aboutsummaryrefslogtreecommitdiffstats
path: root/pkg/csource/generated.go
Commit message (Collapse)AuthorAgeFilesLines
...
* executor/common_kvm_ppc64: enable nested KVMAlexey Kardashevskiy2021-09-161-0/+17
| | | | | | This is necessary to make KVM actually execute the instructions. Signed-off-by: Alexey Kardashevskiy <aik@linux.ibm.com>
* sys: skip kvm const extraction for non i386/amd64Aleksandr Nogikh2021-09-131-4/+4
| | | | | | | | | | | | It is impossible to compile a number of definitions in include/uapi/linux/kvm.h for other platforms, which leads to syz-extract failing to update constants. Skip processing of this file for all arches except i386 and amd64. This is a hacky and (hopefully) temporary solution until #2754 is implemented.
* executor: ifconfig destroy wants the interface (not device) name (#2739)Greg Steuck2021-09-021-1/+1
| | | | | | | | At least on OpenBSD this is the behavior: % doas ifconfig tun5 create % doas ifconfig tun5 destroy % doas ifconfig tun5 create % doas ifconfig /dev/tun5 destroy ifconfig: SIOCIFDESTROY: Invalid argument
* pkg/ifuzz/powerpc: add some RTAS fuzzingAlexey Kardashevskiy2021-07-191-0/+14
| | | | | | | | | | | | | | | RunTime Abstraction Services (RTAS) is an API used by the Linux powerpc/pseries platform to talk to the hypervisor. Under KVM, this is implemented as a custom hypercall (which we have support for) and an in memory array of parameters. The hypercall is H_RTAS and its only parameter is a pointer to the mentioned array. The vast majority of RTAS calls are handled normally by QEMU and only a handful by KVM. This adds fuzzing of 4 RTAS calls. This uses a chunk from main 256MB RAM for parameters. The parameters are big endian hence "<<24" for the token. To allow more targeted fuzzing, use iset.GenerateInt(). Signed-off-by: Alexey Kardashevskiy <aik@linux.ibm.com>
* executor/common_kvm_ppc64: run with enabled MMUAlexey Kardashevskiy2021-07-191-0/+126
| | | | | | | | | | | | | | | | | | | | | This sets up a page table to map the text in order to exercise more code paths in the KVM. This defines flags to control the MMU state. When enabled, this creates a simple page table at the 64K offset and maps all the RAM. The fuzzer code is placed right after the table. The flags are: IR - enables MMU for instruction fetches DR - enables MMU for data loads/stores PR - "problem state", i.e. userspace (implies DR and IR) PID1 - initializes a process table for PID>0 (PID#0 is used by the VM OS normally) This adds a simple "syz_kvm_setup_cpu_ppc64" syz-test with MSR=IR|DR|LE which is a typical Linux kernel mode. Signed-off-by: Alexey Kardashevskiy <aik@linux.ibm.com>
* executor/common_kvm_ppc64: fix KVM supportAlexey Kardashevskiy2021-07-191-92/+174
| | | | | | | | | | | | | | | | | | | | | | | | | | Turns out the ifuzz on powerpc did not ever properly work. This fixes syz_kvm_setup_cpu$ppc64: Enable the PAPR KVM capability (otherwise KVM_RUN fails right away). Finish generated sequences with the software debug breakpoint as there is no x86's "hlt" variant on POWER and otherwise KVM won't exit. Add exception handlers, use the software debug breakpoint instruction to trigger immediate exit from KVM with the only exception of the decrementer interrupt handler (timer) to recharge the timer and continue. Define and use endianness selection flag (Big vs. Little endian). Define the code generator similar to kvm_gen.cc which for now contains 2 simple tests and the decrementer interrupt handler code. Add test cases to the executor so "bin/linux_ppc64le/syz-executor test" can run some sensible tests. The tests copy 0xbadc0de around similar to x86 and uses gpr[3] is a return value register (similar to EAX). Signed-off-by: Alexey Kardashevskiy <aik@linux.ibm.com>
* executor: initialize scope in fault_ioc_infoChuck Silvers2021-07-021-0/+1
| | | | | The "scope" field of struct fault_ioc_info is an input to the ioctl, so initialize it to FAULT_SCOPE_LWP to match other fault_ioc_* usage.
