aboutsummaryrefslogtreecommitdiffstats
path: root/sys/targets
Commit message (Collapse)AuthorAgeFilesLines
* all: remove unused nolint directivesDmitry Vyukov2026-01-021-1/+0
|
* sys/targets: enable ASAN for TestArch64FuzzAleksandr Nogikh2025-08-061-2/+4
| | | | Now it no longer causes a segfault.
* Revert "sys/targets: enable ASAN for TestArch64Fuzz"Aleksandr Nogikh2025-08-051-4/+2
| | | | This reverts commit 0931f9bfa8eacf9840a2bd3f9def3cfb4349431e.
* sys/targets: enable ASAN for TestArch64FuzzAleksandr Nogikh2025-08-051-2/+4
| | | | Now it no longer causes a segfault.
* all: apply linter auto fixesTaras Madan2025-07-171-2/+2
| | | | ./tools/syz-env bin/golangci-lint run ./... --fix
* sys/targets: use a custom data offset for arm32Aleksandr Nogikh2025-05-021-7/+6
| | | | | | | | ARM32 suffers from the same problem as ARM64 - the data offset may be beyond the addressable memory range. Cc #5986. Cc #5770.
* all: use LLVM=1 for building Linux with clangAleksandr Nogikh2025-04-171-3/+8
| | | | | | | | | | | | This is the standard way now. Since our configuration permits multiple parameter value combinations, explicitly check for the compiler and linker that were to be passed via CC and LD, and replace that with LLVM=1 if they were clang and ld.lld correspondingly. Update syz-kconf to rely on pkg/build's exported functionality for generating Linux kernel build arguments.
* sys/targets: extend broken compiler error messageTaras Madan2025-03-261-1/+2
|
* sys/targets: determine DataOffset by ArchAleksandr Nogikh2025-03-231-1/+1
| | | | | | | | It is incorrect to consider VMArch here - if we are running a 32 bit app on a 64 bit kernel, the 64 bit arch is not of interest here. Also, VMArch is not set for every Target, what led to problems when running arm64 fuzzing on an arm64 host.
* sys/targets: use a smaller default DataOffsetAleksandr Nogikh2025-03-191-2/+3
| | | | Use 0x200000000000 to be within the address range used by Starnix.
* sys/targets: use a different DataOffset value for ARM64Aleksandr Nogikh2025-03-051-0/+7
| | | | | | | It seems that, on ARM64, in many cases we just can't use many enough bits of the address space. Let's use the old value for now. It's also problematic (see #5770), but it's lesser of the two evils.
* sys/targets: add a kernel address range for FreeBSD/amd64 kernelsMark Johnston2025-02-281-0/+6
| | | | | | | | | | | | | After some time, my FreeBSD fuzzing runs start to hit frequent "coverage filter is full" SYZFAILs, caused by garbage PC values. Some assertions in kcov convinced me that PC values exported by the kernel are in the expected range, so it appears that the executor is corrupting them somehow. In particular, we leave the first page of each kcov mapping writeable since the interface to clear the trace buffer involves overwriting the first quadword. Sanitize kernel PC values so that we don't fill up the coverage filter with bogus values.
* sys/targets: increase DataOffset for 64bit buildsAleksandr Nogikh2025-02-071-1/+4
| | | | | | | It turned out the currently used value hit the high shadow area on arm64 machines. Closes #5762.
* sys/targets: change the default DataOffset valueAleksandr Nogikh2025-02-041-1/+10
| | | | | | | The current default value sometimes intersects with the addresses used by malloc, which causes executor memory corruptions. Closes #5674.
* all: use min/max functionsDmitry Vyukov2025-01-171-4/+1
| | | | They are shorter, more readable, and don't require temp vars.
* sys/targets: remove hardcoded CFlags for ARMStefan Wiehler2025-01-141-1/+0
| | | | | | Depending on the cross compiler build configuration, it might not be able to emit ARMv6 Thumb-1 instructions leading to "sorry, unimplemented: Thumb-1 hard-float VFP ABI" error.
