aboutsummaryrefslogtreecommitdiffstats
path: root/executor
Commit message (Collapse)AuthorAgeFilesLines
* executor: setup sysctl's in setup_machineDmitry Vyukov2020-10-281-8/+35
| | | | | | | | | | | Currently we assume that sysctl's are setup as part of machine boot. This introduces a non-trivial dependency on image creation and sysctl's are not captured by as part of C reproducers and are not captured by syzbot dashboard. This can make some reproducers fail on developer machines or on syzbot later when sysctl's change. Setup sysctl's in executor as part of machine setup. It makes it much more controllable and hermetic.
* executor, pkg/csource: remove setpgrp() in sandbox_common()liucy19982020-10-271-1/+0
| | | | Process group leader is not allowed to call setsid, thus remove setpgrp.
* executor: compile fixAlexey Kardashevskiy2020-10-261-1/+1
| | | | | | | | | | | | | | | | | | | | | | This fixes an error in printf() format for __u64: gcc -o ./bin/linux_ppc64le/syz-executor executor/executor.cc \ -D__powerpc64__ -O2 -pthread -Wall -Werror -Wparentheses \ -Wunused-const-variable -Wframe-larger-than=16384 -static -DGOOS_linux=1 -DGOARCH_ppc64le=1 \ -DHOSTGOOS_linux=1 \ -DGIT_REVISION=\"82d2e60626ef1f43e557ca2933aee53bd5265eaf+\" In file included from executor/test.h:5:0, from executor/executor.cc:343: executor/test_linux.h: In function ‘int test_one(int, const char*, int, \ int, unsigned int, bool)’: executor/test_linux.h:74:60: error: format ‘%llx’ expects argument of type \ ‘long long unsigned int’, but argument 2 has type ‘__u64 {aka long unsigned int}’ [-Werror=format=] cpu_mem->fail_entry.hardware_entry_failure_reason); ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^ Signed-off-by: Alexey Kardashevskiy <aik@linux.ibm.com>
* executor: fix arp netfiler tables alignment for armDmitry Vyukov2020-10-151-4/+4
| | | | | | | | | | The arp netfilter entry contains u64, but we used only void* to enforce alignment. This worked everywhere except for arm, which is 32-bits and has 8-byte alignment for u64. Use u64 to enforce correct alignment. Fixes #2188
* executor: set parent-death signal after changing user or group ID-sAndrei Vagin2020-10-091-0/+5
| | | | | | | The parent-death signal is set in sandbox_common, but then setresuid and setresgid clear it and we need to set it again. Signed-off-by: Andrei Vagin <avagin@google.com>
* executor: increase prog_extra_cover_timeout for progs that inject 802.11 framesAleksandr Nogikh2020-10-051-1/+3
| | | | | This is required because we can only collect remote kcov coverage for these injected frames.
* executor: msvc support syz-executorSuraj K Suresh2020-10-035-19/+64
|
* sys/linux: descriptions for USB/IPNazime Hande Harputluoglu2020-10-021-0/+57
|
* executor: check for \n in fail/exitf messagesDmitry Vyukov2020-09-284-10/+17
|
* executor/linux: stop dumping mount information when failed to open kcov fileTetsuo Handa2020-09-281-40/+1
| | | | | Since ENOENT problem was solved by commit 318430cbb3b2ceef ("executor/linux: change mount propagation type to private"), remove the debug code for this problem.
* executor: make exit code during fail() depend on fault injectionAleksandr Nogikh2020-09-222-7/+27
| | | | | | | | | | | | | | | | | | | | | | fail()'s are often used during the validation of kernel reactions to queries that were issued by pseudo syscalls implementations. As fault injection may cause the kernel not to succeed in handling these queries (e.g. socket writes or reads may fail), this could ultimately lead to unwanted "lost connection to test machine" crashes. In order to avoid this and, on the other hand, to still have the ability to signal a disastrous situation, the exit code of this function now depends on the current context. All fail() invocations during system call execution with enabled fault injection lead to termination with zero exit code. In all other cases, the exit code is kFailStatus. This is achieved by introduction of a special thread-specific variable `current_thread` that allows to access information about the thread in which the current code is executing. Also, this commit eliminates current_cover as it is no longer needed.
