aboutsummaryrefslogtreecommitdiffstats
path: root/pkg/csource/generated.go
Commit message (Collapse)AuthorAgeFilesLines
* executor: tolerate syz_genetlink_get_family_id failuresAleksandr Nogikh2022-02-251-3/+1
| | | | | | | | | | We cannot expect syscalls to always succeed during fuzzing, especially when the situation involves a complex interaction with the system. For the syz_genetlink_get_family_id case, it leads to numerous SYZFAIL crashes every day. Don't print a SYZFAIL error for this pseudo syscall.
* executor: fail on SEGV during clone()Aleksandr Nogikh2022-01-211-1/+21
| | | | | | | | | | | | | | | As was found out in #2921, fork bombs are still possible in Linux-based instances. One of the possible reasons is described below. An invalid stack can be passed to the clone() call, thus causing it to stumble on an invalid memory access right during returning from the clone() call. This is in turn catched by the NONFAILING() macro and the control actually jumps over it and eventually both the child and the parent continue executing the same code. Prevent it by handling SIGSEGV and SIGBUS differently during the clone process. Co-authored-by: Andrei Vagin <avagin@google.com>
* executor: add extension point for adding non-mainline pseudo-syscallsDmitry Vyukov2022-01-191-0/+1
| | | | | | | | | | Add an empty common_ext.h which is included into executor and C reproducers and can be used to add non-mainline pseudo-syscalls w/o changing any other files (by replacing common_ext.h file). It would be good to finish #2274 which allows to add pseudo-syscalls along with *.txt descriptions, but #2274 is large and there are several open design questions. So add this simple extension point for now.
* all: create 8 tun devices for OpenBSDAleksandr Nogikh2022-01-141-2/+2
| | | | | Currently only 4 are created by default. This limits the maximum number of simultaneously running syz-executors.
* all: add syz_clone() and syz_clone3() pseudo callsAleksandr Nogikh2022-01-131-0/+47
| | | | | | | | | | | | | | | | | | | | As was pointed out in #2921, the current approach of limiting the number of pids per process does not work on all Linux-based kernels. We could just treat fork, clone and clone3 in a special way (e.g. exit on a zero return). However, in that case we also need to sanitize the arguments for clone and clone3 - if CLONE_VM is passed and stack is 0, the forked child processes (threads) will become nearly unindentifiable and will corrupt syz-executor's memory. While we could sanitize clone's arguments, we cannot do so for clone3 - nothing can guarantee that they will not be changed concurrently. Instead of calling those syscalls directly, introduce a special pseudo syscall syz_clone3. It copies and sanitizes the arguments and then executes clone3 (or fork, if we're on an older kernel) in such a way so as to prevent fork bombs from happening. Also introduce syz_clone() to still be able to fuzz it on older systems.
* executor: remove custom sys_io_uring_setup definitionAleksandr Nogikh2022-01-131-7/+1
|
* executor: remove sys_memfd_create definesAleksandr Nogikh2022-01-131-19/+1
| | | | | Add memfd_create as a dependency to syz_mount_image and syz_read_part_table.
* executor: move SYSCALL_DEFINES above common_*.h includesAleksandr Nogikh2022-01-131-1/+4
| | | | | Otherwise the pseudo syscalls there won't be able to access those definitions.
* executor: bump on FreeBSD the maximum number of tun devices to 256 (#2956)Michael Tüxen2021-12-311-0/+3
| | | | | | | syz-execprog now uses twice the number of CPU cores as the number of processes. Each process might use a tun device. So bump the maximum number of tun devices to the maximum of 256, which allows syz-execprog to run with default settings on systems with up to 128 cores.
* executor: support larger maximum number of tun devices on *BSD (#2953)Michael Tüxen2021-12-301-8/+14
|
* all: replace collide mode by `async` call propertyAleksandr Nogikh2021-12-101-12/+2
| | | | | | | | | | | | | Replace the currently existing straightforward approach to race triggering (that was almost entirely implemented inside syz-executor) with a more flexible one. The `async` call property instructs syz-executor not to block until the call has completed execution and proceed immediately to the next call. The decision on what calls to mark with `async` is made by syz-fuzzer. Ultimately this should let us implement more intelligent race provoking strategies as well as make more fine-grained reproducers.
* executor: spread overlapping fdsAleksandr Nogikh2021-12-061-4/+4
| | | | | | | There's a chance that the methods from common_bsd.h and common_linux.h could dup2 (and thus close) an fd belonging to a kcov instance. Prevent this by adjusting fd consts.
* executor: changed initialization of VMCS fieldsAyomide Erinfolami2021-12-011-1/+1
| | | | | | | Initializing the VMCS fields Pin-based VM-execution controls and Primary processor-based VM-execution controls to 0 and setting their reserved bits using the appropriate MSRs increase coverage for arch/x86/kvm/vmx/nested.c from 19% to 43%.
