aboutsummaryrefslogtreecommitdiffstats
path: root/pkg
Commit message (Collapse)AuthorAgeFilesLines
* pkg/instance: explicitly specify optional fuzzer argumentsAleksandr Nogikh2022-04-062-13/+18
| | | | | | | | Otherwise we get problems while testing patches for older syzkaller versions, which didn't support optional arguments. Adjust tests so that problems with how OldFuzzerCmd handles such arguments could be seen.
* pkg/report: ignore print_report functionDmitry Vyukov2022-04-012-0/+141
| | | | It popped up in a new KASAN report after recent KASAN changes.
* pkg/report: better parse "scheduling while atomic" reportsDmitry Vyukov2022-03-288-10/+258
|
* syz-manager: display raw coverageAleksandr Nogikh2022-03-283-25/+46
|
* all: collect raw coverageAleksandr Nogikh2022-03-284-15/+36
| | | | | | | | | Raw coverage might be important when e.g. analysing the origins of out-of-place coverage in coverage reports or understanding why the fuzzer could not reach deeper code. If "raw_cover" is set to true, syzkaller will remember unsorted and unduplicated coverage (PCs) for each its corpus program.
* pkg/instance: refactor FuzzerCmd()Aleksandr Nogikh2022-03-281-13/+31
| | | | | | The method already has too many arguments, which complicates the further addition of new features. Introduce FuzzerCmdArgs structure to overcome the problem.
* all: use `t.TempDir` to create temporary test directoryEng Zer Jun2022-03-287-64/+12
| | | | | | | | | This commit replaces all `ioutil.TempDir` with `t.TempDir` in tests. The directory created by `t.TempDir` is automatically removed when the test and all its subtests complete. Reference: https://pkg.go.dev/testing#T.TempDir Signed-off-by: Eng Zer Jun <engzerjun@gmail.com>
* vm/gce: enable display device configurationAleksandr Nogikh2022-03-221-2/+3
| | | | Now we always enable it, make this configurable for GCE instances.
* syz-verifier: redesigned the analysis program generation and analysis flow ↵Taras Madan2022-03-221-10/+12
| | | | | | | | | (#2908) Program verification logic is located in one function now. VMs fetch programs from priority queues, not from the generator. VMs operate the tasks, not programs now. For the crashed VM - return error for every program in the queue *fixed some road errors
* pkg/instance: support older syzkaller revisionsAleksandr Nogikh2022-03-171-3/+6
| | | | | | | | | | | | | | | | | | | | | Now we use go1.16+, but sometimes syz-ci still has to compile and run old syzkaller revisions, which were not meant to be compiled with modern Go. In particular, this leads to the following errors: syzkaller build failed: failed to run ["make" "target"]: exit status 2 tools/syz-make/make.go:14:2: no required module provides package github.com/google/syzkaller/pkg/osutil: go.mod file not found in current directory or any parent directory; see 'go help modules' tools/syz-make/make.go:15:2: no required module provides package github.com/google/syzkaller/sys/targets: go.mod file not found in current directory or any parent directory; see 'go help modules' Makefile:39: *** syz-make failed. Stop. Fix this by adding GO111MODULE=auto to the environment variables. Reported-by: Taylor R Campbell <riastradh@netbsd.org>
* syz-verifier: don't use -collide in the runner (#3032)Taras Madan2022-03-162-8/+3
|
* pkg/host: only try enabled syscalls when starting syz-fuzzerKris Alder2022-03-084-9/+24
| | | | | | | | | | | When syz-fuzzer starts, it tries all syscalls to filter out any that are not supported. This process should include only the syscalls that are enabled using the 'enable_syscalls' and 'disable_syscalls' fields in syz-manager's config. This is useful for fuzzing Cuttlefish devices, for example, where the 'vhost_vsock' syscall needs to be excluded from fuzzing and from this test.
* tools/syz-testbed: store html templates in filesAleksandr Nogikh2022-02-251-2/+12
|
* tools/syz-testbed: don't parse configsAleksandr Nogikh2022-02-252-5/+59
| | | | | | | | | | It's not practical to parse configs from tools/syz-testbed because it limits the tool to using only those configuration options, which are supported by the syzkaller version at the moment of tools/syz-testbed compilation. Operate with manager configs as if they were just some JSON objects. Introduce a PatchJSON method to update their fields in a convenient way.
* dasboard: add crash stats pageAleksandr Nogikh2022-02-251-1/+59
| | | | | Show top crashers for X last days. Show graph with daily shares of crashes that satisfy user-entered regexps.
* executor: tolerate syz_genetlink_get_family_id failuresAleksandr Nogikh2022-02-251-3/+1
| | | | | | | | | | We cannot expect syscalls to always succeed during fuzzing, especially when the situation involves a complex interaction with the system. For the syz_genetlink_get_family_id case, it leads to numerous SYZFAIL crashes every day. Don't print a SYZFAIL error for this pseudo syscall.
