aboutsummaryrefslogtreecommitdiffstats
path: root/executor
Commit message (Collapse)AuthorAgeFilesLines
...
* executor: remove unneeded NONFAILINGDmitry Vyukov2017-12-171-1/+1
| | | | copyin is already NONFAILING.
* pkg/ipc: make threaded/collide per-program optionsDmitry Vyukov2017-12-171-10/+10
| | | | | | | Currently threaded/collide are global environment flags. It can be useful to turn off collider during some executions (minimization, triage, etc). Make them per-program options.
* prog: don't serialize output data argsDmitry Vyukov2017-12-171-6/+8
| | | | | | | | Fixes #188 We now will write just ""/1000 to denote a 1000-byte output buffer. Also we now don't store 1000-byte buffer in memory just to denote size. Old format is still parsed.
* prog: introduce more readable format for data argsDmitry Vyukov2017-12-171-4/+6
| | | | | | | | | | | | | | | | | | | | | Fixes #460 File names, crypto algorithm names, etc in programs are completely unreadable: bind$alg(r0, &(0x7f0000408000)={0x26, "6861736800000000000000000000", 0x0, 0x0, "6d6435000000000000000000000000000000000000000000000000 000000000000000000000000000000000000000000000000000000000000000 00000000000"}, 0x58) Introduce another format for printable strings. New args are denoted by '' ("" for old args). New format is enabled for printable chars, \x00 and \t, \r, \n. Example: `serialize(&(0x7f0000408000)={"6861736800000000000000000000", "4849000000"})`, vs: `serialize(&(0x7f0000408000)={'hash\x00', 'HI\x00'})`,
* prog: fix TestMutateTableDmitry Vyukov2017-12-171-4/+18
| | | | | | Now works fast enough even for short mode. Fixes #208
* sys: move test syscalls to a separate targetDmitry Vyukov2017-12-173-353/+167
| | | | | | We have them in linux solely for historical reasons. Fixes #462
* executor: fix macros in common.hAndrey Konovalov2017-12-141-3/+4
|
* sys/linux: describe PF_KEYDmitry Vyukov2017-12-111-10/+25
|
* prog: fix hints of data argsDmitry Vyukov2017-12-081-10/+15
| | | | | | | | | | | | Hints for data args don't work. We do all the work, but at the final stage we patch arg in the _old_ program, not in the _new_ one. So programs passed to the callback are all the same and don't contain any mutations. Tests did not catch this because they work right before that point (don't test the actual interface function MutateWithHints). Fix that and add a test that catches this.
* sys/linux: add a simple description for selinuxDmitry Vyukov2017-12-081-10/+95
|
* executor: fix buildDmitry Vyukov2017-12-062-6/+6
| | | | | | exitf function was not defined with some combinations of options in csource. Fix defines and switch exitf back to fail, fail already checks ENOMEM/EAGAIN, so there is no reason to use exitf in this particular case.
* executor: unshare PID namespace even for sandbox=noneDmitry Vyukov2017-12-051-5/+26
| | | | | | | | Unshare as much as we can for all sandboxing modes. This fixes "kernel panic: Attempted to kill init!" crashes under sandbox=none. And should just generally improve reproducibility, e.g. if we unshare SYSVSEM fuzzer won't collide with any existing semaphores.
* executor: treat fail-nth errors as non-fatalDmitry Vyukov2017-12-051-4/+7
| | | | | We see occasional ENOENT/EACCES errors returned. It seems that fuzzer somehow gets its hands to it.
* prog: support bytesizeN for vmaDmitry Vyukov2017-11-291-5/+5
| | | | | | I guess this is currently unused, but ignoring bytesizeN for vma looks wrong. If user asks for bytesizeN for vma, divide vma size by N.
* prog: repair arrays/buffers with incorrect size in DeserializeDmitry Vyukov2017-11-281-10/+20
| | | | | | | | | | | | | For string[N] we successfully deserialize a string of any length. Similarly for a fixed-size array[T, N] we successfully deserialize an array of any size. Such programs later crash in foreachSubargOffset because static size Type.Size() does not match what we've calculated iterating over fields. The crash happens only in SerializeForExec in syz-fuzzer, which is especially bad. Fix this from both sides: 1. Validate sizes of arrays/buffers in Validate. 2. Repair incorrect sizes in Deserialize.
