aboutsummaryrefslogtreecommitdiffstats
path: root/executor
Commit message (Collapse)AuthorAgeFilesLines
...
* executor: setup sysctl/cgroups in snapshot modeDmitry Vyukov2024-12-061-0/+8
| | | | We missed that step for snapshot mode.
* executor: add test_syzos() for arm64Alexander Potapenko2024-12-052-2/+21
| | | | | Make sure regressions in guest code validation are reported during testing rather than fuzzing.
* executor: arm: disable test_globAlexander Potapenko2024-12-051-0/+6
| | | | | | | | Glob() doesn't work on 32-bit ARM when run on a 64-bit system under QEMU: https://gitlab.com/qemu-project/qemu/-/issues/263 Not sure whether this is specific to tests running under qemu-user, or the ARM32 executor in the wild as well.
* executor: arm64: rewrite guest_handle_its_send_cmd() without a switchAlexander Potapenko2024-12-051-31/+33
| | | | | | Prevent the compiler from generating a jump table by replacing a switch with a series of if statements. This is ugly, but lets us work around crashes caused by https://github.com/google/syzkaller/issues/5565
* executor: arm64: declare 'noinline' for SyzOSAlexander Potapenko2024-12-051-32/+35
| | | | | | Apply __attribute__((noinline)) to SyzOS API command handlers to prevent overly optimizing them. While at it, rearrange specifiers in guest function declarations
* executor: arm64: detect data relocations in SyzOSAlexander Potapenko2024-12-051-1/+28
| | | | | | | Detect and report ADRP instructions in the linked binaries to avoid crashes inside SyzOS. See https://github.com/google/syzkaller/issues/5565 for more context.
* executor: remove a tempnam() call from test.hAleksandr Nogikh2024-12-021-2/+0
| | | | It's no longer needed.
* sys/linux: updated fuse fs specificationsSablin Viacheslav2024-11-291-0/+7
|
* sys/linux: move some ARM-specific descriptions to a separate fileAlexander Potapenko2024-11-261-18/+0
| | | | | | | | | | | | | | This is done to solve a particular test failure running: $ tools/syz-env go test ./prog -run TestSpecialStructs , which failed on PPC64, because prog/rand.go instanciated a call to syz_kvm_setup_syzos_vm(), which requested too much memory (1024 pages) from the allocator (PPC64 uses 64k pages, so the number of available pages is lower). On the other hand, factoring out syzos-related descriptions is probably a nice thing to do anyway.
* executor: arm64: sys/linux: allocate 1024 pages for guest address spaceAlexander Potapenko2024-11-262-21/+12
| | | | | | | Pass 1024 pages of memory to both syz_kvm_setup_syzos_vm() and syz_kvm_setup_cpu$arm64() to make sure that: - there is enough memory for guest allocations (e.g. ITS pages) - host can tamper with that memory, provoking more bugs
* executor: arm64: implement SYZOS_API_ITS_SEND_CMDAlexander Potapenko2024-11-261-0/+113
| | | | | In addition to the predefined ITS setup, let the guest execute different ITS configuration commands in an attempt to trigger interesting interactions.
* executor: arm64: implement SYZOS_API_ITS_SETUPAlexander Potapenko2024-11-262-4/+444
| | | | | The new API call implements basic setup of the ARM Interrupt Translation Service for the given number of CPUs, virtual devices, and LPIs.
* executor: arm64: handle interrupt IDs above 1023Alexander Potapenko2024-11-261-5/+11
| | | | | | There's no need to mask the IDs, and it actually doesn't work for LPIs. Also add more comments.
* executor: arm64: allocate memory for ITS tables on the host sideAlexander Potapenko2024-11-263-1/+9
|
* executor: arm64: use KVM_PAGE_SIZE instead of 0x1000Alexander Potapenko2024-11-261-1/+1
|
* executor: add Glob testDmitry Vyukov2024-11-263-1/+92
|
* executor: don't revert coverage orderDmitry Vyukov2024-11-261-1/+2
| | | | | | | Currently we write coverage backwards. This is visible e.g. when running syz-execprog -coverfile, and in the manager raw cover mode. Write it in the right order.
* executor: improve globDmitry Vyukov2024-11-261-1/+25
| | | | | | Don't follow symlinks when globbing. It's haarmful for both files and dirs (see the added comment for details).
* executor: increase coverage buffer sizeDmitry Vyukov2024-11-203-9/+15
| | | | | | | | | | | The coverage buffer frequently overflows. We cannot increase it radically b/c they consume lots of memory (num procs x num kcovs x buffer size) and lead to OOM kills (at least with 8 procs and 2GB KASAN VM). So increase it 2x and slightly reduce number of threads/kcov descriptors. However, in snapshot mode we can be more aggressive (only 1 proc). This reduces number of overflows by ~~2-4x depending on syscall.
* pkg/manager: show number of times coverage for each call has overflowedDmitry Vyukov2024-11-202-2/+15
| | | | | If the overflows happen often, it's bad. Add visibility into this.
