aboutsummaryrefslogtreecommitdiffstats
path: root/executor
Commit message (Collapse)AuthorAgeFilesLines
...
* executor: disable rfkill during setupDmitry Vyukov2021-03-041-0/+18
| | | | | If rfkill is enabled by the fuzzer, wifi setup will fail. Disable rfkill to initial state during setup.
* executor: don't fail on "negative running"Dmitry Vyukov2021-03-041-1/+1
| | | | | See #502 This still happens periodically.
* prog: detect copyout overflowDmitry Vyukov2021-03-041-1/+1
| | | | | | Detect the case when a program requires more copyout than executor can handle. Curretnly these result in: "SYZFAIL: command refers to bad result" failures. Now syz-fuzzer should ignore them.
* executor: improve SYZFAIL messageDmitry Vyukov2021-02-261-1/+1
| | | | | | | Print details and errno after SYZFAIL line. pkg/report captures output after SYZFAIL line, so it's better to have details after that line so that they are captured in report.
* pkg/report: detect executor failuresDmitry Vyukov2021-02-2111-177/+183
| | | | | | | | | | | | Currently all executor fail errors go into "lost connection" bucket. This is not very useful. First, there are different executor failures. Second, it's not possible to understand what failures happen how frequently. Third, there are not authentic lost connection. Create separate SYZFAIL: bugs for them. Update #573 Update #502 Update #318
* executor: don't fail in syz_genetlink_get_family_idDmitry Vyukov2021-02-192-82/+116
| | | | | | | | | | We used to use our own netlink socket and then fail on any errors. But commit "sys/linux: add ieee802154 descriptions" made it possible to use fuzzer-provided socket, and fuzzer can pass any invalid fd. So don't fail on errors now. Fixes #2444
* sys/linux: add ieee802154 descriptionsDmitry Vyukov2021-02-124-18/+77
|
* executor: don't include kvm on armDmitry Vyukov2021-01-261-1/+1
| | | | | | KVM was removed for arm architecture. Latest Linux headers don't contain <asm/kvm.h> for arm. So don't even include them.
* executor: fix kcov_remote_arg declarationDmitry Vyukov2020-12-301-41/+18
| | | | | kcov_remote_arg was changed to a portable format so we don't need to handle differences between 64/32-bits anymore.
* executor/common: repair clang complaint about bad indentationGreg Steuck2020-12-301-1/+2
| | | | | dashboard link: https://syzkaller.appspot.com/bug?extid=38fe37bc451a42e6c9a4 Reported-by: syzbot+38fe37bc451a42e6c9a4@syzkaller.appspotmail.com
* all: make timeouts configurableDmitry Vyukov2020-12-281-4/+6
| | | | | | Add sys/targets.Timeouts struct that parametrizes timeouts throughout the system. The struct allows to control syscall/program/no output timeouts for OS/arch/VM/etc. See comment on the struct for more details.
* executor: remove hardcoded timeoutsDmitry Vyukov2020-12-252-16/+33
| | | | | In preparation for making timeouts tunable based on OS/arch/VM/etc de-hardcode all (almost) timeouts in executor.
* executor: don't use coverage edges for gvisorDmitry Vyukov2020-12-164-22/+14
| | | | gvisor coverage is not a trace, so producing edges won't work.
* executor: use coverage filter for comparisonsDmitry Vyukov2020-12-091-1/+1
| | | | | | Filter out all comparisons in non-interesting code. Comparisons are expensive, so it makes lots of sense, these filtered out can't give us any new interesting signal.
* executor: capture outgoing edges from interesting codeDmitry Vyukov2020-12-091-6/+10
| | | | | | | | | | Currently we capture only incoming edges into the interesting code when code coverage filter is used. Also capture outgoing edges. For code without indirect calls this does not matter as we always get the same edge. But for code with indirect edges we can capture more interesting coverage, and presumably different indirect calls are quite important.
