From 2ebbc7259f2bda405779335b46a2f519f14ec473 Mon Sep 17 00:00:00 2001 From: Alexander Potapenko Date: Thu, 21 Nov 2024 16:30:50 +0100 Subject: executor: arm64: sys/linux: allocate 1024 pages for guest address space Pass 1024 pages of memory to both syz_kvm_setup_syzos_vm() and syz_kvm_setup_cpu$arm64() to make sure that: - there is enough memory for guest allocations (e.g. ITS pages) - host can tamper with that memory, provoking more bugs --- sys/linux/test/arm64-syz_kvm_setup_syzos_vm | 2 +- sys/linux/test/arm64-syz_kvm_setup_syzos_vm-memwrite | 2 +- sys/linux/test/arm64-syz_kvm_setup_syzos_vm-msr | 2 +- sys/linux/test/arm64-syz_kvm_setup_syzos_vm-smc | 2 +- sys/linux/test/arm64-syz_kvm_setup_syzos_vm-vgicv3 | 2 +- sys/linux/test/arm64-syz_kvm_setup_syzos_vm-vgicv3-cpu1 | 2 +- sys/linux/test/arm64-syz_kvm_setup_syzos_vm-vgicv3-its | 2 +- 7 files changed, 7 insertions(+), 7 deletions(-) (limited to 'sys/linux/test') diff --git a/sys/linux/test/arm64-syz_kvm_setup_syzos_vm b/sys/linux/test/arm64-syz_kvm_setup_syzos_vm index 4648c4595..29fcbb864 100644 --- a/sys/linux/test/arm64-syz_kvm_setup_syzos_vm +++ b/sys/linux/test/arm64-syz_kvm_setup_syzos_vm @@ -3,7 +3,7 @@ # r0 = openat$kvm(0, &AUTO='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, AUTO, 0x0) -r2 = syz_kvm_setup_syzos_vm(r1) +r2 = syz_kvm_setup_syzos_vm(r1, &(0x7f0000c00000/0x400000)=nil) # Perform two uexits. The first one is done via a code blob: # d2802000 mov x0, #0x100 // #256 # f2bbbba0 movk x0, #0xdddd, lsl #16 diff --git a/sys/linux/test/arm64-syz_kvm_setup_syzos_vm-memwrite b/sys/linux/test/arm64-syz_kvm_setup_syzos_vm-memwrite index 69f0b176f..e10a26853 100644 --- a/sys/linux/test/arm64-syz_kvm_setup_syzos_vm-memwrite +++ b/sys/linux/test/arm64-syz_kvm_setup_syzos_vm-memwrite @@ -3,7 +3,7 @@ # r0 = openat$kvm(0, &AUTO='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, AUTO, 0x0) -r2 = syz_kvm_setup_syzos_vm(r1) +r2 = syz_kvm_setup_syzos_vm(r1, &(0x7f0000c00000/0x400000)=nil) # Emulate a uexit with the memwrite API command: write 0 at address ARM64_ADDR_UEXIT. # r3 = syz_kvm_add_vcpu(r2, &AUTO={0x0, &AUTO=[@memwrite={AUTO, AUTO, @generic={0xdddd0000, 0x100, 0x0, 0x8}}], AUTO}, 0x0, 0x0) diff --git a/sys/linux/test/arm64-syz_kvm_setup_syzos_vm-msr b/sys/linux/test/arm64-syz_kvm_setup_syzos_vm-msr index f242b47d5..b0298d87d 100644 --- a/sys/linux/test/arm64-syz_kvm_setup_syzos_vm-msr +++ b/sys/linux/test/arm64-syz_kvm_setup_syzos_vm-msr @@ -3,7 +3,7 @@ # r0 = openat$kvm(0, &AUTO='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, AUTO, 0x0) -r2 = syz_kvm_setup_syzos_vm(r1) +r2 = syz_kvm_setup_syzos_vm(r1, &(0x7f0000c00000/0x400000)=nil) # # 0x603000000013c600 is