syzkaller/pkg/csource/csource.go

// Copyright 2015 syzkaller project authors. All rights reserved.
// Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file.

// Package csource generates [almost] equivalent C programs from syzkaller programs.
package csource

import (
	"bytes"
	"fmt"
	"regexp"
	"strings"

	"github.com/google/syzkaller/prog"
	"github.com/google/syzkaller/sys/targets"
)

func Write(p *prog.Prog, opts Options) ([]byte, error) {
	if err := opts.Check(); err != nil {
		return nil, fmt.Errorf("csource: invalid opts: %v", err)
	}
	ctx := &context{
		p:         p,
		opts:      opts,
		target:    p.Target,
		sysTarget: targets.List[p.Target.OS][p.Target.Arch],
		w:         new(bytes.Buffer),
		calls:     make(map[string]uint64),
	}
	for _, c := range p.Calls {
		ctx.calls[c.Meta.CallName] = c.Meta.NR
	}

	ctx.print("// autogenerated by syzkaller (http://github.com/google/syzkaller)\n\n")

	hdr, err := createCommonHeader(p, opts)
	if err != nil {
		return nil, err
	}
	ctx.w.Write(hdr)
	ctx.print("\n")

	ctx.generateSyscallDefines()

	exec := make([]byte, prog.ExecBufferSize)
	progSize, err := ctx.p.SerializeForExec(exec, 0)
	if err != nil {
		return nil, fmt.Errorf("failed to serialize program: %v", err)
	}
	decoded, err := ctx.target.DeserializeExec(exec[:progSize])
	if err != nil {
		return nil, err
	}
	calls, nvar := ctx.generateCalls(decoded)
	if nvar != 0 {
		ctx.printf("long r[%v];\n", nvar)
	}

	if !opts.Repeat {
		ctx.generateTestFunc(calls, nvar, "loop")

		ctx.print("int main()\n{\n")
		if opts.HandleSegv {
			ctx.printf("\tinstall_segv_handler();\n")
		}
		if opts.UseTmpDir {
			ctx.printf("\tuse_temporary_dir();\n")
		}
		if opts.Sandbox != "" {
			ctx.printf("\tint pid = do_sandbox_%v(0, %v);\n", opts.Sandbox, opts.EnableTun)
			ctx.print("\tint status = 0;\n")
			ctx.print("\twhile (waitpid(pid, &status, __WALL) != pid) {}\n")
		} else {
			if opts.EnableTun {
				ctx.printf("\tsetup_tun(0, %v);\n", opts.EnableTun)
			}
			ctx.print("\tloop();\n")
		}
		ctx.print("\treturn 0;\n}\n")
	} else {
		ctx.generateTestFunc(calls, nvar, "test")
		if opts.Procs <= 1 {
			ctx.print("int main()\n{\n")
			if opts.HandleSegv {
				ctx.printf("\tinstall_segv_handler();\n")
			}
			if opts.UseTmpDir {
				ctx.printf("\tuse_temporary_dir();\n")
			}
			if opts.Sandbox != "" {
				ctx.printf("\tint pid = do_sandbox_%v(0, %v);\n", opts.Sandbox, opts.EnableTun)
				ctx.print("\tint status = 0;\n")
				ctx.print("\twhile (waitpid(pid, &status, __WALL) != pid) {}\n")
			} else {
				if opts.EnableTun {
					ctx.printf("\tsetup_tun(0, %v);\n", opts.EnableTun)
				}
				ctx.print("\tloop();\n")
			}
			ctx.print("\treturn 0;\n}\n")
		} else {
			ctx.print("int main()\n{\n")
			ctx.print("\tint i;")
			ctx.printf("\tfor (i = 0; i < %v; i++) {\n", opts.Procs)
			ctx.print("\t\tif (fork() == 0) {\n")
			if opts.HandleSegv {
				ctx.printf("\t\t\tinstall_segv_handler();\n")
			}
			if opts.UseTmpDir {
				ctx.printf("\t\t\tuse_temporary_dir();\n")
			}
			if opts.Sandbox != "" {
				ctx.printf("\t\t\tint pid = do_sandbox_%v(i, %v);\n", opts.Sandbox, opts.EnableTun)
				ctx.print("\t\t\tint status = 0;\n")
				ctx.print("\t\t\twhile (waitpid(pid, &status, __WALL) != pid) {}\n")
			} else {
				if opts.EnableTun {
					ctx.printf("\t\t\tsetup_tun(i, %v);\n", opts.EnableTun)
				}
				ctx.print("\t\t\tloop();\n")
			}
			ctx.print("\t\t\treturn 0;\n")
			ctx.print("\t\t}\n")
			ctx.print("\t}\n")
			ctx.print("\tsleep(1000000);\n")
			ctx.print("\treturn 0;\n}\n")
		}
	}

