.
* executor: don't fail on setns() in pseudo syscallsAleksandr Nogikh2024-02-081-4/+10
| | | | | | | The fd may be closed by an async close() call, it's not a reason to report a failure. Reported-by: Andrei Vagin <avagin@google.com>
* executor: don't hold a loop device fdAleksandr Nogikh2024-01-121-5/+26
| | | | | | When BLK_DEV_WRITE_MOUNTED is enabled, the kernel treats the loopfd reference as a writer and does not let us issue mount() calls over the same block device.
* executor: prevent netlink_send_ext with dofail=trueAleksandr Nogikh2024-01-052-0/+12
| | | | | This should never be happening during fuzzing. Otherwise we let syz-executor silently crash and restart insane number of times.
* syz-executor: don't fail on netlink errors during fuzzingAleksandr Nogikh2024-01-051-21/+23
| | | | | | During fuzzing, it's expected that certain operations might return errors. Don't abort the whole syz-executor process in this case, this is too expensive.
* executor: do not run VIRT86 and CPL3 tests with SVM virtualizationPiotr Siminski2023-12-201-29/+71
| | | | | | It seems like VIRT86 and CPL3 KVM_RUN command prefixes do not work with SVM virtualization. Detect which virtualization option is used and select appropriate tests.
* executor: keep style_test.go happyPiotr Siminski2023-12-201-1/+1
| | | | | | | | | | | | | | | This commit fixes: [0ms] exec opts: procid=0 threaded=1 cover=0 comps=0 dedup=1 signal=0 timeouts=50/5000/1 prog=168 filter=0 spawned worker pid 12456 --- FAIL: TestExecutorMistakes (0.09s) style_test.go:193: executor/test_linux.h:104: Don't use C89 var declarations. Declare vars where they are needed \ and combine with initialization int res; FAIL FAIL github.com/google/syzkaller/executor 1.070s FAIL
* executor: introduce syz_pidfd_open()Aleksandr Nogikh2023-12-191-0/+18
| | | | | | | | | | | This kernel interface provides access to fds of other processes, which is readily abused by the fuzzer to mangle parent syz-executor fds. Pid=1 is the parent syz-executor process when PID namespace is created. Sanitize it in the new syz_pidfd_open() pseudo-syscall. We could not patch the argument in sys/linux/init.go because the first argument is a resource.
* sys/linux, pkg/host, executor: add NVMe-oF/TCP subsystem supportAlon Zahavi2023-12-071-2/+46
| | | | | Add new pseudo-syscall for creating a socket in init netns and connecting to NVMe-oF/TCP server on 127.0.0.1:4420. Also add descriptions for NVMe-oF/TCP.
* executor/common_zlib: fix an mmap leakZhiyao Feng2023-10-061-1/+1
| | | | | The `mmap` size is `max_destlen`, but `munmap` size is `destlen`, which causes a memory leak.
* sys/io_uring, executor/common_linux: remove sqes_index in syz_io_uring_submitDylan Yudaken2023-07-301-17/+12
| | | | | | | | This parameter barely increases coverage since the tail is always set to the entry that is written, but it does increase the complexity of the api and seems to reduce coverage when I run it locally. Remove it.
* sys/linux/io_uring, executor/common_linux: fix io_uring segfaultDylan Yudaken2023-07-301-9/+7
| | | | | | | | | | In Linux 6.4+ it is not allowed to provide a vma to mmap(2) [1]. Change the API to request the address from the Kernel. Note I do not know why this was done in the first place, but it seems not to be useful. [1]: https://github.com/torvalds/linux/commit/d808459b2e31bd5123a14258a7a529995db974c8
* executor/android: updated x86 seccomp policyLiz Prucka2023-07-255-494/+485
| | | | | | | | | | The recent docker upgrade to debian `bookworm` caused x86_64 instances to fail in `pthread_create()` due to the android seccomp filter. On `bookworm`, `pthread_create()` calls `clone3()` and `set_robust_list()` which aren't on the seccomp filter (instead of `clone()`), which is. Added these calls to the seccomp policy.
