aboutsummaryrefslogtreecommitdiffstats
path: root/executor
Commit message (Collapse)AuthorAgeFilesLines
...
* executor: include sys/mman.h (#3476)glpesk2022-10-281-0/+1
|
* executor: remove a few #defines which are not used any longerGreg Steuck2022-10-251-10/+0
|
* executor: deal with input_data more sensiblyGreg Steuck2022-10-251-16/+22
|
* executor: cope with mimmutable(2) on OpenBSDAnton Lindqvist2022-10-231-2/+7
| | | | | | | Pages residing in the BSS section are by now flagged as immutable on OpenBSD. Meaning that their corresponding permissions cannot change. The input_data therefore needs to be explicitly marked as mutable. Should hopefully bring syzbot on OpenBSD back.
* executor: better errors for failed mmapsDmitry Vyukov2022-10-215-15/+22
| | | | | | A fixed-address mmap can fail completely or return a different address. Log what it was. Based on: https://groups.google.com/g/syzkaller/c/lto00RwlDIQ
* executor: enable core dumpsDmitry Vyukov2022-10-071-1/+2
| | | | | | | | Core dumping known to have bugs. Just few recent kernel commits: [brown paperbag] fix coredump breakage [coredump] don't use __kernel_write() on kmap_local_page() We also also found some info leaks in core dumps before. No reason to not test them.
* executor: move syz_mount_image's sanity checks to syz-fuzzerAleksandr Nogikh2022-09-271-23/+0
| | | | | It will simplify the C code and let us extract the raw images in a more convenient way.
* executor: add NIC PCI pass-through VF supportGeorge Kennedy2022-09-212-76/+219
| | | | | | | | | | | | | | | Add support for moving a NIC PCI pass-through VF into Syzkaller's network namespace so that it will tested. As DEVLINK support is triggered by setting the pass-through device to "addr=0x10", NIC PCI pass-through VF support will be triggered by setting the device to "addr=0x11". If a NIC PCI pass-through VF is detected in do_sandbox, setup a staging namespace before the fork() and transfer the NIC VF interface to it. After the fork() and in the child transfer the NIC VF interface to Syzkaller's network namespace and rename the interface to netpci0 so that it will be tested. Signed-off-by: George Kennedy <george.kennedy@oracle.com>
* pkg/csource: fix const sock_filterGeorge Kennedy2022-09-212-2/+2
| | | | | | const sock_filter needs to be const struct sock_filter Signed-off-by: George Kennedy <george.kennedy@oracle.com>
* sys/linux, tools/syz-imagegen: allow `syz_mount_image` to change directoryHrutvik Kanabar2022-09-131-2/+10
| | | | | | | | | | | | | | | | | | | | Add a boolean argument to the `syz_mount_image` pseudo-syscall. When this is true, `syz_mount_image` will change directory to the mountpoint after mounting the image passed. Experimentation suggests that to reproduce many non-`ext4` filesystem bugs, it is sufficient to mount the filesystem within an `ext4`-based VM and then change directory to the mountpoint before executing code. This change aims to increase the probability that a mount operation will be succeeded by the corresponding change in directory, and so increase the probability of finding non-`ext4` bugs. We also have to update the `syz-imagegen` tool. Now it generates seed `syz_mount_image` calls with change of directory enabled. The previous behaviour (i.e. no change of directory) will be recovered by use of existing corpuses and fuzzing the change-of-directory argument. The next commit will regenerate all `syz_mount_image` seeds.
* executor: fix setup of netdevsim deviceDmitry Vyukov2022-09-091-7/+8
| | | | | | | | | | 2 fixed: 1. netdevsim devices cannot be created via NETLINK anymore: https://elixir.bootlin.com/linux/v6.0-rc4/source/drivers/net/netdevsim/netdev.c#L397 But we already create them via /sys/bus/netdevsim/new_device, so just remove the netlink creation. 2. These devices are sticky and are not removed on net namspace destruction, so delete the previous version explicitly.
