aboutsummaryrefslogtreecommitdiffstats
path: root/sys/linux/test
Commit message (Collapse)AuthorAgeFilesLines
* all: initialize vhci in linuxTheOfficialFloW2020-07-301-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * all: initialize vhci in linux * executor/common_linux.h: improve vhci initialization * pkg/repro/repro.go: add missing vhci options * executor/common_linux.h: fix type and add missing header * executor, pkg: do it like NetInjection * pkg/csource/csource.go: do not emit syz_emit_vhci if vhci is not enabled * executor/common_linux.h: fix format string * executor/common_linux.h: initialize with memset For som reason {0} gets complains about missing braces... * executor/common_linux.h: simplify vhci init * executor/common_linux.h: try to bring all available hci devices up * executor/common_linux.h: find which hci device has been registered * executor/common_linux.h: use HCI_VENDOR_PKT response to retrieve device id * sys/linux/dev_vhci.txt: fix structs of inquiry and report packets * executor/common_linux.h: remove unnecessary return statement and check vendor_pkt read size * executor/common_linux.h: remove unnecessary return statement and check vendor_pkt read size * sys/linux/dev_vhci.txt: pack extended_inquiry_info_t * sys/linux/l2cap.txt: add l2cap_conf_opt struct * executor/common_linux.h: just fill bd addr will 0xaa * executor/common_linux.h: just fill bd addr will 0xaa
* executor: added syz_io_uring_setup to wrap both setup and mmapNecip Fazil Yildiran2020-07-291-5/+1
| | | | | | It is hard for the fuzzer to generate correct programs using mmap calls with fuzzer-provided mmap length. This wrapper ensures correct length computation.
* sys/linux: enhanced descs for io_uringNecip Fazil Yildiran2020-07-241-0/+22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * sys/linux: enhanced descs for io_uring Introduced pseudo-call "syz_io_uring_put_sqes_on_ring()" for writing submission queue entries (sqes) on sq_ring, which was obtained by mmap'ping the offsets obtained from io_uring_setup(). Added descriptions for io_ring_register operations that were missing earlier. Did misc changes to adapt the descriptions for the updates on the io_uring subsystem. * pkg/host: add io_uring pseudo-syscall * executor/common_linux.h: fix issues with io_uring pseudo-syscall * executor: fixed io_uring offset computation * executor: fixes and refactorings in syz_io_uring_submit() * executor: added syz_io_uring_complete() pseudo-syscall for io_uring * sys/linux: added descriptions for io_uring operations Each operation requires a different struct io_uring_sqe set up. Those are described to be submitted to the sq ring. * executor: use uint32 instead of uint32_t * executor: remove nonfailing from pseudo-calls * sys/linux: fix io_uring epoll_ctl sqe * prog: fix TestTransitivelyEnabledCallsLinux() The newly introduced syscall, syz_io_uring_submit$IORING_OP_EPOLL_CTL, uses fd_epoll. Adapt TestTransitivelyEnabledCallsLinux() to account for this. * sys/linux: add IORING_OP_PROVIDE_BUFFERS and IORING_OP_REMOVE_BUFFERS * sys/linux: fix IORING_OP_WRITE_FIXED and IORING_OP_READ_FIXED addr and len are for the buffer located at buf_index * sys/linux: io_uring: use reg. bufs for READ, READV, RECV, RECVMSG As a result, IOSQE_BUFFER_SELECT_BIT is included in the iosqe_flags. * sys/linux: io_uring: misc fixes * sys/linux: io_uring: add IORING_SETUP_ATTACH_WQ * executor: refactorings on io_uring pseudo syscalls * sys/linux: io_uring: fix desc for params.cq_entries * executor: fix SQ_ARRAY_OFFSET computation This is required with the fix in io_uring kernel code. https://lore.kernel.org/io-uring/CACT4Y+bgTCMXi3eU7xV+W0ZZNceZFUWRTkngojdr0G_yuY8w9w@mail.gmail.com/T/#t * executor: added pseudosyscall syz_io_uring_cq_eventfd_toggle() The usage of cq_ring->flags is only for manipulating IORING_CQ_EVENTFD_DISABLED bit. This is achieved by a pseudo-syscall, which toggles the bit. * executor: added pseudocall syz_io_uring_put_ring_metadata Removed syz_io_uring_cq_eventfd_toggle() and introduced syz_io_uring_put_ring_metadata() instead. We have many pieces of metadata for both sq_ring and cq_ring, for which we are given the offsets, and some of are not supposed to be manipulated by the application. Among them, both