* sys/darwin: initial syscall definitionsPatrick Meyer2021-06-071-1/+1
| | | | Pretty much ripped from freebsd +/- what isn't applicable to darwin.
* executor: initial darwin supportPatrick Meyer2021-05-201-16/+21
|
* executor: move vm.nr_overcommit_hugepages into configDmitry Vyukov2021-05-121-1/+0
| | | | | Move the sysctl into config, so that kernels can opt out of it if necessary (not all kernels enable it and interested in testing).
* executor: set ctrl-alt-del sysctl to 0Dmitry Vyukov2021-04-221-1/+6
| | | | | | | This blocks some of the ways the fuzzer can trigger a reboot. ctrl-alt-del=0 tells kernel to signal cad_pid instead of rebooting and setting cad_pid to the current pid (transient "syz-executor setup") makes it a no-op. For context see: https://groups.google.com/g/syzkaller-bugs/c/WqOY4TiRnFg/m/6P9u8lWZAQAJ
* executor: fix driver.h import path in common_fuchsia.hMarco Vanotti2021-04-091-1/+1
| | | | The `driver.h` header moved from `ddk/driver.h` to `lib/ddk/driver.h`.
* dashboard/config/linux: disable BPF_JIT on subset of instancesDmitry Vyukov2021-03-091-1/+0
| | | | | Currently we enable JIT always and don't test interpreter. Enable JIT on subset of instances and disable on others using kernel config.
* executor: don't setup x86-specific sysctl on non-x86Dmitry Vyukov2021-03-071-15/+17
| | | | | /sys/kernel/debug/x86/nmi_longest_ns is x86 specific, don't set it on non-x86 arches.
* executor: disable rfkill during setupDmitry Vyukov2021-03-041-0/+18
| | | | | If rfkill is enabled by the fuzzer, wifi setup will fail. Disable rfkill to initial state during setup.
* pkg/report: detect executor failuresDmitry Vyukov2021-02-211-114/+104
| | | | | | | | | | | | Currently all executor fail errors go into "lost connection" bucket. This is not very useful. First, there are different executor failures. Second, it's not possible to understand what failures happen how frequently. Third, there are not authentic lost connection. Create separate SYZFAIL: bugs for them. Update #573 Update #502 Update #318
* executor: don't fail in syz_genetlink_get_family_idDmitry Vyukov2021-02-191-82/+113
| | | | | | | | | | We used to use our own netlink socket and then fail on any errors. But commit "sys/linux: add ieee802154 descriptions" made it possible to use fuzzer-provided socket, and fuzzer can pass any invalid fd. So don't fail on errors now. Fixes #2444
* sys/linux: add ieee802154 descriptionsDmitry Vyukov2021-02-121-16/+73
|
* executor: don't include kvm on armDmitry Vyukov2021-01-261-1/+1
| | | | | | KVM was removed for arm architecture. Latest Linux headers don't contain <asm/kvm.h> for arm. So don't even include them.
* executor/common: repair clang complaint about bad indentationGreg Steuck2020-12-301-1/+2
| | | | | dashboard link: https://syzkaller.appspot.com/bug?extid=38fe37bc451a42e6c9a4 Reported-by: syzbot+38fe37bc451a42e6c9a4@syzkaller.appspotmail.com
* executor: remove hardcoded timeoutsDmitry Vyukov2020-12-251-4/+10
| | | | | In preparation for making timeouts tunable based on OS/arch/VM/etc de-hardcode all (almost) timeouts in executor.