* executor: use any executor if the avoid mask included all of themAndrei Vagin2024-11-181-1/+13
| | | | | | | | | | | | | | | | After 9fc8fe026baa ("executor: better handling for hanged test processes"), yz-executor's responses may reference procids outside of the [0;procs] range. If procids are no longer dense on the syz-executor side, we cannot rely on this check in pkg/rpcserver: ``` if avoid == (uint64(1)<<runner.procs)-1 { avoid = 0 } ``` Signed-off-by: Andrei Vagin <avagin@google.com>
* executor: better handling for hanged test processesDmitry Vyukov2024-10-243-16/+75
| | | | | | | | | | | | | | | Currently we kill hanged processes and consider the corresponding test finished. We don't kill/wait for the actual test subprocess (we don't know its pid to kill, and waiting will presumably hang). This has 2 problems: 1. If the hanged process causes "task hung" report, we can't reproduce it, since the test finished too long ago (manager thinks its finished and discards the request). 2. The test process still consumed per-pid resources. Explicitly detect and handle such cases: Manager keeps these hanged tests forever, and we assign a new proc id for future processes (don't reuse the hanged one).
* executor: check ppid after setting PR_SET_PDEATHSIG for sandbox processDmitry Vyukov2024-10-241-0/+4
| | | | This helps to avoid leaking processes when killing races with PR_SET_PDEATHSIG.
* executor: don't create new session for sandbox processDmitry Vyukov2024-10-241-1/+0
| | | | | | | | It's unclear why we need a new session. Sessions group process groups, but we don't use that. Setsid also creates a new process group, but we don't kill this process group, so also unclear why this is needed.
* executor: don't kill executor exec process groupDmitry Vyukov2024-10-241-1/+0
| | | | | | | | | Killing a process group (negative pid) only makes sense when the process is a group leader (called setsid/setpgrp/setpgid). Executor exec process is not a group leader, so don't try to kill its group. For our controlled executor subprocesses we rely on PR_SET_PDEATHSIG for reliable killing of all child subprocesses.
* executor: sys/linux: arm64: reserve address for ITS, add a seed for ITS creationAlexander Potapenko2024-10-211-1/+4
| | | | | | | Reserve SYZOS address for the ITS redistributor at 0x08080000, add it to the list of kvm_guest_addrs. Also implement a syzlang test for the host part of ITS configuration as per https://www.kernel.org/doc/html/v6.1/virt/kvm/devices/arm-vgic-its.html
* executor: fix mounting of debugfs/smackfs/fusectl/binfmt_miscDmitry Vyukov2024-09-271-9/+14
| | | | | | | | All these broke when we started mounting new tmpfs for sandbox=root. Some are not mounted at all, some are mounted in the outer root and are not accessible from the new root. Mount then inside of the new root tmpfs. Other file systems (binderfs, cgroups) seem to be ok.
* executor: arm64: rename SYZ_KVM_* to KVM_*Alexander Potapenko2024-09-251-16/+16
| | | | | It is more common for the constants in the executor to not have the SYZ_ prefix.
* executor: arm64: store CPU ID in TPIDR_EL1Alexander Potapenko2024-09-252-4/+20
| | | | | | | | | Let SYZOS distinguish CPUs inside VM by storing their ID in TPIDR_EL1. Make sure existing code uses that ID: - in guest_handle_msr(), to ensure concurrent calls do not write to the same cache line; - in gicv3_irq_enable(), to ensure proper CPU ID is being used for IRQ setup.
* executor: arm64: sys/linux: implement syz_kvm_setup_syzos_vm and ↵Alexander Potapenko2024-09-253-54/+135
| | | | | | | | | | | | | | | | | | | | | | | syz_kvm_add_vcpu The old syz_kvm_setup_cpu() API mixed together VM and VCPU setup, making it harder to create and fuzz two VCPUs in the same VM. Introduce two new pseudo-syscalls, syz_kvm_setup_syzos_vm() and syz_kvm_add_vcpu(), that will simplify this task. syz_kvm_setup_syzos_vm() takes a VM file descriptor, performs VM setup (allocates guest memory and installs SYZOS code into it) and returns a new kvm_syz_vm resource, which is in fact a pointer to `struct kvm_syz_vm` encapsulating VM-specific data in the C code. syz_kvm_add_vcpu() takes the VM ID denoted by kvm_syz_vm and creates a new VCPU within that VM with a proper CPU number. It then stores the fuzzer-supplied SYZOS API sequence into the corresponding part (indexed by CPU number) of the VM memory slot, and sets up the CPU registers to interpret that sequence. The new pseudo-syscall let the fuzzer create independent CPUs that run different code sequences without interfering with each other.
* executor: arm64: accept cpu id in guest_main()Alexander Potapenko2024-09-251-2/+2
| | | | | Use the cpu id to choose the SYZOS API commands to be executed by this particular CPU.
* executor: arm64: factor out install_user_code()Alexander Potapenko2024-09-251-22/+42
| | | | | | | | Prepare to let multiple (up to 4) CPUs run different pieces of code by allocating 4 pages for ARM64_ADDR_USER_CODE. Pass the CPU id to guest_main(), so that it can pick the correct starting addres. syz_kvm_setup_cpu() will implicitly use cpuid=0 to retain its current functionality.