* executor: do not follow symlinks during umountAleksandr Nogikh2021-10-291-4/+4
| | | | | Add a UMOUNT_NOFOLLOW flag to umount2 in order to prevent remove_dir from unmounting what was not mounted by the executed program.
* all: add binderfs fuzzing supportAleksandr Nogikh2021-10-291-0/+28
| | | | | | | | Create one instance of binderfs per process and add descriptions to enable syzkaller to create binderfs mounts and binder devices itself. Keep descriptions compatible with the legacy mode (when devices are created at boot time).
* executor: don't mount some cgroup controllers during setupDmitry Vyukov2021-10-131-3/+3
| | | | | | | Leave some controllers unbound so that the fuzzer can mount them during fuzzing. This is suboptimal because all controllers are global (so different test processes will collide, state accumulate, etc), but this still should give at least some new coverage.
* executor: don't fail on cgroup mountingDmitry Vyukov2021-10-131-2/+3
| | | | | | | | | | | | | | | | On stretch images setup_cgroups fails as: mount(/syzcgroup/net, net) failed: 22 mount(/syzcgroup/net, net_cls) failed: 22 mount(/syzcgroup/net, net_prio) failed: 22 mount(/syzcgroup/net, blkio) failed: 22 SYZFAIL: mount cgroup failed (/syzcgroup/net, devices,freezer): 16 (errno 16: Device or resource busy) It seems that systemd starts messing with these mounts somehow and repeated mounting fails with EBUSY. Don't hard fail on that error.
* executor: setup cgroups onceDmitry Vyukov2021-10-121-7/+3
| | | | | | | Currently we setup cgroups on every test process start (along with sandbox creation). That's unnecessary because that's global per-machine setup. Move cgroup setup into setup section that's executed once per machine from pkg/host.Setup.
* executor: enable cgroup controllers one-by-oneDmitry Vyukov2021-10-121-18/+39
| | | | | | | | Currently we enable all controllers at once. As the result if one of them fails (b/c of older kernel or not enabled configs), all will fail. Enable them one-by-one instead. This way we can support kernels that don't have all of the controllers.
* executor: mount new cgroupsDmitry Vyukov2021-10-121-2/+2
| | | | Mount net, blkio, rlimit cgroups.
* executor: work around clang-format issueDmitry Vyukov2021-10-051-4/+6
| | | | | | | | clang-format mis-formats #elif: https://bugs.llvm.org/show_bug.cgi?id=48664 and then clang fails with: error: misleading indentation; statement is not part of the previous 'if' Split #elif into nested #if/else.
* executor: check for single-line compound statementsDmitry Vyukov2021-10-011-12/+6
| | | | | | Historically the code base does not use single-line compound statements ({} around single-line blocks). But there are few precedents creeped into already. Add a check to keep the code base consistent.
* all: refactor fault injection into call propsAleksandr Nogikh2021-09-221-3/+9
| | | | | | | | | | | | Now that call properties mechanism is implemented, we can refactor fault injection. Unfortunately, it is impossible to remove all traces of the previous apprach. In reprolist and while performing syz-ci jobs, syzkaller still needs to parse the old format. Remove the old prog options-based approach whenever possible and replace it with the use of call properties.
* executor: add missing includes to BSD's setup_faultAleksandr Nogikh2021-09-221-0/+1
|
* executor/common_kvm_ppc64: fuzz more hypercallsAlexey Kardashevskiy2021-09-161-8/+8
| | | | | | | | | | | | | At the moment syzkaller only fuzzes the platform architecture defined hypercalls. However there are custom defined hypercalls which KVM handles, they make 2 groups - an extension of hypercalls and so-called ultracalls which are handled by the secure VM firmware but in absense of the secure VM facility, KVM gets to handle those as errors. This enables the two extra groups of hypercalls in KVM. If not enabled, KVM exits to let the userspace handle them (which syzkaller does not do). Signed-off-by: Alexey Kardashevskiy <aik@linux.ibm.com>
* executor/common_kvm_ppc64: enable nested KVMAlexey Kardashevskiy2021-09-161-0/+17
| | | | | | This is necessary to make KVM actually execute the instructions. Signed-off-by: Alexey Kardashevskiy <aik@linux.ibm.com>
* sys: skip kvm const extraction for non i386/amd64Aleksandr Nogikh2021-09-131-4/+4
| | | | | | | | | | | | It is impossible to compile a number of definitions in include/uapi/linux/kvm.h for other platforms, which leads to syz-extract failing to update constants. Skip processing of this file for all arches except i386 and amd64. This is a hacky and (hopefully) temporary solution until #2754 is implemented.
