aboutsummaryrefslogtreecommitdiffstats
path: root/executor
Commit message (Collapse)AuthorAgeFilesLines
...
* syz-manager: support stdin as port forwarding resultAleksandr Nogikh2024-06-241-3/+15
| | | | It is returned from vm/gvisor.
* executor: add runner modeDmitry Vyukov2024-06-2411-395/+1617
| | | | | | | Move all syz-fuzzer logic into syz-executor and remove syz-fuzzer. Also restore syz-runtest functionality in the manager. Update #4917 (sets most signal handlers to SIG_IGN)
* executor: refactor coverage filterDmitry Vyukov2024-06-245-98/+315
|
* executor: fix is_kernel_data/pc for gVisorDmitry Vyukov2024-06-211-0/+4
| | | | The address ranges in is_kernel_data/pc are only true for normal Linux.
* executor: handle errors from netlink_query_family_idCameron Finucane2024-06-171-0/+17
| | | | | There were some cases where the return value was not checked, allowing errors to propagate. This fixes them to return early with a message.
* executor: fix compiler warnings in 32-bit modeAlexander Egorenkov2024-06-131-2/+2
| | | | | | | | | | | | executor/executor.cc: In function ‘uint64 read_input(uint8**, bool)’: executor/executor.cc:1487:59: error: format ‘%zu’ expects argument of type ‘size_t’, but argument 3 has type ‘int’ [-Werror=format=] executor/executor.cc:1495:67: error: format ‘%zu’ expects argument of type ‘size_t’, but argument 3 has type ‘int’ [-Werror=format=] Signed-off-by: Alexander Egorenkov <eaibmz@gmail.com>
* executor: fix extraction of number of KCOV comparisons from coverage dataAlexander Egorenkov2024-06-121-3/+3
| | | | | | | | | | | KCOV stores the number of KCOV comparisons in a coverage buffer always as a 64-bit integer at offset 0 of the coverage buffer. Don't use the field size of the coverage object which is initialized in cover_collect() and size of which depends on kernel bitness because this field is intended only for KCOV PC coverage and not for KCOV comparisons. Signed-off-by: Alexander Egorenkov <eaibmz@gmail.com>
* docs: remove mentions of strconstDmitry Vyukov2024-06-111-1/+1
| | | | strconst["foo"] was replaced by ptr[in, string["foo"]].
* executor: ignore kernel text addresses in comparisonsDmitry Vyukov2024-06-111-2/+2
| | | | | | We ignore comparisons of kernel data/physical addresses b/c these are not coming from user space. Ignore kernel text addresses for the same reason.
* executor: factor out is_kernel_pc helperDmitry Vyukov2024-06-116-32/+62
| | | | Factor out is_kernel_pc helper and add kernel pc range for test OS for testing.
* executor: add end-to-end coverage/signal/comparisons testDmitry Vyukov2024-06-117-15/+67
|
* executor: map input buffer as sharedCameron Finucane2024-06-111-1/+1
| | | | | | | To receive data, executor relies on changes propagating to its copy of the shared memory buffer. This is only guaranteed with MAP_SHARED, whereas behavior is "unspecified" for MAP_PRIVATE (but happened to work on most implementations).
* executor: optimize waiting for child processes exitDmitry Vyukov2024-06-103-1/+11
| | | | | | | Currently we sleep only for 1 ms, which may produce some excessive CPU load (we usually have 6/8 such processes waiting). Make it sleep for 10 ms, but also make the sleep return immediately on child exit. This shuold both improve latency and reduce CPU load.
* executor: use close_range if availableDmitry Vyukov2024-06-101-0/+5
| | | | Close_range is faster.
* executor: don't call close_fds twiceDmitry Vyukov2024-06-101-1/+2
|
* executor: allow to run a single testDmitry Vyukov2024-06-052-3/+5
|
* executor: remove noshmem modeDmitry Vyukov2024-06-047-92/+4
| | | | | | | | | All OSes we have now support shmem. Support for Fuchia/Starnix/Windows wasn't implemented, but generally they support shared memory. Remove all of the complexity and code associated with noshmem mode. If/when we revive these OSes, it's easier to properly implement shmem mode for them.
