aboutsummaryrefslogtreecommitdiffstats
path: root/pkg/csource/csource.go
Commit message (Collapse)AuthorAgeFilesLines
* pkg/csource: remove include guards from reproducersAlexander Potapenko2025-10-271-0/+3
| | | | Drop all lines matching `#define [A-Z0-9_]*_H` from the reproducers
* pkg/csource: add call argument annotations to generated C-source filesEthan Graham2025-08-041-5/+53
| | | | | | | | | | | The structure of arguments passed into syscalls is often hard to parse since it is memcpy'd into mmap'd regions. Structural relations are often lost in translation, resulting in reproducers that take longer for a developer to understand. This patch adds functionality for parsing syscall arguments semantically and emitting a structured and human-readable comment which is inserted before each syscall in the resulting C-source.
* all: apply linter auto fixesTaras Madan2025-07-171-7/+7
| | | | ./tools/syz-env bin/golangci-lint run ./... --fix
* pkg/csource: enforce the bit size of -1Aleksandr Nogikh2025-04-101-8/+16
| | | | | | | | | | | syscall() is a variadic function, so we need to be careful when passing const values in there without specifying their type. For -1, we did not specify it, and on 64 bit architectures the de facto passed value was 0xFFFFFFFF instead of 0xFFFFFFFFFFFFFFFF. Fix it and add a test. Closes #5921.
* sys/targets: mark big-endian targetsDmitry Vyukov2024-06-041-2/+2
| | | | | | Litte-endian is kind of default (except for s390). So instead of saying that each arch is litte-endian, mark only s390 as big-endian.
* pkg/csource: remove the Repro optionAleksandr Nogikh2024-05-171-3/+1
| | | | Enable it unconditionally.
* prog: don't require preallocated buffer for exec encodingDmitry Vyukov2024-04-161-3/+2
| | | | | | If we send exec encoding to the fuzzer, it's not necessary to serialize exec encoding into existing buffer (currnetly we serialize directly into shmem). So simplify code by serializing into a new slice.
* prog: profile what consumes space in exec encodingDmitry Vyukov2024-04-151-1/+1
| | | | | | | | Allow to profile how many bytes are consumed for what in the exec encoding. The profile shows there are not many opportunities left. 53% are consumed by data blobs. 13% for const args. 18% for non-arg things (syscall number, copyout index, props, etc).
* pkg/csource: remove akaros quirkDmitry Vyukov2024-04-151-4/+2
|
* pkg/csource: annotate syscall() args with their pretty-printed valuesFlorent Revest2024-02-011-1/+51
| | | | | | | This factorizes const arguments into the shortest flags OR bitmask possible so they are easy to read. E.g: /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul
* all: use special placeholder for errorsTaras Madan2023-07-241-2/+2
|
* pkg/csource: annotate syscall() args with their namesFlorent Revest2023-06-091-3/+9
| | | | | | | | | This annotates syscall arguments so they are easier to read without having to pull out the syscall's man page. E.g: syscall(__NR_mmap, /*addr=*/0x21000000ul, /*len=*/0x1000ul, /*prot=*/0ul, ... Signed-off-by: Florent Revest <revest@chromium.org>
* sys/targets: introduce HasCallNumber to reduce clutterGreg Steuck2023-04-251-3/+2
| | | | This centralizes all strings.HasPrefix(callName, "syz_") checks.
* pkg/csource: refactor parameters of constArgToStr into helpersGreg Steuck2023-04-251-16/+27
| | | | | | While there, return a fully formed call expression instead of piecing into a Buffer. There's hardly a good reason to do this and not mutating state from outside is more readable.
* pkg/csource: introduce more structure into emitCallBodyGreg Steuck2023-04-251-16/+13
|
* pkg/csource: abstract/recompute isNativeGreg Steuck2023-04-251-7/+12
| | | | It belongs to targets.Target.
* all: tools/syz-env make generate resultTaras Madan2023-02-241-17/+17
|
* Revert "pkg/csource: inline void* cast into generated code"Dmitry Vyukov2022-09-061-1/+1
| | | | | | | This reverts commit 922294abb4c0bc72b24d8526d625110d73fa1b5a. The commit reported to cause old warnings on s390x: https://github.com/google/syzkaller/commit/922294abb4c0bc72b24d8526d625110d73fa1b5a#commitcomment-83096994
* pkg/csource: inline void* cast into generated codeGreg Steuck2022-09-051-1/+1
| | | | | The previous indirection via conditional macros in platform specific places was needless obfuscation.
