aboutsummaryrefslogtreecommitdiffstats
path: root/sys/linux/test
Commit message (Collapse)AuthorAgeFilesLines
...
* sys/linux: support log_true_size field in bpf(2) PROG_LOADPaul Chaignon2023-08-251-1/+1
| | | | | | | | | | Commit [1] upstream added a new field to the bpf(2) PROG_LOAD command for the kernel to return the buffer size that would be required to store all logs. This is an output-only field so probably not much point in fuzzing it, so let's fix it to 0. 1 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=47a71c1f9af0 Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
* sys/linux: support CO-RE info in PROG_LOAD commandPaul Chaignon2023-08-252-3/+3
| | | | | | | | | | Commit [1] upstream added support via the bpf(2) PROG_LOAD command to load BTF CO-RE relocation data. This commit adds basic support for loading the same data in syzkaller. As usual with BTF, we are pretty limited in what we can efficiently describe :-( 1 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=fbd94c7afcf9 Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
* sys/io_uring, executor/common_linux: remove sqes_index in syz_io_uring_submitDylan Yudaken2023-07-301-1/+1
| | | | | | | | This parameter barely increases coverage since the tail is always set to the entry that is written, but it does increase the complexity of the api and seems to reduce coverage when I run it locally. Remove it.
* sys/linux/io_uring, executor/common_linux: fix io_uring segfaultDylan Yudaken2023-07-301-1/+1
| | | | | | | | | | In Linux 6.4+ it is not allowed to provide a vma to mmap(2) [1]. Change the API to request the address from the Kernel. Note I do not know why this was done in the first place, but it seems not to be useful. [1]: https://github.com/torvalds/linux/commit/d808459b2e31bd5123a14258a7a529995db974c8
* sys/linux: add CET(Control-flow Enforcement Technology) user space ↵Pengfei Xu2023-05-041-0/+27
| | | | | | | | | | | | | | | SHSTK(Shadow Stack) test file CET(Control-flow Enforcement Technology) is a security feature that includes shadow stack and end branch to prevent ROP(Return Oriented programming)/JOP (Jump Oriented Programming) attack from the root cause. User space SHSTK which prevents ROP attack for user space process is in Linux tip repo: https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/log/?h=x86/shstk Add CET user space SHSTK test file in syzkaller to cover related fuzzing tests. Signed-off-by: Pengfei Xu <pengfei.xu@intel.com>
* sys/linux/test: add a regression test for sendmmsg bugDmitry Vyukov2023-04-181-0/+4
| | | | | Add a regression test for: https://github.com/torvalds/linux/commit/1c5950fc6fe996235f1d18539b9c6b64b597f50f
* sys/linux: add prog for 2 iommufd ioctl syscallsyantingj2023-04-071-0/+5
| | | | | | | Add test program for ioctl$IOMMU_TEST_OP_MD_CHECK_MAP and ioctl$IOMMU_TEST_OP_MD_CHECK_REFS to hit them quickly. Signed-off-by: yantingj <yanting.jiang@intel.com>
* sys/linux: add syz_pkey_set syscallsDmitry Vyukov2023-04-031-0/+10
| | | | The syscall sets PKRU register which is part of protection keys (pkey).
* prog: reject escaping filenames during deserializationDmitry Vyukov2023-02-161-1/+1
| | | | | | | | We already try as hard as possible to not generate escaping (global) filenames. However, it's possible we read them from the corpus if it happens to contain some. Also check for escaping filenames during deserialization. Fixes #3678
* tools/syz-imagegen: fill fake images with unique constsDmitry Vyukov2022-12-2214-28/+28
| | | | | Fill fake images with unique 4-byte values. This allows hints mutation to easily guess magic numbers and checksums.
* sys/linux: fix afs mountingDmitry Vyukov2022-11-281-6/+0
| | | | | afs is not image-based filesystems. It accepts some server/cell as source argument.
* sys/linux: fix pvfs2 mountDmitry Vyukov2022-11-281-6/+0
| | | | It's not image-based filesystem.
* tools/syz-imagegen: generate fake empty images for all filesystemsDmitry Vyukov2022-11-2516-0/+96
| | | | | Since syz_mount_image calls are no_generate we need to add at least some empty seeds for all for filesystems.