* executor: repair asan buildDmitry Vyukov2024-06-041-12/+29
| | | | | | | | | Asan build with sharem memory mode is broken for a long time since the address for output region is incompatible with asan (asan doesn't have shadow for these addresses). We did not notice it b/c we only tested no shared memory mode in short test mode used on CI. Don't use fixed mmap address under asan.
* executor: fix gvisor signalDmitry Vyukov2024-06-032-5/+7
| | | | | | | | | Fix 2 bugs: 1. We remove low 12 bits of every PC on amd64 b/c use_cover_edges return true. This results in extremly low signal (gvisor PC are dense integers). 2. We hash prev/next PC on arm64 which does not make sense since gvisor coverage is not a trace. This results in falsely large signal.
* executor: rework feature setupDmitry Vyukov2024-06-035-115/+167
| | | | | | | | | | | | | Return failure reason from setup functions rather than crash. This will provide better error messages, but also allow setup w/o creating subprocesses which will be needed when we combine fuzzer and executor. Also close all resources created during setup. This is also useful for in-process setup, but also should improve chances of reproducing a bug with C reproducer. Currently leaked file descriptors may disturb repro execution (e.g. it may act on a wrong fd).
* executor: fix coverfilter header sizeDmitry Vyukov2024-05-282-19/+17
| | | | | | Manager was switched to 64-bit PCs, but executor still expected 4-byte PC start in the header. Fix it and switch size to uint64 for simplicity as well.
* prog: introduce a remote_cover call attributeAleksandr Nogikh2024-05-271-4/+2
| | | | | | Update the descriptions to mark calls that cause remote coverage collection. Remote some hacky code from the executor.
* executor: always send 64bit pc and sigJoey Jiao2024-05-271-6/+5
| | | | | | | | | | | | On 64 bit machine, when CONFIG_RANDOMIZE_BASE enabled, even [32:64] bits changed across reboot. And, core kernel and modules can have diff [31:64] bits. We need to add 64bit pc support and this is to always send 64bit pc and sig to syz-fuzzer. Send 64bit pc and sig is compatable with 32bit OS.
* executor: remove including error.h in test_linux.hKhem Raj2024-05-221-1/+0
| | | | | | It seems to be redundant and moreover it lets us compile on musl which does not provide this system header.
* pkg/csource: remove the Repro optionAleksandr Nogikh2024-05-171-2/+0
| | | | Enable it unconditionally.
* pkg/vminfo: move feature checking to hostDmitry Vyukov2024-05-154-27/+77
| | | | | | | | | | | | | | | | | Feature checking procedure is split into 2 phases: 1. syz-fuzzer invokes "syz-executor setup feature" for each feature one-by-one, and checks if executor does not fail. Executor can also return a special "this feature does not need custom setup", this allows to not call setup of these features in each new VM. 2. pkg/vminfo runs a simple program with ipc.ExecOpts specific for a concrete feature, e.g. for wifi injection it will try to run a program with wifi feature enabled, if setup of the feature fails, executor should also exit with an error. For coverage features we also additionally check that we actually got coverage. Then pkg/vminfo combines results of these 2 checks into final result. syz-execprog now also uses vminfo package and mimics the same checking procedure. Update #1541
* executor: setup binfmt_mist only if it has been mountedAndrei Vagin2024-05-091-0/+1
| | | | | | | gVisor doesn't implement binfmt file system. Fixes: 229488b413d4 ("executor: consistently fail on feature setup") Signed-off-by: Andrei Vagin <avagin@google.com>
* executor: fix embeding of headersDmitry Vyukov2024-05-081-5/+9
| | | | | | | | | | common_usb.h is included by both common_linux.h and common_netbsd.h. The current version may fail to replace one of these common_usb.h, if say common_linux.h is already replaced, but common_netbsd.h is not yet. Make the replacement algorithm more robust and just replace everything on each iteration until we can't replace anything anymore. Fixes #4783
* pkg/csource: replace go:generate with go:embedDmitry Vyukov2024-05-082-7/+73
| | | | | | | go:embed is a more modern way to do this and it does not require a special Makefile step. Since go:embed cannot use paths that contains "..", the actual embeding is moved to executor package.