* executor: ifconfig destroy wants the interface (not device) name (#2739)Greg Steuck2021-09-021-1/+1
| | | | | | | | At least on OpenBSD this is the behavior: % doas ifconfig tun5 create % doas ifconfig tun5 destroy % doas ifconfig tun5 create % doas ifconfig /dev/tun5 destroy ifconfig: SIOCIFDESTROY: Invalid argument
* pkg/ifuzz/powerpc: add some RTAS fuzzingAlexey Kardashevskiy2021-07-191-0/+14
| | | | | | | | | | | | | | | RunTime Abstraction Services (RTAS) is an API used by the Linux powerpc/pseries platform to talk to the hypervisor. Under KVM, this is implemented as a custom hypercall (which we have support for) and an in memory array of parameters. The hypercall is H_RTAS and its only parameter is a pointer to the mentioned array. The vast majority of RTAS calls are handled normally by QEMU and only a handful by KVM. This adds fuzzing of 4 RTAS calls. This uses a chunk from main 256MB RAM for parameters. The parameters are big endian hence "<<24" for the token. To allow more targeted fuzzing, use iset.GenerateInt(). Signed-off-by: Alexey Kardashevskiy <aik@linux.ibm.com>
* executor/common_kvm_ppc64: run with enabled MMUAlexey Kardashevskiy2021-07-191-0/+126
| | | | | | | | | | | | | | | | | | | | | This sets up a page table to map the text in order to exercise more code paths in the KVM. This defines flags to control the MMU state. When enabled, this creates a simple page table at the 64K offset and maps all the RAM. The fuzzer code is placed right after the table. The flags are: IR - enables MMU for instruction fetches DR - enables MMU for data loads/stores PR - "problem state", i.e. userspace (implies DR and IR) PID1 - initializes a process table for PID>0 (PID#0 is used by the VM OS normally) This adds a simple "syz_kvm_setup_cpu_ppc64" syz-test with MSR=IR|DR|LE which is a typical Linux kernel mode. Signed-off-by: Alexey Kardashevskiy <aik@linux.ibm.com>
* executor/common_kvm_ppc64: fix KVM supportAlexey Kardashevskiy2021-07-191-92/+174
| | | | | | | | | | | | | | | | | | | | | | | | | | Turns out the ifuzz on powerpc did not ever properly work. This fixes syz_kvm_setup_cpu$ppc64: Enable the PAPR KVM capability (otherwise KVM_RUN fails right away). Finish generated sequences with the software debug breakpoint as there is no x86's "hlt" variant on POWER and otherwise KVM won't exit. Add exception handlers, use the software debug breakpoint instruction to trigger immediate exit from KVM with the only exception of the decrementer interrupt handler (timer) to recharge the timer and continue. Define and use endianness selection flag (Big vs. Little endian). Define the code generator similar to kvm_gen.cc which for now contains 2 simple tests and the decrementer interrupt handler code. Add test cases to the executor so "bin/linux_ppc64le/syz-executor test" can run some sensible tests. The tests copy 0xbadc0de around similar to x86 and uses gpr[3] is a return value register (similar to EAX). Signed-off-by: Alexey Kardashevskiy <aik@linux.ibm.com>
* executor: initialize scope in fault_ioc_infoChuck Silvers2021-07-021-0/+1
| | | | | The "scope" field of struct fault_ioc_info is an input to the ioctl, so initialize it to FAULT_SCOPE_LWP to match other fault_ioc_* usage.
* sys/darwin: initial syscall definitionsPatrick Meyer2021-06-071-1/+1
| | | | Pretty much ripped from freebsd +/- what isn't applicable to darwin.
* executor: initial darwin supportPatrick Meyer2021-05-201-16/+21
|
* executor: move vm.nr_overcommit_hugepages into configDmitry Vyukov2021-05-121-1/+0
| | | | | Move the sysctl into config, so that kernels can opt out of it if necessary (not all kernels enable it and interested in testing).
* executor: set ctrl-alt-del sysctl to 0Dmitry Vyukov2021-04-221-1/+6
| | | | | | | This blocks some of the ways the fuzzer can trigger a reboot. ctrl-alt-del=0 tells kernel to signal cad_pid instead of rebooting and setting cad_pid to the current pid (transient "syz-executor setup") makes it a no-op. For context see: https://groups.google.com/g/syzkaller-bugs/c/WqOY4TiRnFg/m/6P9u8lWZAQAJ
* executor: fix driver.h import path in common_fuchsia.hMarco Vanotti2021-04-091-1/+1
| | | | The `driver.h` header moved from `ddk/driver.h` to `lib/ddk/driver.h`.
* dashboard/config/linux: disable BPF_JIT on subset of instancesDmitry Vyukov2021-03-091-1/+0
| | | | | Currently we enable JIT always and don't test interpreter. Enable JIT on subset of instances and disable on others using kernel config.
