aboutsummaryrefslogtreecommitdiffstats
path: root/executor
Commit message (Collapse)AuthorAgeFilesLines
* sys: improve bpf descriptionsDmitry Vyukov2017-09-021-0/+35
|
* pkg/compiler: restore generation of unsupported syscallsDmitry Vyukov2017-09-021-0/+276
| | | | | | Unfortunately this is sitll needed, see the added comment. Update #191
* sys: add AF_PACKET sockets descriptionAndrey Konovalov2017-09-011-0/+99
|
* executor, ipc: modify the IO between KCOV<->executor<->fuzzerVictor Chibotaru2017-08-301-37/+116
| | | | | Now executor is able to read comparisons data from KCOV and write them to fuzzer.
* executor, fuzzer: change the way Syzkaller opens the KCOV deviceVictor Chibotaru2017-08-301-18/+38
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | We have implemented a new version of KCOV, which is able to dump comparison operands' data, obtained from Clang's instrumentation hooks __sanitizer_cov_trace_cmp[1248], __sanitizer_cov_trace_const_cmp[1248] and __sanitizer_cov_trace_switch. Current KCOV implementation can work in two modes: "Dump only the PCs" or "Dump only comparisons' data". Mode selection is done by the following series of calls: fd = open(KCOV_PATH, ...); // works as previous ioctl(fd, KCOV_INIT_TRACE, ...); // works as previous mmap(fd, ...); // works as previous ioctl(fd, KCOV_ENABLE, mode); // mode = KCOV_MODE_TRACE_CMP or mode = KCOV_MODE_TRACE_PC Note that this new interface is backwards compatible, as old KCOV devices will just return -EINVAL for the last ioctl. This way we can distinguish if the KCOV device is able to dump the comparisons. Main changes in this commit: 1. Fuzzer now checks at startup which type (new/old) of KCOV device is running. 2. Executor now receives an additional flag, which indicates if executor should read the comparisons data from KCOV. The flag works on per-call basis, so executor can collect PCs or Comps for each individual syscall.
* pkg/compiler: move more const-processing code to compilerDmitry Vyukov2017-08-271-519/+555
|
* pkg/compiler, sys/syz-sysgen: move const handling to pkg/compilerDmitry Vyukov2017-08-271-275/+0
| | | | Now pkg/compiler deals with consts.
* executor: split a too long lineDmitry Vyukov2017-08-241-1/+3
|
* all: support i386 archDmitry Vyukov2017-08-192-6/+1537
| | | | Update #191
* sys: support arm archDmitry Vyukov2017-08-191-0/+1521
| | | | | | | Not tested, but const extraction and build works. Update #324 Update #191
* sys: describe clone/execve callsDmitry Vyukov2017-08-121-0/+9
| | | | | Update #211 Update #310
* sys: describe chroot/getcwd/chdir/fchdirDmitry Vyukov2017-08-121-0/+12
| | | | Update #211
* executor: sandbox with RLIMIT_MEMLOCKDmitry Vyukov2017-08-081-0/+2
| | | | | | | Locking memory is a reasonably legitimate local DoS vector. E.g. bpf maps allow allocation of large chunks of kernel memory without RLIMIT_MEMLOCK, which leads to hangups. Set RLIMIT_MEMLOCK=8MB in executor.
* prog: fix encoding for exec of result argsAndrey Konovalov2017-08-011-0/+6
| | | | | | ResultArg might have const value. Also add a test.
* prog: return error instead of panic when parsingAndrey Konovalov2017-07-241-0/+3
|
* pkg/csource: make all usleeps randomAndrey Konovalov2017-07-241-2/+0
| | | | | | We can't know the exact values of those sleeps in advance, they can be different for different bugs. Making them random increases the chance that the C repro executes with the right timings at some point.
* prog: allow recursion for optional pointersAndrey Konovalov2017-07-191-0/+9
| | | | | | | | When syzkaller generates arg that uses a few structs that reference each other via pointers, it can go into infinite recursion and crash. Fix this by forcing pointer args to be null when the depth of recursion reaches 3 for some struct.
