aboutsummaryrefslogtreecommitdiffstats
path: root/executor
Commit message (Collapse)AuthorAgeFilesLines
...
* executor: add missing static declarations in common_kvm_arm64_syzos.hAlexander Potapenko2024-08-051-4/+4
|
* pkg/rpcserver: use dense VM indices instead of string namesDmitry Vyukov2024-08-021-8/+11
| | | | | | Using actual VM indices for VM identification allows to match these indices to VMs in the pool, allows to use dense arrays to store information about runners (e.g. in queue.Distributor), and just removes string names as unnecessary additional entities.
* executor: restart procs more deterministicallyDmitry Vyukov2024-08-021-9/+41
| | | | | | | | | | | | | | | | | | | | Currently we force restart in rpcserver, but this has 2 problems: 1. It does not know the proc where the requets will land. 2. It does not take into account if the proc has already restarted recently for other reasons. Restart procs in executor only if they haven't restarted recenlty. Also make it deterministic. Given all other randomess we have, there does not seem to be a reason to use randomized restarts and restart after fewer/more runs. Also restart only after corpus triage. Corpus triage is slow already and there does not seem to be enough benefit to restart during corpus triage. Also restart at most 1 proc at a time, since there are lots of serial work in the kernel.
* pkg/fuzzer: try to triage on different VMsDmitry Vyukov2024-08-022-1/+3
| | | | Distribute triage requests to different VMs.
* executor: handle EINTR in connectGreg Steuck2024-07-301-1/+23
| | | | ConnectWait is directly from OpenBSD man page.
* executor: arm64: sys/linux: introduce syzos APIAlexander Potapenko2024-07-293-12/+76
| | | | | | | | | | | | | | | | | | | | | | Allow guest payload to call syzos API functions. The available calls are enumerated by SYZOS_API_* constants, and have a form of: struct api_call { uint64 call; uint64 struct_size; /* arbitrary call-related data here */ }; Complex instruction sequences are too easy to break, so most of the time fuzzer won't be able to efficiently mutate them. We replace kvm_text_arm64 with a sequence of `struct api_call`, making it possible to intermix assembly instructions (SYZOS_API_CODE) with higher-level constructs. Right now the supported calls are: - SYZOS_API_UEXIT - abort from KVM_RUN (1 argument: exit code, uint64) - SYZOS_API_CODE - execute an ARM64 assembly blob (1 argument: inline array of int32's)
* executor: more precise detection of exit/_exit in the linterAlexander Potapenko2024-07-291-1/+1
| | | | Do not report errors when a function name contains '[_]exit' as a substring.
* executor: arm64: add syzos headerAlexander Potapenko2024-07-293-1/+29
| | | | | | | | | | For KVM fuzzing we are going to need some library code that will be running inside KVM to perform common tasks (e.g. register accesses, device setup etc.) This code will reside in a special ".guest" section that the executor will map at address 0xeeee8000. For now it contains just the main function, but will be extended in further patches.
* executor: arm64: more flexible physical page allocationAlexander Potapenko2024-07-292-14/+78
| | | | | | | Refactor phys page allocation in syz_kvm_setup_cpu$arm64 to prepare for more address ranges. Load user-supplied code at ARM64_ADDR_USER_CODE and allocate EL1 stack at ARM64_ADDR_EL1_STACK_BOTTOM.
* all: add qemu snapshotting modeDmitry Vyukov2024-07-255-37/+341
|
* executor: increase kExtraCoverSize to 1024kAndrey Konovalov2024-07-231-1/+1
| | | | | | | | | | | | | | | Running the vusb_ath9k runtest (with [1] and [2] applied) produces ~100k of extra coverage, which is somewhat close to the current 256k limit. A more complicated program might produce more extra coverage and overflow the coverage buffer. Increase kExtraCoverSize to 1024k. As the extra coverage buffer is maintained per-executor and not per-thread, the total increase of the coverage mapping is ~9%, which is not too bad. [1] https://lore.kernel.org/all/eaf54b8634970b73552dcd38bf9be6ef55238c10.1718092070.git.dvyukov@google.com/ [2] https://lore.kernel.org/all/20240722223726.194658-1-andrey.konovalov@linux.dev/T/#u
* executor: fix writing of remote coverageDmitry Vyukov2024-07-223-3/+26
| | | | | | | | We never reset remote coverage, so if there is one block, we will write it after every call and multiple times at the end. It can lead to "too many calls in output" and just writes quadratic amount of coverage/signal. Reset remote coverage after writing.
