aboutsummaryrefslogtreecommitdiffstats
path: root/pkg/ipc/ipc.go
Commit message (Collapse)AuthorAgeFilesLines
* executor: add runner modeDmitry Vyukov2024-06-241-838/+0
| | | | | | | Move all syz-fuzzer logic into syz-executor and remove syz-fuzzer. Also restore syz-runtest functionality in the manager. Update #4917 (sets most signal handlers to SIG_IGN)
* executor: refactor coverage filterDmitry Vyukov2024-06-241-8/+21
|
* pkg/ipc: fix sign extension of comparison argumentsDmitry Vyukov2024-06-111-1/+1
| | | | | | | We incorrectly extended comparison arguments since forever. This is sad. We tested the prog logic, but not the ipc/executor part. Fix the extension, add tests and force manager to re-triage inputs.
* executor: remove noshmem modeDmitry Vyukov2024-06-041-39/+20
| | | | | | | | | All OSes we have now support shmem. Support for Fuchia/Starnix/Windows wasn't implemented, but generally they support shared memory. Remove all of the complexity and code associated with noshmem mode. If/when we revive these OSes, it's easier to properly implement shmem mode for them.
* all: adapt all cover and sig to 64bitJoey Jiao2024-05-271-8/+7
| | | | | | | | | | | | | | | | | | Taken some arm64 devices for example: kaslr_offset is diff at bits 12-40, and kernel modules are loaded at 2GB space, so we have `ffffffd342e10000 T _stext` where uppper 32bit is ffffffd3. However, if we check modules range, the 1st module is loaded at 0xffffffd2eeb2a000, while the last module is loaded at 0xffffffd2f42c4000. We can see the upper 32bits are diff for core kernel and modules. If we use current 32bits for covered PC, we will get wrong module address recovered. So we need to move to 64bit cover and signal: - change cover/sig to 64bit to fit for syz-executor change - remove kernel upper base logic as kernel upper base is not a constant when kaslr enabled for core kernel and modules. - remove unused pcBase
* pkg/ipc: remove ExecOptsDmitry Vyukov2024-05-211-22/+8
| | | | Switch to flatrpc.ExecOpts.
* pkg/ipc: remove ProgInfoDmitry Vyukov2024-05-211-79/+21
| | | | | | Switch to flatrpc.ProgInfo. Note: this disables syz-runtest and syz-verifier.
* pkg/ipc: use flatrpc flagsDmitry Vyukov2024-05-171-64/+28
| | | | | | Flatrpc flags are passed in RPC execution requests, so to avoid conversions and duplicate set of flags use flatrpc flags in pkg/ipc directly.
* pkg/fuzzer: manipulate ipc.ExecOptsAleksandr Nogikh2024-05-161-0/+7
| | | | There's no need in duplicating the signal, coverage, hints flags.
* pkg/vminfo: run programs interactivelyAleksandr Nogikh2024-05-161-0/+19
| | | | | | Use the same interfaces as the fuzzer. Now syz-manager no longer needs to treat machine check executions differently.
* pkg/ipc: split out EmptyProgInfo()Aleksandr Nogikh2024-05-161-7/+12
|
* pkg/vminfo: move feature checking to hostDmitry Vyukov2024-05-151-6/+25
| | | | | | | | | | | | | | | | | Feature checking procedure is split into 2 phases: 1. syz-fuzzer invokes "syz-executor setup feature" for each feature one-by-one, and checks if executor does not fail. Executor can also return a special "this feature does not need custom setup", this allows to not call setup of these features in each new VM. 2. pkg/vminfo runs a simple program with ipc.ExecOpts specific for a concrete feature, e.g. for wifi injection it will try to run a program with wifi feature enabled, if setup of the feature fails, executor should also exit with an error. For coverage features we also additionally check that we actually got coverage. Then pkg/vminfo combines results of these 2 checks into final result. syz-execprog now also uses vminfo package and mimics the same checking procedure. Update #1541
* pkg/repro, pkg/ipc: use flatrpc.FeatureDmitry Vyukov2024-05-061-10/+10
| | | | | | | Start switching from host.Features to flatrpc.Features. This change is supposed to be a no-op, just to reduce future diffs that will change how we obtain features.