* Makefile: actually cross-compile during presubmitDmitry Vyukov2017-06-261-0/+7
|
* Port console to Darwin (#253)Zach Riggle2017-06-261-0/+2
| | | | | | | | | | | | * Port console to Darwin * Get syz-executor to build correctly * Do not export unix and syscall constants * Add presubmit test * Add myself to contributors
* sys: add ETHTOOL ioctl in socket.txtJB Cayrou2017-06-191-0/+3
| | | | | | Add ioctl$sock_SIOCETHTOOL and ETHTOOL structures defined in uapi/linux/ethtool.h http://elixir.free-electrons.com/linux/latest/source/include/uapi/linux/ethtool.h
* sys: use consistent icmp socket syscall namesAndrey Konovalov2017-06-141-36/+30
|
* executor: handle EACCES errno when opening /dev/kvm in testDmitry Vyukov2017-06-141-1/+1
|
* executor: fix compiler warnings in testDmitry Vyukov2017-06-141-21/+24
|
* executor: fix csum testDmitry Vyukov2017-06-141-1/+1
|
* makefile: list generated packagesAndrey Konovalov2017-06-141-1/+1
|
* executor: fix clang-tidy warningsDmitry Vyukov2017-06-132-18/+18
| | | | | A single check is enabled for now (misc-definitions-in-headers). But it's always fixable and found 2 bugs in csource.
* sys: check in generated filesDmitry Vyukov2017-06-131-0/+4542
| | | | | | | | | | | | | | | | | | We used to have all generated files checked in. Later we removed them (now users are supposed to run make to generate them). This causes several problems: - go get does not work as it tries to build everything straight away (go get -d works, but users are confused) - users don't run make and complain that build is broken - users don't re-run make after updates and complain that build is broken - hard to integrate into other build system (even if they support building Go, they don't support running sysgen out-of-the-box) Fixes #216
* Merge pull request #223 from xairy/up-makedev-fixAndrey Konovalov2017-06-131-0/+1
|\ | | | | executor: add sys/sysmacros.h include for makedev in newer gcc
| * executor: add sys/sysmacros.h include for makedev in newer gccAndrey Konovalov2017-06-131-0/+1
| |
* | executor: reformatDmitry Vyukov2017-06-131-1/+1
|/
* csource: don't use guard macros for debug() and NONFAILING()Andrey Konovalov2017-06-122-109/+69
|
* repro: always minimize over EnableTunAndrey Konovalov2017-06-121-1/+1
|
* csource: generate includes when necessaryAndrey Konovalov2017-06-121-25/+102
|
* csource: don't generate execute_syscall callsAndrey Konovalov2017-06-121-0/+2
|
* csource: use tmp dir in repeat loop when tmpdir flag is onAndrey Konovalov2017-06-121-1/+9
|
* csource: only emit fail(), exitf() and doexit() when necessaryAndrey Konovalov2017-06-121-1/+15
|
* csourse: don't generate debug printfsAndrey Konovalov2017-06-121-2/+32
|
* csource: try to simplify repeat loopAndrey Konovalov2017-06-121-3/+10
|
* csource: use sandbox only when requiredAndrey Konovalov2017-06-121-0/+2
|
* csource: emit bitmasks only when requiredAndrey Konovalov2017-06-121-14/+16
|
* csource: force enable tun flag when requiredAndrey Konovalov2017-06-121-10/+2
|
* csource: only handle SIGSEGV when necessaryAndrey Konovalov2017-06-122-9/+29
|
* executor: don't define SYZ_ENABLE_TUN in executorAndrey Konovalov2017-06-122-17/+16
|
* csource: use tmp dir only when necessaryAndrey Konovalov2017-06-121-0/+2
|
* executor: split setup_main_process into smaller functionsAndrey Konovalov2017-06-122-23/+23
|
* csource: add EnableTun optionAndrey Konovalov2017-06-122-31/+36
|
* executor: call flush_tun for repeat reprosAndrey Konovalov2017-06-121-7/+12
|
* executor: move inet checksum code under ifdefAndrey Konovalov2017-06-121-30/+32
|
* executor: limit stack frame sizeDmitry Vyukov2017-05-311-1/+3
| | | | | | | | | Stack usage warning currently breaks our internal build (with 16K frame limit). Executor uses stacks of limited size, that's another reason to not allow frames of arbitrary size. Limit stack frame size to 8K. Reduce tun packet size. We don't need to read out whole packet.
* all: cleanup executor/ipc status checkingMichael Pratt2017-05-301-1/+2
| | | | | | | | | | This is mostly a cleanup change with little functional change. In ipc.command.exec, remove the status fallback from the pipe to the exit status. Once the executor is serving, it always writes the status over the pipe; anything else is an error. Remove the panic check in syz-stress, which is no longer needed.
generated by ggit (джигит) mrf-deployment (git 2.46.0) at 2026-04-06 20:17:39 +0000