aboutsummaryrefslogtreecommitdiffstats
path: root/sys/linux/init.go
Commit message (Collapse)AuthorAgeFilesLines
* sys/linux: neutralize sched_setattrAleksandr Nogikh2022-01-201-0/+49
| | | | | | | | | | Setting itself or another process as a real-time one leads to the starvation of kernel threads and, as a result, to false positive stall bug reports. We have been getting complaints about them for already quite a long time now. Neutralize the policy argument of the syscall as much as possible given the set of possible syzkaller mutations.
* sys/linux: neutralize ioctl for /dev/msrVikram Narayanan2021-11-181-2/+12
|
* all: introduce a prog.Call constructorAleksandr Nogikh2021-09-221-8/+4
| | | | | Create a constructor for the prog.Call type. It allows to reduce the duplication of code now and during further changes.
* sys/linux: add more amd64/riscv64 special addressesDmitry Vyukov2021-03-211-1/+7
| | | | Add VSYSCALL_ADDR, PAGE_OFFSET, VMEMMAP addresses.
* sys/linux: add ieee802154 descriptionsDmitry Vyukov2021-02-121-1/+12
|
* all: make timeouts configurableDmitry Vyukov2020-12-281-0/+1
| | | | | | Add sys/targets.Timeouts struct that parametrizes timeouts throughout the system. The struct allows to control syscall/program/no output timeouts for OS/arch/VM/etc. See comment on the struct for more details.
* sys/targets: add OS/Arch name constsDmitry Vyukov2020-10-261-2/+2
| | | | | | | | | | | | We use strings to identify OS/Arch. These strings are duplicated throughout the code base massively. golangci-lint points to possiblity of typos and duplication. We already had to define these names in pkg/csource and disable checking for prog package. A future change triggers such warnings in another package. Add OS/Arch name consts to sys/targets so that they can be used to refer to OS/Arch. Use the consts everywhere.
* sys/linux: disable SNAPSHOT_POWER_OFFAndrey Konovalov2020-07-211-0/+5
| | | | It causes shutdowns.
* all: fix comments formatDmitry Vyukov2020-07-121-2/+2
| | | | | | | Fix capitalization, dots at the end and two spaces after a period. Update #1876
* sys/linux: add initial support for riscv64Tobias Klauser2020-06-261-1/+1
| | | | Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
* sys/linux: first 64bit big-endian architecture s390xAlexander Egorenkov2020-06-251-1/+1
| | | | | | | | | | | | | | | * mmap syscall is special on Linux s390x because the parameters for this syscall are passed as a struct on user stack instead of registers. * Introduce the SyscallTrampolines table into targets.Target to address the above problem. * There is a bug in Linux kernel s390x which causes QEMU TCG to hang when KASAN is enabled. The bug has been fixed in the forthcoming Linux 5.8 version. Until then do not enable KASAN when using QEMU TCG, QEMU KVM shall have no problems with KASAN. Signed-off-by: Alexander Egorenkov <Alexander.Egorenkov@ibm.com>
* prog: remove target.StringDictionaryDmitry Vyukov2020-06-071-9/+0
| | | | | | | | | The linux string dictionary comes from extremely old times when we did not have proper descriptions for almost anything, and the dictionary was a quick hack to guess at least some special strings. Now we have way better descriptions and the dictionary become both unnecessary and probably even harmful.
* sys/linux: mark some ioctls as disabledDmitry Vyukov2020-05-041-3/+1
| | | | | | | Mark ioctls we disable in init.go as disabled. Update #477 Update #502
* prog: introduce Field typeDmitry Vyukov2020-05-021-12/+12
| | | | | | | | | | | | | Remvoe FieldName from Type and add a separate Field type that holds field name. Use Field for struct fields, union options and syscalls arguments, only these really have names. Reduces size of sys/linux/gen/amd64.go from 5665583 to 5201321 (-8.2%). Allows to not create new type for squashed any pointer. But main advantages will follow, e.g. removing StructDesc, using TypeRef in Arg, etc. Update #1580
* prog: rename {PtrType,ArrayType}.Type to ElemDmitry Vyukov2020-05-011-1/+1
| | | | | | | Name "Type" is confusing when referring to pointer/array element type. Frequently there are too many Type/typ/typ1/t and typ.Type is not very informative. It _is_ a type, but what's usually more relevant is that it's an _element_ type. Let's leave type checking to compiler and give it a more meaningful name.
