aboutsummaryrefslogtreecommitdiffstats
path: root/sys/linux/test
Commit message (Collapse)AuthorAgeFilesLines
* sys/linux/test: add syz_kvm_assert_syzos_uexit to existing testsAlexander Potapenko2024-12-119-1/+63
|
* sys/linux/tests: add a seed that unrolls syz_kvm_vgic_v3_setup()Alexander Potapenko2024-12-061-0/+23
| | | | | Provide a test case that replaces syz_kvm_vgic_v3_setup() with a sequence of 5 KVM ioctls.
* sys/linux/test: add seeds for known KVM bugsAlexander Potapenko2024-12-069-0/+119
|
* sys/linux/test: disable threading in syzos testsAlexander Potapenko2024-12-068-8/+8
| | | | | Syscalls that initialize KVM and set up syzos have to be executed in the particular order, there's no point in running them concurrently.
* sys/linux: updated fuse fs specificationsSablin Viacheslav2024-11-294-8/+8
|
* sys/linux/test: add a test for SYZOS_API_ITS_SEND_CMDAlexander Potapenko2024-11-261-0/+32
|
* sys/linux/test: invoke SYZOS ITS setup in ↵Alexander Potapenko2024-11-261-9/+11
| | | | | | arm64-syz_kvm_setup_syzos_vm-vgicv3-its Make sure the test actually performs guest-side ITS setup and invokes an LPI.
* executor: arm64: sys/linux: allocate 1024 pages for guest address spaceAlexander Potapenko2024-11-267-7/+7
| | | | | | | Pass 1024 pages of memory to both syz_kvm_setup_syzos_vm() and syz_kvm_setup_cpu$arm64() to make sure that: - there is enough memory for guest allocations (e.g. ITS pages) - host can tamper with that memory, provoking more bugs
* executor: sys/linux: arm64: reserve address for ITS, add a seed for ITS creationAlexander Potapenko2024-10-211-0/+30
| | | | | | | Reserve SYZOS address for the ITS redistributor at 0x08080000, add it to the list of kvm_guest_addrs. Also implement a syzlang test for the host part of ITS configuration as per https://www.kernel.org/doc/html/v6.1/virt/kvm/devices/arm-vgic-its.html
* sys/linux/test: split dev_iommuAleksandr Nogikh2024-10-143-28/+30
| | | | | The test has become too big (>40 calls). Split off dev_iommu_vfio and remove the overlap with dev_iommu_hwpt.
* sys/linux: add Landlock scopes for Linux 6.12Mickaël Salaün2024-09-308-10/+10
| | | | | | | | | | Add new the landlock_ruleset_attr's "scoped" field and related flags for Linux 6.12: LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET and LANDLOCK_SCOPE_SIGNAL. Update tests with the new landlock_ruleset_attr's field. Signed-off-by: Mickaël Salaün <mic@linux.microsoft.com>
* sys/linux/test: add ELF binary seedDmitry Vyukov2024-09-271-0/+5
| | | | Add a seed that creates and execs something that resembles an ELF binary.
* sys/linux: use GICD/GICR register offsets in SYZOS_API_MEMWRITEAlexander Potapenko2024-09-272-2/+2
| | | | | In addition to random offsets passed to SYZOS_API_MEMWRITE, use VGICv3 distributor/redistributor base and offsets of the corresponding registers.
* sys/linux/test: add arm64-syz_kvm_setup_syzos_vm-vgicv3-cpu1Alexander Potapenko2024-09-251-0/+16
| | | | | This is a variant of arm64-syz_kvm_setup_syzos_vm-vgicv3 running on a secondary CPU.
* sys/linux: add tests for syz_kvm_setup_syzos_vm()Alexander Potapenko2024-09-255-0/+86
| | | | Rewrite existing tests using syz_kvm_setup_cpu to use the new pseudo-syscall API
* sys/linux: add syz_create_resourceDmitry Vyukov2024-09-191-7/+8
| | | | | | | | syz_create_resource allows to turn any value into a resource. Improve binfmt descriptions using syz_create_resource: we need to pass the same file name to write syscalls and execve. Use syz_create_resource to improve binfmt descriptions.
