From c7ff68231e6c9a054fc3df9348262f376c7b91b4 Mon Sep 17 00:00:00 2001 From: Dmitry Vyukov Date: Wed, 20 Sep 2017 15:38:55 +0200 Subject: pkg/host: add fuchsia support --- pkg/host/host.go | 161 -------------------------------------------- pkg/host/host_fuchsia.go | 19 ++++++ pkg/host/host_linux.go | 161 ++++++++++++++++++++++++++++++++++++++++++++ pkg/host/host_linux_test.go | 86 +++++++++++++++++++++++ pkg/host/host_test.go | 84 ----------------------- 5 files changed, 266 insertions(+), 245 deletions(-) delete mode 100644 pkg/host/host.go create mode 100644 pkg/host/host_fuchsia.go create mode 100644 pkg/host/host_linux.go create mode 100644 pkg/host/host_linux_test.go delete mode 100644 pkg/host/host_test.go (limited to 'pkg') diff --git a/pkg/host/host.go b/pkg/host/host.go deleted file mode 100644 index ef301e2dc..000000000 --- a/pkg/host/host.go +++ /dev/null @@ -1,161 +0,0 @@ -// Copyright 2015 syzkaller project authors. All rights reserved. -// Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file. - -package host - -import ( - "bytes" - "io/ioutil" - "runtime" - "strconv" - "strings" - "syscall" - - "github.com/google/syzkaller/pkg/osutil" - "github.com/google/syzkaller/prog" -) - -// DetectSupportedSyscalls returns list on supported syscalls on host. -func DetectSupportedSyscalls(target *prog.Target) (map[*prog.Syscall]bool, error) { - // There are 3 possible strategies: - // 1. Executes all syscalls with presumably invalid arguments and check for ENOprog. - // But not all syscalls are safe to execute. For example, pause will hang, - // while setpgrp will push the process into own process group. - // 2. Check presence of /sys/kernel/debug/tracing/events/syscalls/sys_enter_* files. - // This requires root and CONFIG_FTRACE_SYSCALLS. Also it lies for some syscalls. - // For example, on x86_64 it says that sendfile is not present (only sendfile64). - // 3. Check sys_syscallname in /proc/kallsyms. - // Requires CONFIG_KALLSYMS. Seems to be the most reliable. That's what we use here. - - kallsyms, _ := ioutil.ReadFile("/proc/kallsyms") - supported := make(map[*prog.Syscall]bool) - for _, c := range target.Syscalls { - if isSupported(kallsyms, c) { - supported[c] = true - } - } - return supported, nil -} - -func isSupported(kallsyms []byte, c *prog.Syscall) bool { - if strings.HasPrefix(c.CallName, "syz_") { - return isSupportedSyzkall(c) - } - if strings.HasPrefix(c.Name, "socket$") { - return isSupportedSocket(c) - } - if strings.HasPrefix(c.Name, "open$") { - return isSupportedOpen(c) - } - if strings.HasPrefix(c.Name, "openat$") { - return isSupportedOpenAt(c) - } - if len(kallsyms) == 0 { - return true - } - return bytes.Index(kallsyms, []byte(" T sys_"+c.CallName+"\n")) != -1 -} - -func isSupportedSyzkall(c *prog.Syscall) bool { - switch c.CallName { - case "syz_test": - return false - case "syz_open_dev": - if _, ok := c.Args[0].(*prog.ConstType); ok { - // This is for syz_open_dev$char/block. - // They are currently commented out, but in case one enables them. - return true - } - fname, ok := extractStringConst(c.Args[0]) - if !ok { - panic("first open arg is not a pointer to string const") - } - if syscall.Getuid() != 0 { - return false - } - var check func(dev string) bool - check = func(dev string) bool { - if !strings.Contains(dev, "#") { - return osutil.IsExist(dev) - } - for i := 0; i < 10; i++ { - if check(strings.Replace(dev, "#", strconv.Itoa(i), 1)) { - return true - } - } - return false - } - return check(fname) - case "syz_open_pts": - return true - case "syz_fuse_mount": - return osutil.IsExist("/dev/fuse") - case "syz_fuseblk_mount": - return osutil.IsExist("/dev/fuse") && syscall.Getuid() == 0 - case "syz_emit_ethernet", "syz_extract_tcp_res": - fd, err := syscall.Open("/dev/net/tun", syscall.O_RDWR, 0) - if err == nil { - syscall.Close(fd) - } - return err == nil && syscall.Getuid() == 0 - case "syz_kvm_setup_cpu": - switch c.Name { - case "syz_kvm_setup_cpu$x86": - return runtime.GOARCH == "amd64" || runtime.GOARCH == "386" - case "syz_kvm_setup_cpu$arm64": - return runtime.GOARCH == "arm64" - } - } - panic("unknown syzkall: " + c.Name) -} - -func isSupportedSocket(c *prog.Syscall) bool { - af, ok := c.Args[0].