aboutsummaryrefslogtreecommitdiffstats
path: root/pkg/repro
Commit message (Collapse)AuthorAgeFilesLines
...
* all: run strace on each found reproducerAleksandr Nogikh2022-04-291-0/+67
| | | | | | | | If `strace_bin` is specified, syzkaller will invoke a reproducer with it and save the output. This should help in debugging. If syz-manager is attached to a dashboard, upload the strace-powered output and report.
* all: use the same prog execution code throughout the projectAleksandr Nogikh2022-04-291-125/+52
| | | | | | | | | | Previously it was copypasted in pkg/instance, pkg/repro, tools/syz-crash. Use the single implementation instead. Also, this commit fixes a bug - the previous code always set collide to true while reproducing a bug, which led to an immediate syz-exexprog's exit. As a result, newer bugs with .syz repro only were never actually reproduced on #syz test requests.
* pkg/mgrconfig: add "interests"Dmitry Vyukov2021-12-161-0/+3
| | | | | | | We have "suppressions" parameter to suppress non-interesting reports. Add "interests" parameter which is an opposite of "suppressions" -- everything that's not in "interests" is suppressed. It's matched against bug title, guilty file and maintainer emails.
* all: replace collide mode by `async` call propertyAleksandr Nogikh2021-12-102-9/+1
| | | | | | | | | | | | | Replace the currently existing straightforward approach to race triggering (that was almost entirely implemented inside syz-executor) with a more flexible one. The `async` call property instructs syz-executor not to block until the call has completed execution and proceed immediately to the next call. The decision on what calls to mark with `async` is made by syz-fuzzer. Ultimately this should let us implement more intelligent race provoking strategies as well as make more fine-grained reproducers.
* all: refactor fault injection into call propsAleksandr Nogikh2021-09-221-62/+4
| | | | | | | | | | | | Now that call properties mechanism is implemented, we can refactor fault injection. Unfortunately, it is impossible to remove all traces of the previous apprach. In reprolist and while performing syz-ci jobs, syzkaller still needs to parse the old format. Remove the old prog options-based approach whenever possible and replace it with the use of call properties.
* pkg/report: separate reporter wrapper from OS-specific implementationsAleksandr Nogikh2021-08-061-2/+2
| | | | | | | | | | | | | Currently a number of report post-processing activities are implemented as a decorator over the interface that defines OS-specific implementations. Following exactly the same interface is too restrictive in this case as adding extra parameters to the post-processing forces the developer to adjust all implementations thay may not need these parameters at all. Untie the wrapper from the Reporter interface. Use a package-private reporterImpl interface for the OS-specific implementations, while having an exported Reporter structure. Make sure that Reporter is stored and passed as a pointer.
* sys/linux: add ieee802154 descriptionsDmitry Vyukov2021-02-121-0/+10
|
* all: make timeouts configurableDmitry Vyukov2020-12-281-15/+18
| | | | | | Add sys/targets.Timeouts struct that parametrizes timeouts throughout the system. The struct allows to control syscall/program/no output timeouts for OS/arch/VM/etc. See comment on the struct for more details.
* pkg/mgrconfig: remove Syz prefix from fieldsDmitry Vyukov2020-11-301-5/+5
| | | | | | | Everything in syzkaller is syz-something, it's pointless to add syz prefix to everything and unnecessary increases clutter. Remove the prefix. Also, rename ExecutorCmd in target to ExecutorBin to make it consistent with mgrconfig and ExecprogBin/FuzzerBin.
* pkg/mgrconfig: add prog&sys.targets targets to ConfigDmitry Vyukov2020-11-301-6/+2
| | | | | | These are widely used with the config as the refactoring shows. This removes a bunch of unnecessary code. Also fixes a number of bugs where we confused Arch with VMArch.
* pkg/csource: setup sysctl's in C reproducersDmitry Vyukov2020-10-281-0/+7
| | | | | | Sysctl's are not captured as part of reproducers. This can result in failure to reproduce a bug on developer machine. Include sysctl setup as part of C reproducers.
* sys/targets: add OS/Arch name constsDmitry Vyukov2020-10-261-1/+2
| | | | | | | | | | | | We use strings to identify OS/Arch. These strings are duplicated throughout the code base massively. golangci-lint points to possiblity of typos and duplication. We already had to define these names in pkg/csource and disable checking for prog package. A future change triggers such warnings in another package. Add OS/Arch name consts to sys/targets so that they can be used to refer to OS/Arch. Use the consts everywhere.
