aboutsummaryrefslogtreecommitdiffstats
path: root/pkg/csource/options.go
Commit message (Collapse)AuthorAgeFilesLines
* pkg/csource: add call argument annotations to generated C-source filesEthan Graham2025-08-041-7/+11
| | | | | | | | | | | The structure of arguments passed into syscalls is often hard to parse since it is memcpy'd into mmap'd regions. Structural relations are often lost in translation, resulting in reproducers that take longer for a developer to understand. This patch adds functionality for parsing syscall arguments semantically and emitting a structured and human-readable comment which is inserted before each syscall in the resulting C-source.
* all: manual linter fixesTaras Madan2025-07-171-2/+2
| | | | | | | | 1. recover the removed comment 2. unnecessary leading newline 3. unnecessary brackets 4. restore dropped "..." 5. use bytes.Equal instead of conversion to string
* all: apply linter auto fixesTaras Madan2025-07-171-3/+3
| | | | ./tools/syz-env bin/golangci-lint run ./... --fix
* executor: add runner modeDmitry Vyukov2024-06-241-0/+58
| | | | | | | Move all syz-fuzzer logic into syz-executor and remove syz-fuzzer. Also restore syz-runtest functionality in the manager. Update #4917 (sets most signal handlers to SIG_IGN)
* pkg/csource: remove the Repro optionAleksandr Nogikh2024-05-171-6/+1
| | | | Enable it unconditionally.
* pkg/csource/options.go: refactor deserializeLegacyFormatsTaras Madan2023-10-301-59/+45
| | | | It contributes to #4285 unblocking.
* all: support swap feature on LinuxAleksandr Nogikh2023-06-151-0/+4
| | | | | If the feature is supported on the device, allocate a 128MB swap file after VM boot and activate it.
* executor: add NIC PCI pass-through VF supportGeorge Kennedy2022-09-211-0/+4
| | | | | | | | | | | | | | | Add support for moving a NIC PCI pass-through VF into Syzkaller's network namespace so that it will tested. As DEVLINK support is triggered by setting the pass-through device to "addr=0x10", NIC PCI pass-through VF support will be triggered by setting the device to "addr=0x11". If a NIC PCI pass-through VF is detected in do_sandbox, setup a staging namespace before the fork() and transfer the NIC VF interface to it. After the fork() and in the child transfer the NIC VF interface to Syzkaller's network namespace and rename the interface to netpci0 so that it will be tested. Signed-off-by: George Kennedy <george.kennedy@oracle.com>
* pkg/csource, pkg/instance, pkg/ipc, pkg/mgrconfig, tools/syz-prog2c, ↵Andrey Artemiev2022-08-061-21/+68
| | | | syz-manager: introduce a new setting 'sandbox_arg' (#3263)
* all: replace collide mode by `async` call propertyAleksandr Nogikh2021-12-101-3/+1
| | | | | | | | | | | | | Replace the currently existing straightforward approach to race triggering (that was almost entirely implemented inside syz-executor) with a more flexible one. The `async` call property instructs syz-executor not to block until the call has completed execution and proceed immediately to the next call. The decision on what calls to mark with `async` is made by syz-fuzzer. Ultimately this should let us implement more intelligent race provoking strategies as well as make more fine-grained reproducers.
* all: refactor fault injection into call propsAleksandr Nogikh2021-09-221-4/+8
| | | | | | | | | | | | Now that call properties mechanism is implemented, we can refactor fault injection. Unfortunately, it is impossible to remove all traces of the previous apprach. In reprolist and while performing syz-ci jobs, syzkaller still needs to parse the old format. Remove the old prog options-based approach whenever possible and replace it with the use of call properties.
* sys/linux: add ieee802154 descriptionsDmitry Vyukov2021-02-121-0/+4
|
* pkg/runtest: check arch requirement earlyDmitry Vyukov2021-02-081-0/+12
| | | | | | | Need to check arch requirement early as some programs may fail to deserialize on some arches due to missing syscalls. See discussion on #2380. Also support negative arch requirements (-arch=amd64).