* sys/targets: allow users to override hardcoded cross-compilersStefan Wiehler2025-01-141-0/+10
| | | | | | | | Currently, cross compiler names are hardcoded for each OS/arch combo. However, toolchain tuples differ, especially when using vendor provided toolchains or building with Yocto. Allow users to specify the cross compiler for an OS/arch combo using SYZ_CC_<os>_<arch> environment variables.
* all: add support for binaries shipped with targetStefan Wiehler2024-12-171-3/+4
| | | | | | | | | | | In some build environments (notably Yocto), syzkaller host and target binaries end up in separate packages for each built architecture, which are then shipped with the respective image/SDK. Add the "Execprog/ExecutorBinOnTarget" and "StraceBinOnTarget" options to the manager config, which when set expects the respective binaries to be shipped with the target image and does not attempt to copy them from the host.
* pkg/rpcserver: move kernel test/data range checks from executorDmitry Vyukov2024-07-011-0/+29
| | | | | | | | | | | | | | | | | We see some errors of the form: SYZFAIL: coverage filter is full pc=0x80007000c0008 regions=[0xffffffffbfffffff 0x243fffffff 0x143fffffff 0xc3fffffff] alloc=156 Executor shouldn't send non kernel addresses in signal, but somehow it does. It can happen if the VM memory is corrupted, or if the test program does something very nasty (e.g. discovers the output region and writes to it). It's not possible to reliably filter signal in the tested VM. Move all of the filtering logic to the host. Fixes #4942
* vm/starnix: run without host fuzzer modeLaura Peskin2024-06-181-5/+0
| | | | | | | Removes the SYZ_STARNIX_HACK envvar and runs syz-fuzzer on the VM. Co-authored-by: mvanotti@google.com
* sys/targets: don't attempt to run unit tests on unsupported TestOS archAlexander Egorenkov2024-06-131-0/+1
| | | | | | | | | | | | | | | | $ go test -v -count=1 -run=TestCover/32 ./pkg/runtest/ === RUN TestCover === PAUSE TestCover === CONT TestCover === RUN TestCover/32 run_test.go:121: skipping due to broken compiler: gcc: error: unrecognized command-line option ‘-m32’; did you mean ‘-m31’? --- PASS: TestCover (0.21s) --- SKIP: TestCover/32 (0.00s) PASS ok github.com/google/syzkaller/pkg/runtest 0.318s Signed-off-by: Alexander Egorenkov <eaibmz@gmail.com>
* sys/targets: fix BuildOS initialization for TestOSAlexander Egorenkov2024-06-131-2/+5
| | | | | | | | | | | | | | | | | | | | | | | | | Move the initialization of the target's BuildOS into initTarget() function for TestOS because a correct value of BuildOS is required not to falsely spoil native compiler binaries for TestOS and by that prevent TestOS unit test from compiling. $ go test -v -count=1 -run=TestCover/32 ./pkg/runtest/ === RUN TestCover === PAUSE TestCover === CONT TestCover === RUN TestCover/32 === PAUSE TestCover/32 === CONT TestCover/32 build.go:39: failed to build executor: failed to build program: compiler invocation: cant-build-test-on-linux --- FAIL: TestCover (0.21s) --- FAIL: TestCover/32 (0.00s) FAIL FAIL github.com/google/syzkaller/pkg/runtest 0.325s FAIL Signed-off-by: Alexander Egorenkov <eaibmz@gmail.com>
* executor: add end-to-end coverage/signal/comparisons testDmitry Vyukov2024-06-111-2/+2
|
* sys/targets: mark big-endian targetsDmitry Vyukov2024-06-041-49/+28
| | | | | | Litte-endian is kind of default (except for s390). So instead of saying that each arch is litte-endian, mark only s390 as big-endian.
