aboutsummaryrefslogtreecommitdiffstats
path: root/executor
Commit message (Collapse)AuthorAgeFilesLines
* Makefile: generate descriptions on-the-flyDmitry Vyukov2020-04-302-26306/+0
| | | | | | | | | | | | | | | | | | Checking in the generated descriptions files makes few things simpler, but causes pain for pull requests: (1) PRs that touch descriptions _always_ conflict, (2) PRs are large and harder to review, (3) people sometimes forget to add auto-generated files. The proposed way does not require us to hardcode lots of dependencies in the Makefile (which is nice) and seem to work. Let's see how it works. The main contributor-visible consequence is that the auto-generated files do not need to be checked-in now. Credit for figuring the Makefile magic goes to @melver. Fixes #1291
* sys: add mldv2 packet structsAndy Nguyen2020-04-291-8/+8
| | | | Use special values for hop limit to increase likelihood of triggering certain paths.
* sys: add more specific ipv6 optionsAndy Nguyen2020-04-292-8/+40
| | | | Additionally fix a type for ipv6_hopopts_ext_header
* pkg/compiler: deduplicate Types in descriptionsDmitry Vyukov2020-04-261-19/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add prog.Ref Type that serves as a proxy for real types and allows to deduplicate Types in generated descriptions. The Ref type is effectively an index in an array of types. Just before serialization pkg/compiler replaces real types with the Ref types and prepares corresponding array of real types. When a Target is registered in prog package, we do the opposite operation and replace Ref's with the corresponding real types. This brings improvements across the board: compiler memory consumption is reduced by 15%, test building time by 25%, descriptions size by 33%. Before: $ du -h sys/linux/gen 54M sys/linux/gen $ time GOMAXPROCS=1 go test -p=1 -c ./prog real 0m54.200s real 0m53.883s $ time GOMAXPROCS=1 go install -p=1 ./tools/syz-execprog real 0m27.911s real 0m27.767s $ TIME="%e %P %M" GOMAXPROCS=1 time go tool compile ./sys/linux/gen 20.59 100% 3200016 20.97 100% 3445976 20.25 100% 3209684 After: $ du -h sys/linux/gen 36M sys/linux/gen $ time GOMAXPROCS=1 go test -p=1 -c ./prog real 0m42.290s real 0m43.230s $ time GOMAXPROCS=1 go install -p=1 ./tools/syz-execprog real 0m24.337s real 0m24.727s $ TIME="%e %P %M" GOMAXPROCS=1 time go tool compile ./sys/linux/gen 19.11 100% 2764952 19.66 100% 2787624 19.35 100% 2749376 Update #1580
* sys/openbsd: extend vnetGreg Steuck2020-04-261-1/+1
| | | | | | | | * started with freebsd/vnet.txt * pruned unsupported items * gmake extract * gmake generate_sys * gmake fomat
* sys/netbsd: add lchmod(2) (#1687)Ayushi Sharma2020-04-212-1/+2
|
* executor: remove unidentified fileGreg Steuck2020-04-201-0/+0
| | | | | | | | | | It was committed as the following and doesn't make sense. commit e06d2ea701a5532381cde7609c521649f0f01018 Author: R3x <siddharth.muralee@gmail.com> Date: Sat Jul 6 14:01:06 2019 +0000 sys/netbsd: Added posix_spawn and fork syscalls
* sys/syz-sysgen: better formatting for syscall descriptionsDmitry Vyukov2020-04-191-4725/+742
| | | | | We don't really need clang-format for auto-generated code. We can do better ourselves!
* prog: add ignore_return and breaks_returns call attribtuesDmitry Vyukov2020-04-193-498/+3392
| | | | | We had these hard-coded for fuchsia and linux accordingly. Replace with call attributes.
* sys/linux: sync call timeouts with executorDmitry Vyukov2020-04-191-1/+2
| | | | Timeouts in executor and sys/linux get out of sync. Sync them.
* sys/linux: add timeout call attributesDmitry Vyukov2020-04-193-288/+1345
| | | | | | | Move additional call/prog timeouts to descriptions. Due to this logic duplication executor used 50ms for syz_mount_image, while pkg/csource used 100ms.
* prog: introduce call attributesDmitry Vyukov2020-04-193-4560/+4570
| | | | | | Add common infrastructure for syscall attributes. Add few attributes we want, but they are not implemented for now (don't affect behavior, this will follow).
