aboutsummaryrefslogtreecommitdiffstats
path: root/pkg/csource/csource.go
Commit message (Collapse)AuthorAgeFilesLines
...
* executor, csource: adjust syz_open_dev$hiddev timeoutAndrey Konovalov2019-09-241-5/+6
| | | | Looks like opening hiddev can take up to ~100 ms.
* sys/linux, executor: add syz_usb_ep_read syzkallAndrey Konovalov2019-07-011-2/+4
| | | | syz_usb_ep_read reads data from USB endpoints other than #0.
* sys/linux, executor: add basic USB HID fuzzing supportAndrey Konovalov2019-06-241-0/+1
| | | | | This commit adds the necessary descriptions and executor adjustments to enable targeted fuzzing of the enumeration process of USB HID devices.
* pkg/csource: generate timeouts for USB syzcallsAndrey Konovalov2019-05-311-0/+12
| | | | This patch only covers per call timeouts, per prog one is not adjusted yet.
* pkg/csource: add ability to annotate syscalls using comments in C reproducersAnton Lindqvist2019-05-241-1/+6
| | | | | | | | | | | | | | | | | | | | | Providing additional info, especially regarding syscall arguments, in reproducers can be helpful. An example is device numbers passed to mknod(2). This commit introduces an optional annotate function on a per target basis. Example for the OpenBSD target: $ cat prog.in mknod(0x0, 0x0, 0x4503) getpid() $ syz-prog2c -prog prog.in int main(void) { syscall(SYS_mmap, 0x20000000, 0x1000000, 3, 0x1012, -1, 0, 0); syscall(SYS_mknod, 0, 0, 0x4503); /* major = 69, minor = 3 */ syscall(SYS_getpid); return 0; }
* executor: implement support for leak checkingDmitry Vyukov2019-05-201-6/+0
| | | | | | | | | | | | | | | | | | | | | | | | | Leak checking support was half done and did not really work. This is heavy-lifting to make it work. 1. Move leak/fault setup into executor. pkg/host was a wrong place for them because we need then in C repros too. The pkg/host periodic callback functionality did not work too, we need it in executor so that we can reuse it in C repros too. Remove setup/callback functions in pkg/host entirely. 2. Do leak setup/checking in C repros. The way leak checking is invoked is slightly different from fuzzer, but much better then no support at all. At least the checking code is shared. 3. Add Leak option to pkg/csource and -leak flag to syz-prog2c. 4. Don't enalbe leak checking in fuzzer while we are triaging initial corpus. It's toooo slow. 5. Fix pkg/repro to do something more sane for leak bugs. Few other minor fixes here and there.
* executor: change syscall argument type to intptr_tmunjinoo2019-05-071-9/+9
| | | | | The type size of long depends on compiler. Therefore, changing to intptr_t makes it depends on architecture.
* pkg/csource: sort sys/types.h to the top on FreeBSDMark Johnston2019-03-071-1/+6
| | | | | sys/types.h is a special header that is required by many other system headers on FreeBSD.
* pkg/host: don't fail if CONFIG_FAIL_FUTEX is not enabledDmitry Vyukov2019-02-111-0/+4
| | | | | | See #991 and added comments. Fixes #991
* executor: remove ability to detect kernel bugsDmitry Vyukov2019-01-311-1/+0
| | | | | | | | This ability was never used but we maintain a bunch of code for it. syzkaller also recently learned to spoof this error code with some ptrace magic (probably intercepted control flow again and exploited executor binary). Drop all of it.
* pkg/csource: write tracing output to stderrDmitry Vyukov2019-01-311-2/+2
| | | | stdout is not flushed on abnormal exit.
* pkg/csource: split emitCall functionDmitry Vyukov2018-12-271-11/+16
| | | | | gometalinter points that emitCall is too complex. Factor out call name emission.
* pkg/csource: use 0 for missing syscall argsDmitry Vyukov2018-12-271-0/+6
| | | | | | | | | | | | | | We don't specify trailing unused args for some syscalls (e.g. ioctl that does not use its arg). Executor always filled tailing unsed args with 0's but pkg/csource didn't. Some such syscalls actually check that the unsed arg is 0 and as the result failed with C repro. We could statically check and eliminate all such cases, but it turns out the warning fires in 1500+ cases: https://gist.githubusercontent.com/dvyukov/e59ba1d9a211ee32fa0ba94fab86a943/raw/a3ace5a63f7281f0298f51ea9842ead1e4713418/gistfile1.txt So instead fill such args with 0's in pkg/csource too.
* pkg/csource: fix PRINTF removalDmitry Vyukov2018-12-261-1/+1
| | | | PRINTF now accepts arguments.
