aboutsummaryrefslogtreecommitdiffstats
path: root/sys/linux/init.go
Commit message (Collapse)AuthorAgeFilesLines
* sys/linux: patch in auto-extracted USB IDs for printer classAndrey Konovalov2025-08-211-13/+14
| | | | | | | | | | This allows exercising driver quirks that might be defined in the matching rules (the printer driver does not actually define any yet, but this change serves as a reference for doing this for other drivers). Only patch in the IDs that are used in the matching rules of the printer driver in the kernel. Patching other IDs might subvert the kernel into matching the emulated device to a different driver.
* sys/linux: drop EXT4_IOC_MIGRATE and USB_MAJOR from init.goAlexander Potapenko2024-07-021-4/+0
| | | | | These two constants are not used anywhere. No functional change.
* sys/linux: re-enable EXT4_IOC_SHUTDOWN and EXT4_IOC_RESIZE_FSAlexander Potapenko2024-07-021-14/+0
| | | | | | | Now that we chroot into tmpfs with sandbox=none, it should be safe to allow using these ioctls, because they won't break the whole VM. Update #971.
* executor: add runner modeDmitry Vyukov2024-06-241-21/+0
| | | | | | | Move all syz-fuzzer logic into syz-executor and remove syz-fuzzer. Also restore syz-runtest functionality in the manager. Update #4917 (sets most signal handlers to SIG_IGN)
* prog: move image extraction from sys/linuxDmitry Vyukov2022-12-221-3/+0
| | | | | | Now that images are not linux-specific, we can move all image-related logic directly into prog package and significantly simplify the logic.
* sys: control structural changes during neutralizationAleksandr Nogikh2022-09-291-3/+7
| | | | | | | | | | | Ideally, we should properly support the already existing fix flag to distinguish between fixing and checking, but for now at least let it control whether structural changes are to be made. Otherwise we get into trouble while hint-mutating syz_mount_image calls, because we iterate over all call arguments and (possibly) remove them at the same time. It leads to `bad group arg size %v, should be <= %v for %#v type %#v` errors.
* sys/linux: extract raw images from syz_mount_imageAleksandr Nogikh2022-09-271-0/+1
| | | | | To simplify the extraction code, let's make segments non-overlapping even before execution.
* executor: move syz_mount_image's sanity checks to syz-fuzzerAleksandr Nogikh2022-09-271-0/+2
| | | | | It will simplify the C code and let us extract the raw images in a more convenient way.
* prog: generate very long file namesDmitry Vyukov2022-08-101-0/+12
| | | | | Generate very long file names once in a while to provoke bugs like: https://github.com/google/gvisor/commit/f857f268eceb1cdee0b2bdfa218c969c84033fcd
* dashboard/config/linux: disable MSR writesDmitry Vyukov2022-04-251-12/+2
| | | | | | | | | | | | | | | | | | Randomly changing MSRs can have unpredictable results. We tried to protect from writes on descriptions level, but it does not work well, the fuzzer has figured out: 03:37:28 executing program 3: syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000180)='fd/3\x00') pwritev(r0, ...) Fortunately there is a command line argument that disables all writes. Use it instead. Note: older kernels will need: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a7e1f67ed29f https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=02a16aa13574
* sys/linux: neutralize sched_setattrAleksandr Nogikh2022-01-201-0/+49
| | | | | | | | | | Setting itself or another process as a real-time one leads to the starvation of kernel threads and, as a result, to false positive stall bug reports. We have been getting complaints about them for already quite a long time now. Neutralize the policy argument of the syscall as much as possible given the set of possible syzkaller mutations.
* sys/linux: neutralize ioctl for /dev/msrVikram Narayanan2021-11-181-2/+12
|
* all: introduce a prog.Call constructorAleksandr Nogikh2021-09-221-8/+4
| | | | | Create a constructor for the prog.Call type. It allows to reduce the duplication of code now and during further changes.
* sys/linux: add more amd64/riscv64 special addressesDmitry Vyukov2021-03-211-1/+7
| | | | Add VSYSCALL_ADDR, PAGE_OFFSET, VMEMMAP addresses.