* pkg/ipc: move executor common_ext testDmitry Vyukov2024-05-081-63/+0
| | | | | | | | Move the test from executor to pkg/ipc to prevent import cycle in the next change. pkg/ipc looks like the most reasonable place for it (besides executor), it already builds executor binary. The test cannot be moved to pkg/csource b/c it will create csource<->ipc cycle.
* executor: move flatbuffers from vendor to executorTaras Madan2024-05-0831-0/+11895
|
* executor: consistently fail on feature setupDmitry Vyukov2024-05-071-42/+41
| | | | | | Currently we fail in some cases, but ignore errors in other cases. Consistently fail when feature setup fails. This will be required for relying on setup failure to detect feature presence.
* executor: make flatrpc build for C++Dmitry Vyukov2024-05-032-6/+4
|
* pkg/vminfo: check enabled syscalls on the hostDmitry Vyukov2024-05-021-2/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Move the syscall checking logic to the host. Diffing sets of disabled syscalls before/after this change in different configurations (none/setuid sandboxes, amd64/386 arches, large/small kernel configs) shows only some improvements/bug fixes. 1. socket$inet[6]_icmp are now enabled. Previously they were disabled due to net.ipv4.ping_group_range sysctl in the init namespace which prevented creation of ping sockets. In the new net namespace the sysctl gets default value which allows creation. 2. get_thread_area and set_thread_area are now disabled on amd64. They are available only in 32-bit mode, but they are present in /proc/kallsyms, so we enabled them always. 3. socket$bt_{bnep, cmtp, hidp, rfcomm} are now disabled. They cannot be created in non init net namespace. bt_sock_create() checks init_net and returns EAFNOSUPPORT immediately. This is a bug in descriptions we need to fix. Now we see it due to more precise checks. 4. fstat64/fstatat64/lstat64/stat64 are now enabled in 32-bit mode. They are not present in /proc/kallsyms as syscalls, so we have not enabled them. But they are available in 32-bit mode. 5. 78 openat variants + 10 socket variants + mount are now disabled with setuid sandbox. They are not permitted w/o root permissions, but we ignored that. This additionally leads to 700 transitively disabled syscalls. In all cases checking in the actual executor context/sandbox looks very positive, esp. for more restrictive sandboxes. Android sandbox should benefit as well. The additional benefit is full testability of the new code. The change includes only a basic test that covers all checks, and ensures the code does not crash/hang, all generated programs parse successfully, etc. But it's possible to unit-test every condition now. The new version also parallelizes checking across VMs, checking on a slow emulated qemu drops from 210 seconds to 140 seconds.
* pkg/ipc: consistently set ENOSYS for non-executed syscallsDmitry Vyukov2024-05-021-1/+1
| | | | | | | Currently we set errno=999 in executor for non-finished syscalls, but syscalls that were not even started still have errno=0. They also don't have Executed flag, but it's still handy to have a non-0 errno when the call is not successful.
* pkg/ipc: make it possible to change EnvFlags between executionsDmitry Vyukov2024-04-301-1/+1
| | | | | | | | | | | | | | | | Pass EnvFlags into Exec instead of New. This allows to change EnvFlags between executions. Change of EnvFlags forces executor process restart since it uses EnvFlags during setup. Currently this is intended to be NFC since we always pass the same EnvFlags. In future this will allow to (1) reduce part of the VM checking procedure to execution of programs with different options (e.g. we can probe for coverage/comparisons support, probe different sandboxes, etc); (2) use it during fuzzing/reproduction, e.g. we can check if the crash reproduces under setuid sandbox, or execute some fuzzing programs in significantly different modes.
* executor: arm64: call KVM_ARM_PREFERRED_TARGET on vmfd instead of cpufdAlexander Potapenko2024-04-181-1/+3
|
* tools/syz-linter: check t.Logf/Errorf/Fatalf messagesDmitry Vyukov2024-04-171-1/+1
| | | | | Fix checking of Logf, it has string in 0-th arg. Add checking of t.Errorf/Fatalf.
* prog: include number of calls into exec encodingDmitry Vyukov2024-04-161-0/+1
| | | | | | Prepend total number of calls to the exec encoding. This will allow pkg/ipc to better parse executor response without full parsing of the encoded program.
