aboutsummaryrefslogtreecommitdiffstats
path: root/executor
Commit message (Collapse)AuthorAgeFilesLines
* sys/linux: update BPF's anonymous structuresPaul Chaignon2019-09-181-5/+5
| | | | Signed-off-by: Paul Chaignon <paul.chaignon@orange.com>
* sys/linux: basic support for bpf-to-bpf function callsPaul Chaignon2019-09-171-5/+5
| | | | | | | | | The BPF template currently only defines helper calls. BPF function calls (bpf-to-bpf calls) are however supported in Linux since v4.16. This patch defines bpf-to-bpf calls in the template. Signed-off-by: Paul Chaignon <paul.chaignon@orange.com>
* executor: fix out-of-bounds access to syscalls arrayAndrey Konovalov2019-09-171-20/+20
| | | | | Move accessing syscalls array to check for USB syscalls after we validate the call_num value (it can be e.g. instr_copyin/out).
* sys/linux: support for loopkup-free map value accessesPaul Chaignon2019-09-171-5/+5
| | | | | | | | | | | | A new BPF instruction that allows lookup-free map value accesses was added in Linux v5.2, with commit d8eca5b ("bpf: implement lookup-free direct value access for maps"). It enables direct access to map values without having to call a BPF helper. It is currently used to implement global variable support. This commit adds support for that new instruction. Signed-off-by: Paul Chaignon <paul.chaignon@orange.com>
* sys/freebsd/sys.txt: update sendfile descriptionMichael Tuexen2019-09-161-2/+2
| | | | | The signature of sendfile() on FreeBSD is different from the one used on Linux.
* sys/freebsd/vnet.txt: replace IPPROTO_SEP by IPPROTO_DCCP (#1401)Michael Tüxen2019-09-161-2/+2
| | | | r350749 updated the constant from IPPROTO_SEP to IPPROTO_DCCP to be consistent with the IANA registry.
* executor/fuchsia: close vmo handle in syz_mmap.Marco Vanotti2019-09-121-0/+7
| | | | | | | | | | | | This commit fixes a handle leak in syz_mmap. The bug was pointed out by mdempsky during a code review. The `syz_mmap` function creates a VMO and maps it to a VMAR in the address specified by the `syz_mmap` parameters. Once a VMO is mapped to a vmar, the handle to the vmo can be closed without problems. The new code makes sure that `zx_handle_close(vmo_handle)` gets called before the `syz_mmap` function returns.
* executor/fuchsia: don't crash on syz_mmap failure.Marco Vanotti2019-09-111-3/+7
| | | | | | | | | | | | | | | | | syz_mmap is a pseudo-syscall that can be used by syzkaller in fuzzing programs, however, it is also used to setup the environment for syz-executor. syz-executor already checks the return value[0] when it is used for setting up the environment, so it doesn't make sense for the function to crash (most probably, in a fuzzing program it will be called with arguments that would make it fail). The previous behavior was causing a bunch of "Lost connection to test machine" syzkaller crashes which were meaningless. An example of a program in which syz_mmap would crash would be any program in which the handle to the root vmar is closed before calling syz_mmap. [0]: https://github.com/google/syzkaller/blob/a60cb4cd840ce786236a00480e8bb1025e0c5fef/executor/executor_fuchsia.h#L15
* executor/usb: use UTF16 encoding for default stringAndrey Konovalov2019-09-061-6/+18
| | | | Also respond with lang ID when string #0 is requested.
* executor/usb: fix null-ptr-deref in syz_usb_control_ioAndrey Konovalov2019-09-061-2/+2
|
* executor/usb: improve debugging messagesAndrey Konovalov2019-09-061-9/+9
|
* sys/linux/usb: fix CDC mac address encodingAndrey Konovalov2019-09-061-5/+5
|
* sys/linux/usb: always provide device string idsAndrey Konovalov2019-09-061-5/+5
| | | | | This forces the kernel to make a USB string request and select a lang ID early during the enumaration stage.