* executor: fix loop condition in lookup_endpointAndrey Konovalov2023-07-181-1/+1
| | | | | | | | | The loop in lookup_endpoint incorrectly iterates over endpoints. Fixes #4038. Reported-by: @cyruscyliu Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
* executor: include missing linux/falloc.hKhem Raj2023-06-201-0/+1
| | | | | | | | | | | | | | Its needed for FALLOC_FL_ZERO_RANGE which needs this header, it works with glibc because fcntl.h includes this header indirectly, however the failure comes to fore with musl C library where this header is not included indirectly by other system headers, therefore include it as required. Fixes In file included from executor/common.h:505: executor/common_linux.h:5604:16: error: use of undeclared identifier 'FALLOC_FL_ZERO_RANGE' fallocate(fd, FALLOC_FL_ZERO_RANGE, 0, SWAP_FILE_SIZE); ^
* all: support swap feature on LinuxAleksandr Nogikh2023-06-153-9/+56
| | | | | If the feature is supported on the device, allocate a 128MB swap file after VM boot and activate it.
* executor: move setup_ext() below other featuresAleksandr Nogikh2023-06-152-8/+7
| | | | | It makes these extentions much more flexible as they can now also customize what other features set up.
* executor: use exitf instead of fail outside of setup sequence (#3959)Andrei Vagin2023-06-155-8/+8
| | | | | | | | | | | | | | | We have a long history of executor managing to corrupt itself in various interesting ways (e.g. using read with a pointer pointing to some global/stack variable and then kernel overwrites it). Or rt_sigreturn can corrupt other registers which won't cause immediate SIGSEGV, but rather some random behavior later. This is the race we can't win. We can't rely on memory consistency when the test already started, so we should use exitf instead of fail outside of setup sequence (and relying more on unit testing to ensure that executor works as expected for sane programs). Suggested-by: Dmitry Vyukov <dvyukov@google.com> Signed-off-by: Andrei Vagin <avagin@google.com>
* executor: use v1 memory cgroup controllerAleksandr Nogikh2023-06-141-16/+14
| | | | | | | Given that we must chose only one version, fuzzing v1 of itseems to be of higher value at the moment. Later we might make it a configurable option and do both version.
* syz-manager, pkg/cover: normalize signals between VM instancesLiz Prucka2023-06-121-3/+6
| | | | | | | | | | | | | Adjust signal creation in syz-executor so hash is independent of module offsets. This allows for canonicalization of the signal between VMs. Added signals to canonicalization/decanonicalization between instances. Coverts serialized Signal values as they have already been serialized in rpc.go. Added a function in signal.go to update serial signal elements.
* executor: resolve pseudo syscall compilation problemsAleksandr Nogikh2023-05-046-50/+81
|
* executor: remove openbsd bits out of common_bsd.hGreg Steuck2023-04-271-47/+1
|
* executor: detangle common_openbsd.h out of common_bsd.hGreg Steuck2023-04-272-1/+383
|
* sys/targets: switch openbsd to SyscallNumbers: falseGreg Steuck2023-04-272-2/+27
| | | | | This relies on sendsyslog in sys/syslog.h which will be in OpenBSD HEAD soon.
* executor: use explicit lretl in kvm_amd64.SSpace Meyer2023-04-121-1/+1
| | | | | | | Without this change the following warning is generated: kvm_amd64.S:95: Warning: no instruction mnemonic suffix given and no register operands; using default for `lret' This does not change the generated code in kvm_amd64.S.h
* executor: mark amd64 kvm_gen.cc stack nonexecutableSpace Meyer2023-04-121-1/+1
| | | | | | | | Without this change `go generate ./executor` on gcc 12.2.0 gives: /usr/bin/ld: warning: /tmp/ccmfWMO4.o: missing .note.GNU-stack section implies executable stack /usr/bin/ld: NOTE: This behaviour is deprecated and will be removed in a future version of the linker This does not change the generated code in kvm_amd64.S.h
* sys/linux: add syz_pkey_set syscallsDmitry Vyukov2023-04-031-0/+24
| | | | The syscall sets PKRU register which is part of protection keys (pkey).
* executor: use valid temporary dir on AndroidKris Alder2023-03-211-1/+1
| | | | | | | The call to mkdtemp() will fail when given /data/data/syzkaller/syzkaller-XXXXXX, since /data/data/syzkaller/ doesn't exist. The correct temporary dir on Android is /data/local/tmp, which exists by default.
generated by ggit (джигит) mrf-deployment (git 2.46.0) at 2026-03-11 22:41:02 +0000