* all: integrate with mac80211_hwsimAleksandr Nogikh2020-09-221-0/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Two virtual wireless devices are instantiated during network devices initialization. A new flag (-wifi) is added that controls whether these virtual wifi devices are instantiated and configured during proc initialization. Also, two new pseudo syscalls are added: 1. syz_80211_inject_frame(mac_addr, packet, packet_len) -- injects an arbitrary packet into the wireless stack. It is injected as if it originated from the device identitied by mac_addr. 2. syz_80211_join_ibss(interface_name, ssid, ssid_len, mode) -- puts a specific network interface into IBSS state and joins an IBSS network. Arguments of syz_80211_join_ibss: 1) interface_name -- null-terminated string that identifies a wireless interface 2) ssid, ssid_len -- SSID of an IBSS network to join to 3) mode -- mode of syz_80211_join_ibss operation (see below) Modes of operation: JOIN_IBSS_NO_SCAN (0x0) -- channel scan is not performed and syz_80211_join_ibss waits until the interface reaches IF_OPER_UP. JOIN_IBSS_BG_SCAN (0x1) -- channel scan is performed (takes ~ 9 seconds), syz_80211_join_ibss does not await IF_OPER_UP. JOIN_IBSS_BG_NO_SCAN (0x2) -- channel scan is not performed, syz_80211_join_ibss does not await IF_OPER_UP. Local testing ensured that these syscalls are indeed able to set up an operating network and inject packets into mac80211.
* pkg/repro: fix execution of non-repeatig C programsDmitry Vyukov2020-09-121-9/+34
| | | | | | | | | | | | | | | | | | | If we have a non-repeating C reproducer with timeout > vm.NoOutputTimeout and it hangs (the reproducer itself does not terminate on its own, note: it does not have builtin timeout), then we will falsely detect "not output from test machine" kernel bug. We could fix it by adding a builtin timeout to such reproducers (like we have in all other cases). However, then it will exit within few seconds and we will finish the test without actually waiting for full vm.NoOutputTimeout, which breaks the whole reason of using vm.NoOutputTimeout in the first place. So we would need something more elaborate: let the program exist after few seconds, but continue waiting for kernel hang errors for minutes, but at the same time somehow ignore "no output" error because it will be false in this case. Instead we simply prohibit !Repeat with long timeouts. It makes sense on its own to some degree: if we are chasing an elusive bug, repeating the test will increase chances of reproducing it and can make the reproducer less flaky. Syz repros does not have this problem because they always have internal timeout, however (1) it makes sense on its own, (2) we will either not use the whole timeout or waste the remaining time as mentioned above, (3) if we remove repeat for syz repro, we won't be able to handle it when/if we switch to C repro (we can simplify options, but we can't "complicate" them back).
* all: initialize vhci in linuxTheOfficialFloW2020-07-301-0/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * all: initialize vhci in linux * executor/common_linux.h: improve vhci initialization * pkg/repro/repro.go: add missing vhci options * executor/common_linux.h: fix type and add missing header * executor, pkg: do it like NetInjection * pkg/csource/csource.go: do not emit syz_emit_vhci if vhci is not enabled * executor/common_linux.h: fix format string * executor/common_linux.h: initialize with memset For som reason {0} gets complains about missing braces... * executor/common_linux.h: simplify vhci init * executor/common_linux.h: try to bring all available hci devices up * executor/common_linux.h: find which hci device has been registered * executor/common_linux.h: use HCI_VENDOR_PKT response to retrieve device id * sys/linux/dev_vhci.txt: fix structs of inquiry and report packets * executor/common_linux.h: remove unnecessary return statement and check vendor_pkt read size * executor/common_linux.h: remove unnecessary return statement and check vendor_pkt read size * sys/linux/dev_vhci.txt: pack extended_inquiry_info_t * sys/linux/l2cap.txt: add l2cap_conf_opt struct * executor/common_linux.h: just fill bd addr will 0xaa * executor/common_linux.h: just fill bd addr will 0xaa
* .golangci.yml: enable goprintffuncname checkerDmitry Vyukov2020-06-051-45/+45
| | | | Only 1 warning. Good to fix and enable before we get more.
* .golangci.yml: enable whitespace checkerDmitry Vyukov2020-06-051-2/+0
| | | | Points to bad empty lines very precisely.
* pkg/repro: don't enable features missing on the targetDmitry Vyukov2020-06-031-42/+61
| | | | | | | Manager has already checked what features are present on the target. But if we detected that, say, USB is missing, we still enabled it in the starting csource options. This is wrong, increases configuration minimization time and may lead to some obscure bugs.