* executor: remove noshmem modeDmitry Vyukov2024-06-041-33/+18
| | | | | | | | | All OSes we have now support shmem. Support for Fuchia/Starnix/Windows wasn't implemented, but generally they support shared memory. Remove all of the complexity and code associated with noshmem mode. If/when we revive these OSes, it's easier to properly implement shmem mode for them.
* sys/targets: build C++ program with C++ compilerDmitry Vyukov2024-06-031-6/+10
| | | | | Arm64 gcc on Debian rejects to build a program that includes <algorithm>. Use C program for C compiler, and C++ program for C++ compiler.
* sys/targets: test that C++ compiler works as wellDmitry Vyukov2024-06-031-10/+18
| | | | | | | | | | debian:bookworm has broken C++ arm64->amd64 cross-compiler: x86_64-linux-gnu-g++ -static-pie fails with: cannot find /usr/lib/x86_64-linux-gnu/libm-2.36.a: No such file or directory cannot find /usr/lib/x86_64-linux-gnu/libmvec.a: No such file or directory collect2: error: ld returned 1 exit status These are installed in a different dif in the image. Test that C++ compiler works as well.
* sys/targets: switch to C++17Dmitry Vyukov2024-06-031-1/+1
| | | | | | Let's see if we can get away with C++17 for all our toolchains. The later standard we can use, the better. C++17 has a number of nice features, e.g. std::optional.
* sys/targets: add consts for gvisor/starnixDmitry Vyukov2024-05-271-0/+4
| | | | | Lint started warning about duplicate "gvisor" const in pkg/cover. Add gvisor/starnix consts to sys/targets package to avoid duplication.
* Makefile: build executor with C++ compilerDmitry Vyukov2024-05-211-6/+15
| | | | | | | | | | | | Add C++ compiler and flags to the target and build executor with the C++ compiler. This will be needed to merge syz-fuzzer in to syz-executor since it will be beefier and will most likely require linking in libc++. But also this should fix #4821 since we won't use C++ flags when building C sources (we already had work-around in pkg/csource, but not in syz-extract). Fixes #4821
* executor: use new flatbuffers locationTaras Madan2024-05-081-1/+1
|
* executor: make flatrpc build for C++Dmitry Vyukov2024-05-031-0/+3
|
* all: remove akaros supportDmitry Vyukov2024-04-151-23/+0
| | | | | | | Akaros support is unused, it was shutdown on syzbot for a while, the akaros development seems to be frozen for years as well. We have a bunch of hacks for Akaros since it supported only super old gcc and haven't supported Go. Remove it.
* pkg/symbolizer: use llvm-addr2lineDmitry Vyukov2024-04-091-0/+48
| | | | | | | | | Use llvm-addr2line instead of addr2line if it's available. llvm-addr2line seems to be way faster than llvm-addr2line and consumes less memory on syzbot's vmlinux. Also move the detection logic to sys/targets since that's where we generally do this type of logic. This also allows to reuse addr2line binary in other packages if needed.
* sys/targets: avoid building TestOS on OpenBSDGreg Steuck2024-04-051-0/+3
| | | | It's missing syscall function yet TestOS requires it.
* pkg/fuzzer: factor out the fuzzing engineAleksandr Nogikh2024-03-121-0/+13
| | | | | | | | | | | | | This is the first step for #1541. Move the fuzzing engine that used to be interleaved with other syz-fuzzer code into a separate package. For now, the algorithm is more or less the same as it was, the only difference is that a pkg/fuzzer instance scales to the available computing power. Add an executor-based test that performs real fuzzing.
* pkg/runtest: enable coverage for some TestOS targetsAleksandr Nogikh2024-03-121-4/+14
|
* executor: introduce syz_pidfd_open()Aleksandr Nogikh2023-12-191-0/+1
| | | | | | | | | | | This kernel interface provides access to fds of other processes, which is readily abused by the fuzzer to mangle parent syz-executor fds. Pid=1 is the parent syz-executor process when PID namespace is created. Sanitize it in the new syz_pidfd_open() pseudo-syscall. We could not patch the argument in sys/linux/init.go because the first argument is a resource.