* all: integrate with mac80211_hwsimAleksandr Nogikh2020-09-222-3/+454
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Two virtual wireless devices are instantiated during network devices initialization. A new flag (-wifi) is added that controls whether these virtual wifi devices are instantiated and configured during proc initialization. Also, two new pseudo syscalls are added: 1. syz_80211_inject_frame(mac_addr, packet, packet_len) -- injects an arbitrary packet into the wireless stack. It is injected as if it originated from the device identitied by mac_addr. 2. syz_80211_join_ibss(interface_name, ssid, ssid_len, mode) -- puts a specific network interface into IBSS state and joins an IBSS network. Arguments of syz_80211_join_ibss: 1) interface_name -- null-terminated string that identifies a wireless interface 2) ssid, ssid_len -- SSID of an IBSS network to join to 3) mode -- mode of syz_80211_join_ibss operation (see below) Modes of operation: JOIN_IBSS_NO_SCAN (0x0) -- channel scan is not performed and syz_80211_join_ibss waits until the interface reaches IF_OPER_UP. JOIN_IBSS_BG_SCAN (0x1) -- channel scan is performed (takes ~ 9 seconds), syz_80211_join_ibss does not await IF_OPER_UP. JOIN_IBSS_BG_NO_SCAN (0x2) -- channel scan is not performed, syz_80211_join_ibss does not await IF_OPER_UP. Local testing ensured that these syscalls are indeed able to set up an operating network and inject packets into mac80211.
* executor/common_linux.h: refactor __NR_syz_genetlink_get_family_idAleksandr Nogikh2020-09-221-38/+12
| | | | | | As netlink helpers now include a function to query generic netlink familty id, it makes no sense to duplicate implementation of essentially the same function.
* executor/common_linux.h: remove assumption that netlink always returns ↵Aleksandr Nogikh2020-09-221-25/+25
| | | | | | | | | | | | | | nonpositive error codes The code in common_linux.h assumes that nlmsgerr can either be 0 or a negative value in case of an error. However, this is not always the case. For example, some commands of mac80211_hwsim use nonnegative values to indicate success (e.g. HWSIM_CMD_NEW_RADIO returns either a negative error or a nonnegative radio index). Therefore, negation of error code inside netlink_send_ext is not correct. This patch changes this behavior. Now netlink_send_ext returns the exact value it received via netlink.
* sys/common_linux.h: replace netlink_devlink_id_get and ↵Aleksandr Nogikh2020-09-221-63/+34
| | | | | | | netlink_wireguard_id_get by a more generic function These two functions are almost entirely idential. In order to avoid adding similar functions later on, a generic one is created.
* sys/common_linux.h: move the definition of a global nlmsg variableAleksandr Nogikh2020-09-221-2/+4
| | | | | | | This global variable cannot be used for pseudo syscalls as they can run concurrently (in threaded mode). It can only be used during initialization, and if initialization routines are not enabled, nlmsg will become an unused variable.
* executor/common_linux.h: extend netlink helpers to support zero-payload ↵Aleksandr Nogikh2020-09-221-1/+2
| | | | | | | attributes (flags) This is required for 802.11 pseudo syscalls (that will be added later).
* executor/common_linux.h: increase default nlmsg buffer sizeAleksandr Nogikh2020-09-221-1/+1
| | | | | 1024 bytes are not enough to contain an arbirary 802.11 MAC frame together with netlink protocol overhead.