* executor: fix setup of xfrm deviceDmitry Vyukov2022-09-091-12/+29
| | | | | | | | | | XFRM device creation will fail w/o IFLA_XFRM_IF_ID attribute: https://elixir.bootlin.com/linux/v6.0-rc4/source/net/xfrm/xfrm_interface.c#L648 Add this attribute. This ID is also present in descriptions in at least 2 places. In one we got it wrong, it's not ifindex (easy to confuse because of the name). Fix it as well.
* Revert "pkg/csource: inline void* cast into generated code"Dmitry Vyukov2022-09-062-0/+8
| | | | | | | This reverts commit 922294abb4c0bc72b24d8526d625110d73fa1b5a. The commit reported to cause old warnings on s390x: https://github.com/google/syzkaller/commit/922294abb4c0bc72b24d8526d625110d73fa1b5a#commitcomment-83096994
* pkg/csource: inline void* cast into generated codeGreg Steuck2022-09-052-7/+0
| | | | | The previous indirection via conditional macros in platform specific places was needless obfuscation.
* executor: revert errno logic for fuchsia (#3306)Marco Vanotti2022-08-121-0/+9
| | | | | | Commit 4ce69996ec362f8dd9762dcc1643d13cebaab44a changed the logic for processing results for fuchsia system calls. That change seems to be fault, as it sets syscalls that return with ZX_OK to return -1 instead. I am reverting that commit for now.
* pkg/csource, pkg/instance, pkg/ipc, pkg/mgrconfig, tools/syz-prog2c, ↵Andrey Artemiev2022-08-062-6/+11
| | | | syz-manager: introduce a new setting 'sandbox_arg' (#3263)
* executor: fixed fuzzing with System account in Android sandbox (#3275)Andrey Artemiev2022-08-051-1/+2
|
* vm/adb: wait for Android boot to finishAndrey Artemiev2022-07-251-5/+1
| | | | executor: removed condition around tun init
* executor: fix mounting of cgroups on read-only fsDmitry Vyukov2022-07-211-23/+33
| | | | | | If root fs is read-only, mkdir(/syzcgroup) will fail and a later rmdir(/syzcgroup/unified) will fail with ENOENT which we don't expect and fail. Return early if mkdir(/syzcgroup) fails.
* executor: added code to run Android with System accountAndrey Artemiev2022-07-197-19/+535
|
* executor: prevent ENOSPC if cgroup mount failsDmitry Vyukov2022-07-151-1/+15
| | | | | | Remove /syzcgroup/* if cgroup mount fails. See #3241 for context. Fixes #3241
* executor: also reset flags on the parent dir if unlinking failsMark Johnston2022-06-241-0/+1
|
* executor: clear more file flags when removing filesMark Johnston2022-06-241-1/+1
| | | | The APPEND flag also prevents file removal.
* syz-manager, executor: fix out-of-bound access due to NextInstructionPCYuchuan Liu2022-06-241-1/+1
|
* executor: skips declaration of unused function 'doexit_thread' for fuchsiaKouame Behouba Manassé2022-06-223-1/+5
|
* executor: replace outdated fuchsia syscalls in common_fuchsia.hKouame Behouba Manassé2022-06-221-2/+2
|
* executor: fix enabling of ICMP/ping socketsDmitry Vyukov2022-06-201-1/+4
| | | | | | | | | | net/ipv4/ping_group_range sysctl grants access to ICMP sockets to the specified user groups. But it needs to be set inside of the net namespace (it's per-namespace). We were setting it but in the init namespace only (which we don't use). Set it after CLONE_NEWNET. This repairs testing of ICMP sockets. Note: don't set it for setuid sandbox since it's "low privilege".
* executor: try harder to unlink files on FreeBSDMark Johnston2022-06-171-2/+31
| | | | | | | | | | | | There is a BSD syscall, chflags(2), which lets one set various flags on a file, including several that prevent unlinking. The use of this flag can cause the executor to fail to clean up tmpdirs, which can lead to spurious reports. Thus, when unlinking fails, try again after clearing relevant flags. I suspect this would be useful on other BSDs but I can't easily verify that this change works there. It may eventually be worth having a BSD-specific remove_dir() implementation.