* executor: ignore EBADF when reading tunDmitry Vyukov2024-04-161-1/+2
| | | | | | | | | | | | Fuzzer managed to do: executing program 0: ... close_range(r5, 0xffffffffffffffff, 0x0) ... SYZFATAL: executor 0 failed 11 times: executor 0: exit status 67 SYZFAIL: tun read failed (errno 9: Bad file descriptor)
* executor: ignore socketpair error in syz_usbip_server_initDmitry Vyukov2024-04-161-2/+5
| | | | | | | | | | | | | | Fuzzer managed to do: executing program 4: ... prlimit64(0x0, 0x7, &(0x7f0000000000), 0x0) ... syz_usbip_server_init(0x3) ... SYZFATAL: executor 4 failed 11 times: executor 4: exit status 67 SYZFAIL: syz_usbip_server_init: socketpair failed (errno 24: Too many open files)
* prog: more compact exec encoding for addressesDmitry Vyukov2024-04-151-5/+21
| | | | | | | | | | 1. Don't write size/flags for addresses. 2. Write address w/o data offset (fewer bytes in leb128 encoding). Median exec size shrinks by 25%: - exec sizes: 10%:584 50%:1423 90%:7076 + exec sizes: 10%:448 50%:1065 90%:6319
* prog: don't pad data in exec encodingDmitry Vyukov2024-04-151-3/+2
| | | | | | | | With leb128 ints it does not make any sense. Reduces exec sizes a bit more: - exec sizes: 10%:597 50%:1438 90%:7145 + exec sizes: 10%:584 50%:1423 90%:7076
* prog: use leb128 for exec encodingDmitry Vyukov2024-04-151-22/+42
| | | | | | | | | | | | Switch from uint64 to leb128 encoding for integers. This almost more than halves serialized size: - exec sizes: 10%:2160 50%:4792 90%:14288 + exec sizes: 10%:597 50%:1438 90%:7145 and makes it smaller than the text serialization: text sizes: 10%:837 50%:1591 90%:10156
* all: remove akaros supportDmitry Vyukov2024-04-154-128/+3
| | | | | | | Akaros support is unused, it was shutdown on syzbot for a while, the akaros development seems to be frozen for years as well. We have a bunch of hacks for Akaros since it supported only super old gcc and haven't supported Go. Remove it.
* executor: cleanup mounts with MNT_FORCEAleksandr Nogikh2024-04-101-4/+9
| | | | | | | | | | Starting from v6.9, we can no longer reuse a loop device while some filesystem is mounted on it. It conflicts with the MNT_DETACH approach we were previously using. Let's umount synchronously instead, but also with a MNT_FORCE flag to abort potentially long graceful cleanup operations. We don't need them for the filesystems mounted only for fuzzing purposes.
* executor: skip executor tests on systems with BrokenCompilerGreg Steuck2024-04-051-0/+5
| | | | | OpenBSD in particular is not compatible with TestOS expectation of having a syscall function.
* executor: fix uninitialized variable when generating kvm codeCookedMelon2024-04-051-0/+4
| | | | | | | | The "avl" fields (variable type is u8) of the kvm_segment structure variables such as seg_cs16 and seg_ldt are not initialized to zero. During creation, there is a chance that they are set to values other than 0 or 1, which can cause the "avl" fields to overwrite other fields when executing the fill_segment_descriptor function, leading to erroneous results.
* executor: add guard pages around the kcov mappingAlexander Potapenko2024-04-041-2/+16
| | | | | | | | | | | Because the executor may place other mappings next to the buffer used by kcov, occasional out-of-bound writes to them may corrupt the coverage, creating garbage PCs (see https://github.com/google/syzkaller/issues/4531). To prevent those, map two extra pages for the kcov buffer, and protect them, so that OOB writes cause a segfault. Fixes https://github.com/google/syzkaller/issues/4532
* executor: ignore ENOENT for socket callsDmitry Vyukov2024-04-021-0/+12
| | | | | | Don't treat ENOENT from socket call as fatal. Fuzzer manages to make all socket calls for a particular protocol fail using NLBL_MGMT_C_REMOVE netlink function.
generated by ggit (джигит) mrf-deployment (git 2.46.0) at 2026-03-12 04:11:53 +0000