aboutsummaryrefslogtreecommitdiffstats
path: root/pkg/csource
Commit message (Collapse)AuthorAgeFilesLines
* all: remove unused nolint directivesDmitry Vyukov2026-01-021-1/+1
|
* pkg/csource: exclude auto-generated syscalls from testsAleksandr Nogikh2025-11-241-6/+10
| | | | | | | | | | | | | Auto-generated syscall descriptions currently do not properly mark arch-specific syscalls like socketcall (which is only available on 32 bit systems), which leads to TestGenerate breakages. Until the syz-declextract tool is fixed and descriptions are re-generated, don't use such calls in TestGenerate tests. It has recently caused numerous syzkaller update erorrs on syzbot. Cc #5410. Closes #6468.
* pkg/csource: remove include guards from reproducersAlexander Potapenko2025-10-272-0/+8
| | | | Drop all lines matching `#define [A-Z0-9_]*_H` from the reproducers
* pkg/csource: fix check for sysTarget.BrokenCompiler()Alexander Potapenko2025-10-201-3/+3
| | | | Make sure arches with the broken compiler are correctly skipped.
* pkg/csource: run testPseudoSyscalls() for all targetsAlexander Potapenko2025-10-171-8/+7
| | | | | | | | | | | | | | | Previously in the -short configuration testPseudoSyscalls() was only executed for the first supported target, which in most cases ended up being linux/386 (the least popular configuration). As a result, platform-specific pseudo-syscalls were never executed on the CI. Fix this by testing the pseudo-syscalls on all available platforms. This increases the execution time of TestGenerate from 18s to 36s, but also helps to discover bugs in pseudo-syscalls quicker. As a result of this change, 3 distinct latent bugs were found on amd64, arm64 and ppc64.
* pkg/csource: add call argument annotations to generated C-source filesEthan Graham2025-08-047-13/+518
| | | | | | | | | | | The structure of arguments passed into syscalls is often hard to parse since it is memcpy'd into mmap'd regions. Structural relations are often lost in translation, resulting in reproducers that take longer for a developer to understand. This patch adds functionality for parsing syscall arguments semantically and emitting a structured and human-readable comment which is inserted before each syscall in the resulting C-source.
* all: manual linter fixesTaras Madan2025-07-171-2/+2
| | | | | | | | 1. recover the removed comment 2. unnecessary leading newline 3. unnecessary brackets 4. restore dropped "..." 5. use bytes.Equal instead of conversion to string
* all: apply linter auto fixesTaras Madan2025-07-173-14/+14
| | | | ./tools/syz-env bin/golangci-lint run ./... --fix
* pkg/csource: remove C23 embed built-in definesAlexander Egorenkov2025-06-101-4/+7
| | | | | | | | | | | | | | The new C23 embed built-in defines cause build errors in executor with GCC 15. <stdin>:3:9: error: ‘__STDC_EMBED_NOT_FOUND__’ redefined [-Werror] <built-in>: note: this is the location of the previous definition <stdin>:4:9: error: ‘__STDC_EMBED_FOUND__’ redefined [-Werror] <built-in>: note: this is the location of the previous definition <stdin>:5:9: error: ‘__STDC_EMBED_EMPTY__’ redefined [-Werror] <built-in>: note: this is the location of the previous definition Signed-off-by: Alexander Egorenkov <eaibmz@gmail.com>
* pkg/csource: add 32 bit tests to TestSourceAleksandr Nogikh2025-04-101-9/+31
|
* pkg/csource: enforce the bit size of -1Aleksandr Nogikh2025-04-102-8/+27
| | | | | | | | | | | syscall() is a variadic function, so we need to be careful when passing const values in there without specifying their type. For -1, we did not specify it, and on 64 bit architectures the de facto passed value was 0xFFFFFFFF instead of 0xFFFFFFFFFFFFFFFF. Fix it and add a test. Closes #5921.
* pkg/csource: remove obsolete go:generateDmitry Vyukov2025-04-021-2/+0
| | | | We don't use go:generate in this package anymore.
