aboutsummaryrefslogtreecommitdiffstats
path: root/sys/linux/test
Commit message (Collapse)AuthorAgeFilesLines
* tools/syz-imagegen: fill fake images with unique constsDmitry Vyukov2022-12-2214-28/+28
| | | | | Fill fake images with unique 4-byte values. This allows hints mutation to easily guess magic numbers and checksums.
* sys/linux: fix afs mountingDmitry Vyukov2022-11-281-6/+0
| | | | | afs is not image-based filesystems. It accepts some server/cell as source argument.
* sys/linux: fix pvfs2 mountDmitry Vyukov2022-11-281-6/+0
| | | | It's not image-based filesystem.
* tools/syz-imagegen: generate fake empty images for all filesystemsDmitry Vyukov2022-11-2516-0/+96
| | | | | Since syz_mount_image calls are no_generate we need to add at least some empty seeds for all for filesystems.
* tools/syz-imagegen: add msdos filesystemDmitry Vyukov2022-11-2460-0/+360
|
* tools/syz-imagegen: add hfs and hfsplus filesystemsDmitry Vyukov2022-11-2416-0/+96
|
* sys/linux/test: add syz_read_part_table seedsDmitry Vyukov2022-11-238-0/+48
|
* sys/linux/test: regenerate syz_mount_image seedsDmitry Vyukov2022-11-23628-628/+628
|
* executor: don't pass uncompressed zlib sizeDmitry Vyukov2022-11-234-4/+4
| | | | | | This will allow us to mutate the image size. Fixes #3527
* sys/linux: regenerate `syz_mount_image` seedsHrutvik Kanabar2022-11-21632-632/+632
| | | | | | | | | | | | | | Update seeds to account for the new pseudo-syscall prototype and the new compressed Base64 syntax. This reduces `syz-imagegen` seed image space requirements from 127 MB to 43 MB (measured using `du -ch syz_mount_image_*`). Note that some filesystems are pathological for deflate, e.g. for `f2fs` seed image space has increased from 320 KB to 2.1 MB. This discrepancy should not be observed in corpuses after performing various filesystem operations and image mutations - the previous ad-hoc compression is highly efficient for near-empty images, but once images are modified deflate should surpass it. Tools/versions used are as in google@0d24140 and google@356d821.
* sys/linux: add NFC seedDmitry Vyukov2022-11-131-0/+43
|
* sys/linux: add iommufd descriptionsJason Gunthorpe2022-11-101-0/+60
|
* sys/linux/test: add landlock_fs_truncateMickaël Salaün2022-10-061-0/+41
| | | | | | | This test covers file truncation with path and file descriptor checks handled in security/landlock/fs.c . Signed-off-by: Mickaël Salaün <mic@linux.microsoft.com>
* sys/linux: fix invalid args in syz_mount_image testsAleksandr Nogikh2022-09-292-3/+2
|
* sys/linux: update manual `syz_mount_image` callsHrutvik Kanabar2022-09-134-5/+5
| | | | | | Add the missing boolean argument for changing directory to `syz_mount_image` calls which are not generated by `syz-imagegen`. Set it to false to ensure behaviour is as before.
* sys/linux: regenerate NTFS3 `syz_mount_image` seed imagesHrutvik Kanabar2022-09-1316-16/+16
| | | | | | Now with the ability to change directory. Regenerate on a VM which supports NTFS, using the same versions as google/syzkaller@356d821720a2d24a4cc96f8c0b2b7a11c8882190.
* sys/linux: regenerate `syz_mount_image` seed imagesHrutvik Kanabar2022-09-13612-612/+612
| | | | | | Now including the ability to change directory. Using the same tools/versions as google/syzkaller@0d2414047943397599e7cfc12d40f4582d008726. N.B. in particular, NTFS3 will be updated in the next commit.