* executor: don't setup x86-specific sysctl on non-x86Dmitry Vyukov2021-03-071-15/+17
| | | | | /sys/kernel/debug/x86/nmi_longest_ns is x86 specific, don't set it on non-x86 arches.
* executor: disable rfkill during setupDmitry Vyukov2021-03-041-0/+18
| | | | | If rfkill is enabled by the fuzzer, wifi setup will fail. Disable rfkill to initial state during setup.
* pkg/report: detect executor failuresDmitry Vyukov2021-02-211-114/+104
| | | | | | | | | | | | Currently all executor fail errors go into "lost connection" bucket. This is not very useful. First, there are different executor failures. Second, it's not possible to understand what failures happen how frequently. Third, there are not authentic lost connection. Create separate SYZFAIL: bugs for them. Update #573 Update #502 Update #318
* executor: don't fail in syz_genetlink_get_family_idDmitry Vyukov2021-02-191-82/+113
| | | | | | | | | | We used to use our own netlink socket and then fail on any errors. But commit "sys/linux: add ieee802154 descriptions" made it possible to use fuzzer-provided socket, and fuzzer can pass any invalid fd. So don't fail on errors now. Fixes #2444
* sys/linux: add ieee802154 descriptionsDmitry Vyukov2021-02-121-16/+73
|
* executor: don't include kvm on armDmitry Vyukov2021-01-261-1/+1
| | | | | | KVM was removed for arm architecture. Latest Linux headers don't contain <asm/kvm.h> for arm. So don't even include them.
* executor/common: repair clang complaint about bad indentationGreg Steuck2020-12-301-1/+2
| | | | | dashboard link: https://syzkaller.appspot.com/bug?extid=38fe37bc451a42e6c9a4 Reported-by: syzbot+38fe37bc451a42e6c9a4@syzkaller.appspotmail.com
* executor: remove hardcoded timeoutsDmitry Vyukov2020-12-251-4/+10
| | | | | In preparation for making timeouts tunable based on OS/arch/VM/etc de-hardcode all (almost) timeouts in executor.
* executor: skip setsid() for threaded reproducersAnton Lindqvist2020-12-091-2/+7
| | | | | | | | | | | | Lately, I've been looking into why such low amount of syz reproducers on OpenBSD are turned into C reproducers. One thing I did notice is that such syz reproducers have one thing in common: they use the threaded=true and sandbox=none parameters. Such C reproducer always exits non-zero early on since the call to setsid() fails with EPERM. Meaning, the calling process is already a process group leader. Not sure if the preprocessor conditional should be tweaked in order to avoid unwanted side effects on other BSDs or configurations.
* executor: tune few more sysctl'sDmitry Vyukov2020-12-011-0/+3
| | | | | | | | | | | | | Faster gc (1 second) is intended to make tests more repeatable. {"/proc/sys/kernel/keys/gc_delay", "1"}, Huge page overcommit is disabled by default, allowing some overcommit is intended to give more coverage. {"/proc/sys/vm/nr_overcommit_hugepages", "4"}, We always want to prefer killing the allocating test process rather than somebody else (sshd or another random test process). {"/proc/sys/vm/oom_kill_allocating_task", "1"},
* tools/create-gce-image.sh: move sysctl's to executorDmitry Vyukov2020-11-211-0/+3
| | | | | | | | | Move the remaining sysctls from image creation scripts into executor. We have the rest in executor now, and these are captured in reproducers and are not duplicated. It seems that ping_group_range was accidentially lost along the way, re-add it.
* pkg/ifuzz/powerpc: add powerpc supportAlexey Kardashevskiy2020-11-201-0/+138
| | | | | | | | | | | | | | | | | | | | | | | | This adds KVM's syz_kvm_setup_cpu pseudo syscall. This adds placeholder for options (none implemented yet). This adds instruction generator for ifuzz; this also adds a few pseudo instructions to simulate super/hyper/ultracalls (a PPC64/pseries platform thing). The insns.go is generated from PowerISA_public.v3.0B.pdf [1] by a horrendous python3 script on top of pdftotext. The ISA covers POWER9 which is the latest available POWER CPU at the moment. The next ISA for POWER10 is quite different and we will deal with it later. The // comment after every instruction is a fixed opcode list for verification purposes. This does not define DecodeExt as there is no obvious replacement of the Intel XED library for POWERPC (gapstone-capstone, later, may be). [1] https://openpowerfoundation.org/?resource_lib=power-isa-version-3-0 Signed-off-by: Alexey Kardashevskiy <aik@linux.ibm.com>
generated by ggit (джигит) mrf-deployment (git 2.46.0) at 2026-03-13 03:54:44 +0000