* all: remove loop variables scopingTaras Madan2025-02-171-2/+0
|
* Revert "pkg/csource: list the newly added SYZ_KVM_ constants in ↵Alexander Potapenko2024-09-251-3/+0
| | | | | | TestExecutorMacros" This reverts commit 1763a1862f3468b4b1a5cedef9d61ddd8d0e58e8.
* pkg/csource: list the newly added SYZ_KVM_ constants in TestExecutorMacrosAlexander Potapenko2024-09-251-0/+3
|
* prog: replace MinimizeParams with MinimizeModeDmitry Vyukov2024-08-071-1/+1
| | | | | | | | | | | | | | All callers shouldn't control lots of internal details of minimization (if we have more params, that's just more variations to test, and we don't have more, params is just a more convoluted way to say if we minimize for corpus or a crash). 2 bools also allow to express 4 options, but only 3 make sense. Also when I see MinimizeParams{} in the code, it's unclear what it means. Replace params with mode. And potentially "crash" minimization is not "light", it's just different. E.g. we can simplify int arguments for reproducers (esp in snapshot mode), but we don't need that for corpus.
* pkg/csource: build executor w/o optimizationsDmitry Vyukov2024-06-261-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Build executor w/o optimizations for tests. Tests can build lots of versions of executor in parallel, and on overloaded machines it can be slow. On my machine this reduces executor build time from ~7.5 to ~3.5 secs. Reduces pkg/runtest tests time considerably. Before: --- PASS: TestExecutor (8.89s) --- SKIP: TestExecutor/386 (0.00s) --- PASS: TestExecutor/riscv64 (30.76s) --- PASS: TestExecutor/arm (32.56s) --- PASS: TestExecutor/arm64 (33.01s) --- PASS: TestExecutor/amd64 (31.83s) --- SKIP: TestExecutor/ppc64le (26.56s) --- PASS: TestExecutor/s390x (25.53s) --- PASS: TestExecutor/mips64le (25.65s) After: --- PASS: TestExecutor (4.74s) --- SKIP: TestExecutor/386 (0.00s) --- PASS: TestExecutor/s390x (12.27s) --- SKIP: TestExecutor/ppc64le (12.59s) --- PASS: TestExecutor/amd64 (12.84s) --- PASS: TestExecutor/riscv64 (12.89s) --- PASS: TestExecutor/arm (11.53s) --- PASS: TestExecutor/arm64 (11.88s) --- PASS: TestExecutor/mips64le (12.82s)
* executor: add runner modeDmitry Vyukov2024-06-241-0/+58
| | | | | | | Move all syz-fuzzer logic into syz-executor and remove syz-fuzzer. Also restore syz-runtest functionality in the manager. Update #4917 (sets most signal handlers to SIG_IGN)
* sys/targets: mark big-endian targetsDmitry Vyukov2024-06-041-2/+2
| | | | | | Litte-endian is kind of default (except for s390). So instead of saying that each arch is litte-endian, mark only s390 as big-endian.
* executor: remove noshmem modeDmitry Vyukov2024-06-041-1/+0
| | | | | | | | | All OSes we have now support shmem. Support for Fuchia/Starnix/Windows wasn't implemented, but generally they support shared memory. Remove all of the complexity and code associated with noshmem mode. If/when we revive these OSes, it's easier to properly implement shmem mode for them.
* prog: make minimization parameters explicitAleksandr Nogikh2024-05-271-1/+1
| | | | Add an explicit parameter to only run call removal.
* Makefile: build executor with C++ compilerDmitry Vyukov2024-05-211-11/+7
| | | | | | | | | | | | Add C++ compiler and flags to the target and build executor with the C++ compiler. This will be needed to merge syz-fuzzer in to syz-executor since it will be beefier and will most likely require linking in libc++. But also this should fix #4821 since we won't use C++ flags when building C sources (we already had work-around in pkg/csource, but not in syz-extract). Fixes #4821
* pkg/csource: remove the Repro optionAleksandr Nogikh2024-05-174-17/+2
| | | | Enable it unconditionally.