* executor: refactor argument parsingDmitry Vyukov2024-07-221-4/+8
| | | | Check that we have at least command argument in the beginning.
* prog: restricts hints to at most 10 attempts per single kernel PCDmitry Vyukov2024-07-221-16/+10
| | | | | | | | | We are getting too many generated candidates, the fuzzer may not keep up with them at all (hints jobs keep growing infinitely). If a hint indeed came from the input w/o transformation, then we should guess it on the first attempt (or at least after few attempts). If it did not come from the input, or came with a non-trivial transformation, then any number of attempts won't help. So limit the total number of attempts (until the next restart).
* executor: deduplicate signal per-callAleksandr Nogikh2024-07-181-13/+15
| | | | | | | | | | | This kind of deduplication is confusing for the fuzzer, which expects to control the process itself (by MaxSignal and by specifying the calls for which full signal must be returned). There's also a chance that it may contribute to the difficulties during program triage and minimization. Let's err on the safe side and deduplicate signal only per-call.
* executor: fix localhost handling for machines with only ipv6Konstantin Bogomolov2024-07-181-7/+15
| | | | | In case only ipv6 is supported, we should try ipv4-localhost first and see if it fails, and then go on to trying ipv6.
* executor: manually replace localhost with equivalent ipv4/6 addressKonstantin Bogomolov2024-07-171-0/+5
| | | | | | | It should fix errors like this one: SYZFAIL: failed to resolve manager addr addr=localhost h_errno=2 (errno 11: Resource temporarily unavailable
* executor: avoid setsid() errorsMark Johnston2024-07-171-1/+1
| | | | | See commit bc144f9a58782daa2399d417b56aad80e82a219e. The justification applies to other BSDs as well, so apply the same workaround.
* executor: print signal info for SIGILL/SIGFPE as wellDmitry Vyukov2024-07-171-9/+24
| | | | | There are also synchnous fatal signals that can happen due to bugs in executor code. So handle them as SIGSEGV.
* executor: fix setup of cad_pidDmitry Vyukov2024-07-161-5/+20
| | | | | | | cad_pid must not point to a persistent runner process, b/c it will be killed on ctrl+alt+del. Fixes #5027
* executor: factor output finishing into separate functionDmitry Vyukov2024-07-112-37/+46
| | | | | This will allow to reuse finish_output function for snapshot mode as well. NFC
* executor: retry read in case of known restartable errorsGreg Steuck2024-07-101-1/+5
|
* executor: only report unknown setsid errorsGreg Steuck2024-07-091-1/+1
| | | | | | | | | | | | | | Unlike linux the BSDs used to check the result of setsid. This suddenly became a problem a couple of weeks ago. It's hard to figure out why because there was a number of problems in the area preventing the test from working: gmake executor execprog && \ ./bin/openbsd_amd64/syz-execprog -stress -executor ./bin/openbsd_amd64/syz-executor At least with this change the test above successfully executes some coverage and exits cleanly.
* executor: fix diagnostic message typoGreg Steuck2024-07-091-1/+1
|
* executor: handle EINTR when reading from control pipeDmitry Vyukov2024-07-081-3/+3
| | | | | | | Handle EINTR errors. Sometimes I see them happenning when running in debug mode. Before the previous commit, each such error was printed to output and detected as a bug. Without debug these should be retried by restarting the process, but still better to handle w/o restarting the process (may be expensive).