* pkg/ipc: consistently set ENOSYS for non-executed syscallsDmitry Vyukov2024-05-021-0/+7
| | | | | | | Currently we set errno=999 in executor for non-finished syscalls, but syscalls that were not even started still have errno=0. They also don't have Executed flag, but it's still handy to have a non-0 errno when the call is not successful.
* pkg/ipc: dedup features to flags conversionDmitry Vyukov2024-04-301-0/+41
| | | | Currently it's duplicated 4 times, dedup it.
* pkg/ipc: make it possible to change EnvFlags between executionsDmitry Vyukov2024-04-301-40/+48
| | | | | | | | | | | | | | | | Pass EnvFlags into Exec instead of New. This allows to change EnvFlags between executions. Change of EnvFlags forces executor process restart since it uses EnvFlags during setup. Currently this is intended to be NFC since we always pass the same EnvFlags. In future this will allow to (1) reduce part of the VM checking procedure to execution of programs with different options (e.g. we can probe for coverage/comparisons support, probe different sandboxes, etc); (2) use it during fuzzing/reproduction, e.g. we can check if the crash reproduces under setuid sandbox, or execute some fuzzing programs in significantly different modes.
* pkg/ipc: remove use of reflect.SliceHeaderDmitry Vyukov2024-04-261-12/+7
| | | | | | | | Linter now complains: Error: SA1019: reflect.SliceHeader has been deprecated since Go 1.21 and an alternative has been available since Go 1.17: Use unsafe.Slice or unsafe.SliceData instead.
* pkg/ipc: include executor freshness into execution resultDmitry Vyukov2024-04-161-19/+17
| | | | | | | | | | Instead of counting exeutor restarts add executor freshness (number of tests executed in the same process before this one) into execution result. This removes all program-related metrics from syz-fuzzer, and concentrates all of them in the manager. The freshness of the concrete test may also be useful for some analysis later.
* pkg/ipc: pass only exec encoding to ExecDmitry Vyukov2024-04-161-35/+16
| | | | | | | Does not require passing text program to ipc.Env.Exec. Make it possible to provide just the exec encoding. This requires moving fallback coverage to the host since it need the program.
* prog: don't require preallocated buffer for exec encodingDmitry Vyukov2024-04-161-6/+5
| | | | | | If we send exec encoding to the fuzzer, it's not necessary to serialize exec encoding into existing buffer (currnetly we serialize directly into shmem). So simplify code by serializing into a new slice.
* pkg/ipc: refactor rate limitingDmitry Vyukov2024-04-151-17/+23
| | | | | | | 1. Move the flag to Config (logically belongs there). 2. Create rate limter lazily (it's not needed most of the time). This will help to stop passing *prog.Prog to Exec method.
* all: refactor statsDmitry Vyukov2024-04-091-4/+10
| | | | | | | Add ability for each package to create and export own stats. Each stat is self-contained, describes how it should be presented, and there is not need to copy them from one package to another. Stats also keep historical data and allow building graphs over time.
* pkg/ipc: copy signal and coverageAleksandr Nogikh2024-02-211-1/+5
| | | | | | | | | | | | | | We used to optimize the memory usage by making the slices of individual CallInfo structs point to the shared memory buffer between syz-fuzzer and executor. However, this puts very strict expectations on all pkg/ipc users and complicates the decoupling of the fuzzing logic from individual proc loops. Let's try to live without this optimization. When compared with the cost of a single syz-executor execution, the cost of array copying is very very small anyway.
* all: experiment with an option to reset accumulated stateAleksandr Nogikh2024-01-231-0/+7
| | | | | | | | | | | | | | | | | In the cases where we do not / cannot sandbox individual prog executions well enough, some share of progs end up being dependent on the previously accumulated state of the whole VM. As the result, * We lose 5-10% of coverage/signal on every instance restart. * A share of our corpus programs do not actually trigger the coverage they were thought to reliably trigger. This significantly affects fuzzing efficiency and prevents syzkaller from accumulating bigger and better corpus over multiple runs. Let's see if the situation becomes better if we restart syz-executor before most of prog executions.