* sys/linux: improve BPF program attach typesPaul Chaignon2024-09-112-7/+7
| | | | | | | | Which attach types are available to a BPF program depends on its type. We can encode this using conditional fields to reduce the time syzkaller loses on unsupported combinations of (program type; attach type). Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
* sys/linux: replace id_or_fd with more precise versionPaul Chaignon2024-09-111-2/+2
| | | | | | | | | | | | | The id_or_fd union was introduced before we had conditional fields to represent IDs or fds for BPF programs or links. The union was overapproximating those specific types. With conditional fields, we can now use information from other fields to determine precisely which type from the union is expected. For example, with BPF_PROG_ATTACH, if BPF_F_ID is the only flag, then the relative_fd field should be interpreted as a program ID. Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
* sys/linux: cover BPF tokensPaul Chaignon2024-09-093-12/+12
| | | | | | | | | | | | | | | | | | | The new BPF_TOKEN_CREATE bpf(2) command was introduced in commit [1] upstream. This command takes a BPF filesystem fd and returns a BPF token [2]. This token can then be passed to commands BPF_PROG_LOAD, BPF_MAP_CREATE, and BPF_BTF_LOAD and the kernel will use it to check if the operation is allowed. What operations a token allows is defined by the mount options of the BPF filesystem. No flags are currently supported for the BPF_TOKEN_CREATE command. The fd should point to the BPF filesystem, but we don't have a specific resource for this yet so just point to a generic fd. This command also doesn't add support for the new mount options. 1 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=35f96de04127 2 - https://lwn.net/Articles/947173/ Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
* sys/linux: cover value_type_btf_obj_fd field for BPF_MAP_CREATEPaul Chaignon2024-09-091-3/+3
| | | | | | | | | This new field for the bpf(2) command BPF_MAP_CREATE was introduced in [1] upstream. It is conditioned on both the map type and its flags (BPF_F_VTYPE_BTF_OBJ_FD). 1 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=fcc2c1fb0651 Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
* executor: sys/linux: arm64: implement SYZOS_API_MEMWRITEAlexander Potapenko2024-09-061-0/+14
| | | | | | | | The new API call will be used to write values to guest memory specified by base+offset. Writing to e.g. MMIO registers for VGIC (or any other MMIO ranges) may result in new coverage.
* sys/linux: add a test for VGICv3Alexander Potapenko2024-09-031-0/+18
|
* executor: arm64: add SYZOS_API_HVCAlexander Potapenko2024-08-071-1/+6
| | | | | Make the necessary changes to support HVC in addition to SMC. These two may subtly differ, so they are handled separately.
* sys/linux: refactor syzos_api_callAlexander Potapenko2024-08-073-3/+3
| | | | | As suggested by Dmitry, use a template to avoid duplication in various syzos types. Also adjust the existing tests.
* executor: arm64: add SYZOS_API_SMCAlexander Potapenko2024-08-071-0/+15
| | | | | | | | Provide an API call to invoke the ARM64 Secure Monitor Call instruction with user-supplied function id and 5 parameters passed in registers x1-x5. For now only `smc #0` is invoked, although in the future we may want to pass other (reserved) immediate values to SMC.
* sys/linux/test: use AUTO where possible in syz_kvm_setup_cpu_arm64Alexander Potapenko2024-08-051-6/+6
| | | | | Reduce the number of hand-rolled constants in syz_kvm_setup_cpu_arm64 by using AUTO
* executor: arm64: add SYZOS_API_MSRAlexander Potapenko2024-08-051-0/+12
| | | | | | | | | | | | | MSR is an ARM64 instruction that writes a value from a GP register to one of the system CPU registers. Exposing those registers to a fuzzer will let us trigger unexpected behavior in handling them on the kernel side. The SYZOS_API_MSR call has two int64 arguments, register ID and value. Register IDs are 64-bit values obtained from ARM64_SYS_REG() in the Linux asm/kvm.h UAPI header. Same register IDs are used by ioctl$KVM_GET_ONE_REG and ioctl$KVM_SET_ONE_REG. Also add sys/linux/test/syz_kvm_setup_cpu_arm64-msr
* sys/linux/test: add basic test for syz_kvm_setup_cpu$arm64Alexander Potapenko2024-07-291-0/+22
| | | | | This is the initial test to help seed syzos program generation. We'll need to add assertions to it once we implement them.
* tools/syz-imagegen: generate bcachefs imagesAleksandr Nogikh2024-05-038-0/+48
| | | | Use the parameters as discussed in https://groups.google.com/g/syzkaller/c/h002HJplxP0/m/ypISQYYpAwAJ
* sys/linux: update the Landlock IOCTL access rightMickaël Salaün2024-04-291-1/+1
| | | | | | | We renamed LANDLOCK_ACCESS_FS_IOCTL to LANDLOCK_ACCESS_FS_IOCTL_DEV, but the value is still the same. Signed-off-by: Mickaël Salaün <mic@linux.microsoft.com>
* sys/linux: add IOMMU_HWPT_INVALIDATEJason Gunthorpe2024-03-131-0/+1
|
* sys/linux: add IOMMU_HWPT_GET_DIRTY_BITMAPJason Gunthorpe2024-03-131-0/+2
|
* sys/linux: add IOMMU_HWPT_SET_DIRTY_TRACKINGJason Gunthorpe2024-03-131-0/+6
|
* sys/linux: add IOMMU_GET_HW_INFOJason Gunthorpe2024-03-131-0/+1
|
* sys/linux: add IOMMUFD_CMD_HWPT_ALLOCJason Gunthorpe2024-03-131-0/+7
| | | | New ioctl to create hwpt objects directly with two forms.