* syz-manager: add preserve_progs configAleksandr Nogikh2022-02-042-7/+13
| | | | | Introduce a presere_progs parameter, which, if set to false, forces syz-manager to purge unneeded programs from the corpus.
* pkg/db: make repair of the db file optionalDmitry Vyukov2022-02-012-15/+18
| | | | | | | | | | | It was too radical to repair and overwrite db file unconditionally. syz-execprog probes if a given file is a database. Usually it's a crash log or a single program, but db.Open started to overwrite it. And an explicit repair flag in db.Open and enable it only in syz-manager and syz-hub. Fixes #2997
* pkg/report: ignore ThreadSanitizer clock allocator overflow errorsAndrei Vagin2022-01-272-0/+39
| | | | | Reported-by: syzbot+aada2d85478c047a3cbf@syzkaller.appspotmail.com Signed-off-by: Andrei Vagin <avagin@google.com>
* pkg/db: fix test under rootDmitry Vyukov2022-01-241-0/+3
| | | | | Opening inaccessible file won't fail under root. Skip the test.
* pkg/db: treat deserialization errors as softDmitry Vyukov2022-01-242-10/+64
| | | | | | | | corpus.db may get corrupted on an unexpected reset, etc. Commit a254b0f5 ("pkg/db: properly handle errors when loading a DB") made these errors fatal and manager never recovers on its own. Restore the previous behavior when we still recovered some records from the db. But (1) ensure that the file is at least writable and (2) add tests.
* executor: fail on SEGV during clone()Aleksandr Nogikh2022-01-212-1/+23
| | | | | | | | | | | | | | | As was found out in #2921, fork bombs are still possible in Linux-based instances. One of the possible reasons is described below. An invalid stack can be passed to the clone() call, thus causing it to stumble on an invalid memory access right during returning from the clone() call. This is in turn catched by the NONFAILING() macro and the control actually jumps over it and eventually both the child and the parent continue executing the same code. Prevent it by handling SIGSEGV and SIGBUS differently during the clone process. Co-authored-by: Andrei Vagin <avagin@google.com>
* pkg/symbolizer: extend error messageDmitry Vyukov2022-01-201-1/+1
|
* pkg/ifuzz/powerpc: update few broken instructionsAlexey Kardashevskiy2022-01-202-204/+193
| | | | | | | | | | | | The source PowerISA latex files have updated so refresh the instruction list. The fixed are not used by syzkaller in macros so there should be no huge change in behaviour, if any. While at this, simplify+comment the conversion script and fix handling of privileged instructions, apparently a debug version of the convertion script made it to the git repo. Signed-off-by: Alexey Kardashevskiy <aik@linux.ibm.com>
* executor: add extension point for adding non-mainline pseudo-syscallsDmitry Vyukov2022-01-193-0/+10
| | | | | | | | | | Add an empty common_ext.h which is included into executor and C reproducers and can be used to add non-mainline pseudo-syscalls w/o changing any other files (by replacing common_ext.h file). It would be good to finish #2274 which allows to add pseudo-syscalls along with *.txt descriptions, but #2274 is large and there are several open design questions. So add this simple extension point for now.
* all: create 8 tun devices for OpenBSDAleksandr Nogikh2022-01-141-2/+2
| | | | | Currently only 4 are created by default. This limits the maximum number of simultaneously running syz-executors.
* pkg/symbolizer: switch to debug/elf for symbol extractionDmitry Vyukov2022-01-131-61/+23
| | | | Using debug/elf is better on all fronts: faster, simpler, no external deps.
* all: add syz_clone() and syz_clone3() pseudo callsAleksandr Nogikh2022-01-133-0/+50
| | | | | | | | | | | | | | | | | | | | As was pointed out in #2921, the current approach of limiting the number of pids per process does not work on all Linux-based kernels. We could just treat fork, clone and clone3 in a special way (e.g. exit on a zero return). However, in that case we also need to sanitize the arguments for clone and clone3 - if CLONE_VM is passed and stack is 0, the forked child processes (threads) will become nearly unindentifiable and will corrupt syz-executor's memory. While we could sanitize clone's arguments, we cannot do so for clone3 - nothing can guarantee that they will not be changed concurrently. Instead of calling those syscalls directly, introduce a special pseudo syscall syz_clone3. It copies and sanitizes the arguments and then executes clone3 (or fork, if we're on an older kernel) in such a way so as to prevent fork bombs from happening. Also introduce syz_clone() to still be able to fuzz it on older systems.