* executor: fix out of bounds write in lookup_connect_response_in()Ovidiu Panait2022-06-143-4/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | gcc 12.1 reports the following -Werror=array-bounds error: /// In function 'bool lookup_connect_response_in(...)' executor/common_usb.h:632:66: error: array subscript 'usb_qualifier_descriptor[0]' is partly outside array bounds of 'char [8]' [-Werror=array-bounds] | 632 | qual->bNumConfigurations = index->dev->bNumConfigurations; | ~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In function 'volatile long int syz_usb_connect_impl(...)': executor/common_usb_linux.h:332:23: note: object 'response_data' of size 8 | 332 | char* response_data = NULL; | ^~~~~~~~~~~~~ ... In function 'bool lookup_connect_response_in(...)', executor/common_usb.h:633:57: error: array subscript 'usb_qualifier_descriptor[0]' is partly outside array bounds of 'char [8]' [-Werror=array-bounds] | 633 | qual->bRESERVED = 0; | ~~~~~~~~~~~~~~~~^~~ In function 'volatile long int syz_usb_connect_impl(...)': executor/common_usb_linux.h:332:23: note: object 'response_data' of size 8 332 | char* response_data = NULL; | ^~~~~~~~~~~~~ /// Current code in USB_DT_DEVICE_QUALIFIER case treats respose_data as a buffer, but in reality it is just a pointer, as detailed in the error trace above. In order to allow passing a usb_qualifier_descriptor struct back to the caller (via response_data), add a new parameter to lookup_connect_response_in(). Build tested only. Fixes: 0c00210ff32 ("executor: always provide DEVICE_QUALIFIER USB descriptor") Signed-off-by: Ovidiu Panait <ovpanait@gmail.com>
* executor: fixed sandbox 'android'Andrey Artemiev2022-06-031-1/+2
|
* executor/android: update seccomp filtersKris Alder2022-06-024-348/+406
| | | | | | | | | | These were last updated for Android Q in or around 2020. These were re-generated using the 'genseccomppy.py' script in the Android build tree. Since the filters have changed during the intervening time, fuzzing with 'sandbox: android' no longer accurately reflected what untrusted apps can access on the device.
* executor: include sched.h for syz_cloneAndrei Vagin2022-05-271-0/+2
| | | | | | | | | | | | | | | | syzkaller reports the following error when it tries to create a C reproducer: <stdin>: In function ‘syz_clone’: <stdin>:289:48: error: ‘CLONE_VM’ undeclared (first use in this function) <stdin>:289:48: note: each undeclared identifier is reported only once for each function it appears in compiler invocation: gcc [-o /tmp/syz-executor3459695007 -DGOOS_linux=1 -DGOARCH_amd64=1 -DHOSTGOOS_linux=1 -x c - -m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -static-pie -fpermissive -w]
* executor: write magic in write_extra_outputAndrei Vagin2022-05-241-0/+1
| | | | Fixes: fcfad4ffcf3a ("ipc: add magic in a call reply")
* ipc: add magic in a call replyAndrei Vagin2022-05-241-0/+3
| | | | | | | | | | When a shared memory is used, the executor can corrupt reply messages, so let's add magic to detect such cases. It is an attempt to debug issues like this one: https://syzkaller.appspot.com/bug?id=faca64c3182e9f130ca94b7931dd771be390ef67 Signed-off-by: Andrei Vagin <avagin@google.com>
* executor: allow external extensions of the setup phaseDmitry Vyukov2022-04-273-0/+10
| | | | Allow common_ext.h to provide setup_ext() function that is called during VM setup.
* executor: applied Bionic patchAndrey Artemiev2022-04-131-0/+29
|
* executor: tolerate syz_genetlink_get_family_id failuresAleksandr Nogikh2022-02-251-4/+1
| | | | | | | | | | We cannot expect syscalls to always succeed during fuzzing, especially when the situation involves a complex interaction with the system. For the syz_genetlink_get_family_id case, it leads to numerous SYZFAIL crashes every day. Don't print a SYZFAIL error for this pseudo syscall.
