From cbca8e0f043495ea2332604d8ce066891710e861 Mon Sep 17 00:00:00 2001 From: Necip Fazil Yildiran Date: Wed, 29 Jul 2020 07:36:25 +0000 Subject: executor: added syz_io_uring_setup to wrap both setup and mmap It is hard for the fuzzer to generate correct programs using mmap calls with fuzzer-provided mmap length. This wrapper ensures correct length computation. --- sys/linux/io_uring.txt | 5 +++++ sys/linux/test/io_uring | 6 +----- 2 files changed, 6 insertions(+), 5 deletions(-) (limited to 'sys/linux') diff --git a/sys/linux/io_uring.txt b/sys/linux/io_uring.txt index a2d384319..f4de4a0a9 100644 --- a/sys/linux/io_uring.txt +++ b/sys/linux/io_uring.txt @@ -16,6 +16,11 @@ resource ioring_personality_id[int16] define IORING_MAX_ENTRIES 32768 define IORING_MAX_CQ_ENTRIES (2 * IORING_MAX_ENTRIES) +# First does the setup calling io_uring_setup, than calls mmap to map the ring and +# the sqes. It is hard for the fuzzer to generate correct programs using mmap calls +# with fuzzer-provided mmap length. This wrapper ensures correct length computation. +syz_io_uring_setup(entries int32[1:IORING_MAX_ENTRIES], params ptr[inout, io_uring_params], addr_ring vma, addr_sqes vma, ring_ptr ptr[out, ring_ptr], sqes_ptr ptr[out, sqes_ptr]) fd_io_uring + io_uring_setup(entries int32[1:IORING_MAX_ENTRIES], params ptr[inout, io_uring_params]) fd_io_uring io_uring_enter(fd fd_io_uring, to_submit int32[0:IORING_MAX_ENTRIES], min_complete int32[0:IORING_MAX_CQ_ENTRIES], flags flags[io_uring_enter_flags], sigmask ptr[in, sigset_t], size len[sigmask]) io_uring_register$IORING_REGISTER_BUFFERS(fd fd_io_uring, opcode const[IORING_REGISTER_BUFFERS], arg ptr[in, array[iovec_out]], nr_args len[arg]) diff --git a/sys/linux/test/io_uring b/sys/linux/test/io_uring index 3e28259d1..1d93c33e6 100644 --- a/sys/linux/test/io_uring +++ b/sys/linux/test/io_uring @@ -1,9 +1,5 @@ # Create an io_uring instance -r0 = io_uring_setup(0x1, &AUTO={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, [0x0, 0x0, 0x0], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) - -# mmap the ring and the sqes -r1 = mmap$IORING_OFF_SQ_RING(&(0x7f00000a0000)=nil, 0x184, 0x3, 0x8001, r0, AUTO) -r2 = mmap$IORING_OFF_SQES(&(0x7f00000b0000)=nil, 0x40, 0x3, 0x8001, r0, AUTO) +r0 = syz_io_uring_setup(0x1, &AUTO={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, [0x0, 0x0, 0x0], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &AUTO=0x0, &AUTO=0x0) # Set IORING_CQ_EVENTFD_DISABLED. Has no side-effect for the test, # only tests syz_memcpy_off(). -- cgit mrf-deployment