aboutsummaryrefslogtreecommitdiffstats
path: root/pkg/csource/csource.go
Commit message (Collapse)AuthorAgeFilesLines
* executor: fail on SEGV during clone()Aleksandr Nogikh2022-01-211-0/+2
| | | | | | | | | | | | | | | As was found out in #2921, fork bombs are still possible in Linux-based instances. One of the possible reasons is described below. An invalid stack can be passed to the clone() call, thus causing it to stumble on an invalid memory access right during returning from the clone() call. This is in turn catched by the NONFAILING() macro and the control actually jumps over it and eventually both the child and the parent continue executing the same code. Prevent it by handling SIGSEGV and SIGBUS differently during the clone process. Co-authored-by: Andrei Vagin <avagin@google.com>
* all: add syz_clone() and syz_clone3() pseudo callsAleksandr Nogikh2022-01-131-0/+1
| | | | | | | | | | | | | | | | | | | | As was pointed out in #2921, the current approach of limiting the number of pids per process does not work on all Linux-based kernels. We could just treat fork, clone and clone3 in a special way (e.g. exit on a zero return). However, in that case we also need to sanitize the arguments for clone and clone3 - if CLONE_VM is passed and stack is 0, the forked child processes (threads) will become nearly unindentifiable and will corrupt syz-executor's memory. While we could sanitize clone's arguments, we cannot do so for clone3 - nothing can guarantee that they will not be changed concurrently. Instead of calling those syscalls directly, introduce a special pseudo syscall syz_clone3. It copies and sanitizes the arguments and then executes clone3 (or fork, if we're on an older kernel) in such a way so as to prevent fork bombs from happening. Also introduce syz_clone() to still be able to fuzz it on older systems.
* all: explicitly list pseudo syscall dependenciesAleksandr Nogikh2022-01-131-0/+7
| | | | | | | | | | | Pseudo syscalls can (and most of the time) do invoke normal system calls. However, when there's a risk that those calls might not be present, syzkaller needs to take preventive actions - prepend the corresponding defines. Otherwise syz-executor or C reproducers might not compile on the host machine. List those dependencies in sys/targets, check them during machine check and add the corresponding defines during C source generation.
* all: add the `rerun` call propertyAleksandr Nogikh2021-12-101-0/+8
| | | | | | | | | | | | | | To be able to collide specific syscalls more precisely, we need to repeat the process many times. Introduce the `rerun` call property, which instructs `syz-executor` to repeat the call the specified number of times. The intended use is: call1() (rerun: 100, async) call2() (rerun: 100) For now, assign rerun values randomly to consecutive pairs of calls, where the first one is async.
* all: replace collide mode by `async` call propertyAleksandr Nogikh2021-12-101-0/+11
| | | | | | | | | | | | | Replace the currently existing straightforward approach to race triggering (that was almost entirely implemented inside syz-executor) with a more flexible one. The `async` call property instructs syz-executor not to block until the call has completed execution and proceed immediately to the next call. The decision on what calls to mark with `async` is made by syz-fuzzer. Ultimately this should let us implement more intelligent race provoking strategies as well as make more fine-grained reproducers.
* pkg/csource: fix call list filtering not being consistentAleksandr Nogikh2021-10-091-20/+23
| | | | | | | | | | There is a bug in the current implementation that leads to csource using the original and the new call lists at the same time. That has led to a bunch of TestGenerate failures. Enforce the module only to use variables put into the csource context in order to avoid similar mistakes in the future.
* pkg/csource: remove calls instead of skipping themAleksandr Nogikh2021-10-011-14/+31
| | | | | | | | | | | | | | | | | | Currently csource skips calls at the very last moment, which has an unpleasant consequence - if we make choice of enabled defines depend on the individual calls or call properties, we may end up with defined yet unused functions. The perfect solution would be to untie syz_emit_ethernet/syz_extract_tcp_res and NetInjection, and also to untie VhciInjection and syz_emit_vhci. For the time being, move these checks to the very beginning of csource processing, so that these calls could be removed before we construct our defines. Adjust pkg/csource/csource_test.go to better cover fault injection generation problems.