* fix: "mmap_alloc_size"->"cov->mmap_alloc_size"aiQG_2022-02-211-1/+1
|
* executor: fail on SEGV during clone()Aleksandr Nogikh2022-01-214-1/+40
| | | | | | | | | | | | | | | As was found out in #2921, fork bombs are still possible in Linux-based instances. One of the possible reasons is described below. An invalid stack can be passed to the clone() call, thus causing it to stumble on an invalid memory access right during returning from the clone() call. This is in turn catched by the NONFAILING() macro and the control actually jumps over it and eventually both the child and the parent continue executing the same code. Prevent it by handling SIGSEGV and SIGBUS differently during the clone process. Co-authored-by: Andrei Vagin <avagin@google.com>
* executor: add extension point for adding non-mainline pseudo-syscallsDmitry Vyukov2022-01-192-0/+8
| | | | | | | | | | Add an empty common_ext.h which is included into executor and C reproducers and can be used to add non-mainline pseudo-syscalls w/o changing any other files (by replacing common_ext.h file). It would be good to finish #2274 which allows to add pseudo-syscalls along with *.txt descriptions, but #2274 is large and there are several open design questions. So add this simple extension point for now.
* all: create 8 tun devices for OpenBSDAleksandr Nogikh2022-01-141-2/+2
| | | | | Currently only 4 are created by default. This limits the maximum number of simultaneously running syz-executors.
* all: add syz_clone() and syz_clone3() pseudo callsAleksandr Nogikh2022-01-131-0/+59
| | | | | | | | | | | | | | | | | | | | As was pointed out in #2921, the current approach of limiting the number of pids per process does not work on all Linux-based kernels. We could just treat fork, clone and clone3 in a special way (e.g. exit on a zero return). However, in that case we also need to sanitize the arguments for clone and clone3 - if CLONE_VM is passed and stack is 0, the forked child processes (threads) will become nearly unindentifiable and will corrupt syz-executor's memory. While we could sanitize clone's arguments, we cannot do so for clone3 - nothing can guarantee that they will not be changed concurrently. Instead of calling those syscalls directly, introduce a special pseudo syscall syz_clone3. It copies and sanitizes the arguments and then executes clone3 (or fork, if we're on an older kernel) in such a way so as to prevent fork bombs from happening. Also introduce syz_clone() to still be able to fuzz it on older systems.
* executor: remove custom sys_io_uring_setup definitionAleksandr Nogikh2022-01-131-7/+1
|
* executor: remove sys_memfd_create definesAleksandr Nogikh2022-01-131-19/+1
| | | | | Add memfd_create as a dependency to syz_mount_image and syz_read_part_table.
* executor: move SYSCALL_DEFINES above common_*.h includesAleksandr Nogikh2022-01-131-1/+4
| | | | | Otherwise the pseudo syscalls there won't be able to access those definitions.
* sys/syz-sysgen: generate possibly missing __NR/SYS definesAleksandr Nogikh2022-01-131-0/+1
| | | | | | | | | As the comiling machine may have a kernel version different from the tested one, not all definitions might be present. Generate sequences of ifndef in defs.h to avoid potential issues. Restrict __NR-related style checking rules to only checking common*.h files.
* executor: don't print errno for successful callsDmitry Vyukov2022-01-111-5/+7
| | | | Don't print the confuing errno 14 for successful calls.
* executor: bump on FreeBSD the maximum number of tun devices to 256 (#2956)Michael Tüxen2021-12-311-0/+5
| | | | | | | syz-execprog now uses twice the number of CPU cores as the number of processes. Each process might use a tun device. So bump the maximum number of tun devices to the maximum of 256, which allows syz-execprog to run with default settings on systems with up to 128 cores.
* executor: support larger maximum number of tun devices on *BSD (#2953)Michael Tüxen2021-12-301-9/+17
|
* executor: ignore async flag in the non-threaded modeAleksandr Nogikh2021-12-131-3/+3
| | | | | | | | pkg/repro tries to clear the Threaded flag during repro simplification, so it's easier just to ignore the remaining async flags in that case - they won't be in the C repro either. Add a test to pkg/ipc to verify the new behavior.
generated by ggit (джигит) mrf-deployment (git 2.46.0) at 2026-03-12 06:55:25 +0000