* all: reformat codeDmitry Vyukov2020-05-081-1/+1
|
* all: replace TRAVIS env var with CIDmitry Vyukov2020-05-071-1/+1
| | | | | | | | In preparation to running some tests as github actions. Both Travis and Github define CI env var, while TRAVIS is, well, too Travis-specific. Update #1699
* csource, executor: add usb emulation featureAndrey Konovalov2020-04-031-0/+8
| | | | | | | | | The feature gets enabled when /dev/raw-gadget is present and accessible. With this feature enabled, executor will do chmod 0666 /dev/raw-gadget on startup, which makes it possible to do USB fuzzing in setuid and namespace sandboxes. There should be no backwards compatibility issues with syz reproducers that don't explicitly enable this feature, as they currently only work in none sandbox.
* pkg/repro: simplify C repros over DevlinkPCIAndrey Konovalov2020-01-071-0/+8
|
* pkg/repro: refactor vm initialization into new fnMarco Vanotti2019-12-091-26/+31
| | | | | This commit moves the instance initialization inside Run() to a subroutine to decrease cyclomatic complexity in the Run function.
* syz/targets: add SyzExecutorCmd flagMarco Vanotti2019-12-091-7/+11
| | | | | | | | | | | | | This commit adds a new attribute to syzkaller targets that tells syzkaller how to invoke the syz-executor command. Some systems, like Fuchsia, are now building syz-executor as part of the build, and there is no need to copy it over, or to run it from `/tmp`. In fact, that might stop working at some time in the future in Fuchsia. All places that used to copy syz-executor into the target machine will now check for the SyzExecutorCmd flag, and won't copy it if the flag is set.
* pkg/csource: rename some optionsDmitry Vyukov2019-11-162-33/+33
| | | | | Rename some options in preparation for subsequent changes which will align names across the code base.
* pkg/repro: don't double-reverse log entriesAndrey Konovalov2019-05-271-10/+2
| | | | | | | | For extractProgSingle() lastEntries are already reversed, so no need to call reverseEntries(). Also for extractProgBisect() there's no point in reversing the entries, as the idea is to try connecting multiple programs in chronological order.
* executor: implement support for leak checkingDmitry Vyukov2019-05-201-12/+38
| | | | | | | | | | | | | | | | | | | | | | | | | Leak checking support was half done and did not really work. This is heavy-lifting to make it work. 1. Move leak/fault setup into executor. pkg/host was a wrong place for them because we need then in C repros too. The pkg/host periodic callback functionality did not work too, we need it in executor so that we can reuse it in C repros too. Remove setup/callback functions in pkg/host entirely. 2. Do leak setup/checking in C repros. The way leak checking is invoked is slightly different from fuzzer, but much better then no support at all. At least the checking code is shared. 3. Add Leak option to pkg/csource and -leak flag to syz-prog2c. 4. Don't enalbe leak checking in fuzzer while we are triaging initial corpus. It's toooo slow. 5. Fix pkg/repro to do something more sane for leak bugs. Few other minor fixes here and there.
* pkg/repro: fix no output timeoutDmitry Vyukov2019-05-201-3/+3
| | | | | | We duplicated the no output timeout in the repro package, and it got out of sync. It's not 3 mins now, but 5 mins. Remove the duplication and fix this.
* repro: speedup bisection for flaky crashesAndrey Konovalov2019-05-032-0/+10
| | | | | | Limit the amount of bisection chunks to 8. Going over this value probably means that we are bisection a flaky crash, and continuing bisection would just take a lot of time and likely produce no result.
* all: add optional close_fds feature to reproducersAndrey Konovalov2019-04-091-0/+10
| | | | | | | | Instead of always closing open fds (number 3 to 30) after each program, add an options called EnableCloseFds. It can be passed to syz-execprog, syz-prog2c and syz-stress via the -enable and -disable flags. Set the default value to true. Also minimize C repros over it, except for when repeat is enabled.
* syz-repro: print detailed listingsAlexander Popov2019-03-291-0/+1
| | | | | | Final reproducers are crafty. Sometimes they just stop working. In that case the detailed listings of the programs executed by syz-repro are very helpful. Let's print them at the loglevel 3.
