From 7c923cf8d45b650c4251503c11e74653779c74c4 Mon Sep 17 00:00:00 2001 From: Dmitry Vyukov Date: Wed, 28 Mar 2018 14:42:02 +0200 Subject: sys/linux: add support for mounting filesystem images --- executor/common_linux.h | 142 +++++++++++++++++++++++++++++++++++++++- executor/executor.h | 27 +++++--- executor/executor_linux.cc | 5 ++ executor/syscalls_linux.h | 90 ++++++++++++++++++++++--- executor/test_executor_linux.cc | 6 ++ 5 files changed, 249 insertions(+), 21 deletions(-) (limited to 'executor') diff --git a/executor/common_linux.h b/executor/common_linux.h index 0d8b145a6..dbe75f10f 100644 --- a/executor/common_linux.h +++ b/executor/common_linux.h @@ -134,6 +134,16 @@ #if defined(SYZ_EXECUTOR) || defined(SYZ_ENABLE_CGROUPS) #include #endif +#if defined(SYZ_EXECUTOR) || defined(__NR_syz_mount_image) +#include +#include +#include +#include +#include +#include +#include +#include +#endif #if defined(SYZ_EXECUTOR) || (defined(SYZ_REPEAT) && defined(SYZ_WAIT_REPEAT)) || \ defined(SYZ_USE_TMP_DIR) || defined(SYZ_HANDLE_SEGV) || defined(SYZ_TUN_ENABLE) || \ @@ -162,6 +172,11 @@ __attribute__((noreturn)) static void doexit(int status) #include "common.h" +#if defined(SYZ_EXECUTOR) +struct thread_t; +void cover_reset(thread_t* th); +#endif + #if defined(SYZ_EXECUTOR) || defined(SYZ_HANDLE_SEGV) static __thread int skip_segv; static __thread jmp_buf segv_env; @@ -787,6 +802,117 @@ static uintptr_t syz_genetlink_get_family_id(uintptr_t name) } #endif +#if defined(SYZ_EXECUTOR) || defined(__NR_syz_mount_image) +extern unsigned long long procid; + +struct fs_image_segment { + void* data; + uintptr_t size; + uintptr_t offset; +}; + +#define IMAGE_MAX_SEGMENTS 4096 +#define IMAGE_MAX_SIZE (32 << 20) + +#ifndef SYS_memfd_create +#if defined(__i386__) +#define SYS_memfd_create 356 +#elif defined(__x86_64__) +#define SYS_memfd_create 319 +#elif defined(__arm__) +#define SYS_memfd_create 385 +#elif defined(__aarch64__) +#define SYS_memfd_create 279 +#elif defined(__ppc64__) || defined(__PPC64__) || defined(__powerpc64__) +#define SYS_memfd_create 360 +#endif +#endif + +//syz_mount_image(fs ptr[in, string[disk_filesystems]], dir ptr[in, filename], size intptr, nsegs len[segments], segments ptr[in, array[fs_image_segment]], flags flags[mount_flags], opts ptr[in, fs_options[vfat_options]]) +//fs_image_segment { +// data ptr[in, array[int8]] +// size len[data, intptr] +// offset intptr +//} +static uintptr_t syz_mount_image(uintptr_t fs, uintptr_t dir, uintptr_t size, uintptr_t nsegs, uintptr_t segments, uintptr_t flags, uintptr_t opts) +{ + char loopname[64]; + int loopfd, err = 0, res = -1; + uintptr_t i; + // Strictly saying we ought to do a nonfailing copyout of segments into a local var. + // But some filesystems have large number of segments (2000+), + // we can't allocate that much on stack and allocating elsewhere is problematic, + // so we just use the memory allocated by fuzzer. + struct fs_image_segment* segs = (struct fs_image_segment*)segments; + + if (nsegs > IMAGE_MAX_SEGMENTS) + nsegs = IMAGE_MAX_SEGMENTS; + for (i = 0; i < nsegs; i++) { + if (segs[i].size > IMAGE_MAX_SIZE) + segs[i].size = IMAGE_MAX_SIZE; + segs[i].offset %= IMAGE_MAX_SIZE; + if (segs[i].offset > IMAGE_MAX_SIZE - segs[i].size) + segs[i].offset = IMAGE_MAX_SIZE - segs[i].size; + if (size < segs[i].offset + segs[i].offset) + size = segs[i].offset + segs[i].offset; + } + if (size > IMAGE_MAX_SIZE) + size = IMAGE_MAX_SIZE; + int memfd = syscall(SYS_memfd_create, "syz_mount_image", 0); + if (memfd == -1) { + err = errno; + goto error; + } + if (ftruncate(memfd, size)) { + err = errno; + goto error_close_memfd; + } + for (i = 0; i < nsegs; i++) { + if (pwrite(memfd, segs[i].data, segs[i].size, segs[i].offset) < 0) { + debug("syz_mount_image: pwrite[%lu] failed: %d\n", i, errno); + } + } + snprintf(loopname, sizeof(loopname), "/dev/loop%llu", procid); + loopfd = open(loopname, O_RDWR); + if (loopfd == -1) { + err = errno; + goto error_close_memfd; + } + if (ioctl(loopfd, LOOP_SET_FD, memfd)) { + if (errno != EBUSY) { + err = errno; + goto error_close_loop; + } + ioctl(loopfd, LOOP_CLR_FD, 0); + usleep(1000); + if (ioctl(loopfd, LOOP_SET_FD, memfd)) { + err = errno; + goto error_close_loop; + } + } + mkdir((char*)dir, 0777); + NONFAILING(if (strcmp((char*)fs, "iso9660") == 0) flags |= MS_RDONLY); + debug("syz_mount_image: size=%llu segs=%llu loop='%s' dir='%s' fs='%s' opts='%s'\n", (uint64)size, (uint64)nsegs, loopname, (char*)dir, (char*)fs, (char*)opts); +#if defined(SYZ_EXECUTOR) + cover_reset(0); +#endif + if (mount(loopname, (char*)dir, (char*)fs, flags, (char*)opts)) { + err = errno; + goto error_clear_loop; + } + res = 0; +error_clear_loop: + ioctl(loopfd, LOOP_CLR_FD, 0); +error_close_loop: + close(loopfd); +error_close_memfd: + close(memfd); +error: + errno = err; + return res; +} +#endif + #if defined(SYZ_EXECUTOR) || defined(__NR_syz_kvm_setup_cpu) #if defined(__x86_64__) #include "common_kvm_amd64.h" @@ -891,7 +1017,7 @@ static void sandbox_common() setrlimit(RLIMIT_AS, &rlim); rlim.rlim_cur = rlim.rlim_max = 8 << 20; setrlimit(RLIMIT_MEMLOCK, &rlim); - rlim.rlim_cur = rlim.rlim_max = 1 << 20; + rlim.rlim_cur = rlim.rlim_max = 32 << 20; setrlimit(RLIMIT_FSIZE, &rlim); rlim.rlim_cur = rlim.rlim_max = 1 << 20; setrlimit(RLIMIT_STACK, &rlim); @@ -1540,6 +1666,9 @@ static void remove_dir(const char* dir) struct dirent* ep; int iter = 0; retry: + while (umount2(dir, MNT_DETACH) == 0) { + debug("umount(%s)\n", dir); + } dp = opendir(dir); if (dp == NULL) { if (errno == EMFILE) { @@ -1704,6 +1833,15 @@ static void loop() if (mkdir(cwdbuf, 0777)) fail("failed to mkdir"); #endif +#if defined(SYZ_EXECUTOR) || defined(__NR_syz_mount_fs) || defined(__NR_syz_mount_image) || defined(__NR_syz_read_part_table) + char buf[64]; + snprintf(buf, sizeof(buf), "/dev/loop%llu", procid); + int loopfd = open(buf, O_RDWR); + if (loopfd != -1) { + ioctl(loopfd, LOOP_CLR_FD, 0); + close(loopfd); + } +#endif #if defined(SYZ_EXECUTOR) // TODO: consider moving the read into the child. // Potentially