* sys/linux: make tets/dev_iommu work againJason Gunthorpe2024-03-131-15/+13
| | | | | | | | | | | | | | | | | This should run without any errno returns. A number of problems have crept in: The kernel changed the size of the test ioctl from 0x38 to 0x48. The generated description picked this up but the hardwired constant in the test did not. Update all cases. Fix TEST_OP_MOCK_DOMAIN to use the kernel changed ID layout and new destruction sequence. Move TEST_OP_MD_CHECK_* up into a region with a MOCK_DOMAIN and fix their arguments so they work properly. The test now passes on v6.8-rc3 with no error failures.
* sys/linux: refactor wifi descriptions using if[]Aleksandr Nogikh2024-02-194-7/+7
| | | | | The descriptions benefit from syzkaller being able to include fields conditionally.
* sys/linux/test: add landlock_fs_ioctlMickaël Salaün2023-12-181-0/+26
| | | | | | | This test covers regular file IOCTL checks handled in security/landlock/fs.c Signed-off-by: Mickaël Salaün <mic@linux.microsoft.com>
* sys/linux, pkg/host, executor: add NVMe-oF/TCP subsystem supportAlon Zahavi2023-12-072-0/+13
| | | | | Add new pseudo-syscall for creating a socket in init netns and connecting to NVMe-oF/TCP server on 127.0.0.1:4420. Also add descriptions for NVMe-oF/TCP.
* sys/linux/test: don't run BPF test programs with helpersPaul Chaignon2023-11-281-10/+6
| | | | | | | | | | | | | Our test programs with BPF helper calls are used to verify that the syzkaller descriptions for BPF helpers are correct. We don't really need to run those BPF programs to check that the descriptions are correct; the real test is to pass the verifier, which happens at load time. This commit therefore removes syscalls to run the BPF programs. We are limited in how many syscalls we can have per syzkaller programs so we might as well make the most of it. Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
* sys/linux: support more complex bpf_snprintf modifiersPaul Chaignon2023-11-271-1/+1
| | | | | | | | This commit adds more complex format modifiers for the bpf_snprintf BPF helper. Those correspond to a bunch of cases that are uncovered in syzbot's coverage of bpf_bprintf_prepare. Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
* sys/linux: add all format specifiers for bpf_trace_printkPaul Chaignon2023-11-271-1/+1
| | | | | | | | The bpf_trace_printk helper supports a limited set of format specifiers [1]. This commit ensures they are all covered in the union. 1 - https://man7.org/linux/man-pages/man7/bpf-helpers.7.html Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
* sys/linux: use AUTO for structs wherever possiblePaul Chaignon2023-11-138-19/+19
| | | | | | | | These occurences were found with the command: git grep -lP "{(AUTO,\s)*AUTO}" Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
* sys/linux: add BPF_RB_* flags for ringbuf helpersPaul Chaignon2023-11-091-2/+2
| | | | | | | | | | | | | BPF helpers bpf_ringbuf_{discard,submit,output} take a set of flags. This commit describes those flags. The default is a zero value, but the kernel doesn't have a macro for that. Thus, "0" is simply added to the flag definition. Note bpf_ringbuf_reserve also has a flags argument, but it is currently unused on the kernel side. Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
* sys/linux: describe BPF helper bpf_ringbuf_outputPaul Chaignon2023-11-091-0/+4
| | | | | | | | | | | | | This helper has the prototype: bpf_ringbuf_output(void *ringbuf, void *data, u64 size, u64 flags) We need to prepare the second argument (R2) on the stack. We use an 8 bytes data value initialized to some random value on the stack and pointed to by R2. The third argument therefore needs to be 8 (for 8 bytes). Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
* sys/linux: describe BPF helper call to bpf_ringbuf_queryPaul Chaignon2023-11-091-0/+4
| | | | | | | | This BPF helper has the prototype: bpf_ringbuf_query(void *ringbuf, u64 flags) Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