* tools/syz-imagegen: add msdos filesystemDmitry Vyukov2022-11-2460-0/+360
|
* tools/syz-imagegen: add hfs and hfsplus filesystemsDmitry Vyukov2022-11-2416-0/+96
|
* sys/linux/test: add syz_read_part_table seedsDmitry Vyukov2022-11-238-0/+48
|
* sys/linux/test: regenerate syz_mount_image seedsDmitry Vyukov2022-11-23628-628/+628
|
* executor: don't pass uncompressed zlib sizeDmitry Vyukov2022-11-234-4/+4
| | | | | | This will allow us to mutate the image size. Fixes #3527
* sys/linux: regenerate `syz_mount_image` seedsHrutvik Kanabar2022-11-21632-632/+632
| | | | | | | | | | | | | | Update seeds to account for the new pseudo-syscall prototype and the new compressed Base64 syntax. This reduces `syz-imagegen` seed image space requirements from 127 MB to 43 MB (measured using `du -ch syz_mount_image_*`). Note that some filesystems are pathological for deflate, e.g. for `f2fs` seed image space has increased from 320 KB to 2.1 MB. This discrepancy should not be observed in corpuses after performing various filesystem operations and image mutations - the previous ad-hoc compression is highly efficient for near-empty images, but once images are modified deflate should surpass it. Tools/versions used are as in google@0d24140 and google@356d821.
* sys/linux: add NFC seedDmitry Vyukov2022-11-131-0/+43
|
* sys/linux: add iommufd descriptionsJason Gunthorpe2022-11-101-0/+60
|
* sys/linux/test: add landlock_fs_truncateMickaël Salaün2022-10-061-0/+41
| | | | | | | This test covers file truncation with path and file descriptor checks handled in security/landlock/fs.c . Signed-off-by: Mickaël Salaün <mic@linux.microsoft.com>
* sys/linux: fix invalid args in syz_mount_image testsAleksandr Nogikh2022-09-292-3/+2
|
* sys/linux: update manual `syz_mount_image` callsHrutvik Kanabar2022-09-134-5/+5
| | | | | | Add the missing boolean argument for changing directory to `syz_mount_image` calls which are not generated by `syz-imagegen`. Set it to false to ensure behaviour is as before.
* sys/linux: regenerate NTFS3 `syz_mount_image` seed imagesHrutvik Kanabar2022-09-1316-16/+16
| | | | | | Now with the ability to change directory. Regenerate on a VM which supports NTFS, using the same versions as google/syzkaller@356d821720a2d24a4cc96f8c0b2b7a11c8882190.
* sys/linux: regenerate `syz_mount_image` seed imagesHrutvik Kanabar2022-09-13612-612/+612
| | | | | | Now including the ability to change directory. Using the same tools/versions as google/syzkaller@0d2414047943397599e7cfc12d40f4582d008726. N.B. in particular, NTFS3 will be updated in the next commit.
* sys/linux: regenerate NTFS3 `syz_mount_image` seed imagesHrutvik Kanabar2022-09-0916-0/+96
| | | | | | Regenerate on a VM which supports NTFS, using: mkntfs libntfs-3g v2022.5.17 kernel v5.19.0
* sys/linux: regenerate `syz_mount_image` seed imagesHrutvik Kanabar2022-09-09648-756/+1836
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Regenerate using the following versions: mkfs.f2fs 1.14.0 (2020-08-24) mkfs.btrfs btrfs-progs v5.18.1 mkfs.fat 4.2 (2021-01-31) mkexfatfs 1.3.0 mkfs.bfs util-linux 2.38 mkfs.xfs 5.19.0 mkfs.minix util-linux 2.38 mkfs.reiserfs 3.6.27 mkfs.jfs 1.1.15 (2011-03-04) mkntfs libntfs-3g v2022.5.17 mke2fs 1.46.5 (2021-12-30) mkfs.gfs2 3.4.1 mkfs.ocfs2 1.8.7 mkfs.cramfs util-linux 2.38 genromfs 0.5.2 mkfs.erofs 1.5 makefs 20190105-3 mkudffs udftools 2.3 mkfs.jffs2 mtd-utils 2.1.4 mkfs.nilfs2 nilfs-utils 2.2.8 mksquashfs sqaushfs-tools 4.5.1 genisomage 1.1.11 NB: NTFS3 is not included here as my kernel does not seem to be compiled with it. No errors appear (except for failure to find NTFS3). This commit also updates a comment in `imagegen.go` listing dependencies.