* prog, pkg/csource: more readable serialization for stringsDmitry Vyukov2018-12-151-52/+4
| | | | | | | Always serialize strings in readable format (non-hex). Serialize binary data in readable format in more cases. Fixes #792
* pkg/csource: support tun and setuid repros on {free,open}bsdGreg Steuck2018-12-131-5/+7
| | | | | | * expose procid on BSD for tun, always declare loop() * deal with terrible bsd includes * replicate loop() declaration
* executor: fix handling of big-endian bitfieldsDmitry Vyukov2018-12-081-6/+10
| | | | | Currently we apply big-endian-ness and bitfield-ness in the wrong order in copyin. This leads to totally bogus result. Fix this.
* pkg/runtest: fixes for fuchsiaDmitry Vyukov2018-09-061-1/+7
| | | | | | | Add simple fuchsia program, the one that is run during image testing. Fix csource errno printing for fuchsia. Fix creation of executable files (chmod is not implemented on fuchsia). Check that we get signal/coverage from all syscalls.
* executor: fix gcc warnings in fuchsia generated codeDmitry Vyukov2018-08-191-1/+1
| | | | | | gcc complains about function declarations not being prototypes, signed/unsigned cast mismatch and casts between incompatible functions. Fix them.
* pkg/csource: fix 32-bit syscall callsDmitry Vyukov2018-08-091-1/+7
| | | | | | syscall accepts args as ellipsis, resources are uint64 and take 2 slots without the cast, which is wrong. Cast resources to long when passing to syscall.
* pkg/csource: minor fixesDmitry Vyukov2018-08-031-1/+3
| | | | | | 1. Print errno with %u instead of %d 2. Avoid unused var warning for syz_emit_ethernet when tracing is enabled.
* pkg/csource: refactor generateCallsDmitry Vyukov2018-08-021-42/+48
| | | | | | Move call generation into a separate function. Update #538
* pkg/csource: refactor call generationDmitry Vyukov2018-07-311-27/+31
| | | | | | Slightly reduce cyclomatic complexity. Update #538
* pkg/csource: add option to trace syscall resultsDmitry Vyukov2018-07-271-8/+15
| | | | This will be needed for testing of generated programs.
* pkg/csource: tidy generated codeDmitry Vyukov2018-07-271-147/+61
| | | | | | | | | | | 1. Remove unnecessary includes. 2. Remove thunk function in threaded mode. 3. Inline syscalls into main for the simplest case. 4. Define main in common.h rather than form with printfs. 5. Fix generation for repeat mode (we had 2 infinite loops: in main and in loop). 6. Remove unused functions (setup/reset_loop, setup/reset_test, sandbox_namespace, etc).
* executor: overhaulDmitry Vyukov2018-07-241-63/+90
| | | | | | | | | | | | | | | | | Make as much code as possible shared between all OSes. In particular main is now common across all OSes. Make more code shared between executor and csource (in particular, loop function and threaded execution logic). Also make loop and threaded logic shared across all OSes. Make more posix/unix code shared across OSes (e.g. signal handling, pthread creation, etc). Plus other changes along similar lines. Also support test OS in executor (based on portable posix) and add 4 arches that cover all execution modes (fork server/no fork server, shmem/no shmem). This change paves way for testing of executor code and allows to preserve consistency across OSes and executor/csource.
* prog, pkg/compiler: support fmt typeDmitry Vyukov2018-07-081-28/+66
| | | | | fmt type allows to convert intergers and resources to string representation.
* pkg/csource: prevent unused-result warningsDmitry Vyukov2018-07-021-2/+2
| | | | | | Warnings for write unused-result fire on travis, somehow I don't get them locally. Use the result in a fake way to prevent the warning.
* pkg/csource: account for different types of syscalls on fuchsiaDmitry Vyukov2018-06-301-5/+10
|
* pkg/csource: support fuchsiaDmitry Vyukov2018-06-291-43/+40
| | | | Lots of assorted heavylifting to support csource on fuchsia.
* Makefile, sys/targets: move all native compilation logic to sys/targetsDmitry Vyukov2018-06-061-1/+1
| | | | | | | | | | | | | | | We currently have native cross-compilation logic duplicated in Makefile and in sys/targets. Some pieces are missed in one place, some are in another. Only pkg/csource knows how to check for -static support. Move all CC/CFLAGS logic to sys/targets and pull results in Makefile. This should make Makefile work on distros that have broken x86_64-linux-gnu-gcc, now we will use just gcc. And this removes the need to define NOSTATIC, as it's always auto-detected. This also paves the way for making pkg/csource work on OSes other than Linux.