* executor: forbid inlining of 'remove_dir'Alexander Egorenkov2020-09-181-1/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes the issue with gcc 10 on Fedora 32 s390x: In file included from ../../executor/executor.cc:147: ../../executor/common.h: In function ‘void remove_dir(const char*)’: ../../executor/common.h:229:44: error: ‘%s’ directive output may be truncated writing up to 255 bytes into a region of size between 0 and 4095 [-Werror=format-truncation=] 229 | snprintf(filename, sizeof(filename), "%s/%s", dir, ep->d_name); | ^~ ../../executor/common.h:229:11: note: ‘snprintf’ output between 2 and 4352 bytes into a destination of size 4096 229 | snprintf(filename, sizeof(filename), "%s/%s", dir, ep->d_name); ../../executor/common.h:243:1: error: the frame size of 21200 bytes is larger than 16384 bytes [-Werror=frame-larger-than=] 243 | } | ^ cc1plus: all warnings being treated as errors compiler invocation: gcc [-o /tmp/syz-executor383272105 -DGOOS_test=1 -DGOARCH_64_fork=1 -DHOSTGOOS_linux=1 ../../executor/executor.cc -m64 -no-pie -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384] FAIL FAIL github.com/google/syzkaller/pkg/runtest 0.998s FAIL Signed-off-by: Alexander Egorenkov <Alexander.Egorenkov@ibm.com>
* executor: fix definition of __NR_io_uring_setupDmitry Vyukov2020-09-152-7/+23
| | | | | | | | | | Sone syzbot instances broke with: <stdin>: In function ‘syz_io_uring_setup’: <stdin>:476:33: error: ‘__NR_io_uring_setup’ undeclared (first use in this function) <stdin>:476:33: note: each undeclared identifier is reported only once for each function it appears in pkg/csource resolves #ifdef's at generation time.
* executor: improve opendir(3) error handlingAnton Lindqvist2020-09-121-1/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | While investigating an OpenBSD reproducer[1][2] I discovered the following: * All threads are stuck on the last `sleep(1000000)` syscall in main(), hence no output for the test machine. * Each executor process created in loop() performs one iteration but exits abnormally during the call to remove_dir(). * Calling remove_dir() will eventually invoke itself recursively since one of the executed syscall is `mkdir("./file0", 0)` meaning that it will try to remove the directory created by execute_one(). However, `opendir(3)` fails with `EACCES` due to the permissions passed to `mkdir(2)` is zero. Instead of exiting, trying to remove the problematic directory in a best effort manner makes the reproducer continue executing the generated syscalls. This work around might be considered to narrow. Another option would be to replace the `sleep(1000000)` with `waitpid(-1, NULL, 0)` until ECHILD is hit. [1] https://syzkaller.appspot.com/bug?id=6f7ce2a0536580a94f65f44e478732ec505e88af [2] https://syzkaller.appspot.com/text?tag=ReproC&x=10fd1a71900000
* executor: detect gvisorDmitry Vyukov2020-09-121-1/+14
| | | | | | gvisor coverage is not in the range of linux kernel coverage. So the coverage filter does not work. Detect if running under gvisor and skip the coverage filter.
* sys/test/test: add a hanging testDmitry Vyukov2020-09-123-2/+11
| | | | Ensure that we can handle hanging syscalls in all modes.
* executor/common_linux.h: add missing FUSE opcodesStefano Duo2020-08-271-1/+5
| | | | | | Add the following missing FUSE opcodes to the syz_fuse_handle_req pseudo-syscall: FUSE_COPY_FILE_RANGE, FUSE_UNLINK, FUSE_DESTROY and FUSE_BATCH_FORGET.
* executor/linux: change mount propagation type to privateTetsuo Handa2020-08-261-0/+3
| | | | | | | unshare(CLONE_NEWNS) might not be sufficient for making all test processes run in separate mount namespace, for "mount --make-rshared /" request issued by systemd causes mount operations issued by test processes visible from outside of test processes. Issue "mount --make-rprivate /" request after unshare(CLONE_NEWNS).