* executor: fix enabling of ICMP/ping socketsDmitry Vyukov2022-06-201-0/+2
| | | | | | | | | | net/ipv4/ping_group_range sysctl grants access to ICMP sockets to the specified user groups. But it needs to be set inside of the net namespace (it's per-namespace). We were setting it but in the init namespace only (which we don't use). Set it after CLONE_NEWNET. This repairs testing of ICMP sockets. Note: don't set it for setuid sandbox since it's "low privilege".
* sys/linux/test: add landlock_fs_reparentMickaël Salaün2022-05-101-0/+39
| | | | | | | This test covers linking, renaming and exchanging (RENAME_EXCHANGE) checks handled in security/landlock/fs.c . Signed-off-by: Mickaël Salaün <mic@linux.microsoft.com>
* sys/linux: add ntfs3 filesystem supportKari Argillander2022-04-2016-0/+64
| | | | | | | | | | 5.15 kernel get new filesystem driver for ntfs called ntfs3. Old driver is still in use so we do not delete it yet. Generated test images are made with mkntfs v2021.8.22 (libntfs-3g) and ntfs3 version from 5.17-rc7. For some reason I did not manage to generate images with "-s 256" due some ntfs3 error. We can add those later when we work out what is going on with those.
* all: add syz_clone() and syz_clone3() pseudo callsAleksandr Nogikh2022-01-133-5/+6
| | | | | | | | | | | | | | | | | | | | As was pointed out in #2921, the current approach of limiting the number of pids per process does not work on all Linux-based kernels. We could just treat fork, clone and clone3 in a special way (e.g. exit on a zero return). However, in that case we also need to sanitize the arguments for clone and clone3 - if CLONE_VM is passed and stack is 0, the forked child processes (threads) will become nearly unindentifiable and will corrupt syz-executor's memory. While we could sanitize clone's arguments, we cannot do so for clone3 - nothing can guarantee that they will not be changed concurrently. Instead of calling those syscalls directly, introduce a special pseudo syscall syz_clone3. It copies and sanitizes the arguments and then executes clone3 (or fork, if we're on an older kernel) in such a way so as to prevent fork bombs from happening. Also introduce syz_clone() to still be able to fuzz it on older systems.
* sys/linux: use out_overlay attributeDmitry Vyukov2022-01-111-1/+1
| | | | | | | Remove all uses of direction attributes on union fields and use out_overlay attribute instead. The attribute actually does what was the intention behind use of direction attribute on unions.
* sys/linux: support map fd arraysPaul Chaignon2021-12-212-3/+3
| | | | | | | | | | | | | | | Commit [1] upstream introduced a new way to reference BPF maps in eBPF instructions. An array of BPF map fds is passed at program load time. Instructions can then reference fds in this array instead of carrying the fds directly. The goal is to allow BPF instructions to be immutable after compilation. Since we don't yet have a good way to reference indexes in an array, we define a new type map_fd_id for that purpose, with indexes between 0 and 16 only. 1 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=387544bfa291 Signed-off-by: Paul Chaignon <paul@isovalent.com>
* all: add binderfs fuzzing supportAleksandr Nogikh2021-10-291-2/+2
| | | | | | | | Create one instance of binderfs per process and add descriptions to enable syzkaller to create binderfs mounts and binder devices itself. Keep descriptions compatible with the legacy mode (when devices are created at boot time).