* syz-fuzzer: take executor restart out of gate ticketsAleksandr Nogikh2024-01-221-12/+21
| | | | | | | On a loaded VM, the restar may easily take 10-20 second, during which all other procs have to wait due to gate ticketing. Restart executor processes outside of synchronization primitives.
* pkg/ipc: kill syz-executor earlierAleksandr Nogikh2024-01-091-1/+1
| | | | | | | | | | | Even though syz-executor is supposed to kill its forked children after 5 seconds, in practice it fails to do so once in a while. As a result, we end up waiting 50+ seconds before pkg/ipc kills the parent syz-executor process. Due to the gate ticketing system, the whole fuzzing stay stalled in the meanwhile. Reduce the timeout to 25 seconds.
* all: use special placeholder for errorsTaras Madan2023-07-241-11/+11
|
* ipc: handle a case when c.cmd.ProcessState is nil (#3967)Andrei Vagin2023-06-151-7/+12
| | | | | This can happen when c.cmd.Wait returns an error. Signed-off-by: Andrei Vagin <avagin@google.com>
* all: ioutil is deprecated in go1.19 (#3718)Taras Madan2023-02-231-2/+1
|
* executor: add NIC PCI pass-through VF supportGeorge Kennedy2022-09-211-0/+1
| | | | | | | | | | | | | | | Add support for moving a NIC PCI pass-through VF into Syzkaller's network namespace so that it will tested. As DEVLINK support is triggered by setting the pass-through device to "addr=0x10", NIC PCI pass-through VF support will be triggered by setting the device to "addr=0x11". If a NIC PCI pass-through VF is detected in do_sandbox, setup a staging namespace before the fork() and transfer the NIC VF interface to it. After the fork() and in the child transfer the NIC VF interface to Syzkaller's network namespace and rename the interface to netpci0 so that it will be tested. Signed-off-by: George Kennedy <george.kennedy@oracle.com>
* pkg/csource, pkg/instance, pkg/ipc, pkg/mgrconfig, tools/syz-prog2c, ↵Andrey Artemiev2022-08-061-7/+10
| | | | syz-manager: introduce a new setting 'sandbox_arg' (#3263)
* pkg/ipc: stop reading executor output after it exitedAndrei Vagin2022-07-211-10/+10
| | | | | | | An executor can leak its file descriptor and we can block on reading from it forever. Signed-off-by: Andrei Vagin <avagin@google.com>
* ipc: add magic in a call replyAndrei Vagin2022-05-241-0/+4
| | | | | | | | | | When a shared memory is used, the executor can corrupt reply messages, so let's add magic to detect such cases. It is an attempt to debug issues like this one: https://syzkaller.appspot.com/bug?id=faca64c3182e9f130ca94b7931dd771be390ef67 Signed-off-by: Andrei Vagin <avagin@google.com>
* all: collect raw coverageAleksandr Nogikh2022-03-281-7/+15
| | | | | | | | | Raw coverage might be important when e.g. analysing the origins of out-of-place coverage in coverage reports or understanding why the fuzzer could not reach deeper code. If "raw_cover" is set to true, syzkaller will remember unsorted and unduplicated coverage (PCs) for each its corpus program.
* all: replace collide mode by `async` call propertyAleksandr Nogikh2021-12-101-2/+2
| | | | | | | | | | | | | Replace the currently existing straightforward approach to race triggering (that was almost entirely implemented inside syz-executor) with a more flexible one. The `async` call property instructs syz-executor not to block until the call has completed execution and proceed immediately to the next call. The decision on what calls to mark with `async` is made by syz-fuzzer. Ultimately this should let us implement more intelligent race provoking strategies as well as make more fine-grained reproducers.