* executor: minor coverage filter cleanupDmitry Vyukov2020-12-093-8/+16
| | | | | Slightly reduce number of ifdef's, define coverage_filter only in shmem mode and remove unnecessary cast.
* executor: skip setsid() for threaded reproducersAnton Lindqvist2020-12-091-2/+7
| | | | | | | | | | | | Lately, I've been looking into why such low amount of syz reproducers on OpenBSD are turned into C reproducers. One thing I did notice is that such syz reproducers have one thing in common: they use the threaded=true and sandbox=none parameters. Such C reproducer always exits non-zero early on since the call to setsid() fails with EPERM. Meaning, the calling process is already a process group leader. Not sure if the preprocessor conditional should be tweaked in order to avoid unwanted side effects on other BSDs or configurations.
* syz-manager/manager.go, executor/executor.cc: support coverage filterKaipeng Zeng2020-12-063-2/+101
|
* sys/linux, sys/freebsd: apply more ignore_return attributesDmitry Vyukov2020-12-053-22/+4
| | | | | | | | | | | | | | 1. Apply ignore_return to semctl$GETVAL which produces random errno values on linux and freebsd. 2. Apply ignore_return to prctl and remove the custom code in executor. 3. Remove the custom errno ignoring code in fuchsia executor. The calls are already marked as ignore_return, so this is just a leftover. 4. Only reset errno for ignore_return. The syscall can still return a resource (maybe). We only need to reset errno for fallback coverage.
* executor: tune few more sysctl'sDmitry Vyukov2020-12-011-0/+7
| | | | | | | | | | | | | Faster gc (1 second) is intended to make tests more repeatable. {"/proc/sys/kernel/keys/gc_delay", "1"}, Huge page overcommit is disabled by default, allowing some overcommit is intended to give more coverage. {"/proc/sys/vm/nr_overcommit_hugepages", "4"}, We always want to prefer killing the allocating test process rather than somebody else (sshd or another random test process). {"/proc/sys/vm/oom_kill_allocating_task", "1"},
* tools/create-gce-image.sh: move sysctl's to executorDmitry Vyukov2020-11-211-0/+6
| | | | | | | | | Move the remaining sysctls from image creation scripts into executor. We have the rest in executor now, and these are captured in reproducers and are not duplicated. It seems that ping_group_range was accidentially lost along the way, re-add it.
* pkg/ifuzz/powerpc: add powerpc supportAlexey Kardashevskiy2020-11-204-2/+89
| | | | | | | | | | | | | | | | | | | | | | | | This adds KVM's syz_kvm_setup_cpu pseudo syscall. This adds placeholder for options (none implemented yet). This adds instruction generator for ifuzz; this also adds a few pseudo instructions to simulate super/hyper/ultracalls (a PPC64/pseries platform thing). The insns.go is generated from PowerISA_public.v3.0B.pdf [1] by a horrendous python3 script on top of pdftotext. The ISA covers POWER9 which is the latest available POWER CPU at the moment. The next ISA for POWER10 is quite different and we will deal with it later. The // comment after every instruction is a fixed opcode list for verification purposes. This does not define DecodeExt as there is no obvious replacement of the Intel XED library for POWERPC (gapstone-capstone, later, may be). [1] https://openpowerfoundation.org/?resource_lib=power-isa-version-3-0 Signed-off-by: Alexey Kardashevskiy <aik@linux.ibm.com>
* executor: fix linux includesDmitry Vyukov2020-10-301-2/+6
| | | | | write_file() is needed for setup_sysctl() and syz_usbip_server_init(). setup_sysctl() also misses some header includes.
* dashboard/config/linux: set watchdog_thresh via cmdlineDmitry Vyukov2020-10-281-4/+0
| | | | Fixes #1989
* pkg/csource: setup sysctl's in C reproducersDmitry Vyukov2020-10-285-42/+46
| | | | | | Sysctl's are not captured as part of reproducers. This can result in failure to reproduce a bug on developer machine. Include sysctl setup as part of C reproducers.