* pkg/compiler: add check that len does not refer to array with varlen elementsDmitry Vyukov2017-11-283-7/+7
| | | | | This [almost] always means a bug in descriptions. Fix all bugs identified by the check.
* sys/linux: add binder descriptionsDmitry Vyukov2017-11-271-15/+45
|
* sys/linux: assorted improvements to descriptionsDmitry Vyukov2017-11-271-10/+45
|
* sys/linux: add files from net dir to list of /proc filesDmitry Vyukov2017-11-271-5/+5
|
* sys/linux: fix control len in msghdr'sDmitry Vyukov2017-11-271-5/+5
| | | | Contol len is in bytes, not array elements.
* sys/linux: improve hash generation for KEYCTL_DH_COMPUTEDmitry Vyukov2017-11-271-5/+5
| | | | | | | KEYCTL_DH_COMPUTE used the old fixed list of algorithm names. Use the new code for algorithm generation. + it needs only SHASH algs, but we passed in all alg names. Pass only SHASH algs.
* sys/linux: open files from /procDmitry Vyukov2017-11-272-341/+373
|
* sys/linux: improve fuse descriptionsDmitry Vyukov2017-11-271-65/+15
|
* executor: use /proc/thread-self/fail-nth instead of /proc/self/task/%d/fail-nthDmitry Vyukov2017-11-271-7/+6
| | | | Makes code slightly simpler.
* sys/linux: improve AF_ALG alg name generationDmitry Vyukov2017-11-241-5/+5
| | | | | | | | | There is effectively infinite number of possible crypto algorithm names due to templates. Plus there is tricky relation between algorithms and algorithm type names. This change adds custom mutator for sockaddr_alg struct to improve variance in generated algorithms.
* sys/syz-extract: fix mmap on armDmitry Vyukov2017-11-232-14/+5
| | | | | | | __NR_mmap is missing on arm entirely, so we disable mmap during generate. Patch mmap to mmap2 right in syz-extract, so that mmap is never missing.
* executor: fixup previous commitDmitry Vyukov2017-11-221-223/+223
|
* executor: move arm syscall fixup to syz-extractDmitry Vyukov2017-11-222-1643/+1616
|
* executor: Modified executor_linux.cc to support ARM32 architectureAtul Prakash2017-11-221-2/+25
| | | | | | executor: changed kOutputDataAddr so that it works on 32-bit kernels executor: simplified ifdefs for arm in executor_linux.cc executor: removed empty lines that were accidentally added.
* sys/linux: remove get_kernel_syms, add quotactl syscallDmitry Vyukov2017-11-201-10/+12
| | | | | | get_kernel_syms does not seem to be present upstream. Describe an old quotactl syscall. Also fix umount/umount2 names in kallsyms.
* executor: proceed even if /dev/net/tun is not availableAndrey Konovalov2017-11-081-2/+12
| | | | | | | | | For some racy bugs syzkaller can generate a C reproducer with tun enabled, when it's not actuallly required to trigger the bug. Some kernel developers (that don't have CONFIG_TUN=y on their setups) complain about such C repros. When tun is not available, instead of exiting, print a message that tun initialization failed and proceed.
* sys/freebsd: add POLLINIGNEOFTobias Klauser2017-11-081-1/+1
|
* sys/linux: add definition for LOOP_SET_BLOCK_SIZEEric Biggers2017-11-071-10/+15
| | | | The v4.14 kernel will support a new loop ioctl, LOOP_SET_BLOCK_SIZE.