* pkg/csource: account for padding arguments in trampolined sycallsGreg Steuck2022-09-051-1/+1
| | | | The cast had a wrong signature failing to account for padding.
* pkg/csource, pkg/instance, pkg/ipc, pkg/mgrconfig, tools/syz-prog2c, ↵Andrey Artemiev2022-08-061-8/+14
| | | | syz-manager: introduce a new setting 'sandbox_arg' (#3263)
* executor: added code to run Android with System accountAndrey Artemiev2022-07-191-1/+5
|
* executor: fail on SEGV during clone()Aleksandr Nogikh2022-01-211-0/+2
| | | | | | | | | | | | | | | As was found out in #2921, fork bombs are still possible in Linux-based instances. One of the possible reasons is described below. An invalid stack can be passed to the clone() call, thus causing it to stumble on an invalid memory access right during returning from the clone() call. This is in turn catched by the NONFAILING() macro and the control actually jumps over it and eventually both the child and the parent continue executing the same code. Prevent it by handling SIGSEGV and SIGBUS differently during the clone process. Co-authored-by: Andrei Vagin <avagin@google.com>
* all: add syz_clone() and syz_clone3() pseudo callsAleksandr Nogikh2022-01-131-0/+1
| | | | | | | | | | | | | | | | | | | | As was pointed out in #2921, the current approach of limiting the number of pids per process does not work on all Linux-based kernels. We could just treat fork, clone and clone3 in a special way (e.g. exit on a zero return). However, in that case we also need to sanitize the arguments for clone and clone3 - if CLONE_VM is passed and stack is 0, the forked child processes (threads) will become nearly unindentifiable and will corrupt syz-executor's memory. While we could sanitize clone's arguments, we cannot do so for clone3 - nothing can guarantee that they will not be changed concurrently. Instead of calling those syscalls directly, introduce a special pseudo syscall syz_clone3. It copies and sanitizes the arguments and then executes clone3 (or fork, if we're on an older kernel) in such a way so as to prevent fork bombs from happening. Also introduce syz_clone() to still be able to fuzz it on older systems.
* all: explicitly list pseudo syscall dependenciesAleksandr Nogikh2022-01-131-0/+7
| | | | | | | | | | | Pseudo syscalls can (and most of the time) do invoke normal system calls. However, when there's a risk that those calls might not be present, syzkaller needs to take preventive actions - prepend the corresponding defines. Otherwise syz-executor or C reproducers might not compile on the host machine. List those dependencies in sys/targets, check them during machine check and add the corresponding defines during C source generation.
* all: add the `rerun` call propertyAleksandr Nogikh2021-12-101-0/+8
| | | | | | | | | | | | | | To be able to collide specific syscalls more precisely, we need to repeat the process many times. Introduce the `rerun` call property, which instructs `syz-executor` to repeat the call the specified number of times. The intended use is: call1() (rerun: 100, async) call2() (rerun: 100) For now, assign rerun values randomly to consecutive pairs of calls, where the first one is async.
* all: replace collide mode by `async` call propertyAleksandr Nogikh2021-12-101-0/+11
| | | | | | | | | | | | | Replace the currently existing straightforward approach to race triggering (that was almost entirely implemented inside syz-executor) with a more flexible one. The `async` call property instructs syz-executor not to block until the call has completed execution and proceed immediately to the next call. The decision on what calls to mark with `async` is made by syz-fuzzer. Ultimately this should let us implement more intelligent race provoking strategies as well as make more fine-grained reproducers.
* pkg/csource: fix call list filtering not being consistentAleksandr Nogikh2021-10-091-20/+23
| | | | | | | | | | There is a bug in the current implementation that leads to csource using the original and the new call lists at the same time. That has led to a bunch of TestGenerate failures. Enforce the module only to use variables put into the csource context in order to avoid similar mistakes in the future.
* pkg/csource: remove calls instead of skipping themAleksandr Nogikh2021-10-011-14/+31
| | | | | | | | | | | | | | | | | | Currently csource skips calls at the very last moment, which has an unpleasant consequence - if we make choice of enabled defines depend on the individual calls or call properties, we may end up with defined yet unused functions. The perfect solution would be to untie syz_emit_ethernet/syz_extract_tcp_res and NetInjection, and also to untie VhciInjection and syz_emit_vhci. For the time being, move these checks to the very beginning of csource processing, so that these calls could be removed before we construct our defines. Adjust pkg/csource/csource_test.go to better cover fault injection generation problems.