* executor/usb: allow syz_usb_control_io args to be 0Andrey Konovalov2019-09-061-2/+7
|
* sys/linux/vusb.txt: properly describe interfaces for USB CDC NCMAndrey Konovalov2019-09-062-15/+15
| | | | Also rename cdc_ethernet to cdc_ecm.
* sys/linux, executor: basic support for multiple USB interfacesAndrey Konovalov2019-09-061-15/+26
|
* executor: fix sigsegv for default USB string responseAndrey Konovalov2019-09-051-1/+1
|
* sys/linux/vusb.txt: fix typo in descriptionsAndrey Konovalov2019-09-051-5/+5
|
* prog: implemented argument and call prioritiesVeronica Radu2019-09-042-1/+3
|
* sys/linux/vusb.txt: fix unused EPSNUM paramAndrey Konovalov2019-09-041-5/+5
|
* all: convert Fuchsia to use "host fuzzing" modeMatthew Dempsky2019-08-271-0/+2
| | | | | | | | | Go support is not a priority for Fuchsia at the moment, so it's preferable to use host fuzzing mode for Fuchsia like currently done for Akaros. This commit basically looks for all the places where there was special logic for OS=="akaros" and extends the same logic for OS=="fuchsia".
* sys/linux, executor: minor USB fixes (#1361)Andrey Konovalov2019-08-232-8/+11
|
* sys/linux: fix bNumEndpoints in a USB interface (#1360)Andrey Konovalov2019-08-221-5/+5
| | | | | | bNumEndpoints is defined as len[endpoints]. This initially assumed that endpoints is an array, which is not the case for descriptions for particular USB classes. Improve it by defining a new template for interfaces and passing in a value range for bNumEndpoints for these cases.
* executor: fix procid not declared properly for netbsd (#1358)Andrey Konovalov2019-08-221-1/+1
|
* sys/linux: add basic USB CDC NCM descriptions (#1337)Andrey Konovalov2019-08-142-5/+15
| | | | CDC NCM support is incomplete, as it requires support for describing multiples interfaces per configuration.
* sys/linux: fix USB string descriptors (#1336)Andrey Konovalov2019-08-141-5/+5
| | | | | They should either contain a lang id or a string. Do some other minor fixes as well.
* sys/fuchsia: update socket syscallsMarco Vanotti2019-08-142-32/+2
|
* sys/openbsd: add ktrace descriptionAnton Lindqvist2019-08-122-1/+2
|
* sys/openbsd: add acct descriptionAnton Lindqvist2019-08-122-1/+2
|
* sys/openbsd: add speaker descriptionsAnton Lindqvist2019-08-122-1/+4
|
* sys/linux: add basic USB CDC Ethernet descriptions (#1328)Andrey Konovalov2019-08-093-6/+16
|
* prog: add special mutation for binary flagsVeronica Radu2019-08-092-1/+7
|
* sys/linux: add syz_open_dev$char_usb descriptionsAndrey Konovalov2019-08-082-5/+20
| | | | | syz_open_dev$char_usb opens char devices with major = USB_MAJOR. Sanitize its values to make sure it doesn't open other char/block devices.
* executer/common_bsd.h: increase the number of tap/tun devices for NetBSDR3x2019-08-081-0/+6
|
* executor: add some USB realted TODOs (#1319)Andrey Konovalov2019-08-072-14/+9
| | | Also simplify timeout related code a bit.
* sys/linux: add basic USB PRINTER descriptions (#1316)Andrey Konovalov2019-08-062-5/+15
| | | Also put USB HID descriptions together.
* sys/linux: import HID report descriptor descriptions (#1311)Andrey Konovalov2019-08-021-5/+5
| | | Remove long items and better specify tags.
* sys/linux/socket.txt: update timestamp optionsHangbin Liu2019-07-302-5/+15
| | | | | | | | | Update socket timeval, timestamp options and flags. v2: separate SO_{TIMESTAMP, TIMESTAMPNS}_{OLD, NEW} as they only need enable/disable option value. Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
* prog: don't minimize ProcType to 0Dmitry Vyukov2019-07-262-1/+2
| | | | | | | | Default value for ProcType is 0 (same for all PID's). Usually 0 either does not make sense at all or make different PIDs collide (since we use ProcType to separate value ranges for different PIDs). So don't change ProcType to 0 unless the type is explicitly marked as opt (in that case we will also generate 0 anyway).