* pkg/csource: do not delete comments inside macrosAleksandr Nogikh2022-01-131-1/+1
| | | | This prevents syzkaller from replacing /*{{{NAME}}}*/ within them.
* executor: remove custom sys_io_uring_setup definitionAleksandr Nogikh2022-01-131-7/+1
|
* executor: remove sys_memfd_create definesAleksandr Nogikh2022-01-131-19/+1
| | | | | Add memfd_create as a dependency to syz_mount_image and syz_read_part_table.
* all: explicitly list pseudo syscall dependenciesAleksandr Nogikh2022-01-132-6/+22
| | | | | | | | | | | Pseudo syscalls can (and most of the time) do invoke normal system calls. However, when there's a risk that those calls might not be present, syzkaller needs to take preventive actions - prepend the corresponding defines. Otherwise syz-executor or C reproducers might not compile on the host machine. List those dependencies in sys/targets, check them during machine check and add the corresponding defines during C source generation.
* executor: move SYSCALL_DEFINES above common_*.h includesAleksandr Nogikh2022-01-131-1/+4
| | | | | Otherwise the pseudo syscalls there won't be able to access those definitions.
* pkg/report: ignore ref_tracker framesDmitry Vyukov2022-01-115-0/+189
| | | | | ref_tracker is a generic debugging facility, the actual bug is (almost always) in the caller.
* prog: pass ctx by pointer to ForeachType callbackDmitry Vyukov2022-01-111-2/+2
| | | | | This will allow callbacks to stop iteration early by setting ctx.Stop flag (as it works for ForeachArg).
* pkg/compiler: require stricter resource constructorsDmitry Vyukov2022-01-114-9/+26
| | | | | | | | | | | | | Don't consider syscalls that return resources in unions/arrays as constructors. Unions and arrays are problematic because we don't have directed generation in prog.randGen.createResource() and can fail to generate a syscall that returns a particular resource (generate a wrong union option that does not contain the necessary resource). This leads to the following panics: panic: failed to create a resource ifindex with ioctl$sock_SIOCGIFCONF Require each resource to have a constructor syscall that returns the resource outside of unions/arrays.
* pkg/compiler: fix error message spellingDmitry Vyukov2022-01-112-5/+5
| | | | Add missing space before brackets.
* pkg/compiler: prohibit use of len/flags/const/proc types in out fieldsDmitry Vyukov2022-01-112-1/+10
| | | | These types in explict out fields is either unnecessary details or bugs in descriptions.
* pkg/compiler: prohibit use of direction attribute on union fieldsDmitry Vyukov2022-01-115-20/+19
| | | | | | Direction attributes on unions work in a confusing way and don't do what users may think they do. Now we have out_overlay attribute for structs that allows to have overlapping input and output fields.
* pkg/compiler: add out_overlay field attributeDmitry Vyukov2022-01-117-25/+141
|
* pkg/compiler: refactor codeDmitry Vyukov2022-01-112-13/+18
| | | | | Slightly refactor code in preparation for future changes. No functional changes intended.
* pkg/report: ignore atomic_dec_and_lock framesDmitry Vyukov2022-01-102-0/+152
| | | | That's some mutex internals.
* pkg/report: use KMSAN origin to dedup reportsDmitry Vyukov2022-01-0410-38/+80
| | | | | | | | Support extracting multiple frames from a single report (one per parseStackTrace marker). Extract KMSAN origin frame and use it as an additional ALT title for deduplication. Fixes #2927
* pkg/report: stop parsing old KMSAN reportsDmitry Vyukov2022-01-0416-1021/+0
| | | | | | Keeping backwards compatibility will complicate future changes. Since KMSAN is not upstream yet and is always rebased, we don't really need to keep parsing old reports.
* pkg/report: repair parsing of KMSAN kernel-usb-infoleakDmitry Vyukov2022-01-042-2/+6
|
* pkg/report: add more KMSAN testsDmitry Vyukov2022-01-046-0/+348
|
* executor: bump on FreeBSD the maximum number of tun devices to 256 (#2956)Michael Tüxen2021-12-311-0/+3
| | | | | | | syz-execprog now uses twice the number of CPU cores as the number of processes. Each process might use a tun device. So bump the maximum number of tun devices to the maximum of 256, which allows syz-execprog to run with default settings on systems with up to 128 cores.
* executor: support larger maximum number of tun devices on *BSD (#2953)Michael Tüxen2021-12-301-8/+14
|
* pkg/report: normalize protection fault report on OpenBSDAnton Lindqvist2021-12-302-0/+308
|
* syzkaller: add the gcp secret manager dependency (#2949)Taras Madan2021-12-281-0/+38
| | | | Adds the function to read GCP Secrets.
generated by ggit (джигит) mrf-deployment (git 2.46.0) at 2026-03-14 22:25:51 +0000