* all: refactor fault injection into call propsAleksandr Nogikh2021-09-221-2/+2
| | | | | | | | | | | | Now that call properties mechanism is implemented, we can refactor fault injection. Unfortunately, it is impossible to remove all traces of the previous apprach. In reprolist and while performing syz-ci jobs, syzkaller still needs to parse the old format. Remove the old prog options-based approach whenever possible and replace it with the use of call properties.
* pkg/compiler: optimize array[const] representationDmitry Vyukov2021-04-211-2/+7
| | | | | | | | | | | | | | Represent array[const[X, int8], N] as string["XX...X"]. This replaces potentially huge number of: NONFAILING(*(uint8_t*)0x2000126c = 0); NONFAILING(*(uint8_t*)0x2000126d = 0); NONFAILING(*(uint8_t*)0x2000126e = 0); with a single memcpy. In one reproducer we had 3991 such lines. Also replace memcpy's with memset's when possible. Update #1070
* pkg/report: detect executor failuresDmitry Vyukov2021-02-211-1/+1
| | | | | | | | | | | | Currently all executor fail errors go into "lost connection" bucket. This is not very useful. First, there are different executor failures. Second, it's not possible to understand what failures happen how frequently. Third, there are not authentic lost connection. Create separate SYZFAIL: bugs for them. Update #573 Update #502 Update #318
* all: make timeouts configurableDmitry Vyukov2020-12-281-3/+5
| | | | | | Add sys/targets.Timeouts struct that parametrizes timeouts throughout the system. The struct allows to control syscall/program/no output timeouts for OS/arch/VM/etc. See comment on the struct for more details.
* executor: remove hardcoded timeoutsDmitry Vyukov2020-12-251-1/+2
| | | | | In preparation for making timeouts tunable based on OS/arch/VM/etc de-hardcode all (almost) timeouts in executor.
* sys/targets: add OS/Arch name constsDmitry Vyukov2020-10-261-3/+3
| | | | | | | | | | | | We use strings to identify OS/Arch. These strings are duplicated throughout the code base massively. golangci-lint points to possiblity of typos and duplication. We already had to define these names in pkg/csource and disable checking for prog package. A future change triggers such warnings in another package. Add OS/Arch name consts to sys/targets so that they can be used to refer to OS/Arch. Use the consts everywhere.
* pkg/csource: add description of the generation processDmitry Vyukov2020-08-101-0/+20
|
* all: initialize vhci in linuxTheOfficialFloW2020-07-301-2/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * all: initialize vhci in linux * executor/common_linux.h: improve vhci initialization * pkg/repro/repro.go: add missing vhci options * executor/common_linux.h: fix type and add missing header * executor, pkg: do it like NetInjection * pkg/csource/csource.go: do not emit syz_emit_vhci if vhci is not enabled * executor/common_linux.h: fix format string * executor/common_linux.h: initialize with memset For som reason {0} gets complains about missing braces... * executor/common_linux.h: simplify vhci init * executor/common_linux.h: try to bring all available hci devices up * executor/common_linux.h: find which hci device has been registered * executor/common_linux.h: use HCI_VENDOR_PKT response to retrieve device id * sys/linux/dev_vhci.txt: fix structs of inquiry and report packets * executor/common_linux.h: remove unnecessary return statement and check vendor_pkt read size * executor/common_linux.h: remove unnecessary return statement and check vendor_pkt read size * sys/linux/dev_vhci.txt: pack extended_inquiry_info_t * sys/linux/l2cap.txt: add l2cap_conf_opt struct * executor/common_linux.h: just fill bd addr will 0xaa * executor/common_linux.h: just fill bd addr will 0xaa
* executor: wrap all syscalls into NONFAILINGDmitry Vyukov2020-07-151-32/+47
| | | | | | | | | | | | | | | Currently we sprinkle NONFAILING all over pseudo-syscall code, around all individual accesses to fuzzer-generated pointers. This is tedious manual work and subject to errors. Wrap execute_syscall invocation with NONFAILING in execute_call once instead. Then we can remove NONFAILING from all pseudo-syscalls and never get back to this. Potential downsides: (1) this is coarser-grained and we will skip whole syscall on invalid pointer, but this is how normal syscalls work as well, so should not be a problem; (2) we will skip any clean up (closing of files, etc) as well; but this may be fine as well (programs can perfectly leave open file descriptors as well). Update #1918