* executor: arm64: factor out setup_vm()Alexander Potapenko2024-09-251-34/+41
| | | | | | | | | No functional change. For multiple CPUs within the same VM, calls to syz_kvm_setup_cpu() will set up the VM memory space multiple times, so only the last one will take effect. Prepare to decouple VM setup from CPU setup by factoring this code out of syz_kvm_setup_cpu().
* sys/linux: add syz_create_resourceDmitry Vyukov2024-09-191-0/+13
| | | | | | | | syz_create_resource allows to turn any value into a resource. Improve binfmt descriptions using syz_create_resource: we need to pass the same file name to write syscalls and execve. Use syz_create_resource to improve binfmt descriptions.
* executor: fix mounting of binfmt_miscDmitry Vyukov2024-09-191-1/+2
|
* executor: arm64: reserve a dedicated dirty page regionAlexander Potapenko2024-09-112-3/+12
| | | | | To ease fuzzing the dirty ring, explicitly reserve two pages with the KVM_MEM_LOG_DIRTY_PAGES flag at known address.
* executor: sys/linux: arm64: implement SYZOS_API_MEMWRITEAlexander Potapenko2024-09-061-0/+43
| | | | | | | | The new API call will be used to write values to guest memory specified by base+offset. Writing to e.g. MMIO registers for VGIC (or any other MMIO ranges) may result in new coverage.
* executor: arm64: sys/linux: add SYZOS_API_IRQ_SETUPAlexander Potapenko2024-09-031-0/+459
| | | | | | | | Implement basic IRQ controller setup for VMs with a single CPU. SYZOS_API_IRQ_SETUP sets up the VGICv3 distributor/redistributor and enables the specified number of SPIs starting from 32. The default IRQ handler is set up to perform a uexit(-2).
* executor: pkg/vminfo: sys/linux: define syz_kvm_vgic_v3_setupAlexander Potapenko2024-09-033-3/+90
| | | | | The new pseudo-syscall sets up VGICv3 IRQ controller on the host. That still requires guest setup code, which will be submitted separately.
* executor: retry pselect() when interruptedCameron Finucane2024-08-301-1/+4
| | | | | | Occasionally a SIGCHLD would cause EINTR to be returned by pselect(), and then the runner would become hung by attempting to read a socket that was not in fact ready.
* executor: fix corner case of misinterpreting comparison dataDmitry Vyukov2024-08-281-0/+12
| | | | | Reset coverage right before scheduling next syscall for execution. See the added comment for details.
* executor: protect kcov/output regions with pkeysDmitry Vyukov2024-08-164-10/+84
| | | | | | | Protect KCOV regions with pkeys if they are available. Protect output region with pkeys in snapshot mode. Snapshot mode is especially sensitive to output buffer corruption since its location is not randomized.
* executor: keep SYZFAIL messages during machine checkDmitry Vyukov2024-08-161-3/+6
| | | | | Replace just the SYZFAIL part instead of the whole message. This makes debugging of things easier.
* executor: simplify mapping of kcov guard pagesDmitry Vyukov2024-08-141-9/+1
|
* executor: set process name before taking snapshotDmitry Vyukov2024-08-131-7/+6
| | | | | It's not necessary to set process name in snapshot mode since we execute only 1 program each time.
* executor: arm64: add SYZOS_API_HVCAlexander Potapenko2024-08-071-8/+36
| | | | | Make the necessary changes to support HVC in addition to SMC. These two may subtly differ, so they are handled separately.
* executor: arm64: add SYZOS_API_SMCAlexander Potapenko2024-08-071-0/+36
| | | | | | | | Provide an API call to invoke the ARM64 Secure Monitor Call instruction with user-supplied function id and 5 parameters passed in registers x1-x5. For now only `smc #0` is invoked, although in the future we may want to pass other (reserved) immediate values to SMC.
* executor: fix coverage collection in snapshot modeDmitry Vyukov2024-08-061-3/+5
| | | | Fixes #5143
* executor: arm64: add SYZOS_API_MSRAlexander Potapenko2024-08-053-0/+46
| | | | | | | | | | | | | MSR is an ARM64 instruction that writes a value from a GP register to one of the system CPU registers. Exposing those registers to a fuzzer will let us trigger unexpected behavior in handling them on the kernel side. The SYZOS_API_MSR call has two int64 arguments, register ID and value. Register IDs are 64-bit values obtained from ARM64_SYS_REG() in the Linux asm/kvm.h UAPI header. Same register IDs are used by ioctl$KVM_GET_ONE_REG and ioctl$KVM_SET_ONE_REG. Also add sys/linux/test/syz_kvm_setup_cpu_arm64-msr
* executor: arm64: kvm: exit from guest_main() using guest_uexit()Alexander Potapenko2024-08-051-0/+1
| | | | | Call guest_uexit(-1) to break from ioctl(KVM_RUN), otherwise the VM will be running infinitely until it is killed.
generated by ggit (джигит) mrf-deployment (git 2.46.0) at 2026-03-12 00:29:42 +0000