* executor: skip setsid() for threaded reproducersAnton Lindqvist2020-12-091-2/+7
| | | | | | | | | | | | Lately, I've been looking into why such low amount of syz reproducers on OpenBSD are turned into C reproducers. One thing I did notice is that such syz reproducers have one thing in common: they use the threaded=true and sandbox=none parameters. Such C reproducer always exits non-zero early on since the call to setsid() fails with EPERM. Meaning, the calling process is already a process group leader. Not sure if the preprocessor conditional should be tweaked in order to avoid unwanted side effects on other BSDs or configurations.
* executor: tune few more sysctl'sDmitry Vyukov2020-12-011-0/+3
| | | | | | | | | | | | | Faster gc (1 second) is intended to make tests more repeatable. {"/proc/sys/kernel/keys/gc_delay", "1"}, Huge page overcommit is disabled by default, allowing some overcommit is intended to give more coverage. {"/proc/sys/vm/nr_overcommit_hugepages", "4"}, We always want to prefer killing the allocating test process rather than somebody else (sshd or another random test process). {"/proc/sys/vm/oom_kill_allocating_task", "1"},
* tools/create-gce-image.sh: move sysctl's to executorDmitry Vyukov2020-11-211-0/+3
| | | | | | | | | Move the remaining sysctls from image creation scripts into executor. We have the rest in executor now, and these are captured in reproducers and are not duplicated. It seems that ping_group_range was accidentially lost along the way, re-add it.
* pkg/ifuzz/powerpc: add powerpc supportAlexey Kardashevskiy2020-11-201-0/+138
| | | | | | | | | | | | | | | | | | | | | | | | This adds KVM's syz_kvm_setup_cpu pseudo syscall. This adds placeholder for options (none implemented yet). This adds instruction generator for ifuzz; this also adds a few pseudo instructions to simulate super/hyper/ultracalls (a PPC64/pseries platform thing). The insns.go is generated from PowerISA_public.v3.0B.pdf [1] by a horrendous python3 script on top of pdftotext. The ISA covers POWER9 which is the latest available POWER CPU at the moment. The next ISA for POWER10 is quite different and we will deal with it later. The // comment after every instruction is a fixed opcode list for verification purposes. This does not define DecodeExt as there is no obvious replacement of the Intel XED library for POWERPC (gapstone-capstone, later, may be). [1] https://openpowerfoundation.org/?resource_lib=power-isa-version-3-0 Signed-off-by: Alexey Kardashevskiy <aik@linux.ibm.com>
* executor: fix linux includesDmitry Vyukov2020-10-301-2/+6
| | | | | write_file() is needed for setup_sysctl() and syz_usbip_server_init(). setup_sysctl() also misses some header includes.
* dashboard/config/linux: set watchdog_thresh via cmdlineDmitry Vyukov2020-10-281-1/+0
| | | | Fixes #1989
* pkg/csource: setup sysctl's in C reproducersDmitry Vyukov2020-10-281-0/+28
| | | | | | Sysctl's are not captured as part of reproducers. This can result in failure to reproduce a bug on developer machine. Include sysctl setup as part of C reproducers.
* executor, pkg/csource: remove setpgrp() in sandbox_common()liucy19982020-10-271-1/+0
| | | | Process group leader is not allowed to call setsid, thus remove setpgrp.