* executor/common_kvm_ppc64: run with enabled MMUAlexey Kardashevskiy2021-07-191-0/+8
| | | | | | | | | | | | | | | | | | | | | This sets up a page table to map the text in order to exercise more code paths in the KVM. This defines flags to control the MMU state. When enabled, this creates a simple page table at the 64K offset and maps all the RAM. The fuzzer code is placed right after the table. The flags are: IR - enables MMU for instruction fetches DR - enables MMU for data loads/stores PR - "problem state", i.e. userspace (implies DR and IR) PID1 - initializes a process table for PID>0 (PID#0 is used by the VM OS normally) This adds a simple "syz_kvm_setup_cpu_ppc64" syz-test with MSR=IR|DR|LE which is a typical Linux kernel mode. Signed-off-by: Alexey Kardashevskiy <aik@linux.ibm.com>
* pkg/compiler: optimize array[const] representationDmitry Vyukov2021-04-2110-15/+15
| | | | | | | | | | | | | | Represent array[const[X, int8], N] as string["XX...X"]. This replaces potentially huge number of: NONFAILING(*(uint8_t*)0x2000126c = 0); NONFAILING(*(uint8_t*)0x2000126d = 0); NONFAILING(*(uint8_t*)0x2000126e = 0); with a single memcpy. In one reproducer we had 3991 such lines. Also replace memcpy's with memset's when possible. Update #1070
* sys/linux/test: add landlock_fs_forbiddenMickaël Salaün2021-03-191-0/+39
| | | | | | | This test covers mount namespace manipulation forbidden in security/landlock/fs.c Signed-off-by: Mickaël Salaün <mic@linux.microsoft.com>
* sys/linux/test: add landlock_fs_accessesMickaël Salaün2021-03-191-0/+105
| | | | | | | This test helps cover most types of access checks in security/landlock/fs.c Signed-off-by: Mickaël Salaün <mic@linux.microsoft.com>
* sys/linux/test: add landlock_ptraceMickaël Salaün2021-03-191-0/+40
| | | | | | This test helps cover security/landlock/ptrace.c Signed-off-by: Mickaël Salaün <mic@linux.microsoft.com>
* sys/linux/test: add landlock_layersMickaël Salaün2021-03-191-0/+49
| | | | | | This test helps cover security/landlock/fs.c:check_access_path() Signed-off-by: Mickaël Salaün <mic@linux.microsoft.com>
* sys/linux/test: add landlock_sb_deleteMickaël Salaün2021-03-191-0/+50
| | | | | | This test helps cover security/landlock/fs.c:hook_sb_delete() Signed-off-by: Mickaël Salaün <mic@linux.microsoft.com>
* executor: disable rfkill during setupDmitry Vyukov2021-03-041-0/+2
| | | | | If rfkill is enabled by the fuzzer, wifi setup will fail. Disable rfkill to initial state during setup.
* executor: don't fail in syz_genetlink_get_family_idDmitry Vyukov2021-02-191-0/+17
| | | | | | | | | | We used to use our own netlink socket and then fail on any errors. But commit "sys/linux: add ieee802154 descriptions" made it possible to use fuzzer-provided socket, and fuzzer can pass any invalid fd. So don't fail on errors now. Fixes #2444
* sys/linux: add ieee802154 descriptionsDmitry Vyukov2021-02-125-5/+5
|
* sys/linux: add description for Mali Bifrost driver (#2394)Peter Shih2021-02-021-0/+16
| | | | | | | | | * sys/linux: add description for mali bifrost driver * sys/linux: regenerate dev_bifrost.txt.const * sys/linux/dev_bifrost: separate BASE_*_GROUP_ID_* to individual bits * sys/linux/dev_bifrost: format code
* sys/linux/test: add a test for bpf_cgroup_sysctlCheng-Min Chiang2020-12-071-0/+25
| | | | | | - Add a test for BPF_PROG_TYPE_CGROUP_SYSCTL. This could be used as a corpus. - Remove an unnecessary file sys/linux/bpf_lsm.txt.const.
* sys/linux: add some basic fscrypt test programsEric Biggers2020-12-032-0/+24
| | | | | | | | | | | | | | | | | | | | | | | With fscrypt (a.k.a. ext4, f2fs, and ubifs encryption), several steps are required to get to a properly set-up encrypted directory: - Mount a filesystem that supports encryption. - Call FS_IOC_ADD_ENCRYPTION_KEY on the mountpoint. - Create a directory in the filesystem. - Call FS_IOC_SET_ENCRYPTION_POLICY on the directory, specifying the encryption key that was added earlier. - Then actually create stuff in the directory. It may be too hard for syzkaller to generate all these steps, which may explain why syzbot isn't yet properly covering the fscrypt code; see https://storage.googleapis.com/syzkaller/cover/ci-upstream-kasan-gce.html which currently shows only 5% coverage of the fs/crypto/ directory. Therefore add some test programs which do this setup on ext4 and f2fs. Note that ubifs support can't be included yet because syzkaller doesn't yet know how to mount an ubifs filesystem (which would likely require using block2mtd, as ubifs uses MTD devices rather than block devices).