* sys/targets: switch openbsd to SyscallNumbers: falseGreg Steuck2023-04-271-1/+1
| | | | | This relies on sendsyslog in sys/syslog.h which will be in OpenBSD HEAD soon.
* sys/targets: introduce HasCallNumber to reduce clutterGreg Steuck2023-04-251-0/+4
| | | | This centralizes all strings.HasPrefix(callName, "syz_") checks.
* sys/netbsd: neutralize compat_50_mknodAleksandr Nogikh2023-04-241-1/+1
| | | | | | Otherwise we may end up corrupting device memory. See https://groups.google.com/g/syzkaller-netbsd-bugs/c/Iy8-NZ_M9Ug/m/5jKKfncsAQAJ
* sys/targets: add FreeBSD/arm64 target supportAndrew Turner2023-03-011-0/+11
|
* sys/targets: set the FreeBSD targetAndrew Turner2023-03-011-3/+3
| | | | | Use --target= to set the correct target on FreeBSD. This allows the syscall details to be extracted on a non-native architecture.
* sys/targets: use non-optional flags to test for optional flagsAlexander Potapenko2023-02-041-3/+11
| | | | | | | | | | | | | | The behavior of certain flags (in particular link-time ones) may depend on the target triple and other compiler options, therefore it's insufficient to test them in the default host configuration. Collect all non-optional flags and pass them to checkFlagSupported(), so that support for optional flags is always tested in the presence of the non-optional ones. This is going to fix the problem with Clang 15 not supporting -static-pie on MIPS, but silently passing the checkFlagSupported() check, because it used to be performed on x86_64.
* sys/targets: pass -Wno-unused-command-line-argument to the compilerAlexander Potapenko2023-02-021-8/+10
| | | | | Clang enables -Wunused-command-line-argument by default, which may start complaining if any of the options are unused.
* sys/targets: add an optional -Wno-unused-but-set-variableAlexander Potapenko2023-02-021-7/+9
| | | | | | | New Clang versions have -Wunused-but-set-variable enabled by default, which leads to test failures if loop variables are declared but never used. Pass -Wno-unused-but-set-variable to the compiler to work around this problem.
* sys/targets: make the SOURCEDIR setting more granularAleksandr Nogikh2023-01-201-6/+20
| | | | | | | | | If a syz-ci is run on multiple arches, it's useful to be able to use the same set of env variables. For this to become possible, make SOURCEDIR_ configuration more granular. Earlier it was just SOURCEDIR or SOURCEDIR_{TargetOS}. Support also the SOUREDIR_{TargetOS}_{TargetArch}_{HostOS}_{HostArch} variable.
* vm/starnix: add support for fuzzing starnix (#3624)juanPabloMiceli2023-01-191-0/+6
| | | | | | | This commit adds a new VM for fuzzing starnix. The VM will boot a fuchsia image using the `ffx` tool and will connect to an adb server inside it. Fuzzing will be done using HostFuzzer mode due to some features not being implemented yet in starnix. Once this is possible, fuzzing will be performed without HostFuzzer mode. Co-authored-by: Juampi Miceli <jpmiceli@google.com>
* sys/targets: take DataOffset from reference targetsAleksandr Nogikh2023-01-181-7/+2
| | | | | | For test targets, we curretly specialize a single FreeBSD/386 exception. But it's more robust to just copy the DataOffset value from the reference targets, especially now that we explicitly determine it.
* sys/targets: ignore unachievable test targetsAleksandr Nogikh2023-01-181-26/+28
| | | | | | Don't set BuildOS for those targets, where we have not managed to find a reference target based on GOARCH/GOOS. It doesn't make much sense to use such test targets in such cases.
generated by ggit (джигит) mrf-deployment (git 2.46.0) at 2026-03-11 17:35:48 +0000