aboutsummaryrefslogtreecommitdiffstats
path: root/executor
Commit message (Collapse)AuthorAgeFilesLines
* executor: increase kMaxCommands and add checksAndrey Konovalov2017-02-081-1/+5
|
* executor: better protect output region from corruptionsDmitry Vyukov2017-02-061-9/+18
| | | | | Fuzzer invented another tricky way to corrupt the region. Map it at a hard to guess address.
* executor: fix undefined setup_tun() function error in c reprosAndrey Konovalov2017-02-011-2/+6
|
* csource: regenerate and reformatDmitry Vyukov2017-02-011-1/+1
|
* executor: fix tun initialization when sandbox != noneAndrey Konovalov2017-01-312-18/+32
|
* sys: improve kvm descriptionDmitry Vyukov2017-01-284-67/+120
| | | | | | Allow fuzzer to change types of segment descriptors. Alter more flags. Allow fuzzer to do a random vmwrite.
* all: implement edge coverageDmitry Vyukov2017-01-271-47/+122
| | | | | | | | | | | Currently syzkaller uses per-call basic block (BB) coverage. This change implements edge (not-per-call) coverage. Edge coverage is more detailed than BB coverage as it captures not-taken branches, looping, etc. So it provides better feedback signal. This coverage is now called "signal" throughout the code. BB code coverage is also collected as it is required for visualisation. Not doing per-call coverage reduces corpus ~6-7x (from ~35K to ~5K), this has profound effect on fuzzing efficiency.
* executor: fix KVM testDmitry Vyukov2017-01-271-1/+1
| | | | SMM is now supported for real code instead of prot16.
* adb: executor: Revert to adb rebootBilly Lau2017-01-261-5/+0
| | | | | | | | | Using `adb shell syz-executor reboot` to reboot devices has stopped working with the recent Android update, probably due to the intro of seccomp. I have reverted the device reboot logic to use `adb shell reboot` although it can be flaky at times so that we can continue to fuzz on devices, until a more reliable solution can be sought out.
* executor: protect against memory corruptions betterDmitry Vyukov2017-01-253-3/+15
| | | | | | | | | | | Fuzzer has figured out how to corrupt input/output shmem regions abusing the text memcpy in syz_kvm_setup_cpu. It guessed a negative text_size value that causes the memcpy to overwrite shmem regions. Protect better against such cases: 1. Make text_size unsigned (there is already a check that it is less than 1000). 2. Map input region as readable only, we don't write to it. 3. Add address sanity check to segv_handler, if we see that we are writing into executable data, it's better to crash instantly.
* executor: change tun subnet to 172.20.*Andrey Konovalov2017-01-231-5/+3
|
* executor: reduce syscall blocking delay from 100ms to 20msDmitry Vyukov2017-01-201-2/+2
| | | | | Syscalls frequently block and this affects fuzzing speed. 20ms should be more than enough for a normal syscall to finish.
* executor: fix warning regarding type cast in STORE_BY_BITMASKAndrey Konovalov2017-01-201-1/+1
|
* executor: fix copyin of valuesDmitry Vyukov2017-01-174-11/+44
| | | | | | Currently non-bitfield values are copied incorrectly. Probably all turned into zeros or something. Fix that. Add test.
* prog: add bitfields to templatesAndrey Konovalov2017-01-172-8/+25
| | | | | | Now it's possible to use `int32:18` to denote a bitfield of size 18 as a struct field. This fixes #72.
* sys, executor: more kvm improvementsDmitry Vyukov2017-01-124-24/+117
| | | | | | | 1. Basic support for arm64 kvm testing. 2. Fix compiler warnings in x86 kvm code. 3. Test all pseudo syz calls in csource. 4. Fix handling of real code in x86.
* sys: extend kvm supportDmitry Vyukov2017-01-0910-0/+1460
| | | | | | Add new pseudo syscall syz_kvm_setup_cpu that setups VCPU into interesting states for execution. KVM is too difficult to setup otherwise. Lots of improvements possible, but this is a starting point.
* executor: use NONFAILING strcpy in syz_open_devDmitry Vyukov2017-01-091-1/+1
| | | | The source is fuzzer provided memory, it can be non-addressable.
* csource: compile with -WerrorDmitry Vyukov2017-01-091-2/+2
| | | | | | Check for compiler warnings during compilation. Don't require -std=c99. Fix existing compiler warnings.
* executor: increase coverage size from 16K to 64K PCsDmitry Vyukov2017-01-091-1/+1
| | | | On some KVM syscalls soverage reaches 36K+ PCs.
* executor: don't fail on ENOMEMDmitry Vyukov2016-12-161-1/+3
|
* executor: handle exit failuresDmitry Vyukov2016-12-082-11/+38
| | | | See the added comment for explanation.
* executor: add struct to cap structsDmitry Vyukov2016-12-071-2/+2
| | | | | Otherwise it does not compile as C. Also regenerate csource/common.go (it misses the MAX_PIDS change).
* executor: use different address for our network cardDmitry Vyukov2016-12-061-3/+7
| | | | | IP addresses like 192.168.0.1/192.168.1.1 are often used for routing between VM and the host. Offset our IP addresses to start from 192.168.218.0 to reduce potential conflicts.