* executor: surround the data mapping with PROT_NONE pagesDmitry Vyukov2020-04-182-2/+11
| | | | | | | | | | | Surround the main data mapping with PROT_NONE pages to make virtual address layout more consistent across different configurations (static/non-static build) and C repros. One observed case before: executor had a mapping above the data mapping (output region), while C repros did not have that mapping above, as the result in one case VMA had next link, while in the other it didn't and it caused a bug to not reproduce with the C repro. The bug that reproduces only with the mapping above: https://lkml.org/lkml/2020/4/17/819
* executor: remove more code if ENABLE_NAPI_FRAGS is not setDmitry Vyukov2020-04-181-8/+11
| | | | | | In some configurations tun_frags_enabled ends up being unused with a compiler warning and failed build. Remove mode code if ENABLE_NAPI_FRAGS is not enabled.
* sys/netbsd: add minherit(2)ais2397@gmail.com2020-04-162-1/+2
|
* sys/linux: add some more ipv4/6 addressesDmitry Vyukov2020-04-141-6/+6
| | | | Add few private ipv4/6 addresses that may affect kernel behavior.
* sys/linux: regenerate constsDmitry Vyukov2020-04-141-6/+6
| | | | | | | | | | | On the current linux-next: f19bb13a0eaf0034a603e3b54a7c3a50faf6821e (next-20200414) EXT4_EOFBLOCKS_FL was removed by 4337ecd1fe997d2b2135b4434caaccdb47c10c06 ARM does not support KVM anymore, removed by 541ad0150ca4 ("arm: Remove 32bit KVM host support"). Fixes #1676
* sys/netbsd: fix struct statais2397@gmail.com2020-04-131-1/+1
|
* sys/linux: add link_create and link_update commandsPaul Chaignon2020-04-122-6/+18
| | | | Signed-off-by: Paul Chaignon <paul@cilium.io>
* bpf: update BPF constantsPaul Chaignon2020-04-121-6/+6
| | | | Signed-off-by: Paul Chaignon <paul@cilium.io>
* executor/usb: don't fail when ath9k is not enabledAndrey Konovalov2020-04-071-1/+1
|
* executor: regenerate filesDmitry Vyukov2020-04-061-7/+7
|
* sys/netbsd: adding chflags(2) syscalls (#1661)Ayushi Sharma2020-04-042-8/+11
|
* csource, executor: add usb emulation featureAndrey Konovalov2020-04-033-0/+12
| | | | | | | | | The feature gets enabled when /dev/raw-gadget is present and accessible. With this feature enabled, executor will do chmod 0666 /dev/raw-gadget on startup, which makes it possible to do USB fuzzing in setuid and namespace sandboxes. There should be no backwards compatibility issues with syz reproducers that don't explicitly enable this feature, as they currently only work in none sandbox.
* executor: re-run make generateDmitry Vyukov2020-03-311-7/+7
|
* sys/netbsd: adding lwp syscalls (#1654)Ayushi Sharma2020-03-312-8/+9
|
* executor: add some comments to USB helper functionsAndrey Konovalov2020-03-281-0/+17
|
* executor: split out Linux specific USB codeAndrey Konovalov2020-03-282-533/+550
|
* sys/freebsd: add Capsicum system callsMark Johnston2020-03-272-2/+18
|
* sys/freebsd: add __realpathat system callMark Johnston2020-03-272-2/+4
|
* sys/freebsd: add bindat(2)Mark Johnston2020-03-272-2/+6
|
* sys/freebsd: add POSIX shared memory system callsMark Johnston2020-03-272-2/+10
|
* sys/freebsd: add connectat(2)Mark Johnston2020-03-272-2/+6
|
* sys/freebsd: add posix_fadvise(2) and posix_fallocate(2)Mark Johnston2020-03-272-2/+6
|
* sys/freebsd: add missing open(2) flagsMark Johnston2020-03-271-2/+2
|
* sys/freebsd: use symbolic names for faccessat(2) flagsMark Johnston2020-03-271-2/+2
|
* sys/freebsd: add chflags(2) and related syscallsMark Johnston2020-03-272-2/+10
|
* sys/freebsd: add lchmod(2)Mark Johnston2020-03-272-2/+4
|
* sys/freebsd: add copy_file_range(2)Mark Johnston2020-03-272-2/+4
|
* sys/freebsd: add minherit(2)Mark Johnston2020-03-272-2/+4
|
* sys/freebsd: add FreeBSD-specific madvise(2) flagsMark Johnston2020-03-271-2/+2
|
* sys/linux: don't use syz_open_dev when openat is enoughDmitry Vyukov2020-03-242-30/+30
|
* pkg/compiler: truncate const values to their physical sizeDmitry Vyukov2020-03-241-7/+7
| | | | | | We do similar truncation for values in the prog package (truncateToBitSize). Truncating them in the generated descriptions makes it possible to directly compare values (otherwise -1 and truncated -1 don't match).