* prog: remove Dir from TypeDmitry Vyukov2020-05-011-19/+20
| | | | | | | | | | | | | | | | | | Having Dir is Type is handy, but forces us to duplicate lots of types. E.g. if a struct is referenced as both in and out, then we need to have 2 copies and 2 copies of structs/types it includes. If also prevents us from having the struct type as struct identity (because we can have up to 3 of them). Revert to the old way we used to do it: propagate Dir as we walk syscall arguments. This moves lots of dir passing from pkg/compiler to prog package. Now Arg contains the dir, so once we build the tree, we can use dirs as before. Reduces size of sys/linux/gen/amd64.go from 6058336 to 5661150 (-6.6%). Update #1580
* sys/linux: sync call timeouts with executorDmitry Vyukov2020-04-191-6/+10
| | | | Timeouts in executor and sys/linux get out of sync. Sync them.
* executor: surround the data mapping with PROT_NONE pagesDmitry Vyukov2020-04-181-1/+1
| | | | | | | | | | | Surround the main data mapping with PROT_NONE pages to make virtual address layout more consistent across different configurations (static/non-static build) and C repros. One observed case before: executor had a mapping above the data mapping (output region), while C repros did not have that mapping above, as the result in one case VMA had next link, while in the other it didn't and it caused a bug to not reproduce with the C repro. The bug that reproduces only with the mapping above: https://lkml.org/lkml/2020/4/17/819
* prog: refactor target.MakeMmapDmitry Vyukov2020-04-181-1/+1
| | | | | | | | | | | Make MakeMmap return more than 1 call. This is a preparation for future changes. Also remove addr/size as they are effectively always the same and can be inferred from the target (will also conflict with the future changes). Also rename to MakeDataMmap to better represent the new purpose: it's just some arbitrary mmap, but rather mapping of the data segment.
* sys/linux: use PROT_EXEC for the data section mmapDmitry Vyukov2020-04-181-1/+1
| | | | | | | Turns out the mmap protection get out of sync between executor and C reproducers. C reproducers missed PROT_EXEC. Add PROT_EXEC for linux, freebsd and akaros.
* prog: rename target.SanitizeCall to NeutralizeDmitry Vyukov2020-03-171-9/+9
| | | | | | | | | | | | | We will need a wrapper for target.SanitizeCall that will do more than just calling the target-provided function. To avoid confusion and potential mistakes, give the target function and prog function different names. Prog package will continue to call this "sanitize", which will include target's "neutralize" + more. Also refactor API a bit: we need a helper function that sanitizes the whole program because that's needed most of the time. Fixes #477 Fixes #502
* prog: fix tests for string enforcementDmitry Vyukov2020-01-051-23/+0
| | | | | | | | String value enforcement broke a number of tests where we use different values. Be more string as to what string values we use in tests. Required to add tmpfs descriptions to test syz_mount_image. Also special-casing AF_ALG algorithms as these are auto-generated.
* syz-manager: corpus rotationDmitry Vyukov2019-12-301-6/+14
| | | | | | | | | Use a random subset of syscalls/corpus/coverage for each individual VM run. Hypothesis is that this should allow fuzzer to get more coverage find more bugs in saturated state (stuck in local optimum). See the issue and comments for details. Update #1348
* sys/linux: prohibit TIOCSSERIALDmitry Vyukov2019-12-191-18/+30
| | | | | | | | | | | | Replace TIOCSSERIAL with TIOCGSERIAL. TIOCSSERIAL can do nasty things under root, like causing writes to random memory pretty much like /dev/mem, but this is also working as intended. For details see: https://groups.google.com/g/syzkaller-bugs/c/1rVENJf9P4U/m/QtGpapRxAgAJ https://syzkaller.appspot.com/bug?extid=f4f1e871965064ae689e TODO: TIOCSSERIAL does some other things that are not dangerous and would be nice to test, if/when we can sanitize based on sandbox value we could prohibit it only under sandbox=none.