it can speed up things a bit -- when the read finishes @@ -1786,7 +1924,7 @@ static void loop() executed_calls = now_executed; last_executed = now; } - if ((now - start < 3 * 1000) && (now - last_executed < 500)) + if ((now - start < 3 * 1000) && (now - start < 1000 || now - last_executed < 500)) continue; #else if (current_time_ms() - start < 3 * 1000) diff --git a/executor/executor.h b/executor/executor.h index 36da89a9a..915fecb14 100644 --- a/executor/executor.h +++ b/executor/executor.h @@ -22,7 +22,7 @@ const int kMaxInput = 2 << 20; const int kMaxOutput = 16 << 20; -const int kCoverSize = 64 << 10; +const int kCoverSize = 256 << 10; const int kMaxArgs = 9; const int kMaxThreads = 16; const int kMaxCommands = 1000; @@ -293,9 +293,11 @@ void execute_one() // Fuzzer once come up with ioctl(fd, FIONREAD, 0x920000), // where 0x920000 was exactly collide address, so every iteration reset collide to 0. bool colliding = false; + write_output(0); // Number of executed syscalls (updated later). + uint64 start = current_time_ms(); + retry: uint64* input_pos = (uint64*)input_data; - write_output(0); // Number of executed syscalls (updated later). if (!colliding && !flag_threaded) cover_enable(&threads[0]); @@ -407,9 +409,9 @@ retry: // We already have results from the previous execution. } else if (flag_threaded) { // Wait for call completion. - // Note: sys knows about this 20ms timeout when it generates + // Note: sys knows about this 25ms timeout when it generates // timespec/timeval values. - const uint64 timeout_ms = flag_debug ? 500 : 20; + const uint64 timeout_ms = flag_debug ? 3000 : 25; if (event_timedwait(&th->done, timeout_ms)) handle_completion(th); // Check if any of previous calls have completed. @@ -419,11 +421,18 @@ retry: fail("running = %d", running); if (running > 0) { bool last = read_input(&input_pos, true) == instr_eof; - sleep_ms(last ? 10 : 1); - for (int i = 0; i < kMaxThreads; i++) { - th = &threads[i]; - if (!th->handled && event_isset(&th->done)) - handle_completion(th); + uint64 wait = last ? 100 : 2; + uint64 wait_start = current_time_ms(); + uint64 wait_end = wait_start + wait; + if (!colliding && wait_end < start + 800) + wait_end = start + 800; + while (running > 0 && current_time_ms() <= wait_end) { + sleep_ms(1); + for (int i = 0; i < kMaxThreads; i++) { + th = &threads[i]; + if (!th->handled && event_isset(&th->done)) + handle_completion(th); + } } } } else { diff --git a/executor/executor_linux.cc b/executor/executor_linux.cc index dcb2e78cb..b1c0a5e42 100644 --- a/executor/executor_linux.cc +++ b/executor/executor_linux.cc @@ -119,6 +119,8 @@ int main(int argc, char** argv) return 1; } +static __thread thread_t* current_thread; + long execute_syscall(call_t* c, long a0, long a1, long a2, long a3, long a4, long a5, long a6, long a7, long a8) { if (c->call) @@ -159,12 +161,15 @@ void cover_enable(thread_t* th) if (ioctl(th->cover_fd, KCOV_ENABLE, kcov_mode)) exitf("cover enable write trace failed, mode=%d", kcov_mode); debug("#%d: enabled /sys/kernel/debug/kcov\n", th->id); + current_thread = th; } void cover_reset(thread_t* th) { if (!flag_cover) return; + if (th == 0) + th = current_thread; __atomic_store_n(th->cover_size_ptr, 0, __ATOMIC_RELAXED); } diff --git a/executor/syscalls_linux.h b/executor/syscalls_linux.h index 29c514127..232cc0606 100644 --- a/executor/syscalls_linux.h +++ b/executor/syscalls_linux.h @@ -2,11 +2,11 @@ #if defined(__i386__) || 0 #define GOARCH "386" -#define SYZ_REVISION "13f58d70d5eb27fb4a6a602eed872296ddfd012b" +#define SYZ_REVISION "3570cc104a8e4f69ab942283cea9c36aead1e7d0" #define SYZ_PAGE_SIZE 4096 #define SYZ_NUM_PAGES 4096 #define SYZ_DATA_OFFSET 536870912 -unsigned syscall_count = 1664; +unsigned syscall_count = 1678; call_t syscalls[] = { {"accept4", 364}, {"accept4$alg", 364}, @@ -1590,6 +1590,20 @@ call_t syscalls[] = { {"syz_init_net_socket$nfc_raw", 0, (syscall_t)syz_init_net_socket}, {"syz_kvm_setup_cpu$arm64", 0, (syscall_t)syz_kvm_setup_cpu}, {"syz_kvm_setup_cpu$x86", 0, (syscall_t)syz_kvm_setup_cpu}, + {"syz_mount_image$bfs", 0, (syscall_t)syz_mount_image}, + {"syz_mount_image$btrfs", 0, (syscall_t)syz_mount_image}, + {"syz_mount_image$ext4", 0, (syscall_t)syz_mount_image}, + {"syz_mount_image$gfs2", 0, (syscall_t)syz_mount_image}, + {"syz_mount_image$hfs", 0, (syscall_t)syz_mount_image}, + {"syz_mount_image$hfsplus", 0, (syscall_t)syz_mount_image}, + {"syz_mount_image$iso9660", 0, (syscall_t)syz_mount_image}, + {"syz_mount_image$jfs", 0, (syscall_t)syz_mount_image}, + {"syz_mount_image$minix", 0, (syscall_t)syz_mount_image}, + {"syz_mount_image$msdos", 0, (syscall_t)syz_mount_image}, + {"syz_mount_image$ntfs", 0, (syscall_t)syz_mount_image}, + {"syz_mount_image$reiserfs", 0, (syscall_t)syz_mount_image}, + {"syz_mount_image$vfat", 0, (syscall_t)syz_mount_image}, + {"syz_mount_image$xfs", 0, (syscall_t)syz_mount_image}, {"syz_open_dev$admmidi", 0, (syscall_t)syz_open_dev}, {"syz_open_dev$adsp", 0, (syscall_t)syz_open_dev}, {"syz_open_dev$amidi", 0, (syscall_t)syz_open_dev}, @@ -1678,11 +1692,11 @@ call_t syscalls[] = { #if defined(__x86_64__) || 0 #define GOARCH "amd64" -#define SYZ_REVISION "e7b2001a0a63147b9a6cc98389571863feca81f4" +#define SYZ_REVISION "038a844b7995797839fc3e515efe1276c116f985" #define SYZ_PAGE_SIZE 4096 #define SYZ_NUM_PAGES 4096 #define SYZ_DATA_OFFSET 536870912 -unsigned syscall_count = 1716; +unsigned syscall_count = 1730; call_t syscalls[] = { {"accept", 43}, {"accept$alg", 43}, @@ -3318,6 +3332,20 @@ call_t syscalls[] = { {"syz_init_net_socket$nfc_raw", 0, (syscall_t)syz_init_net_socket}, {"syz_kvm_setup_cpu$arm64", 0, (syscall_t)syz_kvm_setup_cpu}, {"syz_kvm_setup_cpu$x86", 0, (syscall_t)syz_kvm_setup_cpu}, + {"syz_mount_image$bfs", 0, (syscall_t)syz_mount_image}, + {"syz_mount_image$btrfs", 0, (syscall_t)syz_mount_image}, + {"syz_mount_image$ext4", 0, (syscall_t)syz_mount_image}, + {"syz_mount_image$gfs2", 0, (syscall_t)syz_mount_image}, + {"syz_mount_image$hfs", 0, (syscall_t)syz_mount_image}, + {"syz_mount_image$hfsplus", 