* all: make timeouts configurableDmitry Vyukov2020-12-281-3/+7
| | | | | | Add sys/targets.Timeouts struct that parametrizes timeouts throughout the system. The struct allows to control syscall/program/no output timeouts for OS/arch/VM/etc. See comment on the struct for more details.
* all: fix format of fmt.Printf/Fprintf callsDmitry Vyukov2020-11-301-1/+1
|
* pkg/csource: setup sysctl's in C reproducersDmitry Vyukov2020-10-281-64/+41
| | | | | | Sysctl's are not captured as part of reproducers. This can result in failure to reproduce a bug on developer machine. Include sysctl setup as part of C reproducers.
* sys/targets: add OS/Arch name constsDmitry Vyukov2020-10-261-4/+5
| | | | | | | | | | | | We use strings to identify OS/Arch. These strings are duplicated throughout the code base massively. golangci-lint points to possiblity of typos and duplication. We already had to define these names in pkg/csource and disable checking for prog package. A future change triggers such warnings in another package. Add OS/Arch name consts to sys/targets so that they can be used to refer to OS/Arch. Use the consts everywhere.
* all: integrate with mac80211_hwsimAleksandr Nogikh2020-09-221-0/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Two virtual wireless devices are instantiated during network devices initialization. A new flag (-wifi) is added that controls whether these virtual wifi devices are instantiated and configured during proc initialization. Also, two new pseudo syscalls are added: 1. syz_80211_inject_frame(mac_addr, packet, packet_len) -- injects an arbitrary packet into the wireless stack. It is injected as if it originated from the device identitied by mac_addr. 2. syz_80211_join_ibss(interface_name, ssid, ssid_len, mode) -- puts a specific network interface into IBSS state and joins an IBSS network. Arguments of syz_80211_join_ibss: 1) interface_name -- null-terminated string that identifies a wireless interface 2) ssid, ssid_len -- SSID of an IBSS network to join to 3) mode -- mode of syz_80211_join_ibss operation (see below) Modes of operation: JOIN_IBSS_NO_SCAN (0x0) -- channel scan is not performed and syz_80211_join_ibss waits until the interface reaches IF_OPER_UP. JOIN_IBSS_BG_SCAN (0x1) -- channel scan is performed (takes ~ 9 seconds), syz_80211_join_ibss does not await IF_OPER_UP. JOIN_IBSS_BG_NO_SCAN (0x2) -- channel scan is not performed, syz_80211_join_ibss does not await IF_OPER_UP. Local testing ensured that these syscalls are indeed able to set up an operating network and inject packets into mac80211.
* all: initialize vhci in linuxTheOfficialFloW2020-07-301-24/+34
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * all: initialize vhci in linux * executor/common_linux.h: improve vhci initialization * pkg/repro/repro.go: add missing vhci options * executor/common_linux.h: fix type and add missing header * executor, pkg: do it like NetInjection * pkg/csource/csource.go: do not emit syz_emit_vhci if vhci is not enabled * executor/common_linux.h: fix format string * executor/common_linux.h: initialize with memset For som reason {0} gets complains about missing braces... * executor/common_linux.h: simplify vhci init * executor/common_linux.h: try to bring all available hci devices up * executor/common_linux.h: find which hci device has been registered * executor/common_linux.h: use HCI_VENDOR_PKT response to retrieve device id * sys/linux/dev_vhci.txt: fix structs of inquiry and report packets * executor/common_linux.h: remove unnecessary return statement and check vendor_pkt read size * executor/common_linux.h: remove unnecessary return statement and check vendor_pkt read size * sys/linux/dev_vhci.txt: pack extended_inquiry_info_t * sys/linux/l2cap.txt: add l2cap_conf_opt struct * executor/common_linux.h: just fill bd addr will 0xaa * executor/common_linux.h: just fill bd addr will 0xaa
* all: fix dup types in func argsDmitry Vyukov2020-07-041-1/+1
|
* .golangci.yml: make goconst checker more strictDmitry Vyukov2020-06-071-6/+10
|
* csource, executor: add usb emulation featureAndrey Konovalov2020-04-031-0/+6
| | | | | | | | | The feature gets enabled when /dev/raw-gadget is present and accessible. With this feature enabled, executor will do chmod 0666 /dev/raw-gadget on startup, which makes it possible to do USB fuzzing in setuid and namespace sandboxes. There should be no backwards compatibility issues with syz reproducers that don't explicitly enable this feature, as they currently only work in none sandbox.