* Implement basic support for MIPS64LEJouni Hogander2019-12-171-0/+1
| | | | | | | | | Add basic stuff to enable MIPS64ELR2 target: - build - make extract - make generate - qemu execution - system call parsing from /proc/kallsyms
* sys/linux: enforce arguments of all syz_open_dev callsDmitry Vyukov2019-12-031-4/+20
| | | | | Opening random devices can lead to havoc. Enforce device major/minor.
* sys/linux: update to current linux-nextDmitry Vyukov2019-11-251-1/+1
| | | | | | | | Regenerate consts on linux-next next-20191125. DEVLINK_ATTR_NETNS_* consts were chifted by 1. __BPF_FUNC_MAX_ID increased as usual. CRYPTO_ALG_TYPE_BLKCIPHER, CRYPTO_ALG_TYPE_ABLKCIPHER were removed, replace them with CRYPTO_ALG_TYPE_SKCIPHER.
* sys/linux: add syz_open_dev$char_usb descriptionsAndrey Konovalov2019-08-081-0/+6
| | | | | syz_open_dev$char_usb opens char devices with major = USB_MAJOR. Sanitize its values to make sure it doesn't open other char/block devices.
* sys/linux: extract USB HID ids (#1294)Andrey Konovalov2019-07-221-12/+13
| | | | | | | | | | | | | | | | | | * sys/linux: extract USB HID ids As it turns out the HID kernel subsystem registers only one USB driver that checks that the interface of the connected device has HID class and then looks up its own list of vendor/device ids to find a matching driver. This means that we currently don't generate proper vendor/device ids for USB HID devices. This patch updates the syz-usbgen tool to also extract USB HID vendor/device ids from a running kernel and makes the generated descriptions for HID devices to be patched using the extracted ids. This patch also contains some minor improvements to USB descriptions (better HID descriptions and more replies for some USB classes/drivers). * sys/linux: run make generate
* all: add basic USB fuzzing supportAndrey Konovalov2019-04-111-11/+12
| | | | | | | | | | | | This commits implements 4 syzcalls: syz_usb_connect, syz_usb_io_control, syz_usb_ep_write and syz_usb_disconnect. Those syzcalls are used to emit USB packets through a custom GadgetFS-like interface (currently exposed at /sys/kernel/debug/usb-fuzzer), which requires special kernel patches. USB fuzzing support is quite basic, as it mostly covers only the USB device enumeration process. Even though the syz_usb_ep_write syzcall does allow to communicate with USB endpoints after the device has been enumerated, no coverage is collected from that code yet.
* sys/linux: disable SYSLOG_ACTION_CLEARDmitry Vyukov2019-03-191-1/+4
| | | | | For context see: https://groups.google.com/d/msg/syzkaller/8nUJCnMfark/y8HOM_vrCQAJ
* sys/linux: restrict SYSLOG_ACTION_CONSOLE_LEVELDmitry Vyukov2019-03-181-53/+57
| | | | | Fuzzer must not mess with console, turn it on/off, change log level, etc. Otherwise it turns off kernel output on console.
* sys/linux: prohibit opening /proc/self/exeDmitry Vyukov2019-02-081-24/+51
| | | | | Fuzzer manages to open it and do bad things with it. Prevent it from doing so.
* sys/linux: prohibit EXT4_IOC_RESIZE_FSDmitry Vyukov2019-02-081-0/+9
| | | | | | | | | | | | | | | When we run with sandbox=none, test program can do EXT4_IOC_RESIZE_FS which shrinks rootfs basically to 0. This breaks the machine as all tests then fail with: failed to create temp dir: mkdir syzkaller-testdir077269498: no space left on device This is the most common source of "lost connection" crashes overall and they are not actually kernel bugs. Prohibit EXT4_IOC_RESIZE_FS for now. Alternatively we can mount tmpfs with sandbox=none. Update #971
* sys/linux: move {i,fa}notify into own filesDmitry Vyukov2019-02-071-2/+4
|
* kcov: some fixes for extra coverageAndrey Konovalov2019-01-171-0/+2
| | | | | | Use PC tracing mode when detecting KCOV_REMOTE_ENABLE support in the kernel. Also fix kcov_remote_handle_usb argument.
* all: detect extra coverage supportAndrey Konovalov2019-01-161-4/+6
| | | | Based on whether the kernel supports KCOV_REMOTE_ENABLE ioctl.