* sys/linux: add ieee802154 descriptionsDmitry Vyukov2021-02-121-1/+12
|
* all: make timeouts configurableDmitry Vyukov2020-12-281-0/+1
| | | | | | Add sys/targets.Timeouts struct that parametrizes timeouts throughout the system. The struct allows to control syscall/program/no output timeouts for OS/arch/VM/etc. See comment on the struct for more details.
* sys/targets: add OS/Arch name constsDmitry Vyukov2020-10-261-2/+2
| | | | | | | | | | | | We use strings to identify OS/Arch. These strings are duplicated throughout the code base massively. golangci-lint points to possiblity of typos and duplication. We already had to define these names in pkg/csource and disable checking for prog package. A future change triggers such warnings in another package. Add OS/Arch name consts to sys/targets so that they can be used to refer to OS/Arch. Use the consts everywhere.
* sys/linux: disable SNAPSHOT_POWER_OFFAndrey Konovalov2020-07-211-0/+5
| | | | It causes shutdowns.
* all: fix comments formatDmitry Vyukov2020-07-121-2/+2
| | | | | | | Fix capitalization, dots at the end and two spaces after a period. Update #1876
* sys/linux: add initial support for riscv64Tobias Klauser2020-06-261-1/+1
| | | | Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
* sys/linux: first 64bit big-endian architecture s390xAlexander Egorenkov2020-06-251-1/+1
| | | | | | | | | | | | | | | * mmap syscall is special on Linux s390x because the parameters for this syscall are passed as a struct on user stack instead of registers. * Introduce the SyscallTrampolines table into targets.Target to address the above problem. * There is a bug in Linux kernel s390x which causes QEMU TCG to hang when KASAN is enabled. The bug has been fixed in the forthcoming Linux 5.8 version. Until then do not enable KASAN when using QEMU TCG, QEMU KVM shall have no problems with KASAN. Signed-off-by: Alexander Egorenkov <Alexander.Egorenkov@ibm.com>
* prog: remove target.StringDictionaryDmitry Vyukov2020-06-071-9/+0
| | | | | | | | | The linux string dictionary comes from extremely old times when we did not have proper descriptions for almost anything, and the dictionary was a quick hack to guess at least some special strings. Now we have way better descriptions and the dictionary become both unnecessary and probably even harmful.
* sys/linux: mark some ioctls as disabledDmitry Vyukov2020-05-041-3/+1
| | | | | | | Mark ioctls we disable in init.go as disabled. Update #477 Update #502
* prog: introduce Field typeDmitry Vyukov2020-05-021-12/+12
| | | | | | | | | | | | | Remvoe FieldName from Type and add a separate Field type that holds field name. Use Field for struct fields, union options and syscalls arguments, only these really have names. Reduces size of sys/linux/gen/amd64.go from 5665583 to 5201321 (-8.2%). Allows to not create new type for squashed any pointer. But main advantages will follow, e.g. removing StructDesc, using TypeRef in Arg, etc. Update #1580
* prog: rename {PtrType,ArrayType}.Type to ElemDmitry Vyukov2020-05-011-1/+1
| | | | | | | Name "Type" is confusing when referring to pointer/array element type. Frequently there are too many Type/typ/typ1/t and typ.Type is not very informative. It _is_ a type, but what's usually more relevant is that it's an _element_ type. Let's leave type checking to compiler and give it a more meaningful name.
* prog: remove Dir from TypeDmitry Vyukov2020-05-011-19/+20
| | | | | | | | | | | | | | | | | | Having Dir is Type is handy, but forces us to duplicate lots of types. E.g. if a struct is referenced as both in and out, then we need to have 2 copies and 2 copies of structs/types it includes. If also prevents us from having the struct type as struct identity (because we can have up to 3 of them). Revert to the old way we used to do it: propagate Dir as we walk syscall arguments. This moves lots of dir passing from pkg/compiler to prog package. Now Arg contains the dir, so once we build the tree, we can use dirs as before. Reduces size of sys/linux/gen/amd64.go from 6058336 to 5661150 (-6.6%). Update #1580
* sys/linux: sync call timeouts with executorDmitry Vyukov2020-04-191-6/+10
| | | | Timeouts in executor and sys/linux get out of sync. Sync them.