* sys/linux: add usbmon add vfio descriptionsVeronicaRadu2019-07-262-5/+80
|
* sys/linux: extract USB HID ids (#1294)Andrey Konovalov2019-07-221-5/+5
| | | | | | | | | | | | | | | | | | * sys/linux: extract USB HID ids As it turns out the HID kernel subsystem registers only one USB driver that checks that the interface of the connected device has HID class and then looks up its own list of vendor/device ids to find a matching driver. This means that we currently don't generate proper vendor/device ids for USB HID devices. This patch updates the syz-usbgen tool to also extract USB HID vendor/device ids from a running kernel and makes the generated descriptions for HID devices to be patched using the extracted ids. This patch also contains some minor improvements to USB descriptions (better HID descriptions and more replies for some USB classes/drivers). * sys/linux: run make generate
* sys/linux: use AT_FDCWD only for directoriesDmitry Vyukov2019-07-221-5/+5
| | | | | | Currently we use AT_FDCWD as a special value for all file descriptors, but it does not make sense for almost all of them (sockets, bpf, etc). Use it as a special value only for fd_dir.
* executor: drop CAP_SYS_NICEDmitry Vyukov2019-07-221-4/+12
| | | | | | | | | | A process with CAP_SYS_NICE can bring kernel down by asking for too high SCHED_DEADLINE priority, as the result rcu and other system services that use kernel threads will stop functioning. Some parameters for SCHED_DEADLINE should be OK, but we don't have means to enforce values of indirect syscall arguments. Peter Zijlstra proposed sysctl_deadline_period_{min,max} which could be used to enfore safe limits without droppping CAP_SYS_NICE, but we don't have it yet. See the following bug for details: https://groups.google.com/forum/#!topic/syzkaller-bugs/G6Wl_PKPIWI
* sys/linux: improve sched_attr descriptionDmitry Vyukov2019-07-221-5/+5
| | | | Today we have means to properly describe parent size.
* executor: drop CAP_SYS_PTRACE with sandbox=noneDmitry Vyukov2019-07-221-17/+25
| | | | | | We only drop CAP_SYS_PTRACE for sandbox=namespace, but it can equally affect testing with sandbox=none. Drop it for sandbox=none, add a test.
* sys/fuchsia: update zx_clock_get syscall (#1292)Marco Vanotti2019-07-163-5/+4
| | | | | | | | | | | | * sys/fuchsia: update zx_clock_get. zx_clock_get was deprecated and replaced by zx_clock_get_new. In a recent CL[0], they replaced the zx_clock_get by zx_clock_get_new and moved all client. This commit updates syzkaller to use the new function. [0]: https://fuchsia-review.googlesource.com/c/fuchsia/+/298575 * run make extract && make generate
* run make extract and make generate for fuchsiaMarco Vanotti2019-07-162-22/+6
|
* sys/linux, executor: improve USB descriptionsAndrey Konovalov2019-07-162-11/+54
| | | | | 1. Change HID descriptions to allow devices to have two interrupt endpoints. 2. Remove unneeded responses to OUT control requests from descriptions. 3. Add some debugging code to detect and report missing descriptions.
* sys/linux: update fs-verity descriptionsEric Biggers2019-07-161-5/+5
| | | | | | | | The fs-verity API was redesigned, and we're planning to re-add the fs-verity patches to linux-next soon. Get the syzkaller descriptions up to date with the new API [1] [1] https://lkml.kernel.org/linux-fsdevel/20190701153237.1777-4-ebiggers@kernel.org
* sys/linux: update BPF constantsPaul Chaignon2019-07-161-5/+5
| | | | Signed-off-by: Paul Chaignon <paul.chaignon@orange.com>
generated by ggit (джигит) mrf-deployment (git 2.46.0) at 2026-03-19 14:09:39 +0000