* executor: fix arp netfiler tables alignment for armDmitry Vyukov2020-10-151-4/+4
| | | | | | | | | | The arp netfilter entry contains u64, but we used only void* to enforce alignment. This worked everywhere except for arm, which is 32-bits and has 8-byte alignment for u64. Use u64 to enforce correct alignment. Fixes #2188
* executor: set parent-death signal after changing user or group ID-sAndrei Vagin2020-10-091-0/+2
| | | | | | | The parent-death signal is set in sandbox_common, but then setresuid and setresgid clear it and we need to set it again. Signed-off-by: Andrei Vagin <avagin@google.com>
* executor: msvc support syz-executorSuraj K Suresh2020-10-031-13/+36
|
* sys/linux: descriptions for USB/IPNazime Hande Harputluoglu2020-10-021-0/+44
|
* executor: check for \n in fail/exitf messagesDmitry Vyukov2020-09-281-9/+9
|
* all: integrate with mac80211_hwsimAleksandr Nogikh2020-09-221-3/+414
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Two virtual wireless devices are instantiated during network devices initialization. A new flag (-wifi) is added that controls whether these virtual wifi devices are instantiated and configured during proc initialization. Also, two new pseudo syscalls are added: 1. syz_80211_inject_frame(mac_addr, packet, packet_len) -- injects an arbitrary packet into the wireless stack. It is injected as if it originated from the device identitied by mac_addr. 2. syz_80211_join_ibss(interface_name, ssid, ssid_len, mode) -- puts a specific network interface into IBSS state and joins an IBSS network. Arguments of syz_80211_join_ibss: 1) interface_name -- null-terminated string that identifies a wireless interface 2) ssid, ssid_len -- SSID of an IBSS network to join to 3) mode -- mode of syz_80211_join_ibss operation (see below) Modes of operation: JOIN_IBSS_NO_SCAN (0x0) -- channel scan is not performed and syz_80211_join_ibss waits until the interface reaches IF_OPER_UP. JOIN_IBSS_BG_SCAN (0x1) -- channel scan is performed (takes ~ 9 seconds), syz_80211_join_ibss does not await IF_OPER_UP. JOIN_IBSS_BG_NO_SCAN (0x2) -- channel scan is not performed, syz_80211_join_ibss does not await IF_OPER_UP. Local testing ensured that these syscalls are indeed able to set up an operating network and inject packets into mac80211.
* executor/common_linux.h: refactor __NR_syz_genetlink_get_family_idAleksandr Nogikh2020-09-221-38/+12
| | | | | | As netlink helpers now include a function to query generic netlink familty id, it makes no sense to duplicate implementation of essentially the same function.
* executor/common_linux.h: remove assumption that netlink always returns ↵Aleksandr Nogikh2020-09-221-25/+25
| | | | | | | | | | | | | | nonpositive error codes The code in common_linux.h assumes that nlmsgerr can either be 0 or a negative value in case of an error. However, this is not always the case. For example, some commands of mac80211_hwsim use nonnegative values to indicate success (e.g. HWSIM_CMD_NEW_RADIO returns either a negative error or a nonnegative radio index). Therefore, negation of error code inside netlink_send_ext is not correct. This patch changes this behavior. Now netlink_send_ext returns the exact value it received via netlink.
* sys/common_linux.h: replace netlink_devlink_id_get and ↵Aleksandr Nogikh2020-09-221-63/+34
| | | | | | | netlink_wireguard_id_get by a more generic function These two functions are almost entirely idential. In order to avoid adding similar functions later on, a generic one is created.
* sys/common_linux.h: move the definition of a global nlmsg variableAleksandr Nogikh2020-09-221-2/+4
| | | | | | | This global variable cannot be used for pseudo syscalls as they can run concurrently (in threaded mode). It can only be used during initialization, and if initialization routines are not enabled, nlmsg will become an unused variable.
* executor/common_linux.h: extend netlink helpers to support zero-payload ↵Aleksandr Nogikh2020-09-221-1/+2
| | | | | | | attributes (flags) This is required for 802.11 pseudo syscalls (that will be added later).
* executor/common_linux.h: increase default nlmsg buffer sizeAleksandr Nogikh2020-09-221-1/+1
| | | | | 1024 bytes are not enough to contain an arbirary 802.11 MAC frame together with netlink protocol overhead.