* all: refactor fault injection into call propsAleksandr Nogikh2021-09-221-2/+2
| | | | | | | | | | | | Now that call properties mechanism is implemented, we can refactor fault injection. Unfortunately, it is impossible to remove all traces of the previous apprach. In reprolist and while performing syz-ci jobs, syzkaller still needs to parse the old format. Remove the old prog options-based approach whenever possible and replace it with the use of call properties.
* pkg/compiler: optimize array[const] representationDmitry Vyukov2021-04-211-2/+7
| | | | | | | | | | | | | | Represent array[const[X, int8], N] as string["XX...X"]. This replaces potentially huge number of: NONFAILING(*(uint8_t*)0x2000126c = 0); NONFAILING(*(uint8_t*)0x2000126d = 0); NONFAILING(*(uint8_t*)0x2000126e = 0); with a single memcpy. In one reproducer we had 3991 such lines. Also replace memcpy's with memset's when possible. Update #1070
* pkg/report: detect executor failuresDmitry Vyukov2021-02-211-1/+1
| | | | | | | | | | | | Currently all executor fail errors go into "lost connection" bucket. This is not very useful. First, there are different executor failures. Second, it's not possible to understand what failures happen how frequently. Third, there are not authentic lost connection. Create separate SYZFAIL: bugs for them. Update #573 Update #502 Update #318
* all: make timeouts configurableDmitry Vyukov2020-12-281-3/+5
| | | | | | Add sys/targets.Timeouts struct that parametrizes timeouts throughout the system. The struct allows to control syscall/program/no output timeouts for OS/arch/VM/etc. See comment on the struct for more details.
* executor: remove hardcoded timeoutsDmitry Vyukov2020-12-251-1/+2
| | | | | In preparation for making timeouts tunable based on OS/arch/VM/etc de-hardcode all (almost) timeouts in executor.
* sys/targets: add OS/Arch name constsDmitry Vyukov2020-10-261-3/+3
| | | | | | | | | | | | We use strings to identify OS/Arch. These strings are duplicated throughout the code base massively. golangci-lint points to possiblity of typos and duplication. We already had to define these names in pkg/csource and disable checking for prog package. A future change triggers such warnings in another package. Add OS/Arch name consts to sys/targets so that they can be used to refer to OS/Arch. Use the consts everywhere.
* pkg/csource: add description of the generation processDmitry Vyukov2020-08-101-0/+20
|
* all: initialize vhci in linuxTheOfficialFloW2020-07-301-2/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * all: initialize vhci in linux * executor/common_linux.h: improve vhci initialization * pkg/repro/repro.go: add missing vhci options * executor/common_linux.h: fix type and add missing header * executor, pkg: do it like NetInjection * pkg/csource/csource.go: do not emit syz_emit_vhci if vhci is not enabled * executor/common_linux.h: fix format string * executor/common_linux.h: initialize with memset For som reason {0} gets complains about missing braces... * executor/common_linux.h: simplify vhci init * executor/common_linux.h: try to bring all available hci devices up * executor/common_linux.h: find which hci device has been registered * executor/common_linux.h: use HCI_VENDOR_PKT response to retrieve device id * sys/linux/dev_vhci.txt: fix structs of inquiry and report packets * executor/common_linux.h: remove unnecessary return statement and check vendor_pkt read size * executor/common_linux.h: remove unnecessary return statement and check vendor_pkt read size * sys/linux/dev_vhci.txt: pack extended_inquiry_info_t * sys/linux/l2cap.txt: add l2cap_conf_opt struct * executor/common_linux.h: just fill bd addr will 0xaa * executor/common_linux.h: just fill bd addr will 0xaa