* executor: change the way we wait for childrenDmitry Vyukov2016-12-052-8/+11
| | | | | | waitpid(pid) does not work if child invokes ptrace(PTRACE_TRACEME): https://groups.google.com/forum/#!topic/syzkaller/SjWzOnNRRIU Use waitpid(-1) instead.
* executor: don't try to open tun if it's not enabledAndrey Konovalov2016-12-022-4/+11
|
* csourse: emit remove_dir only when neededAndrey Konovalov2016-11-291-0/+2
|
* executor: emit ethernet trafficAndrey Konovalov2016-11-292-14/+137
|
* csource: don't emit syz_ syscalls is they are not usedDmitry Vyukov2016-11-261-3/+26
|
* executor: fix sandbox=setuidDmitry Vyukov2016-11-221-2/+4
| | | | | Need to chmod(0777) the work dir before we do setuid(nobody). Otherwise nobody user won't have rights to use the temp dir.
* csourceL add missing include and defineDmitry Vyukov2016-11-221-0/+2
|
* repro: factor out of syz-repro toolDmitry Vyukov2016-11-192-308/+368
| | | | | | | | Factor out repro logic from syz-repro tool, so that it can be used in syz-manager. Also, support sandboxes in code generated by csoure. This is required to reproduce crashes that require e.g. namespace sandbox.
* sys, prog: add tests for description parsing and serializationDmitry Vyukov2016-09-281-0/+2
| | | | | | | | | | Add sys/test.txt file with description of syscalls for tests. These descriptions can be used to ensure that we can parse everything we clain we can parse. Use these descriptions to write several tests for exec serialization (one test shows that alignment handling is currently incorrect). These test descriptions can also be used to write e.g. mutation tests. Update #78
* sys: remove autogenerated filesDmitry Vyukov2016-09-021-3350/+0
| | | | | | | | They were necessary when they were the source of constant values extracted from kernel code (hard to do). Now constants are checked-in separately, and these large files can be easily regenerated with 'make generate'. Now they are only a source of large uninteresting diffs in commits. Remove them.
* csource: teach how to execute pseudo syz_ syscallsDmitry Vyukov2016-08-282-107/+115
| | | | Update #59
* executor, csource: share some common code between executor and csourceDmitry Vyukov2016-08-283-3365/+3377
|
* overhaul syscall description generation processDmitry Vyukov2016-08-261-4121/+3008
| | | | | | | | | | | | | | | | | | | | | | This splits generation process into two phases: 1. Extract values of constants from linux kernel sources. 2. Generate Go code. Constant values are checked in. The advantage is that the second phase is now completely independent from linux source files, kernel version, presence of headers for particular drivers, etc. This allows to change what Go code we generate any time without access to all kernel headers (which in future won't be limited to only upstream headers). Constant extraction process does require proper kernel sources, but this can be done only once by the person who added the driver and has access to the required sources. Then the constant values are checked in for others to use. Consant extraction process is per-file/per-arch. That is, if I am adding a driver that is not present upstream and that works only on a single arch, I will check in constants only for that driver and for that arch.
* executor: add experimental mode to skip paging faultsDmitry Vyukov2016-08-221-27/+65
| | | | | | | Ignore SIGSEGV/SIGBUS during copyin/copyout of arguments. The memory may not be addressable. The ignoring allows to pass partially-addressable input data to kernel. It's unclear if it's a good idea or not yet.
* executor: revive setuid sandboxDmitry Vyukov2016-07-011-15/+76
| | | | | | | | | | | | | | The new namespace-based sanboxing is good, but it's not always what one wants (and also requires special kernel configs). Change dropprivs config value to sandbox, which can have different values (currently: none, setuid, namespace). Setuid mode uses setuid(nobody) before fuzzing as before. In future we can add more sandboxing modes or, say, extend -sandbox=setuid to -sandbox=setuid:johndoe to impersonolate into given user.
* executor: add support for 386 arch (COMPAT syscalls)Dmitry Vyukov2016-06-302-23/+1136
| | | | | This is not fully working now: e.g. prog and sys packages assume that pointer size is 8. But at least it compiles and works.
* executor: don't consider failures to remove temp dirs as crashesDmitry Vyukov2016-06-281-6/+6
| | | | | | | There is a number of known, low-frequency reasons for failures in remove_dir. Make the failures non-fatal. Fixes #45
* sys: update generated filesDmitry Vyukov2016-06-131-0/+207
|
* executor: prevent test processes from ptracing parent processesDmitry Vyukov2016-03-101-0/+17
|
* executor: ignore NOFILE errors during cleanupDmitry Vyukov2016-03-101-1/+8
| | | | This is a common source of false positives.
* executor: ignore the case when test process kills loop processDmitry Vyukov2016-03-101-1/+2
| | | | This lead to lots of false positives.
* executor: make loop killing non-fatalDmitry Vyukov2016-03-101-1/+4
|
* sys: fix /dev/snd/pcm descriptionDmitry Vyukov2016-02-051-3/+6
|
* ipc: give executor some time to startupDmitry Vyukov2016-01-271-1/+5
| | | | | | Namespace-based sandbox can take some time to setup. In particular, lots of parallel executors block on net namespace creation.
* sys: regenerate after tun/random supportDmitry Vyukov2016-01-261-0/+87
|
* sys: open a bunch of new devicesDmitry Vyukov2016-01-262-2/+148
|
generated by ggit (джигит) mrf-deployment (git 2.46.0) at 2026-03-12 12:36:56 +0000