* executor: repair debug modeDmitry Vyukov2024-07-081-1/+8
| | | | | Don't print SYZFAIL messages during machine check. Otherwise each of them is detected as a bug.
* executor: set `source` for the proc mountAndrei Vagin2024-07-031-1/+1
| | | | | | | | | | mount() in gVisor returns EFAULT if source is NULL. It is a gVisor issue and we will fix it. Let's explicitly sets a string source for the proc mount to unblock gVisor jobs. The source string will additionally be useful for troubleshooting mount-related problems in the future, because it is shown in /prod/pid/mountinfo. Signed-off-by: Andrei Vagin <avagin@google.com>
* executor: linux: bump fs.mount-max to 100000Alexander Potapenko2024-07-031-0/+3
| | | | | | | Android sets fs.mount-max to 100, making it impossible to create new chroots. Relax the limit, setting it to a value used on desktops. Tracking bug: https://github.com/google/syzkaller/issues/4972
* pkg/fuzzer: remove signal rotationDmitry Vyukov2024-07-023-16/+1
| | | | | | | Signal rotation is intended to make the fuzzer re-discover flaky coverage in non flaky way. However, taking into accout that we get effectively the same effect after each manager restart, and that the fuzzer is overloaded with triage/smash jobs, it does not look to be worth it.
* executor: linux: chroot into tmpfs with sandbox=noneAlexander Potapenko2024-07-021-50/+63
| | | | | | | | | | | To prevent the executor from accidentally making the whole root file system immutable (which breaks fuzzing), modify sandbox=none to create a tmpfs mount and chroot into it before executing programs in a process. According to `syz-manager -mode=smoke-test`, the number of enabled syscalls on x86 doesn't change with this patch. Fixes #4939, #2933, #971.
* pkg/mgrconfig: allow to disable remote coverage and coverage edgesDmitry Vyukov2024-07-021-7/+9
|
* pkg/rpcserver: move kernel test/data range checks from executorDmitry Vyukov2024-07-018-219/+80
| | | | | | | | | | | | | | | | | We see some errors of the form: SYZFAIL: coverage filter is full pc=0x80007000c0008 regions=[0xffffffffbfffffff 0x243fffffff 0x143fffffff 0xc3fffffff] alloc=156 Executor shouldn't send non kernel addresses in signal, but somehow it does. It can happen if the VM memory is corrupted, or if the test program does something very nasty (e.g. discovers the output region and writes to it). It's not possible to reliably filter signal in the tested VM. Move all of the filtering logic to the host. Fixes #4942
* pkg/report: suppress executor SIGBUSDmitry Vyukov2024-07-011-2/+3
| | | | | | SIGBUS means OOM on Linux. Most of the crashes that happen during fuzzing are SIGBUS, so separate them from SIGSEGV and suppress.
* executor: fix endianess of size of received flatbuffers root tableAlexander Egorenkov2024-07-011-0/+2
| | | | | | | | | | Flatbuffers represents each scalar in little-endian format (https://flatbuffers.dev/flatbuffers_internals.html). Therefore, the size of the received root table must be converted to the host endianness format before its first usage. Signed-off-by: Alexander Egorenkov <eaibmz@gmail.com> Fixes: e16e2c9a4cb6 ("executor: add runner mode")
* pkg/flatrpc: rename StartLeakChecks to CorpusTriagedDmitry Vyukov2024-07-011-3/+3
| | | | | | It's a more general name that says what happened rather than a detail of what excutor should do. We can use this notification for other things as well.
* executor: always return some coverage for test OSDmitry Vyukov2024-06-281-5/+10
| | | | This allows to enable test executor with coverage.
* executor: don't trace PCs as comparisonsDmitry Vyukov2024-06-282-1/+4
| | | | | | Currnetly we always write PCs into the buffer even if tracing comparisons. Such bogus data will fail comparison consistentcy checks (type/pc) and executor will crash. Don't trace PCs as comparisons.