0, (syscall_t)syz_mount_image}, + {"syz_mount_image$iso9660", 0, (syscall_t)syz_mount_image}, + {"syz_mount_image$jfs", 0, (syscall_t)syz_mount_image}, + {"syz_mount_image$minix", 0, (syscall_t)syz_mount_image}, + {"syz_mount_image$msdos", 0, (syscall_t)syz_mount_image}, + {"syz_mount_image$ntfs", 0, (syscall_t)syz_mount_image}, + {"syz_mount_image$reiserfs", 0, (syscall_t)syz_mount_image}, + {"syz_mount_image$vfat", 0, (syscall_t)syz_mount_image}, + {"syz_mount_image$xfs", 0, (syscall_t)syz_mount_image}, {"syz_open_dev$admmidi", 0, (syscall_t)syz_open_dev}, {"syz_open_dev$adsp", 0, (syscall_t)syz_open_dev}, {"syz_open_dev$amidi", 0, (syscall_t)syz_open_dev}, @@ -3406,11 +3434,11 @@ call_t syscalls[] = { #if defined(__arm__) || 0 #define GOARCH "arm" -#define SYZ_REVISION "07c800ad7a28b012724a7a163699ecca237a7743" +#define SYZ_REVISION "8474607329320b44dfeefacf1b065e564436dc41" #define SYZ_PAGE_SIZE 4096 #define SYZ_NUM_PAGES 4096 #define SYZ_DATA_OFFSET 536870912 -unsigned syscall_count = 1661; +unsigned syscall_count = 1675; call_t syscalls[] = { {"accept", 285}, {"accept$alg", 285}, @@ -4993,6 +5021,20 @@ call_t syscalls[] = { {"syz_init_net_socket$nfc_raw", 0, (syscall_t)syz_init_net_socket}, {"syz_kvm_setup_cpu$arm64", 0, (syscall_t)syz_kvm_setup_cpu}, {"syz_kvm_setup_cpu$x86", 0, (syscall_t)syz_kvm_setup_cpu}, + {"syz_mount_image$bfs", 0, (syscall_t)syz_mount_image}, + {"syz_mount_image$btrfs", 0, (syscall_t)syz_mount_image}, + {"syz_mount_image$ext4", 0, (syscall_t)syz_mount_image}, + {"syz_mount_image$gfs2", 0, (syscall_t)syz_mount_image}, + {"syz_mount_image$hfs", 0, (syscall_t)syz_mount_image}, + {"syz_mount_image$hfsplus", 0, (syscall_t)syz_mount_image}, + {"syz_mount_image$iso9660", 0, (syscall_t)syz_mount_image}, + {"syz_mount_image$jfs", 0, (syscall_t)syz_mount_image}, + {"syz_mount_image$minix", 0, (syscall_t)syz_mount_image}, + {"syz_mount_image$msdos", 0, (syscall_t)syz_mount_image}, + {"syz_mount_image$ntfs", 0, (syscall_t)syz_mount_image}, + {"syz_mount_image$reiserfs", 0, (syscall_t)syz_mount_image}, + {"syz_mount_image$vfat", 0, (syscall_t)syz_mount_image}, + {"syz_mount_image$xfs", 0, (syscall_t)syz_mount_image}, {"syz_open_dev$admmidi", 0, (syscall_t)syz_open_dev}, {"syz_open_dev$adsp", 0, (syscall_t)syz_open_dev}, {"syz_open_dev$amidi", 0, (syscall_t)syz_open_dev}, @@ -5079,11 +5121,11 @@ call_t syscalls[] = { #if defined(__aarch64__) || 0 #define GOARCH "arm64" -#define SYZ_REVISION "7a261210eafb174d52f717aa99d43aef80a694d6" +#define SYZ_REVISION "fe357a7bb4ffc4edcba92c35976c5fb5a8e0b917" #define SYZ_PAGE_SIZE 4096 #define SYZ_NUM_PAGES 4096 #define SYZ_DATA_OFFSET 536870912 -unsigned syscall_count = 1645; +unsigned syscall_count = 1659; call_t syscalls[] = { {"accept", 202}, {"accept$alg", 202}, @@ -6654,6 +6696,20 @@ call_t syscalls[] = { {"syz_init_net_socket$nfc_raw", 0, (syscall_t)syz_init_net_socket}, {"syz_kvm_setup_cpu$arm64", 0, (syscall_t)syz_kvm_setup_cpu}, {"syz_kvm_setup_cpu$x86", 0, (syscall_t)syz_kvm_setup_cpu}, + {"syz_mount_image$bfs", 