* sys/linux: regenerate NTFS3 `syz_mount_image` seed imagesHrutvik Kanabar2022-09-0916-0/+96
| | | | | | Regenerate on a VM which supports NTFS, using: mkntfs libntfs-3g v2022.5.17 kernel v5.19.0
* sys/linux: regenerate `syz_mount_image` seed imagesHrutvik Kanabar2022-09-09648-756/+1836
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Regenerate using the following versions: mkfs.f2fs 1.14.0 (2020-08-24) mkfs.btrfs btrfs-progs v5.18.1 mkfs.fat 4.2 (2021-01-31) mkexfatfs 1.3.0 mkfs.bfs util-linux 2.38 mkfs.xfs 5.19.0 mkfs.minix util-linux 2.38 mkfs.reiserfs 3.6.27 mkfs.jfs 1.1.15 (2011-03-04) mkntfs libntfs-3g v2022.5.17 mke2fs 1.46.5 (2021-12-30) mkfs.gfs2 3.4.1 mkfs.ocfs2 1.8.7 mkfs.cramfs util-linux 2.38 genromfs 0.5.2 mkfs.erofs 1.5 makefs 20190105-3 mkudffs udftools 2.3 mkfs.jffs2 mtd-utils 2.1.4 mkfs.nilfs2 nilfs-utils 2.2.8 mksquashfs sqaushfs-tools 4.5.1 genisomage 1.1.11 NB: NTFS3 is not included here as my kernel does not seem to be compiled with it. No errors appear (except for failure to find NTFS3). This commit also updates a comment in `imagegen.go` listing dependencies.
* executor: fix enabling of ICMP/ping socketsDmitry Vyukov2022-06-201-0/+2
| | | | | | | | | | net/ipv4/ping_group_range sysctl grants access to ICMP sockets to the specified user groups. But it needs to be set inside of the net namespace (it's per-namespace). We were setting it but in the init namespace only (which we don't use). Set it after CLONE_NEWNET. This repairs testing of ICMP sockets. Note: don't set it for setuid sandbox since it's "low privilege".
* sys/linux/test: add landlock_fs_reparentMickaël Salaün2022-05-101-0/+39
| | | | | | | This test covers linking, renaming and exchanging (RENAME_EXCHANGE) checks handled in security/landlock/fs.c . Signed-off-by: Mickaël Salaün <mic@linux.microsoft.com>
* sys/linux: add ntfs3 filesystem supportKari Argillander2022-04-2016-0/+64
| | | | | | | | | | 5.15 kernel get new filesystem driver for ntfs called ntfs3. Old driver is still in use so we do not delete it yet. Generated test images are made with mkntfs v2021.8.22 (libntfs-3g) and ntfs3 version from 5.17-rc7. For some reason I did not manage to generate images with "-s 256" due some ntfs3 error. We can add those later when we work out what is going on with those.
* all: add syz_clone() and syz_clone3() pseudo callsAleksandr Nogikh2022-01-133-5/+6
| | | | | | | | | | | | | | | | | | | | As was pointed out in #2921, the current approach of limiting the number of pids per process does not work on all Linux-based kernels. We could just treat fork, clone and clone3 in a special way (e.g. exit on a zero return). However, in that case we also need to sanitize the arguments for clone and clone3 - if CLONE_VM is passed and stack is 0, the forked child processes (threads) will become nearly unindentifiable and will corrupt syz-executor's memory. While we could sanitize clone's arguments, we cannot do so for clone3 - nothing can guarantee that they will not be changed concurrently. Instead of calling those syscalls directly, introduce a special pseudo syscall syz_clone3. It copies and sanitizes the arguments and then executes clone3 (or fork, if we're on an older kernel) in such a way so as to prevent fork bombs from happening. Also introduce syz_clone() to still be able to fuzz it on older systems.
* sys/linux: use out_overlay attributeDmitry Vyukov2022-01-111-1/+1
| | | | | | | Remove all uses of direction attributes on union fields and use out_overlay attribute instead. The attribute actually does what was the intention behind use of direction attribute on unions.
* sys/linux: support map fd arraysPaul Chaignon2021-12-212-3/+3
| | | | | | | | | | | | | | | Commit [1] upstream introduced a new way to reference BPF maps in eBPF instructions. An array of BPF map fds is passed at program load time. Instructions can then reference fds in this array instead of carrying the fds directly. The goal is to allow BPF instructions to be immutable after compilation. Since we don't yet have a good way to reference indexes in an array, we define a new type map_fd_id for that purpose, with indexes between 0 and 16 only. 1 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=387544bfa291 Signed-off-by: Paul Chaignon <paul@isovalent.com>
* all: add binderfs fuzzing supportAleksandr Nogikh2021-10-291-2/+2
| | | | | | | | Create one instance of binderfs per process and add descriptions to enable syzkaller to create binderfs mounts and binder devices itself. Keep descriptions compatible with the legacy mode (when devices are created at boot time).