* sys/linux: fix wrong ioctl numbers in loop device definitionsEric Biggers2017-11-071-5/+5
| | | | | | | Fix a couple apparent copy-and-paste errors: - ioctl$LOOP_CHANGE_FD should use LOOP_CHANGE_FD - ioctl$LOOP_CTL_REMOVE should use LOOP_CTL_REMOVE
* sys/linux: add definition for keyctl_restrict_keyring()Eric Biggers2017-11-031-10/+15
| | | | | Add a definition for keyctl_restrict_keyring(), which was added in the v4.12 kernel.
* sys/linux: add definition for keyctl_dh_compute()Eric Biggers2017-11-031-10/+15
| | | | | | Add a definition for keyctl_dh_compute(), which was added in the v4.7 kernel, then in the v4.12 kernel extended to take in an optional 'keyctl_kdf_params' argument. (Requires CONFIG_KEY_DH_OPERATIONS=y.)
* sys/linux: use resource subtypes for "user" and "keyring" keysEric Biggers2017-11-031-10/+20
| | | | | | | | | | | Many functions in the keys API take in an ID parameter that is expected to refer to a keyring, not to any key. Therefore, define a resource subtype 'keyring' which can be created by add_key("keyring", ...) or by using one of the special keyring IDs. Also define a resource subtype 'user_key', since we'll be adding a definition for KEYCTL_DH_COMPUTE which takes in a struct containing "user" key IDs.
* sys/linux: define all the key typesEric Biggers2017-11-031-5/+5
| | | | | | | Add to key.txt all key types that currently might be present in the kernel. It was missing a few important ones such as "asymmetric", which has a significant attack surface since the payloads are run through an ASN.1 decoder.
* Changing the types of members of struct statUtkarsh Anand2017-10-301-1/+1
| | | | As defined in the header files.
* Added a few more syscall descriptions, constsUtkarsh Anand2017-10-301-2/+139
| | | | and other related files.
* Add two new syscalls `shmctl` and `msgctl`Utkarsh Anand2017-10-301-2/+10
|
* Fix the SYS_SEMCTL value issue for NetBSDUtkarsh Anand2017-10-301-11/+11
|
* sys/netbsd: fix mmap signatureDmitry Vyukov2017-10-251-1/+1
| | | | mmap syscall has 7 arguments (one unused padding)
* executor: small fixes for netbsdDmitry Vyukov2017-10-251-1/+5
| | | | | | | | | | RLIMIT_AS auses frequent random aborts on netbsd. Reason unknown. Disable it for now. Documentation says that __syscall should be used for syscalls with 64-bit arguments. On amd64 most syscalls have 64-bit arguments (incl mmap), so switch to it.
* executor: fix netbsd syscallsDmitry Vyukov2017-10-252-1/+9
| | | | | | executor_netbsd.cc was including syscalls_freebsd.h, which completely messed up syscall numbers and names. Include the right syscalls header.
* Lots of changes to sys/netbsd (#397)Utkarsh Anand2017-10-251-0/+54
| | | | | | | | | | | | | | | | * Lots of changes to sys/netbsd: - Removed a few syscalls that did not have proper constants defined. - Autogenerated *.const files. - Removed a few types like uid and gid, that were not available. - Ran make generate * Few changes for NetBSD support: - Added sys/netbsd/init.go - Added netbsd to sys/sys.go * Fix order in sys/sys.go * Update documentation for NetBSD
* executor: fix mkdtemp return value checkDmitry Vyukov2017-10-251-1/+1
| | | | mkdtemp return NULL on failure.
* all: basic building on netbsdDmitry Vyukov2017-10-233-173/+176
| | | | | This just makes make TARGETOS=netbsd succeed. We don't yet have prog target for netbsd.
* executor: prevent executor from messing with output regionDmitry Vyukov2017-10-236-19/+78
| | | | | | | | When comparisons are enabled fuzzer somehow manages to discover the output region and corrupt it. It seems to fetch the address from some memory operations (mmap/munmap). Don't leak the output region address.
* executor: fix build breakages due to doexitDmitry Vyukov2017-10-196-9/+46
| | | | | Some standard libraries contain "using ::exit;", which breaks with the current redefinition of exit.
generated by ggit (джигит) mrf-deployment (git 2.46.0) at 2026-03-14 18:16:59 +0000