* all: adapt to how mmapping a kcov instance works in LinuxAleksandr Nogikh2021-12-091-0/+1
| | | | | | | | | | | | | | | | | | | | It turns out that the current Linux implementation of KCOV does not properly handle multiple mmap invocations on the same instance. The first one succeedes, but the subsequent ones do not actually mmap anything, yet returning no error at all. The ability to mmap that memory multiple times allows us to increase syz-executor performance and it would be a pity to completely lose it (especially given that mmapping kcov works fine on *BSD). In some time a patch will be prepared, but still we will have to support both versions at the same time - the buggy one and the correct one. Detect whether the bug is present by writing a value at the pointer returned by mmap. If it is present, disable dynamic kcov mmapping and pre-mmap 5 instances in the main() function - it should be enough for all reasonable uses. Otherwise, pre-mmap 3 and let syz-executor mmap them as needed.
* executor: fail if the first argument isn't a known commandAndrei Vagin2021-09-301-1/+1
| | | | | | | | | | | | | | | | | | We have seen cases when a test program re-execed the current binary: 11:53:29 executing program 0: openat$zero(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/exe\x00', 0x0, 0x0) lseek(r0, 0x4000000000000000, 0x4) execveat(r0, &(0x7f0000000080)='\x00', 0x0, 0x0, 0x1000) In such cases, we have to be sure that executor will not print SYZFAIL log messages and will not exit with kFailStatus. Since a659b3f1, syzkaller reports bugs in all these cases. Fixes: a659b3f1dc88 ("pkg/report: detect executor failures") Signed-off-by: Andrei Vagin <avagin@google.com>
* all: refactor fault injection into call propsAleksandr Nogikh2021-09-221-8/+1
| | | | | | | | | | | | Now that call properties mechanism is implemented, we can refactor fault injection. Unfortunately, it is impossible to remove all traces of the previous apprach. In reprolist and while performing syz-ci jobs, syzkaller still needs to parse the old format. Remove the old prog options-based approach whenever possible and replace it with the use of call properties.
* pkg/ipc: fix reflect.SliceHeader misuseDmitry Vyukov2021-02-221-6/+5
| | | | | Pointed by golangci-lint. For context see https://github.com/golang/go/issues/40701
* pkg/ipc: scale sandbox timeoutDmitry Vyukov2020-12-291-8/+7
| | | | | Scale sandbox wait timeout according to the target slowdown. Also de-hardcode program timeout.
* all: make timeouts configurableDmitry Vyukov2020-12-281-3/+9
| | | | | | Add sys/targets.Timeouts struct that parametrizes timeouts throughout the system. The struct allows to control syscall/program/no output timeouts for OS/arch/VM/etc. See comment on the struct for more details.
* executor: remove hardcoded timeoutsDmitry Vyukov2020-12-251-14/+20
| | | | | In preparation for making timeouts tunable based on OS/arch/VM/etc de-hardcode all (almost) timeouts in executor.
* syz-manager/manager.go, executor/executor.cc: support coverage filterKaipeng Zeng2020-12-061-6/+7
|
* pkg/ipc: remove Config.TimeoutDmitry Vyukov2020-11-301-28/+10
| | | | | It's not used for anything useful and will conflict with automatic timeout tuning.
* sys/targets: add OS/Arch name constsDmitry Vyukov2020-10-261-1/+1
| | | | | | | | | | | | We use strings to identify OS/Arch. These strings are duplicated throughout the code base massively. golangci-lint points to possiblity of typos and duplication. We already had to define these names in pkg/csource and disable checking for prog package. A future change triggers such warnings in another package. Add OS/Arch name consts to sys/targets so that they can be used to refer to OS/Arch. Use the consts everywhere.
* syz-fuzzer: ignore encodingexec buffer overflow errorsDmitry Vyukov2020-10-011-1/+1
| | | | | | | We started to see lots of "provided buffer is too small" with seeded syz_mount_image programs. Currently it fails whole VM, which is not good. Ignoring them is not perfect, but there does not seem to be any better simple solution.