* sys/linux: prohibit SNAPSHOT_FREEZEDmitry Vyukov2019-01-061-0/+8
| | | | SNAPSHOT_FREEZE freezes all processes and leaves the machine dead.
* sys/linux: add basic X25 descriptionsDmitry Vyukov2018-12-241-1/+3
|
* sys/linux: extend AX25/ROSE/NETROM descriptionsDmitry Vyukov2018-12-241-1/+8
|
* sys/linux: limit init_module size argumentDmitry Vyukov2018-10-301-0/+7
| | | | | | | Kernel tries to vmalloc whatever we pass as size and it's not accounted against memcg. As the result it can lead to massive OOM kills of everything running on the machine. Strictly saying, the same applies to finit_module with a sparse file too, but there is no simple way to handle that.
* sys/syz-extract: support missing arch headersDmitry Vyukov2018-10-281-2/+3
| | | | | | | | The latest Linux kernel misses some arch-specific headers on some archs: asm/a.out.h asm/prctl.h asm/mce.h Support that.
* sys: check that target consts are definedDmitry Vyukov2018-10-191-20/+30
| | | | | | | | | | | | | | Currently when we get target consts with target.ConstMap["name"] during target initialization, we just get 0 for missing consts. This is error-prone as we can mis-type a const, or a const may be undefined only on some archs (as we have common unix code shared between several OSes). Check that all the consts are actually defined. The check detects several violations, to fix them: 1. move mremap to linux as it's only defined on linux 2. move S_IFMT to openbsd, as it's only defined and used on openbsd 3. define missing MAP_ANONYMOUS for freebsd and netbsd 4. fix extract for netbsd
* sys/linux: prohibit FAN_OPEN_PERM and FAN_ACCESS_PERMDmitry Vyukov2018-10-151-1/+12
| | | | | | | FAN_OPEN_PERM and FAN_ACCESS_PERM require the program to reply to open requests. If that does not happen, the program will hang in an unkillable state forever. See the following bug for details: https://groups.google.com/d/msg/syzkaller-bugs/pD-vbqJu6U0/kGH30p3lBgAJ
* sys/linux: prohibit EXT4_IOC_SHUTDOWNDmitry Vyukov2018-09-131-0/+10
| | | | EXT4_IOC_SHUTDOWN EXT4_IOC_SHUTDOWN on root fs effectively brings the machine down in weird ways.
* prog: add concept of "special pointers"Dmitry Vyukov2018-08-301-18/+20
| | | | | | | | | | | | | | | | | Currently we only generate either valid user-space pointers or NULL. Extend NULL to a set of special pointers that we will use in programs. All targets now contain 3 special values: - NULL - 0xfffffffffffffff (invalid kernel pointer) - 0x999999999999999 (non-canonical address) Each target can add additional special pointers on top of this. Also generate NULL/special pointers for non-opt ptr's. This restriction was always too restrictive. We may want to generate them with very low probability, but we do want to generate them. Also change pointers to NULL/special during mutation (but still not in the opposite direction).
* Makefile: don't compile all targets into target binariesDmitry Vyukov2018-08-021-2/+3
| | | | | | | | | | Currently target binaries contain support for all OS/arch combinations. However, obviously a fuchsia target binary won't test windows. For target binaries we need support only for a single target (with the exception of 386/arm target in amd64/arm64 binaries). So compile in only _the_ target into target binaries. This reduces akaros/amd64 fuzzer binary from 33 to 7 MB and execprog from 28 to 2 MB.
* sys: dedup sanitization of common unix syscallsDmitry Vyukov2018-05-071-56/+4
| | | | Update #538
* sys: dedup mmap code across OSesDmitry Vyukov2018-05-061-32/+2
| | | | Update #538
* sys: move generate files to separate packagesDmitry Vyukov2018-05-051-0/+9
| | | | | | | | | Move generated files to gen subdir. This allows to: 1. Rebuild init.go without rebuilding generated code. 2. Excluding generated files from gometalinter checking. This makes faster and consume less memory. Update #538
generated by ggit (джигит) mrf-deployment (git 2.46.0) at 2026-03-12 13:24:33 +0000