* pkg/csource: rename some optionsDmitry Vyukov2019-11-161-67/+66
| | | | | Rename some options in preparation for subsequent changes which will align names across the code base.
* executor: refactor sandbox flagsDmitry Vyukov2019-11-161-2/+2
| | | | In preparation for future changes.
* pkg/csource: remove duplicate checkJiri Pirko2019-11-031-3/+0
| | | | | | | Remove a check that was mistakenly added with devlink_pci feature and is duplicate of the existing check. Signed-off-by: Jiri Pirko <jiri@mellanox.com>
* pkg/csource: fix lint warningsDmitry Vyukov2019-11-031-2/+0
| | | | | CI failed: https://travis-ci.org/google/syzkaller/jobs/606730911?utm_medium=notification&utm_source=github_status
* executor: move fixed pci devlink handle into network namespaceJiri Pirko2019-11-031-0/+12
| | | | | | | | In case there is a fixed pci devlink handle "pci/pci/0000:00:10.0" on the system (initial network namespace), it is moved to a working network namespace. Signed-off-by: Jiri Pirko <jiri@mellanox.com>
* executor, host, csource: Add support to enable KCSANMarco Elver2019-10-041-1/+5
| | | | | | | | | By default, the current KCSAN .config does not enable KCSAN during boot, since we encounter races during boot which would prevent syzkaller from ever executing. This adds support to detect if KCSAN is available, and enables it on the fuzzer host.
* pkg/csource: fix failing syz-runtest for NetBSDSiddharth M2019-08-211-2/+2
| | | | | | * pkg/csource: fix failing syz-runtest for NetBSD * update common.go
* executor: implement support for leak checkingDmitry Vyukov2019-05-201-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | Leak checking support was half done and did not really work. This is heavy-lifting to make it work. 1. Move leak/fault setup into executor. pkg/host was a wrong place for them because we need then in C repros too. The pkg/host periodic callback functionality did not work too, we need it in executor so that we can reuse it in C repros too. Remove setup/callback functions in pkg/host entirely. 2. Do leak setup/checking in C repros. The way leak checking is invoked is slightly different from fuzzer, but much better then no support at all. At least the checking code is shared. 3. Add Leak option to pkg/csource and -leak flag to syz-prog2c. 4. Don't enalbe leak checking in fuzzer while we are triaging initial corpus. It's toooo slow. 5. Fix pkg/repro to do something more sane for leak bugs. Few other minor fixes here and there.
* all: fix some static analysis warningsDmitry Vyukov2019-04-231-18/+18
| | | | | | Fix warnings produced by golangci-lint. Update #977
* all: add optional close_fds feature to reproducersAndrey Konovalov2019-04-091-0/+10
| | | | | | | | Instead of always closing open fds (number 3 to 30) after each program, add an options called EnableCloseFds. It can be passed to syz-execprog, syz-prog2c and syz-stress via the -enable and -disable flags. Set the default value to true. Also minimize C repros over it, except for when repeat is enabled.
* pkg/csource: sort sys/types.h to the top on FreeBSDMark Johnston2019-03-071-2/+2
| | | | | sys/types.h is a special header that is required by many other system headers on FreeBSD.
* execprog, stress, prog2c: unify flags to enable additional featuresAndrey Konovalov2019-03-051-33/+108
| | | | | | | | | | | This change makes all syz-execprog, syz-prog2c and syz-stress accept -enable and -disable flags to enable or disable additional features (tun, net_dev, net_reset, cgroups and binfmt_misc) instead of having a separate flag for each of them. The default (without any flags) behavior isn't changed: syz-execprog and syz-stress enabled all the features (provided the runtime supports them) and syz-prog2c disables all of them.
