aboutsummaryrefslogtreecommitdiffstats
path: root/executor
Commit message (Collapse)AuthorAgeFilesLines
* executor: set `source` for the proc mountAndrei Vagin2024-07-031-1/+1
| | | | | | | | | | mount() in gVisor returns EFAULT if source is NULL. It is a gVisor issue and we will fix it. Let's explicitly sets a string source for the proc mount to unblock gVisor jobs. The source string will additionally be useful for troubleshooting mount-related problems in the future, because it is shown in /prod/pid/mountinfo. Signed-off-by: Andrei Vagin <avagin@google.com>
* executor: linux: bump fs.mount-max to 100000Alexander Potapenko2024-07-031-0/+3
| | | | | | | Android sets fs.mount-max to 100, making it impossible to create new chroots. Relax the limit, setting it to a value used on desktops. Tracking bug: https://github.com/google/syzkaller/issues/4972
* pkg/fuzzer: remove signal rotationDmitry Vyukov2024-07-023-16/+1
| | | | | | | Signal rotation is intended to make the fuzzer re-discover flaky coverage in non flaky way. However, taking into accout that we get effectively the same effect after each manager restart, and that the fuzzer is overloaded with triage/smash jobs, it does not look to be worth it.
* executor: linux: chroot into tmpfs with sandbox=noneAlexander Potapenko2024-07-021-50/+63
| | | | | | | | | | | To prevent the executor from accidentally making the whole root file system immutable (which breaks fuzzing), modify sandbox=none to create a tmpfs mount and chroot into it before executing programs in a process. According to `syz-manager -mode=smoke-test`, the number of enabled syscalls on x86 doesn't change with this patch. Fixes #4939, #2933, #971.
* pkg/mgrconfig: allow to disable remote coverage and coverage edgesDmitry Vyukov2024-07-021-7/+9
|
* pkg/rpcserver: move kernel test/data range checks from executorDmitry Vyukov2024-07-018-219/+80
| | | | | | | | | | | | | | | | | We see some errors of the form: SYZFAIL: coverage filter is full pc=0x80007000c0008 regions=[0xffffffffbfffffff 0x243fffffff 0x143fffffff 0xc3fffffff] alloc=156 Executor shouldn't send non kernel addresses in signal, but somehow it does. It can happen if the VM memory is corrupted, or if the test program does something very nasty (e.g. discovers the output region and writes to it). It's not possible to reliably filter signal in the tested VM. Move all of the filtering logic to the host. Fixes #4942
* pkg/report: suppress executor SIGBUSDmitry Vyukov2024-07-011-2/+3
| | | | | | SIGBUS means OOM on Linux. Most of the crashes that happen during fuzzing are SIGBUS, so separate them from SIGSEGV and suppress.
* executor: fix endianess of size of received flatbuffers root tableAlexander Egorenkov2024-07-011-0/+2
| | | | | | | | | | Flatbuffers represents each scalar in little-endian format (https://flatbuffers.dev/flatbuffers_internals.html). Therefore, the size of the received root table must be converted to the host endianness format before its first usage. Signed-off-by: Alexander Egorenkov <eaibmz@gmail.com> Fixes: e16e2c9a4cb6 ("executor: add runner mode")
* pkg/flatrpc: rename StartLeakChecks to CorpusTriagedDmitry Vyukov2024-07-011-3/+3
| | | | | | It's a more general name that says what happened rather than a detail of what excutor should do. We can use this notification for other things as well.
* executor: always return some coverage for test OSDmitry Vyukov2024-06-281-5/+10
| | | | This allows to enable test executor with coverage.
* executor: don't trace PCs as comparisonsDmitry Vyukov2024-06-282-1/+4
| | | | | | Currnetly we always write PCs into the buffer even if tracing comparisons. Such bogus data will fail comparison consistentcy checks (type/pc) and executor will crash. Don't trace PCs as comparisons.
* executor: fix max signal/cover filter mapping into subprocessesDmitry Vyukov2024-06-282-1/+15
| | | | | | | | | | | There is a quirk related to posix_spawn_file_actions_adddup2: it just executes the specified dup's in order in the child process. In our case we do dups as follows: 20 -> 4 (output region) 4 -> 5 (max signal) So we dup the output region onto 4 first, and then dup the same output region (fd 4 becomes the output region) onto 5 (max signal). So we have output region as both output region and max signal.
* pkg/runtest: test feature detectionDmitry Vyukov2024-06-272-0/+46
| | | | | Fail some features in various ways for test OS, and check that features are detected properly.
* executor: handle features that fail in non-fatal wayDmitry Vyukov2024-06-271-1/+1
| | | | | | | Coverage setup fails with exitf if not supported. Currently we consider it as transient error that needs to be retried. As the result we reach 20 attempts and crash the VM. Return an error in such case instead.
* executor: disable lsan for exec subprocessesDmitry Vyukov2024-06-261-2/+4
| | | | | Somehow it's very slow in syzbot arm64 image. This speeds up pkg/runtest tests a hundred of times.