(*prog.ConstType) - if !ok { - println(c.Name) - panic("socket family is not const") - } - fd, err := syscall.Socket(int(af.Val), 0, 0) - if fd != -1 { - syscall.Close(fd) - } - return err != syscall.ENOSYS && err != syscall.EAFNOSUPPORT -} - -func isSupportedOpen(c *prog.Syscall) bool { - fname, ok := extractStringConst(c.Args[0]) - if !ok { - return true - } - fd, err := syscall.Open(fname, syscall.O_RDONLY, 0) - if fd != -1 { - syscall.Close(fd) - } - return err == nil -} - -func isSupportedOpenAt(c *prog.Syscall) bool { - fname, ok := extractStringConst(c.Args[1]) - if !ok { - return true - } - fd, err := syscall.Open(fname, syscall.O_RDONLY, 0) - if fd != -1 { - syscall.Close(fd) - } - return err == nil -} - -func extractStringConst(typ prog.Type) (string, bool) { - ptr, ok := typ.(*prog.PtrType) - if !ok { - panic("first open arg is not a pointer to string const") - } - str, ok := ptr.Type.(*prog.BufferType) - if !ok || str.Kind != prog.BufferString || len(str.Values) != 1 { - return "", false - } - v := str.Values[0] - v = v[:len(v)-1] // string terminating \x00 - return v, true -} diff --git a/pkg/host/host_fuchsia.go b/pkg/host/host_fuchsia.go new file mode 100644 index 000000000..7f4abc47b --- /dev/null +++ b/pkg/host/host_fuchsia.go @@ -0,0 +1,19 @@ +// Copyright 2017 syzkaller project authors. All rights reserved. +// Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file. + +// +build fuchsia + +package host + +import ( + "github.com/google/syzkaller/prog" +) + +// DetectSupportedSyscalls returns list on supported syscalls on host. +func DetectSupportedSyscalls(target *prog.Target) (map[*prog.Syscall]bool, error) { + supported := make(map[*prog.Syscall]bool) + for _, c := range target.Syscalls { + supported[c] = true + } + return supported, nil +} diff --git a/pkg/host/host_linux.go b/pkg/host/host_linux.go new file mode 100644 index 000000000..ef301e2dc --- /dev/null +++ b/pkg/host/host_linux.go @@ -0,0 +1,161 @@ +// Copyright 2015 syzkaller project authors. All rights reserved. +// Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file. + +package host + +import ( + "bytes" + "io/ioutil" + "runtime" + "strconv" + "strings" + "syscall" + + "github.com/google/syzkaller/pkg/osutil" + "github.com/google/syzkaller/prog" +) + +// DetectSupportedSyscalls returns list on supported syscalls on host. +func DetectSupportedSyscalls(target *prog.Target) (map[*prog.Syscall]bool, error) { + // There are 3 possible strategies: + // 1. Executes all syscalls with presumably invalid arguments and check for ENOprog. + // But not all syscalls are safe to execute. For example, pause will hang, + // while setpgrp will push the process into own process group. + // 2. Check presence of /sys/kernel/debug/tracing/events/syscalls/sys_enter_* files. + // This requires root and CONFIG_FTRACE_SYSCALLS. Also it lies for some syscalls. + // For example, on x86_64 it says that sendfile is not present (only sendfile64). + // 3. Check sys_syscallname in /proc/kallsyms. + // Requires CONFIG_KALLSYMS. Seems to be the most reliable. That's what we use here. + + kallsyms, _ := ioutil.ReadFile("/proc/kallsyms") + supported := make(map[*prog.Syscall]bool) + for _, c := range target.Syscalls { + if isSupported(kallsyms, c) { + supported[c] = true + } + } + return supported, nil +} + +func isSupported(kallsyms []byte, c *prog.Syscall) bool { + if strings.HasPrefix(c.CallName, "syz_") { + return isSupportedSyzkall(c) + } + if strings.HasPrefix(c.Name, "socket$") { + return isSupportedSocket(c) + } + if strings.HasPrefix(c.Name, "open$") { + return isSupportedOpen(c) + } + if strings.HasPrefix(c.Name, "openat$") { + return isSupportedOpenAt(c) + } + if len(kallsyms) == 0 { + return true + } + return bytes.Index(kallsyms, []byte(" T sys_"+c.CallName+"\n")) != -1 +} + +func isSupportedSyzkall(c *prog.Syscall) bool { + switch c.CallName { + case "syz_test": + return false + case "syz_open_dev": + if _, ok := c.Args[0].(*prog.ConstType); ok { + // This is for syz_open_dev$char/block. + // They are currently commented out, but in case one enables them. + return true + } + fname, ok := extractStringConst(c.Args[0]) + if !ok { + panic("first open arg is not a pointer to string const") + } + if syscall.Getuid() != 0 { + return false + } + var check func(dev string) bool + check = func(dev string) bool { + if !strings.Contains(dev, "#") { + return osutil.IsExist(dev) + } + for i := 0; i < 10; i++ { + if check(strings.Replace(dev, "#", strconv.Itoa(i), 1)) { + return true + } + } + return false + } + return check(fname) + case "syz_open_pts": + return true + case "syz_fuse_mount": + return osutil.IsExist("/dev/fuse") + case "syz_fuseblk_mount": + return osutil.IsExist("/dev/fuse") && syscall.Getuid() == 0 + case "syz_emit_ethernet", "syz_extract_tcp_res": + fd, err := syscall.Open("/dev/net/tun", syscall.O_RDWR, 0) + if err == nil { + syscall.Close(fd) + } + return err == nil && syscall.Getuid() == 0 + case "syz_kvm_setup_cpu": + switch c.Name { + case "syz_kvm_setup_cpu$x86": + return runtime.GOARCH == "amd64" || runtime.GOARCH == "386" + case "syz_kvm_setup_cpu$arm64": + return runtime.GOARCH == "arm64" + } + } + panic("unknown syzkall: " + c.Name) +} + +func isSupportedSocket(c *prog.Syscall) bool { + af, ok := c.Args[0].(*prog.ConstType) + if !ok { + println(c.Name) + panic("socket family is not const") + } + fd, err := syscall.Socket(int(af.Val), 0, 0) + if fd != -1 { + syscall.Close(fd) + } + return err != syscall.ENOSYS && err != syscall.EAFNOSUPPORT +} + +func isSupportedOpen(c *prog.Syscall) bool { + fname, ok := extractStringConst(c.Args[0]) + if !ok { + return true + } + fd, err := syscall.Open(fname, syscall.O_RDONLY, 0) + if fd != -1 { + syscall.Close(fd) + } + return err == nil +} + +func isSupportedOpenAt(c *prog.Syscall) bool { + fname, ok := extractStringConst(c.Args[1]) + if !ok { + return true + } + fd, err := syscall.Open(fname, syscall.O_RDONLY, 0) + if fd != -1 { + syscall.Close(fd) + } + return err == nil +} + +func extractStringConst(typ prog.Type) (string, bool) { + ptr, ok := typ.(*prog.PtrType) + if !ok { + panic("first open arg is not a pointer to string const") + } + str, ok := ptr.Type.(*prog.BufferType) + if !ok || str.Kind != prog.BufferString || len(str.Values) != 1 { + return "", false + } + v := str.Values[0] + v = v[:len(v)-1] // string terminating \x00 + return v, true +} diff --git a/pkg/host/host_linux_test.go b/pkg/host/host_linux_test.go new file mode 100644 index 000000000..e32fe09cc --- /dev/null +++ b/pkg/host/host_linux_test.go @@ -0,0 +1,86 @@ +// Copyright 2015 syzkaller project authors. All rights reserved. +// Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file. + +// +build linux + +package host + +import ( + "runtime" + "syscall" + "testing" + + "github.com/google/syzkaller/prog" + _ "github.com/google/syzkaller/sys" +) + +func TestLog(t *testing.T) { + t.Parallel() + target, err := prog.GetTarget("linux", runtime.GOARCH) + if err != nil { + t.Fatal(err) + } + // Dump for manual inspection. + supp, err := DetectSupportedSyscalls(target) + if err != nil { + t.Skipf("skipping: %v", err) + } + t.Logf("unsupported:") + for _, c := range target.Syscalls { + s, ok := supp[c] + if ok && !s { + t.Fatalf("map contains false value") + } + if !s { + t.Logf("\t%v", c.Name) + } + } + trans := target.TransitivelyEnabledCalls(supp) + t.Logf("transitively unsupported:") + for _, c := range target.Syscalls { + s, ok := trans[c] + if ok && !s { + t.Fatalf("map contains false value") + } + if !s && supp[c] { + t.Logf("\t%v", c.Name) + } + } +} + +func TestSupportedSyscalls(t *testing.T) { + t.Parallel() + target, err := prog.GetTarget("linux", runtime.GOARCH) + if err != nil { + t.Fatal(err) + } + supp, err := DetectSupportedSyscalls(target) + if err != nil { + t.Skipf("skipping: %v", err) + } + // These are safe to execute with invalid arguments. + safe := []string{ + "memfd_create", + "sendfile", + "bpf$MAP_CREATE", + "open", + "openat", + "read", + "write", + "stat", + } + for _, name := range safe { + c := target.SyscallMap[name] + if c == nil { + t.Fatalf("can't find syscall '%v'", name) + } + a := ^uintptr(0) - 4097 // hopefully invalid + _, _, err := syscall.Syscall6(uintptr(c.NR), a, a, a, a, a, a) + if err == 0 { + t.Fatalf("%v did not fail", name) + } + if ok := err != syscall.ENOSYS; ok != supp[c] { + t.Fatalf("syscall %v: perse=%v kallsyms=%v", name, ok, supp[c]) + } + } +} diff --git a/pkg/host/host_test.go b/pkg/host/host_test.go deleted file mode 100644 index 1c40335d7..000000000 --- a/pkg/host/host_test.go +++ /dev/null @@ -1,84 +0,0 @@ -// Copyright 2015 syzkaller project authors. All rights reserved. -// Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file. - -package host - -import ( - "runtime" - "syscall" - "testing" - - "github.com/google/syzkaller/prog" - _ "github.com/google/syzkaller/sys" -) - -func TestLog(t *testing.T) { - t.Parallel() - target, err := prog.GetTarget("linux", runtime.GOARCH) - if err != nil { - t.Fatal(err) - } - // Dump for manual inspection. - supp, err := DetectSupportedSyscalls(target) - if err != nil { - t.Skipf("skipping: %v", err) - } - t.Logf("unsupported:") - for _, c := range target.Syscalls { - s, ok := supp[c] - if ok && !s { - t.Fatalf("map contains false value") - } - if !s { - t.Logf("\t%v", c.Name) - } - } - trans := target.TransitivelyEnabledCalls(supp) - t.Logf("transitively unsupported:") - for _, c := range target.Syscalls { - s, ok := trans[c] - if ok && !s { - t.Fatalf("map contains false value") - } - if !s && supp[c] { - t.Logf("\t%v", c.Name) - } - } -} - -func TestSupportedSyscalls(t *testing.T) { - t.Parallel() - target, err := prog.GetTarget("linux", runtime.GOARCH) - if err != nil { - t.Fatal(err) - } - supp, err := DetectSupportedSyscalls(target) - if err != nil { - t.Skipf("skipping: %v", err) - } - // These are safe to execute with invalid arguments. - safe := []string{ - "memfd_create", - "sendfile", - "bpf$MAP_CREATE", - "open", - "openat", - "read", - "write", - "stat", - } - for _, name := range safe { - c := target.SyscallMap[name] - if c == nil { - t.Fatalf("can't find syscall '%v'", name) - } - a := ^uintptr(0) - 4097 // hopefully invalid - _, _, err := syscall.Syscall6(uintptr(c.NR), a, a, a, a, a, a) - if err == 0 { - t.Fatalf("%v did not fail", name) - } - if ok := err != syscall.ENOSYS; ok != supp[c] { - t.Fatalf("syscall %v: perse=%v kallsyms=%v", name, ok, supp[c]) - } - } -} -- cgit mrf-deployment