* all: fix comments formatDmitry Vyukov2020-07-121-6/+6
| | | | | | | Fix capitalization, dots at the end and two spaces after a period. Update #1876
* executor: fix bitfields for big-endian archAlexander Egorenkov2020-07-101-2/+6
| | | | | | | | Add bitfield tests for big-endian arch Issue: #1885 Signed-off-by: Alexander Egorenkov <Alexander.Egorenkov@ibm.com>
* all: don't compare string len with 0Dmitry Vyukov2020-07-041-1/+1
| | | | | | | For strings it's more readable to compare the string itself with "", instead of comparing len with 0. Fix all such cases. Update #1876
* pkg/csource: fix casting of parameters for trampolinesAlexander Egorenkov2020-06-261-3/+4
| | | | Signed-off-by: Alexander Egorenkov <Alexander.Egorenkov@ibm.com>
* sys/linux: first 64bit big-endian architecture s390xAlexander Egorenkov2020-06-251-1/+4
| | | | | | | | | | | | | | | * mmap syscall is special on Linux s390x because the parameters for this syscall are passed as a struct on user stack instead of registers. * Introduce the SyscallTrampolines table into targets.Target to address the above problem. * There is a bug in Linux kernel s390x which causes QEMU TCG to hang when KASAN is enabled. The bug has been fixed in the forthcoming Linux 5.8 version. Until then do not enable KASAN when using QEMU TCG, QEMU KVM shall have no problems with KASAN. Signed-off-by: Alexander Egorenkov <Alexander.Egorenkov@ibm.com>
* pkg/csource: init res var in generated callDmitry Vyukov2020-05-041-1/+1
| | | | | | | | | | | | | | | It seems that gcc in ubuntu on travis got dumber: <stdin>: In function ‘execute_call’: <stdin>:1741:6: error: ‘res’ may be used uninitialized in this function [-Werror=maybe-uninitialized] cc1: all warnings being treated as errors compiler invocation: arm-linux-gnueabi-gcc [-o /tmp/syz-executor675297211 -DGOOS_linux=1 -DGOARCH_arm=1 -DHOSTGOOS_linux=1 -x c - -O2 -pthread -Wall -Werror -Wparentheses -Wframe-larger-than=16384 -D__LINUX_ARM_ARCH__=6 -march=armv6 -static -Wno-overflow] https://travis-ci.com/github/dvyukov/syzkaller/jobs/327487382 Though, we generate the same code and res seems to be initialized on all paths. Initialize it explicitly.
* sys/linux: add timeout call attributesDmitry Vyukov2020-04-191-12/+1
| | | | | | | Move additional call/prog timeouts to descriptions. Due to this logic duplication executor used 50ms for syz_mount_image, while pkg/csource used 100ms.
* prog: refactor target.MakeMmapDmitry Vyukov2020-04-181-1/+1
| | | | | | | | | | | Make MakeMmap return more than 1 call. This is a preparation for future changes. Also remove addr/size as they are effectively always the same and can be inferred from the target (will also conflict with the future changes). Also rename to MakeDataMmap to better represent the new purpose: it's just some arbitrary mmap, but rather mapping of the data segment.
* executor, sys/linux: add ath9k usb descriptionsAndrey Konovalov2020-03-131-7/+8
| | | | | | | Among other things this changes timeout for USB programs from 2 to 3 seconds. ath9k fuzzing also requires ath9k firmware to be present, so system images need to be regenerated with the updated script.
* executor: fix syz_mount_imageDmitry Vyukov2019-12-101-0/+1
| | | | | | | 1. It always crashed in cover_reset when coverage is disabled. 2. Use NONFAILING when accessing image segments. 3. Give it additional 100 ms as it may be slow. 4. Add a test for syz_mount_image.
* pkg/csource: rename some optionsDmitry Vyukov2019-11-161-1/+1
| | | | | Rename some options in preparation for subsequent changes which will align names across the code base.
* pkg/csource: Force promotion of 64-bit constant valuesMark Johnston2019-11-081-4/+26
| | | | | | | | | | Constant 64-bit arguments to the variadic syscall(2) must have their width specified explicitly. In practice this is not necessary most of the time, but on amd64/freebsd with clang the compiler can and does store the constant 32-bit value to the stack, leaving garbage in the upper 32 bits. This makes C reproducers somewhat uglier, but I see no other solution.
generated by ggit (джигит) mrf-deployment (git 2.46.0) at 2026-03-11 21:08:21 +0000