VBAR_EL1, it aligns the written value on 0x20. # diff --git a/sys/linux/test/arm64-syz_kvm_setup_syzos_vm-smc b/sys/linux/test/arm64-syz_kvm_setup_syzos_vm-smc index d165b2b92..0b9fa62c2 100644 --- a/sys/linux/test/arm64-syz_kvm_setup_syzos_vm-smc +++ b/sys/linux/test/arm64-syz_kvm_setup_syzos_vm-smc @@ -3,7 +3,7 @@ # r0 = openat$kvm(0, &AUTO='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, AUTO, 0x0) -r2 = syz_kvm_setup_syzos_vm(r1) +r2 = syz_kvm_setup_syzos_vm(r1, &(0x7f0000c00000/0x400000)=nil) # # KVM_SET_DEVICE_ATTR: group=KVM_ARM_VM_SMCCC_CTRL, attr=KVM_ARM_VM_SMCCC_FILTER # Filter: base=0xef000000, nr_functions=0x1000, action=KVM_SMCCC_FILTER_FWD_TO_USER diff --git a/sys/linux/test/arm64-syz_kvm_setup_syzos_vm-vgicv3 b/sys/linux/test/arm64-syz_kvm_setup_syzos_vm-vgicv3 index 07bfa5f10..0c6b0dfc4 100644 --- a/sys/linux/test/arm64-syz_kvm_setup_syzos_vm-vgicv3 +++ b/sys/linux/test/arm64-syz_kvm_setup_syzos_vm-vgicv3 @@ -3,7 +3,7 @@ # r0 = openat$kvm(0, &AUTO='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, AUTO, 0x0) -r2 = syz_kvm_setup_syzos_vm(r1) +r2 = syz_kvm_setup_syzos_vm(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu(r2, &AUTO={0x0, &AUTO=[@irq_setup={AUTO, AUTO, {0x1, 0x20}}], AUTO}, 0x0, 0x0) syz_kvm_vgic_v3_setup(r1, 0x1, 0x100) ioctl$KVM_RUN(r3, AUTO, 0x0) diff --git a/sys/linux/test/arm64-syz_kvm_setup_syzos_vm-vgicv3-cpu1 b/sys/linux/test/arm64-syz_kvm_setup_syzos_vm-vgicv3-cpu1 index 02551142b..a77ae90d0 100644 --- a/sys/linux/test/arm64-syz_kvm_setup_syzos_vm-vgicv3-cpu1 +++ b/sys/linux/test/arm64-syz_kvm_setup_syzos_vm-vgicv3-cpu1 @@ -3,7 +3,7 @@ # r0 = openat$kvm(0, &AUTO='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, AUTO, 0x0) -r2 = syz_kvm_setup_syzos_vm(r1) +r2 = syz_kvm_setup_syzos_vm(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu(r2, &AUTO={0x0, &AUTO=[@irq_setup={AUTO, AUTO, {0x1, 0x20}}], AUTO}, 0x0, 0x0) r4 = syz_kvm_add_vcpu(r2, &AUTO={0x0, &AUTO=[@irq_setup={AUTO, AUTO, {0x1, 0x20}}], AUTO}, 0x0, 0x0) syz_kvm_vgic_v3_setup(r1, 0x2, 0x100) diff --git a/sys/linux/test/arm64-syz_kvm_setup_syzos_vm-vgicv3-its b/sys/linux/test/arm64-syz_kvm_setup_syzos_vm-vgicv3-its index c1f151c8a..7752a8f6e 100644 --- a/sys/linux/test/arm64-syz_kvm_setup_syzos_vm-vgicv3-its +++ b/sys/linux/test/arm64-syz_kvm_setup_syzos_vm-vgicv3-its @@ -3,7 +3,7 @@ # r0 = openat$kvm(0, &AUTO='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, AUTO, 0x0) -r2 = syz_kvm_setup_syzos_vm(r1) +r2 = syz_kvm_setup_syzos_vm(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu(r2, &AUTO={0x0, &AUTO=[@irq_setup={AUTO, AUTO, {0x1, 0x20}}], AUTO}, 0x0, 0x0) syz_kvm_vgic_v3_setup(r1, 0x1, 0x100) -- cgit mrf-deployment