* sys/linux/test: add s390x GUP fast path testAlexander Egorenkov2020-10-091-0/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | https://lore.kernel.org/linuxppc-dev/20190418100218.0a4afd51@mschwideX1/ The test triggers this bug: [ 224.294341] ================================================================== [ 224.294389] BUG: KASAN: stack-out-of-bounds in gup_pgd_range+0x124a/0x1398 [ 224.294405] Read of size 8 at addr 000003e002e8f3d8 by task gup_fast_regr-s/633 [ 224.294417] [ 224.294431] CPU: 0 PID: 633 Comm: gup_fast_regr-s Not tainted 5.9.0-rc6 #1 [ 224.294443] Hardware name: IBM 8561 T01 701 (KVM/Linux) [ 224.294454] Call Trace: [ 224.294470] [<0000000047708384>] show_stack+0x174/0x220 [ 224.294488] [<000000004bbcfb9c>] dump_stack+0x274/0x2f8 [ 224.294506] [<0000000047f4e8e6>] print_address_description.constprop.0+0x5e/0x550 [ 224.294523] [<0000000047f4e4ea>] kasan_report+0x11a/0x168 [ 224.294538] [<0000000047e4a77a>] gup_pgd_range+0x124a/0x1398 [ 224.294554] [<0000000047e4cbea>] internal_get_user_pages_fast+0x212/0x460 [ 224.294571] [<0000000047e4cf10>] get_user_pages_fast+0x70/0xb0 [ 224.294588] [<0000000049886cee>] iov_iter_get_pages+0x2d6/0xdf0 [ 224.294605] [<000000004974aaca>] bio_iov_iter_get_pages+0x2ca/0x1088 [ 224.294623] [<0000000048210282>] iomap_dio_bio_actor+0x8e2/0x1118 [ 224.294638] [<0000000048210b64>] iomap_dio_actor+0xac/0x550 [ 224.294655] [<000000004820212a>] iomap_apply+0x21a/0x9d0 [ 224.294670] [<00000000482118ae>] iomap_dio_rw+0x7c6/0x11e8 [ 224.294689] [<0000000048374ca8>] ext4_file_read_iter+0x4b0/0x638 [ 224.294707] [<0000000047fd85ec>] new_sync_read+0x444/0x6d0 [ 224.294722] [<0000000047fde212>] vfs_read+0x2c2/0x4e0 [ 224.294737] [<0000000047fdf3ba>] ksys_read+0x16a/0x298 [ 224.294754] [<000000004bc37ee8>] system_call+0xdc/0x298 [ 224.294794] [ 224.294800] [ 224.294809] addr 000003e002e8f3d8 is located in stack of task gup_fast_regr-s/633 at offset 72 in frame: [ 224.294827] gup_pgd_range+0x0/0x1398 [ 224.294837] [ 224.294844] this frame has 3 objects: [ 224.294854] [32, 40) 'pgd' [ 224.294858] [64, 72) 'p4d' [ 224.294867] [96, 104) 'pud' [ 224.294874] [ 224.294885] Memory state around the buggy address: [ 224.294900] 000003e002e8f280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 224.294915] 000003e002e8f300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 224.294930] >000003e002e8f380: 00 00 f1 f1 f1 f1 00 f2 f2 f2 00 f2 f2 f2 00 f3 [ 224.294943] ^ [ 224.294957] 000003e002e8f400: f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 224.294972] 000003e002e8f480: 00 f1 f1 f1 f1 f1 f1 04 f2 00 f3 f3 f3 00 00 00 [ 224.294984] ================================================================== Signed-off-by: Alexander Egorenkov <Alexander.Egorenkov@ibm.com>
* sys/linux/test: refactor and extend 802.11 testsAleksandr Nogikh2020-10-053-16/+53
| | | | | | | | | | | | 80211_setup_station is extended with frame injections and delays that are arranged in such a way that the device successuflly joins an access point. 80211_scan is a new test that starts a channel scan and then injects a beacon and a probe response. These additions were tested manually and were observed to fulfill their purpose.
generated by ggit (джигит) mrf-deployment (git 2.46.0) at 2026-03-13 02:20:00 +0000