* executor: wrap all syscalls into NONFAILINGDmitry Vyukov2020-07-151-32/+47
| | | | | | | | | | | | | | | Currently we sprinkle NONFAILING all over pseudo-syscall code, around all individual accesses to fuzzer-generated pointers. This is tedious manual work and subject to errors. Wrap execute_syscall invocation with NONFAILING in execute_call once instead. Then we can remove NONFAILING from all pseudo-syscalls and never get back to this. Potential downsides: (1) this is coarser-grained and we will skip whole syscall on invalid pointer, but this is how normal syscalls work as well, so should not be a problem; (2) we will skip any clean up (closing of files, etc) as well; but this may be fine as well (programs can perfectly leave open file descriptors as well). Update #1918
* all: fix comments formatDmitry Vyukov2020-07-121-6/+6
| | | | | | | Fix capitalization, dots at the end and two spaces after a period. Update #1876
* executor: fix bitfields for big-endian archAlexander Egorenkov2020-07-101-2/+6
| | | | | | | | Add bitfield tests for big-endian arch Issue: #1885 Signed-off-by: Alexander Egorenkov <Alexander.Egorenkov@ibm.com>
* all: don't compare string len with 0Dmitry Vyukov2020-07-041-1/+1
| | | | | | | For strings it's more readable to compare the string itself with "", instead of comparing len with 0. Fix all such cases. Update #1876
* pkg/csource: fix casting of parameters for trampolinesAlexander Egorenkov2020-06-261-3/+4
| | | | Signed-off-by: Alexander Egorenkov <Alexander.Egorenkov@ibm.com>
* sys/linux: first 64bit big-endian architecture s390xAlexander Egorenkov2020-06-251-1/+4
| | | | | | | | | | | | | | | * mmap syscall is special on Linux s390x because the parameters for this syscall are passed as a struct on user stack instead of registers. * Introduce the SyscallTrampolines table into targets.Target to address the above problem. * There is a bug in Linux kernel s390x which causes QEMU TCG to hang when KASAN is enabled. The bug has been fixed in the forthcoming Linux 5.8 version. Until then do not enable KASAN when using QEMU TCG, QEMU KVM shall have no problems with KASAN. Signed-off-by: Alexander Egorenkov <Alexander.Egorenkov@ibm.com>
* pkg/csource: init res var in generated callDmitry Vyukov2020-05-041-1/+1
| | | | | | | | | | | | | | | It seems that gcc in ubuntu on travis got dumber: <stdin>: In function ‘execute_call’: <stdin>:1741:6: error: ‘res’ may be used uninitialized in this function [-Werror=maybe-uninitialized] cc1: all warnings being treated as errors compiler invocation: arm-linux-gnueabi-gcc [-o /tmp/syz-executor675297211 -DGOOS_linux=1 -DGOARCH_arm=1 -DHOSTGOOS_linux=1 -x c - -O2 -pthread -Wall -Werror -Wparentheses -Wframe-larger-than=16384 -D__LINUX_ARM_ARCH__=6 -march=armv6 -static -Wno-overflow] https://travis-ci.com/github/dvyukov/syzkaller/jobs/327487382 Though, we generate the same code and res seems to be initialized on all paths. Initialize it explicitly.
* sys/linux: add timeout call attributesDmitry Vyukov2020-04-191-12/+1
| | | | | | | Move additional call/prog timeouts to descriptions. Due to this logic duplication executor used 50ms for syz_mount_image, while pkg/csource used 100ms.
* prog: refactor target.MakeMmapDmitry Vyukov2020-04-181-1/+1
| | | | | | | | | | | Make MakeMmap return more than 1 call. This is a preparation for future changes. Also remove addr/size as they are effectively always the same and can be inferred from the target (will also conflict with the future changes). Also rename to MakeDataMmap to better represent the new purpose: it's just some arbitrary mmap, but rather mapping of the data segment.