* executor: setup sysctl's in setup_machineDmitry Vyukov2020-10-281-8/+35
| | | | | | | | | | | Currently we assume that sysctl's are setup as part of machine boot. This introduces a non-trivial dependency on image creation and sysctl's are not captured by as part of C reproducers and are not captured by syzbot dashboard. This can make some reproducers fail on developer machines or on syzbot later when sysctl's change. Setup sysctl's in executor as part of machine setup. It makes it much more controllable and hermetic.
* executor, pkg/csource: remove setpgrp() in sandbox_common()liucy19982020-10-271-1/+0
| | | | Process group leader is not allowed to call setsid, thus remove setpgrp.
* executor: compile fixAlexey Kardashevskiy2020-10-261-1/+1
| | | | | | | | | | | | | | | | | | | | | | This fixes an error in printf() format for __u64: gcc -o ./bin/linux_ppc64le/syz-executor executor/executor.cc \ -D__powerpc64__ -O2 -pthread -Wall -Werror -Wparentheses \ -Wunused-const-variable -Wframe-larger-than=16384 -static -DGOOS_linux=1 -DGOARCH_ppc64le=1 \ -DHOSTGOOS_linux=1 \ -DGIT_REVISION=\"82d2e60626ef1f43e557ca2933aee53bd5265eaf+\" In file included from executor/test.h:5:0, from executor/executor.cc:343: executor/test_linux.h: In function ‘int test_one(int, const char*, int, \ int, unsigned int, bool)’: executor/test_linux.h:74:60: error: format ‘%llx’ expects argument of type \ ‘long long unsigned int’, but argument 2 has type ‘__u64 {aka long unsigned int}’ [-Werror=format=] cpu_mem->fail_entry.hardware_entry_failure_reason); ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^ Signed-off-by: Alexey Kardashevskiy <aik@linux.ibm.com>
* executor: fix arp netfiler tables alignment for armDmitry Vyukov2020-10-151-4/+4
| | | | | | | | | | The arp netfilter entry contains u64, but we used only void* to enforce alignment. This worked everywhere except for arm, which is 32-bits and has 8-byte alignment for u64. Use u64 to enforce correct alignment. Fixes #2188
* executor: set parent-death signal after changing user or group ID-sAndrei Vagin2020-10-091-0/+5
| | | | | | | The parent-death signal is set in sandbox_common, but then setresuid and setresgid clear it and we need to set it again. Signed-off-by: Andrei Vagin <avagin@google.com>
* executor: increase prog_extra_cover_timeout for progs that inject 802.11 framesAleksandr Nogikh2020-10-051-1/+3
| | | | | This is required because we can only collect remote kcov coverage for these injected frames.
* executor: msvc support syz-executorSuraj K Suresh2020-10-035-19/+64
|
* sys/linux: descriptions for USB/IPNazime Hande Harputluoglu2020-10-021-0/+57
|
* executor: check for \n in fail/exitf messagesDmitry Vyukov2020-09-284-10/+17
|
* executor/linux: stop dumping mount information when failed to open kcov fileTetsuo Handa2020-09-281-40/+1
| | | | | Since ENOENT problem was solved by commit 318430cbb3b2ceef ("executor/linux: change mount propagation type to private"), remove the debug code for this problem.
* executor: make exit code during fail() depend on fault injectionAleksandr Nogikh2020-09-222-7/+27
| | | | | | | | | | | | | | | | | | | | | | fail()'s are often used during the validation of kernel reactions to queries that were issued by pseudo syscalls implementations. As fault injection may cause the kernel not to succeed in handling these queries (e.g. socket writes or reads may fail), this could ultimately lead to unwanted "lost connection to test machine" crashes. In order to avoid this and, on the other hand, to still have the ability to signal a disastrous situation, the exit code of this function now depends on the current context. All fail() invocations during system call execution with enabled fault injection lead to termination with zero exit code. In all other cases, the exit code is kFailStatus. This is achieved by introduction of a special thread-specific variable `current_thread` that allows to access information about the thread in which the current code is executing. Also, this commit eliminates current_cover as it is no longer needed.
