From 397c964fceb327fe12c6f42334b879e1887412fc Mon Sep 17 00:00:00 2001 From: Aleksandr Nogikh Date: Fri, 5 Jan 2024 17:58:50 +0100 Subject: executor: prevent netlink_send_ext with dofail=true This should never be happening during fuzzing. Otherwise we let syz-executor silently crash and restart insane number of times. --- executor/common_linux.h | 7 +++++++ executor/executor.cc | 5 +++++ 2 files changed, 12 insertions(+) (limited to 'executor') diff --git a/executor/common_linux.h b/executor/common_linux.h index 950c43096..9558bdb7d 100644 --- a/executor/common_linux.h +++ b/executor/common_linux.h @@ -258,6 +258,13 @@ static void find_vf_interface(void) static int netlink_send_ext(struct nlmsg* nlmsg, int sock, uint16 reply_type, int* reply_len, bool dofail) { +#if SYZ_EXECUTOR + if (in_execute_one && dofail) { + // We can expect different sorts of breakages during fuzzing, + // we should not kill the whole process because of them. + failmsg("invalid netlink_send_ext arguments", "dofail is true during syscall execution"); + } +#endif if (nlmsg->pos > nlmsg->buf + sizeof(nlmsg->buf) || nlmsg->nesting) fail("nlmsg overflow/bad nesting"); struct nlmsghdr* hdr = (struct nlmsghdr*)nlmsg->buf; diff --git a/executor/executor.cc b/executor/executor.cc index 3d6d8f1b8..8b58287b1 100644 --- a/executor/executor.cc +++ b/executor/executor.cc @@ -188,6 +188,10 @@ static uint64 syscall_timeout_ms; static uint64 program_timeout_ms; static uint64 slowdown_scale; +// Can be used to disginguish whether we're at the initialization stage +// or we already execute programs. +static bool in_execute_one = false; + #define SYZ_EXECUTOR 1 #include "common.h" @@ -748,6 +752,7 @@ void realloc_output_data() // execute_one executes program stored in input_data. void execute_one() { + in_execute_one = true; #if SYZ_EXECUTOR_USES_SHMEM realloc_output_data(); output_pos = output_data; -- cgit mrf-deployment