sq and cq flags can be changed. Both valid and invalid cases might cause interesting outcomes. Use the newly introduced pseudo syscall to manipulate them randomly while also manipulating the flags to their special values. * executor: added pseudo-syscall syz_memcpy_off Removed syz_io_uring_put_ring_metadata() and instead added a much more generic pseudo systemcall to achieve the task. This should benefit other subsystems as well. * sys/linux: refactored io_uring descriptions syz_io_uring_submit() is called with a union of sqes to reduce duplication of other parameters of the function. io_uring_sqe is templated with io_uring_sqe_t, and this template type is used to describe sqes for different ops. The organization of io_uring.txt is changed. * sys/linux: io_uring: improved descs to utilize registered files The files are registered using io_uring_register$IORING_REGISTER_FILES(). When IOSQE_FIXED_FILE_BIT is enabled in iosqe_flags in sqe, a variety of operations can use those registered files using the index of the file instead of fd. Changed the sqe descriptions for the eligible operations to utilize this. * sys/linux: io_uring: improved the descs to utilize personality_id in sqes A personality_id can be registered for a io_uring fd using io_uring_register$IORING_REGISTER_PERSONALITY(). This id can be utilized within sqes. This commit improves the descs for io_uring to utilize it. In addition, the descriptions for the misc field in io_uring_sqe_t is refactored as most are shared among sqes. * sys/linux: io_uring: utilized cqe.res io_uring_cqe.res is used to carry the return value of operations achieved through io_uring. The only operations with meaningful return values (in terms of their possible usage) are openat and openat2. The pseudo-syscall syz_io_uring_complete() is modified to account for this and return those fds. The description for sqe_user_data is splitted into two to identify openat and non-openat io_uring ops. IORING_OP_IOCTL was suggested but never supported in io_uring. Thus, the note on this is removed in the descriptions. tee() expects pipefds, thus, IORING_OP_TEE. The descriptions for the pipe r/w fds are written as ordinary fd. Thus, in the description for IORING_OP_TEE, which is io_uring_sqe_tee, fd is used in the place where pipefds are expected. The note on this is removed in the descriptions. * sys/linux/test: added test for io_uring This is not tested yet. * sys/linux/test: fixed the test for io_uring The changes successfully pass the sys/linux/test/io_uring test. sys/linux/io_uring.txt: sq_ring_ptr and cq_ring_ptr are really the same. Thus, they are replaced with ring_ptr. executor/common_linux.h: thanks to io_uring test, a bug is found in where the sq_array's address is computed in syz_io_uring_submit(). Fixed. In addition, similar to the descriptions, the naming for the ring_ptr is changed from {sq,cq}_ring_ptr to ring_ptr. * sys/linux: io_uring: misc fixes * sys/linux: io_uring: changed the sqe_user_data enum Used a smaller range to ease the collisions. Used comperatively unique and magic numbers for openat user_data to avoid thinking as if the cqe belongs to openat while the user_data is coming from some random location. * pkg/host: added checks for io_uring syscall * pkg/host: fixed checks for io_uring syscall * sys/linux: fixed io_uring test
* sys/linux: first 64bit big-endian architecture s390xAlexander Egorenkov2020-06-251-0/+1
| | | | | | | | | | | | | | | * mmap syscall is special on Linux s390x because the parameters for this syscall are passed as a struct on user stack instead of registers. * Introduce the SyscallTrampolines table into targets.Target to address the above problem. * There is a bug in Linux kernel s390x which causes QEMU TCG to hang when KASAN is enabled. The bug has been fixed in the forthcoming Linux 5.8 version. Until then do not enable KASAN when using QEMU TCG, QEMU KVM shall have no problems with KASAN. Signed-off-by: Alexander Egorenkov <Alexander.Egorenkov@ibm.com>
* executor, sys/linux: syz_usb_ep_read/write accept endpoint addressAndrey Konovalov2020-05-154-6/+6
| | | | | This patch changes syz_usb_ep_read/write pseudo-syscalls to accept endpoint address as specified in its endpoint descriptor, instead of endpoint index.
