From 75a7c5e2d1f09a4a58e7e1f1f4ef0b0f55a33413 Mon Sep 17 00:00:00 2001 From: Dmitry Vyukov Date: Mon, 19 Feb 2018 19:35:04 +0100 Subject: prog: rework address allocation 1. mmap all memory always, without explicit mmap calls in the program. This makes lots of things much easier and removes lots of code. Makes mmap not a special syscall and allows to fuzz without mmap enabled. 2. Change address assignment algorithm. Current algorithm allocates unmapped addresses too frequently and allows collisions between arguments of a single syscall. The new algorithm analyzes actual allocations in the program and places new arguments at unused locations. --- sys/windows/amd64.go | 4 ++-- sys/windows/init.go | 26 +++----------------------- 2 files changed, 5 insertions(+), 25 deletions(-) (limited to 'sys/windows') diff --git a/sys/windows/amd64.go b/sys/windows/amd64.go index d35f653a3..b3d2a4c16 100644 --- a/sys/windows/amd64.go +++ b/sys/windows/amd64.go @@ -4,7 +4,7 @@ package windows import . "github.com/google/syzkaller/prog" func init() { - RegisterTarget(&Target{OS: "windows", Arch: "amd64", Revision: revision_amd64, PtrSize: 8, Syscalls: syscalls_amd64, Resources: resources_amd64, Structs: structDescs_amd64, Consts: consts_amd64}, initTarget) + RegisterTarget(&Target{OS: "windows", Arch: "amd64", Revision: revision_amd64, PtrSize: 8, PageSize: 4096, NumPages: 4096, DataOffset: 536870912, Syscalls: syscalls_amd64, Resources: resources_amd64, Structs: structDescs_amd64, Consts: consts_amd64}, initTarget) } var resources_amd64 = []*ResourceDesc{ @@ -14612,4 +14612,4 @@ var consts_amd64 = []ConstValue{ {Name: "WRITE_OWNER", Value: 524288}, } -const revision_amd64 = "5d63c10c1e139f4a33dae8f94809285dae73a415" +const revision_amd64 = "38e754fb8319bf26f8642703cab9d9acbcec5109" diff --git a/sys/windows/init.go b/sys/windows/init.go index 8e3761024..7729f3260 100644 --- a/sys/windows/init.go +++ b/sys/windows/init.go @@ -15,19 +15,9 @@ func initTarget(target *prog.Target) { PAGE_EXECUTE_READWRITE: target.ConstMap["PAGE_EXECUTE_READWRITE"], } - target.PageSize = pageSize - target.DataOffset = dataOffset - target.MmapSyscall = arch.virtualAllocSyscall target.MakeMmap = arch.makeMmap - target.AnalyzeMmap = arch.analyzeMmap } -const ( - // TODO(dvyukov): what should we do about 4k vs 64k? - pageSize = 4 << 10 - dataOffset = 512 << 20 -) - type arch struct { virtualAllocSyscall *prog.Syscall @@ -36,26 +26,16 @@ type arch struct { PAGE_EXECUTE_READWRITE uint64 } -func (arch *arch) makeMmap(start, npages uint64) *prog.Call { +func (arch *arch) makeMmap(addr, size uint64) *prog.Call { meta := arch.virtualAllocSyscall return &prog.Call{ Meta: meta, Args: []prog.Arg{ - prog.MakePointerArg(meta.Args[0], start, 0, npages, nil), - prog.MakeConstArg(meta.Args[1], npages*pageSize), + prog.MakeVmaPointerArg(meta.Args[0], addr, size), + prog.MakeConstArg(meta.Args[1], size), prog.MakeConstArg(meta.Args[2], arch.MEM_COMMIT|arch.MEM_RESERVE), prog.MakeConstArg(meta.Args[3], arch.PAGE_EXECUTE_READWRITE), }, Ret: prog.MakeReturnArg(meta.Ret), } } - -func (arch *arch) analyzeMmap(c *prog.Call) (start, npages uint64, mapped bool) { - switch c.Meta.Name { - case "VirtualAlloc": - npages = c.Args[1].(*prog.ConstArg).Val / pageSize - start = c.Args[0].(*prog.PointerArg).PageIndex - mapped = true - } - return -} -- cgit mrf-deployment