* executor/common_linux.h: make rfkill_unblock_all staticAndy Nguyen2020-08-231-1/+1
|
* executor/common_linux.h: unblock rfkill and retry HCIDEVUP on ERFKILLAndy Nguyen2020-08-231-2/+27
|
* tools/docker: add old-envDmitry Vyukov2020-08-221-1/+1
| | | | | | | old-env is based on Ubuntu 16.04 and allows to test executor build on older distributions. Fixes #2055
* executor/common_linux.go: fix build breakage for Linux 4.14Stefano Duo2020-08-181-5/+87
| | | | | | | Locally define structures and constants required by syz_fuse_handle_req() and remove linux/fuse.h. dependency. Reported-by: syzbot+f5f98e1608b272285aa5@syzkaller.appspotmail.com
* executor/common_linux.h: open target dir inside syz_mount_image()Stefano Duo2020-08-141-72/+79
| | | | | | | | | | Refactor syz_mount_image() to support filesystems not requiring a backing device and filesystem image (e.g. FUSE). To do that, we check for the presence of the pointer to the array of struct fs_image_segment: if missingi, there is no need to setup the loop device and we can proceed directly with the mount() syscall. Add syz_mount_image$fuse() (specialization for FUSE) inside sys/linux/fs_fuse.txt.
* executor/common_linux.h: add syz_fuse_handle_req()Stefano Duo2020-08-141-0/+181
| | | | | | | | | | | | | | | | | | | | | | At the moment syzkaller is able to respond to FUSE with a syntactically correct response using the specific write$FUSE_*() syscalls, but most of the times these responses are not related to the type of request that was received. With this pseudo-syscall we are able to provide the correct response type while still allowing the fuzzer to fuzz its content. This is done by requiring each type of response as an input parameter and then choosing the correct one based on the request opcode. Notice that the fuzzer is still free to mix write$FUSE_*() and syz_fuse_handle_req() syscalls, so it is not losing any degree of freedom. syz_fuse_handle_req() retrieves the FUSE request and resource fuse_unique internally (by performing a read() on the /dev/fuse file descriptor provided as input). For this reason, a new template argument has been added to fuse_out (renamed to _fuse_out) so that the unique field can be both an int64 (used by syz_fuse_handle_req()) and a fuse_unique resource (used by the write$FUSE_*() syscalls) without any code duplication.
* executor: fix use of SYZ_SANDBOX_ANDROID defineDmitry Vyukov2020-08-141-8/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | "#if not" does not seem to be a thing in C: $ cpp -undef -fdirectives-only -dDI -E -P -DSYZ_REPEAT -DSYZ_USE_TMP_DIR executor/common_linux.h 1>/dev/null executor/common_linux.h:3776:9: error: missing binary operator before token "SYZ_SANDBOX_ANDROID" 3776 | #if not SYZ_SANDBOX_ANDROID | ^~~~~~~~~~~~~~~~~~~ executor/common_linux.h:3801:9: error: missing binary operator before token "SYZ_SANDBOX_ANDROID" 3801 | #if not SYZ_SANDBOX_ANDROID | ^~~~~~~~~~~~~~~~~~~ executor/common_linux.h:3837:9: error: missing binary operator before token "SYZ_SANDBOX_ANDROID" 3837 | #if not SYZ_SANDBOX_ANDROID | ^~~~~~~~~~~~~~~~~~~ executor/common_linux.h:3868:9: error: missing binary operator before token "SYZ_SANDBOX_ANDROID" 3868 | #if not SYZ_SANDBOX_ANDROID | ^~~~~~~~~~~~~~~~~~~ Currently parts under "#if not SYZ_SANDBOX_ANDROID" are always stripped from reproducers under all sandboxes. Use the standard !SYZ_SANDBOX_ANDROID. We also need SYZ_EXECUTOR part because sandbox is not statically known when we are building syz-executor. And we also need to remove the use of flag_sandbox_android for C reproducers because for these sandbox is statically known and we don't have flag_sandbox_*.