* pkg/csource: replace go:generate with go:embedDmitry Vyukov2024-05-084-12826/+4
| | | | | | | go:embed is a more modern way to do this and it does not require a special Makefile step. Since go:embed cannot use paths that contains "..", the actual embeding is moved to executor package.
* executor: consistently fail on feature setupDmitry Vyukov2024-05-071-42/+41
| | | | | | Currently we fail in some cases, but ignore errors in other cases. Consistently fail when feature setup fails. This will be required for relying on setup failure to detect feature presence.
* executor: make flatrpc build for C++Dmitry Vyukov2024-05-031-6/+26
|
* all: go fix everythingDmitry Vyukov2024-04-261-1/+0
|
* executor: arm64: call KVM_ARM_PREFERRED_TARGET on vmfd instead of cpufdAlexander Potapenko2024-04-181-1/+1
|
* tools/syz-linter: check t.Logf/Errorf/Fatalf messagesDmitry Vyukov2024-04-171-2/+2
| | | | | Fix checking of Logf, it has string in 0-th arg. Add checking of t.Errorf/Fatalf.
* prog: don't require preallocated buffer for exec encodingDmitry Vyukov2024-04-161-3/+2
| | | | | | If we send exec encoding to the fuzzer, it's not necessary to serialize exec encoding into existing buffer (currnetly we serialize directly into shmem). So simplify code by serializing into a new slice.
* executor: ignore EBADF when reading tunDmitry Vyukov2024-04-161-1/+1
| | | | | | | | | | | | Fuzzer managed to do: executing program 0: ... close_range(r5, 0xffffffffffffffff, 0x0) ... SYZFATAL: executor 0 failed 11 times: executor 0: exit status 67 SYZFAIL: tun read failed (errno 9: Bad file descriptor)
* executor: ignore socketpair error in syz_usbip_server_initDmitry Vyukov2024-04-161-2/+4
| | | | | | | | | | | | | | Fuzzer managed to do: executing program 4: ... prlimit64(0x0, 0x7, &(0x7f0000000000), 0x0) ... syz_usbip_server_init(0x3) ... SYZFATAL: executor 4 failed 11 times: executor 4: exit status 67 SYZFAIL: syz_usbip_server_init: socketpair failed (errno 24: Too many open files)
* prog: profile what consumes space in exec encodingDmitry Vyukov2024-04-151-1/+1
| | | | | | | | Allow to profile how many bytes are consumed for what in the exec encoding. The profile shows there are not many opportunities left. 53% are consumed by data blobs. 13% for const args. 18% for non-arg things (syscall number, copyout index, props, etc).
* pkg/csource: remove akaros quirkDmitry Vyukov2024-04-151-4/+2
|
* all: remove akaros supportDmitry Vyukov2024-04-152-82/+3
| | | | | | | Akaros support is unused, it was shutdown on syzbot for a while, the akaros development seems to be frozen for years as well. We have a bunch of hacks for Akaros since it supported only super old gcc and haven't supported Go. Remove it.
* executor: cleanup mounts with MNT_FORCEAleksandr Nogikh2024-04-101-4/+5
| | | | | | | | | | Starting from v6.9, we can no longer reuse a loop device while some filesystem is mounted on it. It conflicts with the MNT_DETACH approach we were previously using. Let's umount synchronously instead, but also with a MNT_FORCE flag to abort potentially long graceful cleanup operations. We don't need them for the filesystems mounted only for fuzzing purposes.
* executor: fix uninitialized variable when generating kvm codeCookedMelon2024-04-051-0/+4
| | | | | | | | The "avl" fields (variable type is u8) of the kvm_segment structure variables such as seg_cs16 and seg_ldt are not initialized to zero. During creation, there is a chance that they are set to values other than 0 or 1, which can cause the "avl" fields to overwrite other fields when executing the fill_segment_descriptor function, leading to erroneous results.