* executor/common_kvm_ppc64: run with enabled MMUAlexey Kardashevskiy2021-07-191-0/+8
| | | | | | | | | | | | | | | | | | | | | This sets up a page table to map the text in order to exercise more code paths in the KVM. This defines flags to control the MMU state. When enabled, this creates a simple page table at the 64K offset and maps all the RAM. The fuzzer code is placed right after the table. The flags are: IR - enables MMU for instruction fetches DR - enables MMU for data loads/stores PR - "problem state", i.e. userspace (implies DR and IR) PID1 - initializes a process table for PID>0 (PID#0 is used by the VM OS normally) This adds a simple "syz_kvm_setup_cpu_ppc64" syz-test with MSR=IR|DR|LE which is a typical Linux kernel mode. Signed-off-by: Alexey Kardashevskiy <aik@linux.ibm.com>
* pkg/compiler: optimize array[const] representationDmitry Vyukov2021-04-2110-15/+15
| | | | | | | | | | | | | | Represent array[const[X, int8], N] as string["XX...X"]. This replaces potentially huge number of: NONFAILING(*(uint8_t*)0x2000126c = 0); NONFAILING(*(uint8_t*)0x2000126d = 0); NONFAILING(*(uint8_t*)0x2000126e = 0); with a single memcpy. In one reproducer we had 3991 such lines. Also replace memcpy's with memset's when possible. Update #1070
* sys/linux/test: add landlock_fs_forbiddenMickaël Salaün2021-03-191-0/+39
| | | | | | | This test covers mount namespace manipulation forbidden in security/landlock/fs.c Signed-off-by: Mickaël Salaün <mic@linux.microsoft.com>
* sys/linux/test: add landlock_fs_accessesMickaël Salaün2021-03-191-0/+105
| | | | | | | This test helps cover most types of access checks in security/landlock/fs.c Signed-off-by: Mickaël Salaün <mic@linux.microsoft.com>
* sys/linux/test: add landlock_ptraceMickaël Salaün2021-03-191-0/+40
| | | | | | This test helps cover security/landlock/ptrace.c Signed-off-by: Mickaël Salaün <mic@linux.microsoft.com>
* sys/linux/test: add landlock_layersMickaël Salaün2021-03-191-0/+49
| | | | | | This test helps cover security/landlock/fs.c:check_access_path() Signed-off-by: Mickaël Salaün <mic@linux.microsoft.com>
* sys/linux/test: add landlock_sb_deleteMickaël Salaün2021-03-191-0/+50
| | | | | | This test helps cover security/landlock/fs.c:hook_sb_delete() Signed-off-by: Mickaël Salaün <mic@linux.microsoft.com>
* executor: disable rfkill during setupDmitry Vyukov2021-03-041-0/+2
| | | | | If rfkill is enabled by the fuzzer, wifi setup will fail. Disable rfkill to initial state during setup.
* executor: don't fail in syz_genetlink_get_family_idDmitry Vyukov2021-02-191-0/+17
| | | | | | | | | | We used to use our own netlink socket and then fail on any errors. But commit "sys/linux: add ieee802154 descriptions" made it possible to use fuzzer-provided socket, and fuzzer can pass any invalid fd. So don't fail on errors now. Fixes #2444
* sys/linux: add ieee802154 descriptionsDmitry Vyukov2021-02-125-5/+5
|
* sys/linux: add description for Mali Bifrost driver (#2394)Peter Shih2021-02-021-0/+16
| | | | | | | | | * sys/linux: add description for mali bifrost driver * sys/linux: regenerate dev_bifrost.txt.const * sys/linux/dev_bifrost: separate BASE_*_GROUP_ID_* to individual bits * sys/linux/dev_bifrost: format code
* sys/linux/test: add a test for bpf_cgroup_sysctlCheng-Min Chiang2020-12-071-0/+25
| | | | | | - Add a test for BPF_PROG_TYPE_CGROUP_SYSCTL. This could be used as a corpus. - Remove an unnecessary file sys/linux/bpf_lsm.txt.const.