* sys/linux: run usb runtests with namespace/setuid sandboxAndrey Konovalov2020-04-036-7/+5
|
* executor, sys/linux: add ath9k usb descriptionsAndrey Konovalov2020-03-131-0/+4
| | | | | | | Among other things this changes timeout for USB programs from 2 to 3 seconds. ath9k fuzzing also requires ath9k firmware to be present, so system images need to be regenerated with the updated script.
* sys/linux: add descriptions of wireguard packetsDmitry Vyukov2020-02-182-1/+3
|
* sys/linux: fix udp testDmitry Vyukov2020-02-181-5/+3
| | | | | | | | Fix the packet injection in udp test. Now we know how to do it! And without IFF_NAPI_FRAGS it actually reaches the socket. Update #1594
* sys/linux/test: add few tests for UDPDmitry Vyukov2020-02-102-0/+15
| | | | Update #1594
* prog: fix tests for string enforcementDmitry Vyukov2020-01-054-19/+4
| | | | | | | | String value enforcement broke a number of tests where we use different values. Be more string as to what string values we use in tests. Required to add tmpfs descriptions to test syz_mount_image. Also special-casing AF_ALG algorithms as these are auto-generated.
* sys/linux: fix 240 warnings in descriptionsDmitry Vyukov2019-12-203-4/+4
| | | | | | Sweeping fix of everything up to socket_netlink_route.txt. Update #590
* sys/linux: fix caps test for new descriptionsDmitry Vyukov2019-12-181-3/+3
|
* sys/linux: add a test that files are writableDmitry Vyukov2019-12-161-0/+4
|
* executor: fix syz_mount_imageDmitry Vyukov2019-12-101-0/+2
| | | | | | | 1. It always crashed in cover_reset when coverage is disabled. 2. Use NONFAILING when accessing image segments. 3. Give it additional 100 ms as it may be slow. 4. Add a test for syz_mount_image.
* sys/linux: update usb runtestsAndrey Konovalov2019-11-052-3/+11
| | | | | Add a test that issues multiple syz_usb_ep_write calls. Update hiddev test to use a wider used hid driver.
* sys/linux/text: fix test program syntaxDmitry Vyukov2019-11-041-2/+2
|
* sys/linux: improve CAN descriptionsDmitry Vyukov2019-11-041-0/+9
|
* executor/usb: enable endpoints on SET_INTERFACEAndrey Konovalov2019-10-212-2/+4
| | | | | This commit changes syz_usb_control_io to enable the relevant endpoints for the interface being set via a SET_INTERFACE request.
* sys/linux: add more USB runtestsAndrey Konovalov2019-09-244-0/+19
|
* sys/linux: add USB hiddev runtestAndrey Konovalov2019-09-241-0/+6
|
* sys/linux: fix USB runtestAndrey Konovalov2019-07-241-4/+1
|
* executor: drop CAP_SYS_NICEDmitry Vyukov2019-07-221-0/+3
| | | | | | | | | | A process with CAP_SYS_NICE can bring kernel down by asking for too high SCHED_DEADLINE priority, as the result rcu and other system services that use kernel threads will stop functioning. Some parameters for SCHED_DEADLINE should be OK, but we don't have means to enforce values of indirect syscall arguments. Peter Zijlstra proposed sysctl_deadline_period_{min,max} which could be used to enfore safe limits without droppping CAP_SYS_NICE, but we don't have it yet. See the following bug for details: https://groups.google.com/forum/#!topic/syzkaller-bugs/G6Wl_PKPIWI
* executor: drop CAP_SYS_PTRACE with sandbox=noneDmitry Vyukov2019-07-222-0/+6
| | | | | | We only drop CAP_SYS_PTRACE for sandbox=namespace, but it can equally affect testing with sandbox=none. Drop it for sandbox=none, add a test.