* pkg/compiler: check that flags values fit into base typeDmitry Vyukov2020-03-171-10/+10
| | | | | | | | flags[foo, int8] foo = 0x12345678 is always an error, detect these cases. Found some bugs in mptcp, packet sockets, kvm.
* pkg/compiler: check that const values fit into base typeDmitry Vyukov2020-03-171-12/+12
| | | | | const[0x12345678, int8] is always an error, detect these cases. Found some bugs in mptcp, socket proto and fuchsia fidl descriptions.
* pkg/compiler: calculate more precise sizes for argumentsDmitry Vyukov2020-03-171-16/+16
| | | | | | | | | | | | | | | | | | | | If we have: ioctl(fd fd, cmd int32) ioctl$FOO(fd fd, cmd const[FOO]) Currently we assume that cmd size in ioctl$FOO is sizeof(void*). However, we know that in ioctl it's specified as int32, so we can infer that the actual syscall size is 4. This massively reduces sizes of socket/setsockopt/getsockopt/ioctl and some other syscalls, which is good because we now use physical size in mutation/hints and some other places. This will also enable not morphing ioctl's into other ioctl's. Update #477 Update #502
* pkg/compiler: ensure consistency of syscall argument typesDmitry Vyukov2020-03-172-68/+62
| | | | | | | | | | | | | | | | | | Ensure that we don't have conflicting sizes for the same argument of the same syscall, e.g.: foo$1(a int16) foo$2(a int32) This is useful for several reasons: - we will be able avoid morphing syscalls into other syscalls - we will be able to figure out more precise sizes for args (lots of them are implicitly intptr, which is the largest type on most important arches) - found few bugs in linux descriptions Update #477 Update #502
* pkg/compiler: don't specify syscall consts for test OSDmitry Vyukov2020-03-172-3/+390
| | | | This is just tedious. Fabricate them on the fly.
* executor: fix format warningDmitry Vyukov2020-03-131-2/+2
|
* executor: fix data raceDmitry Vyukov2020-03-131-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ThreadSanitizer says: WARNING: ThreadSanitizer: data race (pid=3) Atomic read of size 4 at 0x56360e562f08 by main thread: #0 __tsan_atomic32_load <null> (libtsan.so.0+0x64249) #1 event_isset executor/common_linux.h:51 (syz-executor.0+0x2cf1f) #2 handle_completion executor/executor.cc:886 (syz-executor.0+0x2cf1f) #3 execute_one executor/executor.cc:732 (syz-executor.0+0x2da3b) #4 loop executor/common.h:581 (syz-executor.0+0x2f1aa) #5 do_sandbox_none executor/common_linux.h:2694 (syz-executor.0+0x189d6) #6 main executor/executor.cc:407 (syz-executor.0+0x189d6) Previous write of size 4 at 0x56360e562f08 by thread T1: #0 event_reset executor/common_linux.h:32 (syz-executor.0+0x1f5af) #1 worker_thread executor/executor.cc:1048 (syz-executor.0+0x1f5af) #2 <null> <null> (libtsan.so.0+0x2b0b6) Location is global 'threads' of size 2560 at 0x56360e562f00 (syz-executor.0+0x00000008bf08) Thread T1 (tid=6, running) created by main thread at: #0 pthread_create <null> (libtsan.so.0+0x2d55b) #1 thread_start executor/common.h:256 (syz-executor.0+0x2d707) #2 thread_create executor/executor.cc:1037 (syz-executor.0+0x2d707) #3 schedule_call executor/executor.cc:811 (syz-executor.0+0x2d707) #4 execute_one executor/executor.cc:719 (syz-executor.0+0x2d707) #5 loop executor/common.h:581 (syz-executor.0+0x2f1aa) #6 do_sandbox_none executor/common_linux.h:2694 (syz-executor.0+0x189d6) #7 main executor/executor.cc:407 (syz-executor.0+0x189d6)
generated by ggit (джигит) mrf-deployment (git 2.46.0) at 2026-03-13 08:47:46 +0000