* executor: ignore ENOENT for socket callsDmitry Vyukov2024-04-021-0/+6
| | | | | | Don't treat ENOENT from socket call as fatal. Fuzzer manages to make all socket calls for a particular protocol fail using NLBL_MGMT_C_REMOVE netlink function.
* pkg/fuzzer: factor out the fuzzing engineAleksandr Nogikh2024-03-121-0/+19
| | | | | | | | | | | | | This is the first step for #1541. Move the fuzzing engine that used to be interleaved with other syz-fuzzer code into a separate package. For now, the algorithm is more or less the same as it was, the only difference is that a pkg/fuzzer instance scales to the available computing power. Add an executor-based test that performs real fuzzing.
* executor: temporarily disable IORING_SETUP_CQE32 and IORING_SETUP_SQE128Alexander Potapenko2024-03-051-1/+3
| | | | | | | | | | IORING_SETUP_CQE32 and IORING_SETUP_SQE128 may lead to incorrect assumptions about the ring buffer size, causing the kernel to write outside of the mapped memory, smashing whatever follows it. This is a hotfix for https://github.com/google/syzkaller/issues/4531 that will stop the ci-upstream-gce-arm64 from generating random coverage.
* executor: don't fail on setns() in pseudo syscallsAleksandr Nogikh2024-02-081-4/+6
| | | | | | | The fd may be closed by an async close() call, it's not a reason to report a failure. Reported-by: Andrei Vagin <avagin@google.com>
* pkg/csource: annotate syscall() args with their pretty-printed valuesFlorent Revest2024-02-012-1/+70
| | | | | | | This factorizes const arguments into the shortest flags OR bitmask possible so they are easy to read. E.g: /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul
* executor: don't hold a loop device fdAleksandr Nogikh2024-01-121-5/+24
| | | | | | When BLK_DEV_WRITE_MOUNTED is enabled, the kernel treats the loopfd reference as a writer and does not let us issue mount() calls over the same block device.
* executor: prevent netlink_send_ext with dofail=trueAleksandr Nogikh2024-01-051-0/+5
| | | | | This should never be happening during fuzzing. Otherwise we let syz-executor silently crash and restart insane number of times.
* syz-executor: don't fail on netlink errors during fuzzingAleksandr Nogikh2024-01-051-21/+23
| | | | | | During fuzzing, it's expected that certain operations might return errors. Don't abort the whole syz-executor process in this case, this is too expensive.
* executor: introduce syz_pidfd_open()Aleksandr Nogikh2023-12-191-0/+12
| | | | | | | | | | | This kernel interface provides access to fds of other processes, which is readily abused by the fuzzer to mangle parent syz-executor fds. Pid=1 is the parent syz-executor process when PID namespace is created. Sanitize it in the new syz_pidfd_open() pseudo-syscall. We could not patch the argument in sys/linux/init.go because the first argument is a resource.
* sys/linux, pkg/host, executor: add NVMe-oF/TCP subsystem supportAlon Zahavi2023-12-071-2/+45
| | | | | Add new pseudo-syscall for creating a socket in init netns and connecting to NVMe-oF/TCP server on 127.0.0.1:4420. Also add descriptions for NVMe-oF/TCP.
* pkg/csource/options.go: refactor deserializeLegacyFormatsTaras Madan2023-10-301-59/+45
| | | | It contributes to #4285 unblocking.
* executor/common_zlib: fix an mmap leakZhiyao Feng2023-10-061-2/+2
| | | | | The `mmap` size is `max_destlen`, but `munmap` size is `destlen`, which causes a memory leak.
* sys/io_uring, executor/common_linux: remove sqes_index in syz_io_uring_submitDylan Yudaken2023-07-301-12/+9
| | | | | | | | This parameter barely increases coverage since the tail is always set to the entry that is written, but it does increase the complexity of the api and seems to reduce coverage when I run it locally. Remove it.
generated by ggit (джигит) mrf-deployment (git 2.46.0) at 2026-03-11 17:33:30 +0000