* executor, sys/linux: add ath9k usb descriptionsAndrey Konovalov2020-03-131-7/+8
| | | | | | | Among other things this changes timeout for USB programs from 2 to 3 seconds. ath9k fuzzing also requires ath9k firmware to be present, so system images need to be regenerated with the updated script.
* executor: fix syz_mount_imageDmitry Vyukov2019-12-101-0/+1
| | | | | | | 1. It always crashed in cover_reset when coverage is disabled. 2. Use NONFAILING when accessing image segments. 3. Give it additional 100 ms as it may be slow. 4. Add a test for syz_mount_image.
* pkg/csource: rename some optionsDmitry Vyukov2019-11-161-1/+1
| | | | | Rename some options in preparation for subsequent changes which will align names across the code base.
* pkg/csource: Force promotion of 64-bit constant valuesMark Johnston2019-11-081-4/+26
| | | | | | | | | | Constant 64-bit arguments to the variadic syscall(2) must have their width specified explicitly. In practice this is not necessary most of the time, but on amd64/freebsd with clang the compiler can and does store the constant 32-bit value to the stack, leaving garbage in the upper 32 bits. This makes C reproducers somewhat uglier, but I see no other solution.
* executor, csource: adjust syz_open_dev$hiddev timeoutAndrey Konovalov2019-09-241-5/+6
| | | | Looks like opening hiddev can take up to ~100 ms.
* sys/linux, executor: add syz_usb_ep_read syzkallAndrey Konovalov2019-07-011-2/+4
| | | | syz_usb_ep_read reads data from USB endpoints other than #0.
* sys/linux, executor: add basic USB HID fuzzing supportAndrey Konovalov2019-06-241-0/+1
| | | | | This commit adds the necessary descriptions and executor adjustments to enable targeted fuzzing of the enumeration process of USB HID devices.
* pkg/csource: generate timeouts for USB syzcallsAndrey Konovalov2019-05-311-0/+12
| | | | This patch only covers per call timeouts, per prog one is not adjusted yet.
* pkg/csource: add ability to annotate syscalls using comments in C reproducersAnton Lindqvist2019-05-241-1/+6
| | | | | | | | | | | | | | | | | | | | | Providing additional info, especially regarding syscall arguments, in reproducers can be helpful. An example is device numbers passed to mknod(2). This commit introduces an optional annotate function on a per target basis. Example for the OpenBSD target: $ cat prog.in mknod(0x0, 0x0, 0x4503) getpid() $ syz-prog2c -prog prog.in int main(void) { syscall(SYS_mmap, 0x20000000, 0x1000000, 3, 0x1012, -1, 0, 0); syscall(SYS_mknod, 0, 0, 0x4503); /* major = 69, minor = 3 */ syscall(SYS_getpid); return 0; }
* executor: implement support for leak checkingDmitry Vyukov2019-05-201-6/+0
| | | | | | | | | | | | | | | | | | | | | | | | | Leak checking support was half done and did not really work. This is heavy-lifting to make it work. 1. Move leak/fault setup into executor. pkg/host was a wrong place for them because we need then in C repros too. The pkg/host periodic callback functionality did not work too, we need it in executor so that we can reuse it in C repros too. Remove setup/callback functions in pkg/host entirely. 2. Do leak setup/checking in C repros. The way leak checking is invoked is slightly different from fuzzer, but much better then no support at all. At least the checking code is shared. 3. Add Leak option to pkg/csource and -leak flag to syz-prog2c. 4. Don't enalbe leak checking in fuzzer while we are triaging initial corpus. It's toooo slow. 5. Fix pkg/repro to do something more sane for leak bugs. Few other minor fixes here and there.
* executor: change syscall argument type to intptr_tmunjinoo2019-05-071-9/+9
| | | | | The type size of long depends on compiler. Therefore, changing to intptr_t makes it depends on architecture.