* pkg/csource: test sys/*/test programsDmitry Vyukov2019-07-221-1/+3
| | | | | | Running sys/*/test programs requires real machines and kernels for each OS. We can't do that in unit tests, but at least try to deserialize these programs so that they don't get rotten.
* pkg/runtest: add simple USB runtestAndrey Konovalov2019-05-311-0/+3
|
* sys/linux: improve binder descriptionsDmitry Vyukov2019-05-171-0/+6
| | | | | Refine some consts to increase changes of correct programs. Fix some types. Add comments and a test.
* sys/linux/test: use pipe2 instead of pipeDmitry Vyukov2019-02-132-2/+2
| | | | pipe does not exist on arm64.
* sys/linux/test: disable tipc testDmitry Vyukov2019-02-131-1/+3
| | | | It still crashes kernel, disable for now.
* sys/linux: prohibit opening /proc/self/exeDmitry Vyukov2019-02-082-0/+15
| | | | | Fuzzer manages to open it and do bad things with it. Prevent it from doing so.
* sys/test/test: add tests for test exiting in the middle of executionDmitry Vyukov2019-01-312-0/+6
|
* sys/linux/test: fix constraints in ipc testDmitry Vyukov2019-01-311-0/+2
|
* executor: restrict ipc resource usageDmitry Vyukov2018-12-261-0/+5
| | | | | For context see: https://groups.google.com/d/msg/syzkaller-bugs/ZaBzAJbn6i8/Py9FVlAqDQAJ
* sys/linux: extend AX25/ROSE/NETROM descriptionsDmitry Vyukov2018-12-241-0/+2
|
* sys/linux: add basic tipc testDmitry Vyukov2018-12-121-0/+3
|
* prog: support AUTO args in programsDmitry Vyukov2018-12-105-33/+33
| | | | | | | | | | | | | | | AUTO arguments can be used for: - consts - lens - pointers For const's and len's AUTO is replaced with the natural value, addresses for AUTO pointers are allocated linearly. This greatly simplifies writing test programs by hand as most of the time we want these natural values. Update tests to use AUTO.
* executor: fix cgroupsDmitry Vyukov2018-08-091-0/+15
| | | | | | | 1. Create per-proc cgroup in executor. 2. Setup cgroups after chdir into test dir (it assumes relative paths against test dir). 3. Add test.
* executor: mount binfmt_mistDmitry Vyukov2018-08-091-0/+16
| | | | | | We forgot to mount binfmt_misc. Mount it. Add a test. Increase per-call timeout, otherwise last execve timesout. Fix csource waiting for call completion at the end of program.
* executor: clean up immutable dirsDmitry Vyukov2018-08-091-0/+3
| | | | | | Turns out dirs can be immutable too. Update #650
* executor: clean up immutable filesDmitry Vyukov2018-08-081-0/+7
| | | | Fixes #650
* pkg/runtest: assorted improvementsDmitry Vyukov2018-08-081-3/+4
| | | | | | | | Support checking "blocked"/"unfinished" flags for calls. Support test constanints, e.g. "requires: threaded" or "requires: -sandbox=setuid". Some improvements in tools/syz-runtest. Update #603
* executor: abort fuse connectionDmitry Vyukov2018-08-041-7/+6
| | | | | | | If the test process is not dying after 100ms, abort all fuse connections in the system. This gets rid at least of simple fuse deadlocks, let's see how well this works in all cases.
* tools/syz-runtest: add tool for program unit testingDmitry Vyukov2018-08-034-0/+25
The tool is run as: $ syz-runtest -config manager.config This runs all programs from sys/*/test/* in different modes on actual VMs and checks results. Fixes #603
generated by ggit (джигит) mrf-deployment (git 2.46.0) at 2026-03-23 02:19:48 +0000