* sys/linux: add some basic fscrypt test programsEric Biggers2020-12-032-0/+24
| | | | | | | | | | | | | | | | | | | | | | | With fscrypt (a.k.a. ext4, f2fs, and ubifs encryption), several steps are required to get to a properly set-up encrypted directory: - Mount a filesystem that supports encryption. - Call FS_IOC_ADD_ENCRYPTION_KEY on the mountpoint. - Create a directory in the filesystem. - Call FS_IOC_SET_ENCRYPTION_POLICY on the directory, specifying the encryption key that was added earlier. - Then actually create stuff in the directory. It may be too hard for syzkaller to generate all these steps, which may explain why syzbot isn't yet properly covering the fscrypt code; see https://storage.googleapis.com/syzkaller/cover/ci-upstream-kasan-gce.html which currently shows only 5% coverage of the fs/crypto/ directory. Therefore add some test programs which do this setup on ext4 and f2fs. Note that ubifs support can't be included yet because syzkaller doesn't yet know how to mount an ubifs filesystem (which would likely require using block2mtd, as ubifs uses MTD devices rather than block devices).
* sys/linux/test: add s390x GUP fast path testAlexander Egorenkov2020-10-091-0/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | https://lore.kernel.org/linuxppc-dev/20190418100218.0a4afd51@mschwideX1/ The test triggers this bug: [ 224.294341] ================================================================== [ 224.294389] BUG: KASAN: stack-out-of-bounds in gup_pgd_range+0x124a/0x1398 [ 224.294405] Read of size 8 at addr 000003e002e8f3d8 by task gup_fast_regr-s/633 [ 224.294417] [ 224.294431] CPU: 0 PID: 633 Comm: gup_fast_regr-s Not tainted 5.9.0-rc6 #1 [ 224.294443] Hardware name: IBM 8561 T01 701 (KVM/Linux) [ 224.294454] Call Trace: [ 224.294470] [<0000000047708384>] show_stack+0x174/0x220 [ 224.294488] [<000000004bbcfb9c>] dump_stack+0x274/0x2f8 [ 224.294506] [<0000000047f4e8e6>] print_address_description.constprop.0+0x5e/0x550 [ 224.294523] [<0000000047f4e4ea>] kasan_report+0x11a/0x168 [ 224.294538] [<0000000047e4a77a>] gup_pgd_range+0x124a/0x1398 [ 224.294554] [<0000000047e4cbea>] internal_get_user_pages_fast+0x212/0x460 [ 224.294571] [<0000000047e4cf10>] get_user_pages_fast+0x70/0xb0 [ 224.294588] [<0000000049886cee>] iov_iter_get_pages+0x2d6/0xdf0 [ 224.294605] [<000000004974aaca>] bio_iov_iter_get_pages+0x2ca/0x1088 [ 224.294623] [<0000000048210282>] iomap_dio_bio_actor+0x8e2/0x1118 [ 224.294638] [<0000000048210b64>] iomap_dio_actor+0xac/0x550 [ 224.294655] [<000000004820212a>] iomap_apply+0x21a/0x9d0 [ 224.294670] [<00000000482118ae>] iomap_dio_rw+0x7c6/0x11e8 [ 224.294689] [<0000000048374ca8>] ext4_file_read_iter+0x4b0/0x638 [ 224.294707] [<0000000047fd85ec>] new_sync_read+0x444/0x6d0 [ 224.294722] [<0000000047fde212>] vfs_read+0x2c2/0x4e0 [ 224.294737] [<0000000047fdf3ba>] ksys_read+0x16a/0x298 [ 224.294754] [<000000004bc37ee8>] system_call+0xdc/0x298 [ 224.294794] [ 224.294800] [ 224.294809] addr 000003e002e8f3d8 is located in stack of task gup_fast_regr-s/633 at offset 72 in frame: [ 224.294827] gup_pgd_range+0x0/0x1398 [ 224.294837] [ 224.294844] this frame has 3 objects: [ 224.294854] [32, 40) 'pgd' [ 224.294858] [64, 72) 'p4d' [ 224.294867] [96, 104) 'pud' [ 224.294874] [ 224.294885] Memory state around the buggy address: [ 224.294900] 000003e002e8f280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 224.294915] 000003e002e8f300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 224.294930] >000003e002e8f380: 00 00 f1 f1 f1 f1 00 f2 f2 f2 00 f2 f2 f2 00 f3 [ 224.294943] ^ [ 224.294957] 000003e002e8f400: f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 224.294972] 000003e002e8f480: 00 f1 f1 f1 f1 f1 f1 04 f2 00 f3 f3 f3 00 00 00 [ 224.294984] ================================================================== Signed-off-by: Alexander Egorenkov <Alexander.Egorenkov@ibm.com>
* sys/linux/test: refactor and extend 802.11 testsAleksandr Nogikh2020-10-053-16/+53
| | | | | | | | | | | | 80211_setup_station is extended with frame injections and delays that are arranged in such a way that the device successuflly joins an access point. 80211_scan is a new test that starts a channel scan and then injects a beacon and a probe response. These additions were tested manually and were observed to fulfill their purpose.