0, (syscall_t)syz_mount_image}, + {"syz_mount_image$btrfs", 0, (syscall_t)syz_mount_image}, + {"syz_mount_image$ext4", 0, (syscall_t)syz_mount_image}, + {"syz_mount_image$gfs2", 0, (syscall_t)syz_mount_image}, + {"syz_mount_image$hfs", 0, (syscall_t)syz_mount_image}, + {"syz_mount_image$hfsplus", 0, (syscall_t)syz_mount_image}, + {"syz_mount_image$iso9660", 0, (syscall_t)syz_mount_image}, + {"syz_mount_image$jfs", 0, (syscall_t)syz_mount_image}, + {"syz_mount_image$minix", 0, (syscall_t)syz_mount_image}, + {"syz_mount_image$msdos", 0, (syscall_t)syz_mount_image}, + {"syz_mount_image$ntfs", 0, (syscall_t)syz_mount_image}, + {"syz_mount_image$reiserfs", 0, (syscall_t)syz_mount_image}, + {"syz_mount_image$vfat", 0, (syscall_t)syz_mount_image}, + {"syz_mount_image$xfs", 0, (syscall_t)syz_mount_image}, {"syz_open_dev$admmidi", 0, (syscall_t)syz_open_dev}, {"syz_open_dev$adsp", 0, (syscall_t)syz_open_dev}, {"syz_open_dev$amidi", 0, (syscall_t)syz_open_dev}, @@ -6736,11 +6792,11 @@ call_t syscalls[] = { #if defined(__ppc64__) || defined(__PPC64__) || defined(__powerpc64__) || 0 #define GOARCH "ppc64le" -#define SYZ_REVISION "c32f6bf12bfd604d26097506ff0ed1b5c504d9f3" +#define SYZ_REVISION "e64905daf5267a3bd825927680131feb7764dea2" #define SYZ_PAGE_SIZE 4096 #define SYZ_NUM_PAGES 4096 #define SYZ_DATA_OFFSET 536870912 -unsigned syscall_count = 1635; +unsigned syscall_count = 1649; call_t syscalls[] = { {"accept", 330}, {"accept$alg", 330}, @@ -8295,6 +8351,20 @@ call_t syscalls[] = { {"syz_init_net_socket$nfc_raw", 0, (syscall_t)syz_init_net_socket}, {"syz_kvm_setup_cpu$arm64", 0, (syscall_t)syz_kvm_setup_cpu}, {"syz_kvm_setup_cpu$x86", 0, (syscall_t)syz_kvm_setup_cpu}, + {"syz_mount_image$bfs", 0, (syscall_t)syz_mount_image}, + {"syz_mount_image$btrfs", 0, (syscall_t)syz_mount_image}, + {"syz_mount_image$ext4", 0, (syscall_t)syz_mount_image}, + {"syz_mount_image$gfs2", 0, (syscall_t)syz_mount_image}, + {"syz_mount_image$hfs", 0, (syscall_t)syz_mount_image}, + {"syz_mount_image$hfsplus", 0, (syscall_t)syz_mount_image}, + {"syz_mount_image$iso9660", 0, (syscall_t)syz_mount_image}, + {"syz_mount_image$jfs", 0, (syscall_t)syz_mount_image}, + {"syz_mount_image$minix", 0, (syscall_t)syz_mount_image}, + {"syz_mount_image$msdos", 0, (syscall_t)syz_mount_image}, + {"syz_mount_image$ntfs", 0, (syscall_t)syz_mount_image}, + {"syz_mount_image$reiserfs", 0, (syscall_t)syz_mount_image}, + {"syz_mount_image$vfat", 0, (syscall_t)syz_mount_image}, + {"syz_mount_image$xfs", 0, (syscall_t)syz_mount_image}, {"syz_open_dev$admmidi", 0, (syscall_t)syz_open_dev}, {"syz_open_dev$adsp", 0, (syscall_t)syz_open_dev}, {"syz_open_dev$amidi", 0, (syscall_t)syz_open_dev}, diff --git a/executor/test_executor_linux.cc b/executor/test_executor_linux.cc index 27292ce27..d0414ae88 100644 --- a/executor/test_executor_linux.cc +++ b/executor/test_executor_linux.cc @@ -8,6 +8,12 @@ #include +unsigned long long procid; + +void cover_reset(thread_t*) +{ +} + extern "C" int test_copyin() { unsigned char x[4] = {}; -- cgit mrf-deployment