* all: fix warnings pointed to by golangci-lintDmitry Vyukov2019-03-281-1/+1
| | | | Update #977
* pkg/csource: allow to ignore warnings during buildDmitry Vyukov2019-03-211-1/+1
| | | | | | | | | | | | | | | Running bisection using an older repro failed with: <stdin>: In function ‘syz_mount_image.constprop’: <stdin>:298:3: error: argument 1 null where non-null expected [-Werror=nonnull] In file included from <stdin>:26:0: /usr/include/x86_64-linux-gnu/sys/stat.h:320:12: note: in a call to function ‘mkdir’ declared here extern int mkdir (const char *__path, __mode_t __mode) Let's be safe and ignore warnings during repro/bisect. Everything that runs during tests still has all warnings. Update #501
* execprog, stress, prog2c: unify flags to enable additional featuresAndrey Konovalov2019-03-052-21/+29
| | | | | | | | | | | This change makes all syz-execprog, syz-prog2c and syz-stress accept -enable and -disable flags to enable or disable additional features (tun, net_dev, net_reset, cgroups and binfmt_misc) instead of having a separate flag for each of them. The default (without any flags) behavior isn't changed: syz-execprog and syz-stress enabled all the features (provided the runtime supports them) and syz-prog2c disables all of them.
* pkg/repro: fix goroutine/instance leaksDmitry Vyukov2019-02-251-5/+6
| | | | | On early return paths we fail to close instances and shutdown goroutines. Fix that.
* prog, pkg/{csource,ifuzz,ipc,repro}: make tests deterministic on travisDmitry Vyukov2019-01-021-0/+4
| | | | | Don't use random seed on travis as it produces flaky coverage reports, and probably generally better for CI setting.
* vm: allow fine-grained control over program exit conditionsDmitry Vyukov2018-12-241-1/+2
| | | | | | | | | Currently we only support canExit flag. However there are actually 3 separate conditions: - program can exit normally - program can timeout (e.g. fuzzer test or runtest can't) - program can exit with error (e.g. C test can) Allow to specify these 3 conditions separately.
* pkg/mgrconfig: move from syz-manager/mgrconfigDmitry Vyukov2018-08-021-1/+1
| | | | | | | | mgrconfig was used only by syz-manager initially, but now it's used by a dozen of packages and it's weird to import from under a binary dir. pkg/ is much more reasonable dir for a widely used helper package.
* gometalinter: clean up vetshadowDmitry Vyukov2018-07-311-45/+49
| | | | | | | This just cleans up existing warnings. vetshadow is not enabled yet because it crashes. Update #538
* executor: overhaulDmitry Vyukov2018-07-242-11/+0
| | | | | | | | | | | | | | | | | Make as much code as possible shared between all OSes. In particular main is now common across all OSes. Make more code shared between executor and csource (in particular, loop function and threaded execution logic). Also make loop and threaded logic shared across all OSes. Make more posix/unix code shared across OSes (e.g. signal handling, pthread creation, etc). Plus other changes along similar lines. Also support test OS in executor (based on portable posix) and add 4 arches that cover all execution modes (fork server/no fork server, shmem/no shmem). This change paves way for testing of executor code and allows to preserve consistency across OSes and executor/csource.
* pkg/instance: pass -os to execprog/fuzzer only for akarosDmitry Vyukov2018-07-061-8/+5
| | | | | | Only akaros needs OS, because the rest assume host OS. But speciying OS for all OSes breaks patch testing on syzbot because old execprog does not have os flag.
* pkg/repro: provide stats even for failed reproDmitry Vyukov2018-07-052-20/+21
| | | | | | | Provide stats and logs for failed repro and save it in manager. In particular log is useful for failed repros, currently there is no visibility into why bugs failed to reproduce.
* pkg/repro: pass target OS to execprogDmitry Vyukov2018-07-051-2/+2
| | | | | Pass target OS to execprog and pass executor the same way manager passes it to fuzzer.
* pkg/repro: ignore suppressed crashesDmitry Vyukov2018-06-301-0/+4
| | | | | | This looks like the simplest way to deal with suppressed crashes reported out of repro. Fixes #645
* pkg/csource: support fuchsiaDmitry Vyukov2018-06-292-24/+3
| | | | Lots of assorted heavylifting to support csource on fuchsia.
* vm: pass instance to MonitorExecutionDmitry Vyukov2018-06-221-1/+1
| | | | | It may need it later to try to obtain additional diagnostic from hanged instances.
* pkg/csource: allow to build source fom memoryDmitry Vyukov2018-06-061-6/+1
| | | | | | In most cases we have source in memory, so provide a function to build right from memory without creating temp files.
* pkg/csource: minimize netdevices and net resetDmitry Vyukov2018-05-172-0/+24
| | | | | | Add separate options to minimize netdevices setup and net namespace reset. Fixes #581
* gometalinter: enable line length checkingDmitry Vyukov2018-05-041-2/+4
| | | | | | | 120 columns looks like a reasonable limit and requires few changes to existing code. Update #538
* gometalinter: check dot importsDmitry Vyukov2018-05-031-2/+2
| | | | Update #538
generated by ggit (джигит) mrf-deployment (git 2.46.0) at 2026-03-11 20:23:07 +0000