* all: integrate with mac80211_hwsimAleksandr Nogikh2020-09-222-3/+454
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Two virtual wireless devices are instantiated during network devices initialization. A new flag (-wifi) is added that controls whether these virtual wifi devices are instantiated and configured during proc initialization. Also, two new pseudo syscalls are added: 1. syz_80211_inject_frame(mac_addr, packet, packet_len) -- injects an arbitrary packet into the wireless stack. It is injected as if it originated from the device identitied by mac_addr. 2. syz_80211_join_ibss(interface_name, ssid, ssid_len, mode) -- puts a specific network interface into IBSS state and joins an IBSS network. Arguments of syz_80211_join_ibss: 1) interface_name -- null-terminated string that identifies a wireless interface 2) ssid, ssid_len -- SSID of an IBSS network to join to 3) mode -- mode of syz_80211_join_ibss operation (see below) Modes of operation: JOIN_IBSS_NO_SCAN (0x0) -- channel scan is not performed and syz_80211_join_ibss waits until the interface reaches IF_OPER_UP. JOIN_IBSS_BG_SCAN (0x1) -- channel scan is performed (takes ~ 9 seconds), syz_80211_join_ibss does not await IF_OPER_UP. JOIN_IBSS_BG_NO_SCAN (0x2) -- channel scan is not performed, syz_80211_join_ibss does not await IF_OPER_UP. Local testing ensured that these syscalls are indeed able to set up an operating network and inject packets into mac80211.
* executor/common_linux.h: refactor __NR_syz_genetlink_get_family_idAleksandr Nogikh2020-09-221-38/+12
| | | | | | As netlink helpers now include a function to query generic netlink familty id, it makes no sense to duplicate implementation of essentially the same function.
* executor/common_linux.h: remove assumption that netlink always returns ↵Aleksandr Nogikh2020-09-221-25/+25
| | | | | | | | | | | | | | nonpositive error codes The code in common_linux.h assumes that nlmsgerr can either be 0 or a negative value in case of an error. However, this is not always the case. For example, some commands of mac80211_hwsim use nonnegative values to indicate success (e.g. HWSIM_CMD_NEW_RADIO returns either a negative error or a nonnegative radio index). Therefore, negation of error code inside netlink_send_ext is not correct. This patch changes this behavior. Now netlink_send_ext returns the exact value it received via netlink.
* sys/common_linux.h: replace netlink_devlink_id_get and ↵Aleksandr Nogikh2020-09-221-63/+34
| | | | | | | netlink_wireguard_id_get by a more generic function These two functions are almost entirely idential. In order to avoid adding similar functions later on, a generic one is created.
* sys/common_linux.h: move the definition of a global nlmsg variableAleksandr Nogikh2020-09-221-2/+4
| | | | | | | This global variable cannot be used for pseudo syscalls as they can run concurrently (in threaded mode). It can only be used during initialization, and if initialization routines are not enabled, nlmsg will become an unused variable.
* executor/common_linux.h: extend netlink helpers to support zero-payload ↵Aleksandr Nogikh2020-09-221-1/+2
| | | | | | | attributes (flags) This is required for 802.11 pseudo syscalls (that will be added later).
* executor/common_linux.h: increase default nlmsg buffer sizeAleksandr Nogikh2020-09-221-1/+1
| | | | | 1024 bytes are not enough to contain an arbirary 802.11 MAC frame together with netlink protocol overhead.
