From e8dd2c6713522707b3b89884eb95601cdf9bc9be Mon Sep 17 00:00:00 2001 From: Dmitry Vyukov Date: Thu, 30 Aug 2018 14:17:47 -0700 Subject: prog: add concept of "special pointers" Currently we only generate either valid user-space pointers or NULL. Extend NULL to a set of special pointers that we will use in programs. All targets now contain 3 special values: - NULL - 0xfffffffffffffff (invalid kernel pointer) - 0x999999999999999 (non-canonical address) Each target can add additional special pointers on top of this. Also generate NULL/special pointers for non-opt ptr's. This restriction was always too restrictive. We may want to generate them with very low probability, but we do want to generate them. Also change pointers to NULL/special during mutation (but still not in the opposite direction). --- sys/linux/init.go | 38 ++++++++++++++++++++------------------ 1 file changed, 20 insertions(+), 18 deletions(-) (limited to 'sys/linux/init.go') diff --git a/sys/linux/init.go b/sys/linux/init.go index 035ffee2f..1400ce182 100644 --- a/sys/linux/init.go +++ b/sys/linux/init.go @@ -10,16 +10,6 @@ import ( "github.com/google/syzkaller/sys/targets" ) -/* -func init() { - prog.RegisterTarget(gen.Target_amd64, initTarget) - prog.RegisterTarget(gen.Target_386, initTarget) - prog.RegisterTarget(gen.Target_arm64, initTarget) - prog.RegisterTarget(gen.Target_arm, initTarget) - prog.RegisterTarget(gen.Target_ppc64le, initTarget) -} -*/ - func InitTarget(target *prog.Target) { arch := &arch{ unix: targets.MakeUnixSanitizer(target), @@ -54,7 +44,26 @@ func InitTarget(target *prog.Target) { "arpt_replace": arch.generateArptables, "ebt_replace": arch.generateEbtables, } - target.StringDictionary = stringDictionary + // TODO(dvyukov): get rid of this, this must be in descriptions. + target.StringDictionary = []string{ + "user", "keyring", "trusted", "system", "security", "selinux", + "posix_acl_access", "mime_type", "md5sum", "nodev", "self", + "bdev", "proc", "cgroup", "cpuset", + "lo", "eth0", "eth1", "em0", "em1", "wlan0", "wlan1", "ppp0", "ppp1", + "vboxnet0", "vboxnet1", "vmnet0", "vmnet1", "GPL", + } + switch target.Arch { + case "amd64": + target.SpecialPointers = []uint64{ + 0xffffffff81000000, // kernel text + } + case "386": + case "arm64": + case "arm": + case "ppc64le": + default: + panic("unknown arch") + } if target.Arch == runtime.GOARCH { KCOV_INIT_TRACE = uintptr(target.ConstMap["KCOV_INIT_TRACE"]) @@ -70,13 +79,6 @@ var ( KCOV_ENABLE uintptr KCOV_DISABLE uintptr KCOV_TRACE_CMP uintptr - - // TODO(dvyukov): get rid of this, this must be in descriptions. - stringDictionary = []string{"user", "keyring", "trusted", "system", "security", "selinux", - "posix_acl_access", "mime_type", "md5sum", "nodev", "self", - "bdev", "proc", "cgroup", "cpuset", - "lo", "eth0", "eth1", "em0", "em1", "wlan0", "wlan1", "ppp0", "ppp1", - "vboxnet0", "vboxnet1", "vmnet0", "vmnet1", "GPL"} ) type arch struct { -- cgit mrf-deployment