* executor: warn about C89-style var declarationsDmitry Vyukov2020-08-1413-198/+172
| | | | | | | | | | | | | | | | | We generally use the newer C99 var declarations combined with initialization because: - declarations are more local, reduced scope - fewer lines of code - less potential for using uninit vars and other bugs However, we have some relic code from times when we did not understand if we need to stick with C89 or not. Also some external contributions that don't follow style around. Add a static check for C89-style declarations and fix existing precedents. Akaros toolchain uses -std=gnu89 (or something) and does not allow variable declarations inside of for init statement. And we can't switch it to -std=c99 because Akaros headers are C89 themselves. So in common.h we need to declare loop counters outside of for.
* executor/linux: dump more information when failed to open kcov fileTetsuo Handa2020-08-131-0/+17
| | | | | | | | | | | | With commit 50e21c6be6188f42 ("executor/linux: dump mount information when failed to open kcov file"), we got an unexpected result. /sys/kernel/ does not exist despite /sys/ exists. /proc/mounts cannot be opened despite /proc/ exists. If sysfs is not mounted on /sys/ and proc is not mounted on /proc/ , maybe other filesystems (e.g. devtmpfs, cgroup) are not mounted as well. Let's dump "/", "/proc/" and "/sys/", and then mount /proc/ and dump /proc/mounts .
* executor: fix style checking testDmitry Vyukov2020-08-133-5/+4
| | | | | The regexp for empty suppressions matches _everything_... Don't match suppression if it's empty.
* executor/linux: dump mount information when failed to open kcov fileTetsuo Handa2020-08-121-1/+23
| | | | | | | | | There are many "lost connection to test machine (5)" reports where the testing terminated due to ENOENT upon open("/sys/kernel/debug/kcov"). Since some testcase might be unintendedly modifying mount information, let's start from checking whether/how mount is broken. This commit might be reverted after the cause is identified and fixed.
* executor: initialize vhci earlyDmitry Vyukov2020-08-121-21/+18
| | | | | | | | | We added initialize_vhci to all sandboxes so that we don't have unused function warnings. We assumed it will fail silently, but it fails loudly and crashes the whole machine on init, so no fuzzing can happen with sandboxes other than none. Initialize vhci earlier while we still have CAP_ADMIN. As a nice side effect we now don't need to use syz_init_net_socket.
* executor: enable extra coverage on OpenBSDAnton Lindqvist2020-08-111-0/+9
| | | | This reverts commit 63a7334112fa63edb0c0a3f317d3d92135a6ead9.
* executor: always ignore SIGBUS on FreeBSDMark Johnston2020-08-081-1/+13
| | | | | | | | | | | syz-executor uses a heuristic to help fail closed if an invalid access might corrupt the output region. This heuristic fails on FreeBSD, where SIGBUS is delievered with si_addr equal to address of the faulting instruction, rather than 0 when the fault address cannot be determined (e.g., an amd64 protection fault). Always handle SIGBUS quietly on FreeBSD. This fixes pkg/runtest tests for sys/test/test/nonfailing.
* executor: use MAP_EXCL to map the data region on FreeBSDMark Johnston2020-08-081-1/+7
| | | | | | We've had some problems where the default SYZ_DATA_OFFSET collides with a mapping created by the C runtime. MAP_EXCL ensures that mmap() will fail in this case, so such problems become a bit easier to diagnose.
* sys/linux: add descriptions for BPF LSMCheng-Min Chiang2020-08-071-0/+188
| | | | | | | | | | | | | | This commit includes the following changes: * executor: add a new syz_btf_id_by_name psuedo-syscall * sys/linux: add descriptions for BPF LSM subsystem * sys/linux: add instructions on how to dump vmlinux and install bpftool * sys/linux/test: add tests for the new psuedo-syscall * pkg/host: add support detection for the new psuedo-syscall * pkg/runtest: skip the coverage test when invoking the new psuedo-syscall Update #533.