* sys/linux: add 802.11 frame descriptionsAleksandr Nogikh2020-10-052-9/+9
| | | | | | | | | | | | This commit enables accurate generation of 802.11 frames for injection. The descriptions only include frames/fields/elements that are supported by mac80211. Also, this commit includes fixes to tests that were affected by modification of the existing descriptions. The validity of the frames was verified by capturing the generated packets and examining them in Wirehark.
* sys/linux/tests: add three new runtests for 802.11Aleksandr Nogikh2020-10-013-0/+41
| | | | | | 1. A runtest that sets up an access point. 2. A runtest that configures a station. 3. A runtest that configures a mesh device.
* all: integrate with mac80211_hwsimAleksandr Nogikh2020-09-221-0/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Two virtual wireless devices are instantiated during network devices initialization. A new flag (-wifi) is added that controls whether these virtual wifi devices are instantiated and configured during proc initialization. Also, two new pseudo syscalls are added: 1. syz_80211_inject_frame(mac_addr, packet, packet_len) -- injects an arbitrary packet into the wireless stack. It is injected as if it originated from the device identitied by mac_addr. 2. syz_80211_join_ibss(interface_name, ssid, ssid_len, mode) -- puts a specific network interface into IBSS state and joins an IBSS network. Arguments of syz_80211_join_ibss: 1) interface_name -- null-terminated string that identifies a wireless interface 2) ssid, ssid_len -- SSID of an IBSS network to join to 3) mode -- mode of syz_80211_join_ibss operation (see below) Modes of operation: JOIN_IBSS_NO_SCAN (0x0) -- channel scan is not performed and syz_80211_join_ibss waits until the interface reaches IF_OPER_UP. JOIN_IBSS_BG_SCAN (0x1) -- channel scan is performed (takes ~ 9 seconds), syz_80211_join_ibss does not await IF_OPER_UP. JOIN_IBSS_BG_NO_SCAN (0x2) -- channel scan is not performed, syz_80211_join_ibss does not await IF_OPER_UP. Local testing ensured that these syscalls are indeed able to set up an operating network and inject packets into mac80211.
* tools/syz-imagegen: add 20 more filesystemsDmitry Vyukov2020-09-20636-128/+2192
| | | | | | | | And populate images with some files, which should make both mounting and resulting dir more interesting. Note: this adds 100MB of image files into the repo... Maybe we need to think of some other way of string these images...
* tools/syz-imagegen: add few more f2fs featuresDmitry Vyukov2020-09-20116-104/+152
| | | | Add flexible_inline_xattr, inode_checksum, inode_crtime, project_quota features.
* tools/syz-imagegen: generate full test files instead of bash scriptsDmitry Vyukov2020-09-20104-208/+208
| | | | | | | | | | | | | | | | | tools/create_{f2fs,btrfs}_image.sh are... well, shell scripts. It's hard to scale this appraoch to more file systems avoiding duplication and stupid errors while doing proper error handling and parallelization. Upgrade syz-imagegen to generate full test files and replace the shell scripts. f2fs -O=compression options is removed, it does not seem to be supported by mkfs.f2fs, it always says: Error: Wrong features The shell script used it, but it seems that the way it passed arguments (in a single '-quoted string) just made mkfs misparse the arguments (use only the first one?) and so -O=compression and most other arguments were simply ignored.
* tools/create_btrfs_image.sh: fix up and re-runDmitry Vyukov2020-09-1480-40/+200
| | | | | | The previous commit did not get all intended changes. Follow up to 2066
* tools/create_btrfs_image.sh: fix scriptDmitry Vyukov2020-09-1482-80/+160
| | | | | | | | | 1. Use set -eu 2. Use consistent name of the generated files 3. Add "requires: manual" 4. Fix some option combinations that lead to errors Follow up to 2066
* sys/linux: mount btrfs testsJiaheng Hu2020-09-1480-0/+80
| | | | | Add several unit tests that mount different versions of btrfs images, and the .sh file that generates these tests.
generated by ggit (джигит) mrf-deployment (git 2.46.0) at 2026-04-02 03:48:26 +0000