* pkg/csource: sort sys/types.h to the top on FreeBSDMark Johnston2019-03-071-1/+6
| | | | | sys/types.h is a special header that is required by many other system headers on FreeBSD.
* pkg/host: don't fail if CONFIG_FAIL_FUTEX is not enabledDmitry Vyukov2019-02-111-0/+4
| | | | | | See #991 and added comments. Fixes #991
* executor: remove ability to detect kernel bugsDmitry Vyukov2019-01-311-1/+0
| | | | | | | | This ability was never used but we maintain a bunch of code for it. syzkaller also recently learned to spoof this error code with some ptrace magic (probably intercepted control flow again and exploited executor binary). Drop all of it.
* pkg/csource: write tracing output to stderrDmitry Vyukov2019-01-311-2/+2
| | | | stdout is not flushed on abnormal exit.
* pkg/csource: split emitCall functionDmitry Vyukov2018-12-271-11/+16
| | | | | gometalinter points that emitCall is too complex. Factor out call name emission.
* pkg/csource: use 0 for missing syscall argsDmitry Vyukov2018-12-271-0/+6
| | | | | | | | | | | | | | We don't specify trailing unused args for some syscalls (e.g. ioctl that does not use its arg). Executor always filled tailing unsed args with 0's but pkg/csource didn't. Some such syscalls actually check that the unsed arg is 0 and as the result failed with C repro. We could statically check and eliminate all such cases, but it turns out the warning fires in 1500+ cases: https://gist.githubusercontent.com/dvyukov/e59ba1d9a211ee32fa0ba94fab86a943/raw/a3ace5a63f7281f0298f51ea9842ead1e4713418/gistfile1.txt So instead fill such args with 0's in pkg/csource too.
* pkg/csource: fix PRINTF removalDmitry Vyukov2018-12-261-1/+1
| | | | PRINTF now accepts arguments.
* prog, pkg/csource: more readable serialization for stringsDmitry Vyukov2018-12-151-52/+4
| | | | | | | Always serialize strings in readable format (non-hex). Serialize binary data in readable format in more cases. Fixes #792
* pkg/csource: support tun and setuid repros on {free,open}bsdGreg Steuck2018-12-131-5/+7
| | | | | | * expose procid on BSD for tun, always declare loop() * deal with terrible bsd includes * replicate loop() declaration
* executor: fix handling of big-endian bitfieldsDmitry Vyukov2018-12-081-6/+10
| | | | | Currently we apply big-endian-ness and bitfield-ness in the wrong order in copyin. This leads to totally bogus result. Fix this.
* pkg/runtest: fixes for fuchsiaDmitry Vyukov2018-09-061-1/+7
| | | | | | | Add simple fuchsia program, the one that is run during image testing. Fix csource errno printing for fuchsia. Fix creation of executable files (chmod is not implemented on fuchsia). Check that we get signal/coverage from all syscalls.
* executor: fix gcc warnings in fuchsia generated codeDmitry Vyukov2018-08-191-1/+1
| | | | | | gcc complains about function declarations not being prototypes, signed/unsigned cast mismatch and casts between incompatible functions. Fix them.
* pkg/csource: fix 32-bit syscall callsDmitry Vyukov2018-08-091-1/+7
| | | | | | syscall accepts args as ellipsis, resources are uint64 and take 2 slots without the cast, which is wrong. Cast resources to long when passing to syscall.
* pkg/csource: minor fixesDmitry Vyukov2018-08-031-1/+3
| | | | | | 1. Print errno with %u instead of %d 2. Avoid unused var warning for syz_emit_ethernet when tracing is enabled.
* pkg/csource: refactor generateCallsDmitry Vyukov2018-08-021-42/+48
| | | | | | Move call generation into a separate function. Update #538
generated by ggit (джигит) mrf-deployment (git 2.46.0) at 2026-03-14 03:45:41 +0000