* executor: add some code style checksDmitry Vyukov2020-08-066-12/+119
| | | | | | | Move the test from pkg/csource to executor/ in order to be able to (1) run it on *.cc files, (2) run on unprocessed *.h files, (3) produce line numbers. Add a check for missed space after //.
* Makefile: enable clang-tidy in presubmit testsDmitry Vyukov2020-08-042-13/+7
| | | | | Fix all errors it points to. The one in netlink_send_ext is concerning.
* executor: remove block commentsDmitry Vyukov2020-08-044-34/+26
| | | | | | | | | 1. We don't generally use /* */ block comments, few precedents we have are inconsistent with the rest of the code. 2. pkg/csource does not strip them from the resulting code. Remove the cases we have and add a test to prevent new ones being added.
* all: fake hci le conn using handle 201Andy Nguyen2020-08-021-5/+40
|
* Revert "executor: enable extra coverage on OpenBSD"Anton Lindqvist2020-08-021-9/+0
| | | | | | | Forgot that the build machine must be updated with a newer OpenBSD snapshot first in order to make the new kcov stuff available. This reverts commit 96dd36234d97bbf6b403f3a7f03cfc0296422879.
* executor: enable extra coverage on OpenBSDAnton Lindqvist2020-08-021-0/+9
| | | | | | Recently added[1] to the kcov implementation on OpenBSD. [1] https://github.com/openbsd/src/commit/8430bc4bce9f93dce843b53971377b7afd96cdb1
* sys/linux: assorted improvements for vhciDmitry Vyukov2020-07-301-3/+4
| | | | | | | | | | | | | | | | Regenerate const files on next-20200729. Change conn handle to 200 because it also seems to be matches against phy_handle fields which are int8 (current 256 does not fit into int8). Use 200 for all handle's and all phy_handle's. Remove hci_evt_le_cis_req, it does not seem to be used in the kernel. Restrict some event types and statuses. Add rssi field to hci_ev_le_advertising_info. Use bytesize for some of the data length fields.
* all: initialize vhci in linuxTheOfficialFloW2020-07-302-3/+306
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * all: initialize vhci in linux * executor/common_linux.h: improve vhci initialization * pkg/repro/repro.go: add missing vhci options * executor/common_linux.h: fix type and add missing header * executor, pkg: do it like NetInjection * pkg/csource/csource.go: do not emit syz_emit_vhci if vhci is not enabled * executor/common_linux.h: fix format string * executor/common_linux.h: initialize with memset For som reason {0} gets complains about missing braces... * executor/common_linux.h: simplify vhci init * executor/common_linux.h: try to bring all available hci devices up * executor/common_linux.h: find which hci device has been registered * executor/common_linux.h: use HCI_VENDOR_PKT response to retrieve device id * sys/linux/dev_vhci.txt: fix structs of inquiry and report packets * executor/common_linux.h: remove unnecessary return statement and check vendor_pkt read size * executor/common_linux.h: remove unnecessary return statement and check vendor_pkt read size * sys/linux/dev_vhci.txt: pack extended_inquiry_info_t * sys/linux/l2cap.txt: add l2cap_conf_opt struct * executor/common_linux.h: just fill bd addr will 0xaa * executor/common_linux.h: just fill bd addr will 0xaa
* executor: added syz_io_uring_setup to wrap both setup and mmapNecip Fazil Yildiran2020-07-291-1/+85
| | | | | | It is hard for the fuzzer to generate correct programs using mmap calls with fuzzer-provided mmap length. This wrapper ensures correct length computation.
generated by ggit (джигит) mrf-deployment (git 2.46.0) at 2026-03-17 22:49:42 +0000