* executor: set PR_SET_PDEATHSIG for TestOSAleksandr Nogikh2024-06-261-0/+11
| | | | | | | Otherwise we may leave orphaned executor process children, which prevent the cleanup of the executor directory. Closes #4920.
* executor: include missing headerDmitry Vyukov2024-06-261-0/+1
| | | | | | | FreeBSD says: executor/conn.h:100:3: error: unknown type name 'sockaddr_in'; did you mean 'sockaddr'? sockaddr_in saddr4 = {};
* executor: use mcontext_t only on linuxDmitry Vyukov2024-06-261-2/+2
| | | | | | | | OpenBSD says: executor/executor_runner.h:750:51: error: no member named 'uc_mcontext' in 'sigcontext' auto& mctx = static_cast<ucontext_t*>(ucontext)->uc_mcontext; ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ^
* executor: check whether the address is stdin before validation a portAndrei Vagin2024-06-251-2/+2
| | | | Otherwise, it fails with "SYZFAIL: failed to parse manager port".
* executor: use ftruncate instead of fallocateDmitry Vyukov2024-06-251-2/+3
| | | | OpenBSD has neither fallocate nor posix_fallocate.
* executor: prohibit malloc/calloc via linterDmitry Vyukov2024-06-254-16/+39
| | | | | | We include a number of C++ headers in the runnner. On FreeBSD some of them mention malloc, and our defines break the build. Use the style test to check only our files for these things.
* executor: swap addr/pc in SigsegvHandlerDmitry Vyukov2024-06-251-1/+1
|
* Revert "syz-manager: support stdin as port forwarding result"Dmitry Vyukov2024-06-251-15/+3
| | | | | | | | | | | | This reverts commit 215eef4ad85fb6124af70d1e5c9729b69554a32b. The gvisor "stdin" address still crashes in executor Connection::Connect on atoi(ports) with ports == NULL. The gvisor "stdin" address is not tested, so it's better to make it less special rather than add more special cases in manager, executor, and now also in Connection to handle it. It still may crash in future after some changes.
* executor/linux: fix compilation error with old compilersPavel Skripkin2024-06-251-1/+8
| | | | | | | | | | | | | | | | | | | | My gcc-10 in testing vm compainls during reproducer [0] build with following error: rep.c: In function ‘remove_dir’: rep.c:662:3: error: a label can only be part of a statement and a declaration is not a statement 662 | const int umount_flags = MNT_FORCE | UMOUNT_NOFOLLOW; | ^~~~~ Label followed by declaration is C23 extension, so only new compilers support it. Fix it by moving declaration above `retry` label and put unused attribute to suppress possible warning. [0] https://syzkaller.appspot.com/bug?extid=dcc068159182a4c31ca3 Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
* syz-manager: support stdin as port forwarding resultAleksandr Nogikh2024-06-241-3/+15
| | | | It is returned from vm/gvisor.
* executor: add runner modeDmitry Vyukov2024-06-2411-395/+1617
| | | | | | | Move all syz-fuzzer logic into syz-executor and remove syz-fuzzer. Also restore syz-runtest functionality in the manager. Update #4917 (sets most signal handlers to SIG_IGN)
* executor: refactor coverage filterDmitry Vyukov2024-06-245-98/+315
|
* executor: fix is_kernel_data/pc for gVisorDmitry Vyukov2024-06-211-0/+4
| | | | The address ranges in is_kernel_data/pc are only true for normal Linux.
* executor: handle errors from netlink_query_family_idCameron Finucane2024-06-171-0/+17
| | | | | There were some cases where the return value was not checked, allowing errors to propagate. This fixes them to return early with a message.
* executor: fix compiler warnings in 32-bit modeAlexander Egorenkov2024-06-131-2/+2
| | | | | | | | | | | | executor/executor.cc: In function ‘uint64 read_input(uint8**, bool)’: executor/executor.cc:1487:59: error: format ‘%zu’ expects argument of type ‘size_t’, but argument 3 has type ‘int’ [-Werror=format=] executor/executor.cc:1495:67: error: format ‘%zu’ expects argument of type ‘size_t’, but argument 3 has type ‘int’ [-Werror=format=] Signed-off-by: Alexander Egorenkov <eaibmz@gmail.com>
* executor: fix extraction of number of KCOV comparisons from coverage dataAlexander Egorenkov2024-06-121-3/+3
| | | | | | | | | | | KCOV stores the number of KCOV comparisons in a coverage buffer always as a 64-bit integer at offset 0 of the coverage buffer. Don't use the field size of the coverage object which is initialized in cover_collect() and size of which depends on kernel bitness because this field is intended only for KCOV PC coverage and not for KCOV comparisons. Signed-off-by: Alexander Egorenkov <eaibmz@gmail.com>
* docs: remove mentions of strconstDmitry Vyukov2024-06-111-1/+1
| | | | strconst["foo"] was replaced by ptr[in, string["foo"]].
