From d6f3385b1a3f2fba8e14d6794bece1dcdd9e479e Mon Sep 17 00:00:00 2001 From: Aleksandr Nogikh Date: Wed, 12 Jan 2022 14:40:51 +0000 Subject: all: add syz_clone() and syz_clone3() pseudo calls As was pointed out in #2921, the current approach of limiting the number of pids per process does not work on all Linux-based kernels. We could just treat fork, clone and clone3 in a special way (e.g. exit on a zero return). However, in that case we also need to sanitize the arguments for clone and clone3 - if CLONE_VM is passed and stack is 0, the forked child processes (threads) will become nearly unindentifiable and will corrupt syz-executor's memory. While we could sanitize clone's arguments, we cannot do so for clone3 - nothing can guarantee that they will not be changed concurrently. Instead of calling those syscalls directly, introduce a special pseudo syscall syz_clone3. It copies and sanitizes the arguments and then executes clone3 (or fork, if we're on an older kernel) in such a way so as to prevent fork bombs from happening. Also introduce syz_clone() to still be able to fuzz it on older systems. --- pkg/host/syscalls_linux.go | 2 ++ 1 file changed, 2 insertions(+) (limited to 'pkg/host/syscalls_linux.go') diff --git a/pkg/host/syscalls_linux.go b/pkg/host/syscalls_linux.go index f43f1ada3..c628d20ab 100644 --- a/pkg/host/syscalls_linux.go +++ b/pkg/host/syscalls_linux.go @@ -316,6 +316,8 @@ var syzkallSupport = map[string]func(*prog.Syscall, *prog.Target, string) (bool, "syz_80211_inject_frame": isWifiEmulationSupported, "syz_80211_join_ibss": isWifiEmulationSupported, "syz_usbip_server_init": isSyzUsbIPSupported, + "syz_clone": alwaysSupported, + "syz_clone3": alwaysSupported, } func isSupportedSyzkall(c *prog.Syscall, target *prog.Target, sandbox string) (bool, string) { -- cgit mrf-deployment