* sys/linux: describe call to BPF helper bpf_ringbuf_discardPaul Chaignon2023-11-091-1/+1
| | | | | | | | Including this helper call in our descriptions is trivial since it takes the same arguments and returns the same (void) as the already described bpf_ringbuf_submit helper call. Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
* sys/linux: add null check BPF instructionsPaul Chaignon2023-11-091-1/+1
| | | | | | | | | | | | | | | | | | This commit adds a new struct with two BPF instructions to perform a null check on a given pointer. It is then used to update our small ringbuf program to null check the ringbuf reserved data pointer as follows. u64 *e; e = bpf_ringbuf_reserve(&rb, sizeof(*e), 0); if (!e) return 0; [...] bpf_ringbuf_submit(e, 0); return 0; With this null check, our test case corresponding to this program now passes the verifier and is successfully loaded. Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
* sys/linux: describe call to BPF helper bpf_ringbuf_submitPaul Chaignon2023-11-091-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This helper has the verifier prototype: .ret_type = RET_VOID, .arg1_type = ARG_PTR_TO_RINGBUF_MEM | OBJ_RELEASE, .arg2_type = ARG_ANYTHING, We therefore need to pass the pointer retrieved with bpf_ringbuf_reserve via R2. We saved that pointer to R9 so we can retrieve it from there. Since bpf_ringbuf_submit doesn't return anything, we need to write something in R0 before we exit the program. Our BPF program now looks like: u64 *e; e = bpf_ringbuf_reserve(&rb, sizeof(*e), 0); [...] bpf_ringbuf_submit(e, 0); return 0; It will still fail, but with EACCES instead of EINVAL, due to the following verifier error: 0: R1=ctx(off=0,imm=0) R10=fp0 0: (18) r0 = 0x0 ; R0_w=0 2: (18) r1 = 0xffff984f66f93600 ; R1_w=map_ptr(off=0,ks=0,vs=0,imm=0) 4: (b7) r2 = 20 ; R2_w=20 5: (b7) r3 = 0 ; R3_w=0 6: (85) call bpf_ringbuf_reserve#131 ; R0_w=ringbuf_mem_or_null(id=2,ref_obj_id=2,off=0,imm=0) refs=2 7: (bf) r9 = r0 ; R0_w=ringbuf_mem_or_null(id=2,ref_obj_id=2,off=0,imm=0) R9_w=ringbuf_mem_or_null(id=2,ref_obj_id=2,off=0,imm=0) refs=2 8: (bf) r1 = r9 ; R1_w=ringbuf_mem_or_null(id=2,ref_obj_id=2,off=0,imm=0) R9_w=ringbuf_mem_or_null(id=2,ref_obj_id=2,off=0,imm=0) refs=2 9: (b7) r2 = 0 ; R2_w=0 refs=2 10: (85) call bpf_ringbuf_submit#132 R1 type=ringbuf_mem_or_null expected=ringbuf_mem In short, we didn't check that the pointer returned by bpf_ringbug_reserve isn't null. Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
* sys/linux: describe call to BPF helper bpf_ringbuf_reservePaul Chaignon2023-11-091-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Describe a full call to bpf_ringbuf_reserve, using the map type created in the previous commit. The test corresponds to this simple line: u64 *e; e = bpf_ringbuf_reserve(&rb, sizeof(*e), 0); [...] return e; The pointer returned by bpf_ringbuf_reserve is kept in R9. The goal is to keep it around so we can use it in other instructions later; several other helpers take a pointer to ringbuf data as argument. There's of course a risk that some instruction in between will clobber R9, but I don't know another way. R9 is at least safe for calls (only R1--R5 get clobbered). We expect the program loading to fail with EINVAL because we never release the reference to the ringbuf data. The verifier will therefore reject the program with: 0: R1=ctx(off=0,imm=0) R10=fp0 0: (18) r0 = 0x0 ; R0_w=0 2: (18) r1 = 0xffff984e4b55da00 ; R1_w=map_ptr(off=0,ks=0,vs=0,imm=0) 4: (b7) r2 = 20 ; R2_w=20 5: (b7) r3 = 0 ; R3_w=0 6: (85) call bpf_ringbuf_reserve#131 ; R0_w=ringbuf_mem_or_null(id=2,ref_obj_id=2,off=0,imm=0) refs=2 7: (bf) r9 = r0 ; R0_w=ringbuf_mem_or_null(id=2,ref_obj_id=2,off=0,imm=0) R9_w=ringbuf_mem_or_null(id=2,ref_obj_id=2,off=0,imm=0) refs=2 8: (95) exit Unreleased reference id=2 alloc_insn=6 Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
generated by ggit (джигит) mrf-deployment (git 2.46.0) at 2026-03-18 20:06:16 +0000