1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
|
// Copyright 2017 syzkaller project authors. All rights reserved.
// Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file.
// +build
#define SYZ_EXECUTOR
#include "common_freebsd.h"
#include "executor_posix.h"
#include "executor.h"
#include "syscalls_freebsd.h"
#include <sys/resource.h>
#include <sys/time.h>
#include <sys/types.h>
char input_data[kMaxInput];
uint32_t output;
int main(int argc, char** argv)
{
if (argc == 2 && strcmp(argv[1], "version") == 0) {
puts("linux " GOARCH " " SYZ_REVISION " " GIT_REVISION);
return 0;
}
// Some minimal sandboxing.
struct rlimit rlim;
rlim.rlim_cur = rlim.rlim_max = 128 << 20;
setrlimit(RLIMIT_AS, &rlim);
rlim.rlim_cur = rlim.rlim_max = 8 << 20;
setrlimit(RLIMIT_MEMLOCK, &rlim);
rlim.rlim_cur = rlim.rlim_max = 1 << 20;
setrlimit(RLIMIT_FSIZE, &rlim);
rlim.rlim_cur = rlim.rlim_max = 1 << 20;
setrlimit(RLIMIT_STACK, &rlim);
rlim.rlim_cur = rlim.rlim_max = 0;
setrlimit(RLIMIT_CORE, &rlim);
install_segv_handler();
int pos = 0;
for (;;) {
int rv = read(0, input_data + pos, sizeof(input_data) - pos);
if (rv < 0)
fail("read failed");
if (rv == 0)
break;
pos += rv;
}
if (pos < 24)
fail("truncated input");
uint64_t flags = *(uint64_t*)input_data;
flag_debug = flags & (1 << 0);
flag_threaded = flags & (1 << 2);
flag_collide = flags & (1 << 3);
if (!flag_threaded)
flag_collide = false;
uint64_t executor_pid = *((uint64_t*)input_data + 2);
debug("input %d, threaded=%d collide=%d pid=%llu\n",
pos, flag_threaded, flag_collide, executor_pid);
execute_one(((uint64_t*)input_data) + 3);
return 0;
}
long execute_syscall(call_t* c, long a0, long a1, long a2, long a3, long a4, long a5, long a6, long a7, long a8)
{
if (c->call)
return c->call(a0, a1, a2, a3, a4, a5, a6, a7, a8);
return syscall(c->sys_nr, a0, a1, a2, a3, a4, a5);
}
void cover_open()
{
}
void cover_enable(thread_t* th)
{
}
void cover_reset(thread_t* th)
{
}
uint64_t read_cover_size(thread_t* th)
{
return 0;
}
uint32_t* write_output(uint32_t v)
{
return &output;
}
void write_completed(uint32_t completed)
{
}
|