* executor: surround the data mapping with PROT_NONE pagesDmitry Vyukov2020-04-181-1/+1
| | | | | | | | | | | Surround the main data mapping with PROT_NONE pages to make virtual address layout more consistent across different configurations (static/non-static build) and C repros. One observed case before: executor had a mapping above the data mapping (output region), while C repros did not have that mapping above, as the result in one case VMA had next link, while in the other it didn't and it caused a bug to not reproduce with the C repro. The bug that reproduces only with the mapping above: https://lkml.org/lkml/2020/4/17/819
* prog: refactor target.MakeMmapDmitry Vyukov2020-04-181-1/+1
| | | | | | | | | | | Make MakeMmap return more than 1 call. This is a preparation for future changes. Also remove addr/size as they are effectively always the same and can be inferred from the target (will also conflict with the future changes). Also rename to MakeDataMmap to better represent the new purpose: it's just some arbitrary mmap, but rather mapping of the data segment.
* sys/linux: use PROT_EXEC for the data section mmapDmitry Vyukov2020-04-181-1/+1
| | | | | | | Turns out the mmap protection get out of sync between executor and C reproducers. C reproducers missed PROT_EXEC. Add PROT_EXEC for linux, freebsd and akaros.
* prog: rename target.SanitizeCall to NeutralizeDmitry Vyukov2020-03-171-9/+9
| | | | | | | | | | | | | We will need a wrapper for target.SanitizeCall that will do more than just calling the target-provided function. To avoid confusion and potential mistakes, give the target function and prog function different names. Prog package will continue to call this "sanitize", which will include target's "neutralize" + more. Also refactor API a bit: we need a helper function that sanitizes the whole program because that's needed most of the time. Fixes #477 Fixes #502
* prog: fix tests for string enforcementDmitry Vyukov2020-01-051-23/+0
| | | | | | | | String value enforcement broke a number of tests where we use different values. Be more string as to what string values we use in tests. Required to add tmpfs descriptions to test syz_mount_image. Also special-casing AF_ALG algorithms as these are auto-generated.
* syz-manager: corpus rotationDmitry Vyukov2019-12-301-6/+14
| | | | | | | | | Use a random subset of syscalls/corpus/coverage for each individual VM run. Hypothesis is that this should allow fuzzer to get more coverage find more bugs in saturated state (stuck in local optimum). See the issue and comments for details. Update #1348
* sys/linux: prohibit TIOCSSERIALDmitry Vyukov2019-12-191-18/+30
| | | | | | | | | | | | Replace TIOCSSERIAL with TIOCGSERIAL. TIOCSSERIAL can do nasty things under root, like causing writes to random memory pretty much like /dev/mem, but this is also working as intended. For details see: https://groups.google.com/g/syzkaller-bugs/c/1rVENJf9P4U/m/QtGpapRxAgAJ https://syzkaller.appspot.com/bug?extid=f4f1e871965064ae689e TODO: TIOCSSERIAL does some other things that are not dangerous and would be nice to test, if/when we can sanitize based on sandbox value we could prohibit it only under sandbox=none.
* Implement basic support for MIPS64LEJouni Hogander2019-12-171-0/+1
| | | | | | | | | Add basic stuff to enable MIPS64ELR2 target: - build - make extract - make generate - qemu execution - system call parsing from /proc/kallsyms
* sys/linux: enforce arguments of all syz_open_dev callsDmitry Vyukov2019-12-031-4/+20
| | | | | Opening random devices can lead to havoc. Enforce device major/minor.
* sys/linux: update to current linux-nextDmitry Vyukov2019-11-251-1/+1
| | | | | | | | Regenerate consts on linux-next next-20191125. DEVLINK_ATTR_NETNS_* consts were chifted by 1. __BPF_FUNC_MAX_ID increased as usual. CRYPTO_ALG_TYPE_BLKCIPHER, CRYPTO_ALG_TYPE_ABLKCIPHER were removed, replace them with CRYPTO_ALG_TYPE_SKCIPHER.