* executor: forbid inlining of 'remove_dir'Alexander Egorenkov2020-09-181-1/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes the issue with gcc 10 on Fedora 32 s390x: In file included from ../../executor/executor.cc:147: ../../executor/common.h: In function ‘void remove_dir(const char*)’: ../../executor/common.h:229:44: error: ‘%s’ directive output may be truncated writing up to 255 bytes into a region of size between 0 and 4095 [-Werror=format-truncation=] 229 | snprintf(filename, sizeof(filename), "%s/%s", dir, ep->d_name); | ^~ ../../executor/common.h:229:11: note: ‘snprintf’ output between 2 and 4352 bytes into a destination of size 4096 229 | snprintf(filename, sizeof(filename), "%s/%s", dir, ep->d_name); ../../executor/common.h:243:1: error: the frame size of 21200 bytes is larger than 16384 bytes [-Werror=frame-larger-than=] 243 | } | ^ cc1plus: all warnings being treated as errors compiler invocation: gcc [-o /tmp/syz-executor383272105 -DGOOS_test=1 -DGOARCH_64_fork=1 -DHOSTGOOS_linux=1 ../../executor/executor.cc -m64 -no-pie -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384] FAIL FAIL github.com/google/syzkaller/pkg/runtest 0.998s FAIL Signed-off-by: Alexander Egorenkov <Alexander.Egorenkov@ibm.com>
* executor: fix definition of __NR_io_uring_setupDmitry Vyukov2020-09-152-7/+23
| | | | | | | | | | Sone syzbot instances broke with: <stdin>: In function ‘syz_io_uring_setup’: <stdin>:476:33: error: ‘__NR_io_uring_setup’ undeclared (first use in this function) <stdin>:476:33: note: each undeclared identifier is reported only once for each function it appears in pkg/csource resolves #ifdef's at generation time.
* executor: improve opendir(3) error handlingAnton Lindqvist2020-09-121-1/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | While investigating an OpenBSD reproducer[1][2] I discovered the following: * All threads are stuck on the last `sleep(1000000)` syscall in main(), hence no output for the test machine. * Each executor process created in loop() performs one iteration but exits abnormally during the call to remove_dir(). * Calling remove_dir() will eventually invoke itself recursively since one of the executed syscall is `mkdir("./file0", 0)` meaning that it will try to remove the directory created by execute_one(). However, `opendir(3)` fails with `EACCES` due to the permissions passed to `mkdir(2)` is zero. Instead of exiting, trying to remove the problematic directory in a best effort manner makes the reproducer continue executing the generated syscalls. This work around might be considered to narrow. Another option would be to replace the `sleep(1000000)` with `waitpid(-1, NULL, 0)` until ECHILD is hit. [1] https://syzkaller.appspot.com/bug?id=6f7ce2a0536580a94f65f44e478732ec505e88af [2] https://syzkaller.appspot.com/text?tag=ReproC&x=10fd1a71900000
* executor: detect gvisorDmitry Vyukov2020-09-121-1/+14
| | | | | | gvisor coverage is not in the range of linux kernel coverage. So the coverage filter does not work. Detect if running under gvisor and skip the coverage filter.
* sys/test/test: add a hanging testDmitry Vyukov2020-09-123-2/+11
| | | | Ensure that we can handle hanging syscalls in all modes.
* executor/common_linux.h: add missing FUSE opcodesStefano Duo2020-08-271-1/+5
| | | | | | Add the following missing FUSE opcodes to the syz_fuse_handle_req pseudo-syscall: FUSE_COPY_FILE_RANGE, FUSE_UNLINK, FUSE_DESTROY and FUSE_BATCH_FORGET.
* executor/linux: change mount propagation type to privateTetsuo Handa2020-08-261-0/+3
| | | | | | | unshare(CLONE_NEWNS) might not be sufficient for making all test processes run in separate mount namespace, for "mount --make-rshared /" request issued by systemd causes mount operations issued by test processes visible from outside of test processes. Issue "mount --make-rprivate /" request after unshare(CLONE_NEWNS).
generated by ggit (джигит) mrf-deployment (git 2.46.0) at 2026-03-12 12:18:20 +0000