* pkg/csource: support tun and setuid repros on {free,open}bsdGreg Steuck2018-12-131-2/+4
| | | | | | * expose procid on BSD for tun, always declare loop() * deal with terrible bsd includes * replicate loop() declaration
* RFC: android: Add support for untrusted_app sandboxing (#697)Zach Riggle2018-09-171-2/+2
| | | | | | | | | | | | | | | | | | | | | executor: add support for android_untrusted_app sandbox This adds a new sandbox type, 'android_untrusted_app', which restricts syz-executor to the privileges which are available to third-party applications, e.g. those installed from the Google Play store. In particular, this uses the UID space reserved for applications (instead of the 'setuid' sandbox, which uses the traditional 'nobody' user / 65534) as well as a set of groups which the Android-specific kernels are aware of, and finally ensures that the SELinux context is set appropriately. Dependencies on libselinux are avoided by manually implementing the few functions that are needed to change the context of the current process, and arbitrary files. The underlying mechanisms are relatively simple. Fixes google/syzkaller#643 Test: make presubmit Bug: http://b/112900774
* pkg/csource: don't do checkpoint/reset net with setuid sandboxDmitry Vyukov2018-08-081-19/+26
| | | | | Missing part of "executor: don't checkpoint/reset net namespace with setuid sandbox"
* pkg/csource: refactor defineListDmitry Vyukov2018-08-021-0/+5
| | | | | | Make it simpler and shorter. Update #538
* pkg/mgrconfig: move from syz-manager/mgrconfigDmitry Vyukov2018-08-021-1/+1
| | | | | | | | mgrconfig was used only by syz-manager initially, but now it's used by a dozen of packages and it's weird to import from under a binary dir. pkg/ is much more reasonable dir for a widely used helper package.
* pkg/csource: rafactor option checkingDmitry Vyukov2018-07-311-27/+25
| | | | Update #538
* pkg/csource: add option to trace syscall resultsDmitry Vyukov2018-07-271-6/+11
| | | | This will be needed for testing of generated programs.
* pkg/csource: tun/cgroups are linux-specificDmitry Vyukov2018-07-251-2/+1
|
* executor: overhaulDmitry Vyukov2018-07-241-15/+13
| | | | | | | | | | | | | | | | | Make as much code as possible shared between all OSes. In particular main is now common across all OSes. Make more code shared between executor and csource (in particular, loop function and threaded execution logic). Also make loop and threaded logic shared across all OSes. Make more posix/unix code shared across OSes (e.g. signal handling, pthread creation, etc). Plus other changes along similar lines. Also support test OS in executor (based on portable posix) and add 4 arches that cover all execution modes (fork server/no fork server, shmem/no shmem). This change paves way for testing of executor code and allows to preserve consistency across OSes and executor/csource.
* pkg/csource: disable most features on akarosDmitry Vyukov2018-07-051-8/+8
| | | | Akaros does not support tun, fault injections, sandboxes, etc.
* pkg/csource: support fuchsiaDmitry Vyukov2018-06-291-1/+53
| | | | Lots of assorted heavylifting to support csource on fuchsia.
* pkg/csource: minimize netdevices and net resetDmitry Vyukov2018-05-171-0/+14
| | | | | | Add separate options to minimize netdevices setup and net namespace reset. Fixes #581
* pkg/csource: serialize options into jsonDmitry Vyukov2018-05-171-17/+26
| | | | | Current format is painful to parse after changes. Switch to json.
* sys/linux: add cgroup descriptionsDmitry Vyukov2018-03-251-13/+39
|
* sys/linux: extend netfilter descriptionsDmitry Vyukov2018-01-271-0/+3
|
* pkg/csource: add function to parse serialized optionsDmitry Vyukov2017-11-171-0/+82
Also move options and options tests into a separate file, add serialization function.
generated by ggit (джигит) mrf-deployment (git 2.46.0) at 2026-03-12 00:10:05 +0000