* gometalinter: enable line length checkingDmitry Vyukov2018-05-041-14/+22
| | | | | | | 120 columns looks like a reasonable limit and requires few changes to existing code. Update #538
* sys/linux: add support for reading partition tablesDmitry Vyukov2018-04-011-1/+2
|
* executor: fix compilation warningsDmitry Vyukov2018-03-301-1/+1
| | | | | | | | SYS_memfd_create define produces warning in scource if system headers already contain the definition (we strip all ifdefs!). The same is true for CLONE_NEWCGROUP but we just never hit it yet. Also fix format string for 32 bits. Also fix potential uninit var in csource, and a missing new line.
* sys/linux: add support for mounting filesystem imagesDmitry Vyukov2018-03-301-1/+7
|
* sys/linux: add cgroup descriptionsDmitry Vyukov2018-03-251-3/+3
|
* executor: simplify initialize_tunDmitry Vyukov2018-02-261-6/+9
| | | | Remove executor_pid, enable_tun and setup_tun.
* executor: use proper default values for resourcesDmitry Vyukov2018-02-261-48/+46
| | | | | | | | | We currently use -1 as default value for resources when the actual value is not available. -1 is good for fd's, but is not the right default value for pointers/keys/etc. Pass from prog and use in executor proper default value for resources.
* prog: rework address allocationDmitry Vyukov2018-02-191-11/+36
| | | | | | | | | | | | 1. mmap all memory always, without explicit mmap calls in the program. This makes lots of things much easier and removes lots of code. Makes mmap not a special syscall and allows to fuzz without mmap enabled. 2. Change address assignment algorithm. Current algorithm allocates unmapped addresses too frequently and allows collisions between arguments of a single syscall. The new algorithm analyzes actual allocations in the program and places new arguments at unused locations.
* pkg/csource: fix build of generated filesDmitry Vyukov2018-01-061-1/+1
| | | | | | | | | On another machine both clang and gcc produce: test.c:163:32: error: invalid suffix "+procid" on integer constant *(uint32_t*)0x20001004 = 0x25dfdbfe+procid*4; Not sure why this wasn't caught on buildbot.
* pkg/csource: tidy up generated code a bitDmitry Vyukov2017-12-271-15/+25
| | | | | | | Remove dup newlines around includes. Makes int values shorter if not hurting readability. Increase line len to 80. Remove {} when not needed during copyout.
* pkg/csource: add top-level repeat loopDmitry Vyukov2017-12-271-16/+28
| | | | | | | | Even if all 3 levels of processes in executor exit, execprog will still recreate them. Model the same in csource. This matters when the inner process kills loop and then everything stops.
* pkg/csource: simplify generated codeDmitry Vyukov2017-12-271-5/+3
| | | | We already have procid variable, no need to introduce i.
* executor: check format stringsDmitry Vyukov2017-12-271-0/+1
| | | | | | | | | | | | | | | | | | | I see a crash which says: #0: too much cover 0 (errno 0) while the code is: uint64_t n = ...; if (n >= kCoverSize) fail("#%d: too much cover %u", th->id, n); It seems that the high part of n is set, but we don't see it. Add printf format attribute to fail and friends and fix all similar cases. Caught a bunch of similar cases and a missing argument in: exitf("opendir(%s) failed due to NOFILE, exiting");
* pkg/csource: mimic the way syscalls are scheduled in executorDmitry Vyukov2017-12-221-22/+6
| | | | | | | | Currently csource uses completely different, simpler way of scheduling syscalls onto threads (thread per call with random sleeps). Mimic the way calls are scheduled in executor. Fixes #312
* pkg/csource: fix handling of proc typesDmitry Vyukov2017-12-221-18/+36
| | | | | | | | | | Generated program always uses pid=0 even when there are multiple processes. Make each process use own pid. Unfortunately required to do quite significant changes to prog, because the current format only supported fixed pid. Fixes #490
* pkg/csource: limit thread stacksDmitry Vyukov2017-12-221-2/+5
| | | | | | | | | We always set RLIMIT_AS to 128MB. I've debugged a program with 21 syscalls. With collide it creates 42 threads. With default stack size of 8MB this requires: 42*8 = 336MB. Thread creation fails and nothing works. Limit thread stacks the same way executor does. Fixes #488
* pkg/csource: fix string escaping bugDmitry Vyukov2017-12-221-0/+2
|
* pkg/csource: make strings more readableDmitry Vyukov2017-12-171-11/+56
| | | | | If string contains a file name or a crypto alg name, don't escape it all to hex.
* prog: use dense indexes for copyout instructionsDmitry Vyukov2017-12-171-13/+42
| | | | Fixes #174
generated by ggit (джигит) mrf-deployment (git 2.46.0) at 2026-03-11 22:56:37 +0000