* all: integrate with mac80211_hwsimAleksandr Nogikh2020-09-221-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Two virtual wireless devices are instantiated during network devices initialization. A new flag (-wifi) is added that controls whether these virtual wifi devices are instantiated and configured during proc initialization. Also, two new pseudo syscalls are added: 1. syz_80211_inject_frame(mac_addr, packet, packet_len) -- injects an arbitrary packet into the wireless stack. It is injected as if it originated from the device identitied by mac_addr. 2. syz_80211_join_ibss(interface_name, ssid, ssid_len, mode) -- puts a specific network interface into IBSS state and joins an IBSS network. Arguments of syz_80211_join_ibss: 1) interface_name -- null-terminated string that identifies a wireless interface 2) ssid, ssid_len -- SSID of an IBSS network to join to 3) mode -- mode of syz_80211_join_ibss operation (see below) Modes of operation: JOIN_IBSS_NO_SCAN (0x0) -- channel scan is not performed and syz_80211_join_ibss waits until the interface reaches IF_OPER_UP. JOIN_IBSS_BG_SCAN (0x1) -- channel scan is performed (takes ~ 9 seconds), syz_80211_join_ibss does not await IF_OPER_UP. JOIN_IBSS_BG_NO_SCAN (0x2) -- channel scan is not performed, syz_80211_join_ibss does not await IF_OPER_UP. Local testing ensured that these syscalls are indeed able to set up an operating network and inject packets into mac80211.
* all: initialize vhci in linuxTheOfficialFloW2020-07-301-12/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * all: initialize vhci in linux * executor/common_linux.h: improve vhci initialization * pkg/repro/repro.go: add missing vhci options * executor/common_linux.h: fix type and add missing header * executor, pkg: do it like NetInjection * pkg/csource/csource.go: do not emit syz_emit_vhci if vhci is not enabled * executor/common_linux.h: fix format string * executor/common_linux.h: initialize with memset For som reason {0} gets complains about missing braces... * executor/common_linux.h: simplify vhci init * executor/common_linux.h: try to bring all available hci devices up * executor/common_linux.h: find which hci device has been registered * executor/common_linux.h: use HCI_VENDOR_PKT response to retrieve device id * sys/linux/dev_vhci.txt: fix structs of inquiry and report packets * executor/common_linux.h: remove unnecessary return statement and check vendor_pkt read size * executor/common_linux.h: remove unnecessary return statement and check vendor_pkt read size * sys/linux/dev_vhci.txt: pack extended_inquiry_info_t * sys/linux/l2cap.txt: add l2cap_conf_opt struct * executor/common_linux.h: just fill bd addr will 0xaa * executor/common_linux.h: just fill bd addr will 0xaa
* pkg/runtest: tell ASAN to not mess with our NONFAILINGDmitry Vyukov2020-07-161-0/+2
| | | | | | | | | | | | | | | | | | | | | | It seems that different gcc's have different defaults for ASAN flags. Some fail with: run.go:67: nonfailing none/thr/repeat : FAIL: run 0: call 0 is not executed ASAN:DEADLYSIGNAL ================================================================= ==67143==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f7b0befb0a2 bp 0x7f7b0cfdad10 sp 0x7f7b0cfda490 T1) #0 0x7f7b0befb0a1 (/usr/lib/x86_64-linux-gnu/libasan.so.3+0x8d0a1) #1 0x404bbb in syz_compare(long, long, long, long) (/tmp/utor355225125.0+0x404bbb) #2 0x403cdf in execute_call(thread_t*) (/tmp/utor355225125.0+0x403cdf) #3 0x404006 in worker_thread(void*) (/tmp/utor355225125.0+0x404006) #4 0x7f7b0bc584a3 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x74a3) #5 0x7f7b0b99ad0e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe8d0e) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV (/usr/lib/x86_64-linux-gnu/libasan.so.3+0x8d0a1) Thread T1 created by T0 here: #0 0x7f7b0be9ef59 in __interceptor_pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.3+0x30f59) #1 0x406117 in execute_one() (/tmp/utor355225125.0+0x406117)
* all: fix comments formatDmitry Vyukov2020-07-121-1/+2
| | | | | | | Fix capitalization, dots at the end and two spaces after a period. Update #1876
generated by ggit (джигит) mrf-deployment (git 2.46.0) at 2026-03-12 02:57:24 +0000