* sys/linux: add syz_open_dev$char_usb descriptionsAndrey Konovalov2019-08-081-0/+6
| | | | | syz_open_dev$char_usb opens char devices with major = USB_MAJOR. Sanitize its values to make sure it doesn't open other char/block devices.
* sys/linux: extract USB HID ids (#1294)Andrey Konovalov2019-07-221-12/+13
| | | | | | | | | | | | | | | | | | * sys/linux: extract USB HID ids As it turns out the HID kernel subsystem registers only one USB driver that checks that the interface of the connected device has HID class and then looks up its own list of vendor/device ids to find a matching driver. This means that we currently don't generate proper vendor/device ids for USB HID devices. This patch updates the syz-usbgen tool to also extract USB HID vendor/device ids from a running kernel and makes the generated descriptions for HID devices to be patched using the extracted ids. This patch also contains some minor improvements to USB descriptions (better HID descriptions and more replies for some USB classes/drivers). * sys/linux: run make generate
* all: add basic USB fuzzing supportAndrey Konovalov2019-04-111-11/+12
| | | | | | | | | | | | This commits implements 4 syzcalls: syz_usb_connect, syz_usb_io_control, syz_usb_ep_write and syz_usb_disconnect. Those syzcalls are used to emit USB packets through a custom GadgetFS-like interface (currently exposed at /sys/kernel/debug/usb-fuzzer), which requires special kernel patches. USB fuzzing support is quite basic, as it mostly covers only the USB device enumeration process. Even though the syz_usb_ep_write syzcall does allow to communicate with USB endpoints after the device has been enumerated, no coverage is collected from that code yet.
* sys/linux: disable SYSLOG_ACTION_CLEARDmitry Vyukov2019-03-191-1/+4
| | | | | For context see: https://groups.google.com/d/msg/syzkaller/8nUJCnMfark/y8HOM_vrCQAJ
* sys/linux: restrict SYSLOG_ACTION_CONSOLE_LEVELDmitry Vyukov2019-03-181-53/+57
| | | | | Fuzzer must not mess with console, turn it on/off, change log level, etc. Otherwise it turns off kernel output on console.
* sys/linux: prohibit opening /proc/self/exeDmitry Vyukov2019-02-081-24/+51
| | | | | Fuzzer manages to open it and do bad things with it. Prevent it from doing so.
* sys/linux: prohibit EXT4_IOC_RESIZE_FSDmitry Vyukov2019-02-081-0/+9
| | | | | | | | | | | | | | | When we run with sandbox=none, test program can do EXT4_IOC_RESIZE_FS which shrinks rootfs basically to 0. This breaks the machine as all tests then fail with: failed to create temp dir: mkdir syzkaller-testdir077269498: no space left on device This is the most common source of "lost connection" crashes overall and they are not actually kernel bugs. Prohibit EXT4_IOC_RESIZE_FS for now. Alternatively we can mount tmpfs with sandbox=none. Update #971
* sys/linux: move {i,fa}notify into own filesDmitry Vyukov2019-02-071-2/+4
|
* kcov: some fixes for extra coverageAndrey Konovalov2019-01-171-0/+2
| | | | | | Use PC tracing mode when detecting KCOV_REMOTE_ENABLE support in the kernel. Also fix kcov_remote_handle_usb argument.
* all: detect extra coverage supportAndrey Konovalov2019-01-161-4/+6
| | | | Based on whether the kernel supports KCOV_REMOTE_ENABLE ioctl.
* sys/linux: prohibit SNAPSHOT_FREEZEDmitry Vyukov2019-01-061-0/+8
| | | | SNAPSHOT_FREEZE freezes all processes and leaves the machine dead.
* sys/linux: add basic X25 descriptionsDmitry Vyukov2018-12-241-1/+3
|
* sys/linux: extend AX25/ROSE/NETROM descriptionsDmitry Vyukov2018-12-241-1/+8
|
generated by ggit (джигит) mrf-deployment (git 2.46.0) at 2026-03-12 03:10:45 +0000