* executor: fix max signal/cover filter mapping into subprocessesDmitry Vyukov2024-06-282-1/+15
| | | | | | | | | | | There is a quirk related to posix_spawn_file_actions_adddup2: it just executes the specified dup's in order in the child process. In our case we do dups as follows: 20 -> 4 (output region) 4 -> 5 (max signal) So we dup the output region onto 4 first, and then dup the same output region (fd 4 becomes the output region) onto 5 (max signal). So we have output region as both output region and max signal.
* pkg/runtest: test feature detectionDmitry Vyukov2024-06-272-0/+46
| | | | | Fail some features in various ways for test OS, and check that features are detected properly.
* executor: handle features that fail in non-fatal wayDmitry Vyukov2024-06-271-1/+1
| | | | | | | Coverage setup fails with exitf if not supported. Currently we consider it as transient error that needs to be retried. As the result we reach 20 attempts and crash the VM. Return an error in such case instead.
* executor: disable lsan for exec subprocessesDmitry Vyukov2024-06-261-2/+4
| | | | | Somehow it's very slow in syzbot arm64 image. This speeds up pkg/runtest tests a hundred of times.
* executor: set PR_SET_PDEATHSIG for TestOSAleksandr Nogikh2024-06-261-0/+11
| | | | | | | Otherwise we may leave orphaned executor process children, which prevent the cleanup of the executor directory. Closes #4920.
* executor: include missing headerDmitry Vyukov2024-06-261-0/+1
| | | | | | | FreeBSD says: executor/conn.h:100:3: error: unknown type name 'sockaddr_in'; did you mean 'sockaddr'? sockaddr_in saddr4 = {};
* executor: use mcontext_t only on linuxDmitry Vyukov2024-06-261-2/+2
| | | | | | | | OpenBSD says: executor/executor_runner.h:750:51: error: no member named 'uc_mcontext' in 'sigcontext' auto& mctx = static_cast<ucontext_t*>(ucontext)->uc_mcontext; ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ^
* executor: check whether the address is stdin before validation a portAndrei Vagin2024-06-251-2/+2
| | | | Otherwise, it fails with "SYZFAIL: failed to parse manager port".
* executor: use ftruncate instead of fallocateDmitry Vyukov2024-06-251-2/+3
| | | | OpenBSD has neither fallocate nor posix_fallocate.
* executor: prohibit malloc/calloc via linterDmitry Vyukov2024-06-254-16/+39
| | | | | | We include a number of C++ headers in the runnner. On FreeBSD some of them mention malloc, and our defines break the build. Use the style test to check only our files for these things.
* executor: swap addr/pc in SigsegvHandlerDmitry Vyukov2024-06-251-1/+1
|
* Revert "syz-manager: support stdin as port forwarding result"Dmitry Vyukov2024-06-251-15/+3
| | | | | | | | | | | | This reverts commit 215eef4ad85fb6124af70d1e5c9729b69554a32b. The gvisor "stdin" address still crashes in executor Connection::Connect on atoi(ports) with ports == NULL. The gvisor "stdin" address is not tested, so it's better to make it less special rather than add more special cases in manager, executor, and now also in Connection to handle it. It still may crash in future after some changes.
* executor/linux: fix compilation error with old compilersPavel Skripkin2024-06-251-1/+8
| | | | | | | | | | | | | | | | | | | | My gcc-10 in testing vm compainls during reproducer [0] build with following error: rep.c: In function ‘remove_dir’: rep.c:662:3: error: a label can only be part of a statement and a declaration is not a statement 662 | const int umount_flags = MNT_FORCE | UMOUNT_NOFOLLOW; | ^~~~~ Label followed by declaration is C23 extension, so only new compilers support it. Fix it by moving declaration above `retry` label and put unused attribute to suppress possible warning. [0] https://syzkaller.appspot.com/bug?extid=dcc068159182a4c31ca3 Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
generated by ggit (джигит) mrf-deployment (git 2.46.0) at 2026-03-12 04:10:01 +0000