* executor: ignore kernel text addresses in comparisonsDmitry Vyukov2024-06-111-2/+2
| | | | | | We ignore comparisons of kernel data/physical addresses b/c these are not coming from user space. Ignore kernel text addresses for the same reason.
* executor: factor out is_kernel_pc helperDmitry Vyukov2024-06-116-32/+62
| | | | Factor out is_kernel_pc helper and add kernel pc range for test OS for testing.
* executor: add end-to-end coverage/signal/comparisons testDmitry Vyukov2024-06-117-15/+67
|
* executor: map input buffer as sharedCameron Finucane2024-06-111-1/+1
| | | | | | | To receive data, executor relies on changes propagating to its copy of the shared memory buffer. This is only guaranteed with MAP_SHARED, whereas behavior is "unspecified" for MAP_PRIVATE (but happened to work on most implementations).
* executor: optimize waiting for child processes exitDmitry Vyukov2024-06-103-1/+11
| | | | | | | Currently we sleep only for 1 ms, which may produce some excessive CPU load (we usually have 6/8 such processes waiting). Make it sleep for 10 ms, but also make the sleep return immediately on child exit. This shuold both improve latency and reduce CPU load.
* executor: use close_range if availableDmitry Vyukov2024-06-101-0/+5
| | | | Close_range is faster.
* executor: don't call close_fds twiceDmitry Vyukov2024-06-101-1/+2
|
* executor: allow to run a single testDmitry Vyukov2024-06-052-3/+5
|
* executor: remove noshmem modeDmitry Vyukov2024-06-047-92/+4
| | | | | | | | | All OSes we have now support shmem. Support for Fuchia/Starnix/Windows wasn't implemented, but generally they support shared memory. Remove all of the complexity and code associated with noshmem mode. If/when we revive these OSes, it's easier to properly implement shmem mode for them.
* executor: repair asan buildDmitry Vyukov2024-06-041-12/+29
| | | | | | | | | Asan build with sharem memory mode is broken for a long time since the address for output region is incompatible with asan (asan doesn't have shadow for these addresses). We did not notice it b/c we only tested no shared memory mode in short test mode used on CI. Don't use fixed mmap address under asan.
* executor: fix gvisor signalDmitry Vyukov2024-06-032-5/+7
| | | | | | | | | Fix 2 bugs: 1. We remove low 12 bits of every PC on amd64 b/c use_cover_edges return true. This results in extremly low signal (gvisor PC are dense integers). 2. We hash prev/next PC on arm64 which does not make sense since gvisor coverage is not a trace. This results in falsely large signal.
* executor: rework feature setupDmitry Vyukov2024-06-035-115/+167
| | | | | | | | | | | | | Return failure reason from setup functions rather than crash. This will provide better error messages, but also allow setup w/o creating subprocesses which will be needed when we combine fuzzer and executor. Also close all resources created during setup. This is also useful for in-process setup, but also should improve chances of reproducing a bug with C reproducer. Currently leaked file descriptors may disturb repro execution (e.g. it may act on a wrong fd).
* executor: fix coverfilter header sizeDmitry Vyukov2024-05-282-19/+17
| | | | | | Manager was switched to 64-bit PCs, but executor still expected 4-byte PC start in the header. Fix it and switch size to uint64 for simplicity as well.
* prog: introduce a remote_cover call attributeAleksandr Nogikh2024-05-271-4/+2
| | | | | | Update the descriptions to mark calls that cause remote coverage collection. Remote some hacky code from the executor.
* executor: always send 64bit pc and sigJoey Jiao2024-05-271-6/+5
| | | | | | | | | | | | On 64 bit machine, when CONFIG_RANDOMIZE_BASE enabled, even [32:64] bits changed across reboot. And, core kernel and modules can have diff [31:64] bits. We need to add 64bit pc support and this is to always send 64bit pc and sig to syz-fuzzer. Send 64bit pc and sig is compatable with 32bit OS.
* executor: remove including error.h in test_linux.hKhem Raj2024-05-221-1/+0
| | | | | | It seems to be redundant and moreover it lets us compile on musl which does not provide this system header.
* pkg/csource: remove the Repro optionAleksandr Nogikh2024-05-171-2/+0
| | | | Enable it unconditionally.
* pkg/vminfo: move feature checking to hostDmitry Vyukov2024-05-154-27/+77
| | | | | | | | | | | | | | | | | Feature checking procedure is split into 2 phases: 1. syz-fuzzer invokes "syz-executor setup feature" for each feature one-by-one, and checks if executor does not fail. Executor can also return a special "this feature does not need custom setup", this allows to not call setup of these features in each new VM. 2. pkg/vminfo runs a simple program with ipc.ExecOpts specific for a concrete feature, e.g. for wifi injection it will try to run a program with wifi feature enabled, if setup of the feature fails, executor should also exit with an error. For coverage features we also additionally check that we actually got coverage. Then pkg/vminfo combines results of these 2 checks into final result. syz-execprog now also uses vminfo package and mimics the same checking procedure. Update #1541
generated by ggit (джигит) mrf-deployment (git 2.46.0) at 2026-03-14 20:26:53 +0000