* executor: forbid inlining of 'remove_dir'Alexander Egorenkov2020-09-181-2/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes the issue with gcc 10 on Fedora 32 s390x: In file included from ../../executor/executor.cc:147: ../../executor/common.h: In function ‘void remove_dir(const char*)’: ../../executor/common.h:229:44: error: ‘%s’ directive output may be truncated writing up to 255 bytes into a region of size between 0 and 4095 [-Werror=format-truncation=] 229 | snprintf(filename, sizeof(filename), "%s/%s", dir, ep->d_name); | ^~ ../../executor/common.h:229:11: note: ‘snprintf’ output between 2 and 4352 bytes into a destination of size 4096 229 | snprintf(filename, sizeof(filename), "%s/%s", dir, ep->d_name); ../../executor/common.h:243:1: error: the frame size of 21200 bytes is larger than 16384 bytes [-Werror=frame-larger-than=] 243 | } | ^ cc1plus: all warnings being treated as errors compiler invocation: gcc [-o /tmp/syz-executor383272105 -DGOOS_test=1 -DGOARCH_64_fork=1 -DHOSTGOOS_linux=1 ../../executor/executor.cc -m64 -no-pie -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384] FAIL FAIL github.com/google/syzkaller/pkg/runtest 0.998s FAIL Signed-off-by: Alexander Egorenkov <Alexander.Egorenkov@ibm.com>
* executor: fix definition of __NR_io_uring_setupDmitry Vyukov2020-09-151-6/+4
| | | | | | | | | | Sone syzbot instances broke with: <stdin>: In function ‘syz_io_uring_setup’: <stdin>:476:33: error: ‘__NR_io_uring_setup’ undeclared (first use in this function) <stdin>:476:33: note: each undeclared identifier is reported only once for each function it appears in pkg/csource resolves #ifdef's at generation time.
* executor: improve opendir(3) error handlingAnton Lindqvist2020-09-121-1/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | While investigating an OpenBSD reproducer[1][2] I discovered the following: * All threads are stuck on the last `sleep(1000000)` syscall in main(), hence no output for the test machine. * Each executor process created in loop() performs one iteration but exits abnormally during the call to remove_dir(). * Calling remove_dir() will eventually invoke itself recursively since one of the executed syscall is `mkdir("./file0", 0)` meaning that it will try to remove the directory created by execute_one(). However, `opendir(3)` fails with `EACCES` due to the permissions passed to `mkdir(2)` is zero. Instead of exiting, trying to remove the problematic directory in a best effort manner makes the reproducer continue executing the generated syscalls. This work around might be considered to narrow. Another option would be to replace the `sleep(1000000)` with `waitpid(-1, NULL, 0)` until ECHILD is hit. [1] https://syzkaller.appspot.com/bug?id=6f7ce2a0536580a94f65f44e478732ec505e88af [2] https://syzkaller.appspot.com/text?tag=ReproC&x=10fd1a71900000
* sys/test/test: add a hanging testDmitry Vyukov2020-09-121-1/+9
| | | | Ensure that we can handle hanging syscalls in all modes.
* executor/common_linux.h: add missing FUSE opcodesStefano Duo2020-08-271-0/+4
| | | | | | Add the following missing FUSE opcodes to the syz_fuse_handle_req pseudo-syscall: FUSE_COPY_FILE_RANGE, FUSE_UNLINK, FUSE_DESTROY and FUSE_BATCH_FORGET.
* executor/linux: change mount propagation type to privateTetsuo Handa2020-08-261-0/+3
| | | | | | | unshare(CLONE_NEWNS) might not be sufficient for making all test processes run in separate mount namespace, for "mount --make-rshared /" request issued by systemd causes mount operations issued by test processes visible from outside of test processes. Issue "mount --make-rprivate /" request after unshare(CLONE_NEWNS).
* executor/common_linux.h: make rfkill_unblock_all staticAndy Nguyen2020-08-231-1/+1
|
* executor/common_linux.h: unblock rfkill and retry HCIDEVUP on ERFKILLAndy Nguyen2020-08-231-2/+27
|
* tools/docker: add old-envDmitry Vyukov2020-08-221-1/+1
| | | | | | | old-env is based on Ubuntu 16.04 and allows to test executor build on older distributions. Fixes #2055
generated by ggit (джигит) mrf-deployment (git 2.46.0) at 2026-03-17 04:30:07 +0000