	// Remove NONFAILING and debug calls.
	out0 := ctx.w.String()
	if !opts.HandleSegv {
		re := regexp.MustCompile(`\t*NONFAILING\((.*)\);\n`)
		out0 = re.ReplaceAllString(out0, "$1;\n")
	}
	if !opts.Debug {
		re := regexp.MustCompile(`\t*debug\(.*\);\n`)
		out0 = re.ReplaceAllString(out0, "")
		re = regexp.MustCompile(`\t*debug_dump_data\(.*\);\n`)
		out0 = re.ReplaceAllString(out0, "")
	}
	out0 = strings.Replace(out0, "NORETURN", "", -1)

	// Remove duplicate new lines.
	out1 := []byte(out0)
	for {
		out2 := bytes.Replace(out1, []byte{'\n', '\n', '\n'}, []byte{'\n', '\n'}, -1)
		if len(out1) == len(out2) {
			break
		}
		out1 = out2
	}

	return out1, nil
}

type context struct {
	p         *prog.Prog
	opts      Options
	target    *prog.Target
	sysTarget *targets.Target
	w         *bytes.Buffer
	calls     map[string]uint64 // CallName -> NR
}

func (ctx *context) print(str string) {
	ctx.w.WriteString(str)
}

func (ctx *context) printf(str string, args ...interface{}) {
	ctx.print(fmt.Sprintf(str, args...))
}

func (ctx *context) generateTestFunc(calls []string, nvar uint64, name string) {
	opts := ctx.opts
	if !opts.Threaded && !opts.Collide {
		ctx.printf("void %v()\n{\n", name)
		if opts.Debug {
			// Use debug to avoid: error: ‘debug’ defined but not used.
			ctx.printf("\tdebug(\"%v\\n\");\n", name)
		}
		if opts.Repro {
			ctx.printf("\tsyscall(SYS_write, 1, \"executing program\\n\", strlen(\"executing program\\n\"));\n")
		}
		if nvar != 0 {
			ctx.printf("\tmemset(r, -1, sizeof(r));\n")
		}
		for _, c := range calls {
			ctx.printf("%s", c)
		}
		ctx.printf("}\n\n")
	} else {
		ctx.printf("void *thr(void *arg)\n{\n")
		ctx.printf("\tswitch ((long)arg) {\n")
		for i, c := range calls {
			ctx.printf("\tcase %v:\n", i)
			ctx.printf("%s", strings.Replace(c, "\t", "\t\t", -1))
			ctx.printf("\t\tbreak;\n")
		}
		ctx.printf("\t}\n")
		ctx.printf("\treturn 0;\n}\n\n")

		ctx.printf("void %v()\n{\n", name)
		ctx.printf("\tlong i;\n")
		ctx.printf("\tpthread_t th[%v];\n", 2*len(calls))
		ctx.printf("\tpthread_attr_t attr;\n")
		ctx.printf("\n")
		if opts.Debug {
			// Use debug to avoid: error: ‘debug’ defined but not used.
			ctx.printf("\tdebug(\"%v\\n\");\n", name)
		}
		if opts.Repro {
			ctx.printf("\tsyscall(SYS_write, 1, \"executing program\\n\", strlen(\"executing program\\n\"));\n")
		}
		if nvar != 0 {
			ctx.printf("\tmemset(r, -1, sizeof(r));\n")
		}
		if opts.Collide {
			ctx.printf("\tsrand(getpid());\n")
		}
		ctx.printf("\tpthread_attr_init(&attr);\n")
		ctx.printf("\tpthread_attr_setstacksize(&attr, 128 << 10);\n")
		ctx.printf("\tfor (i = 0; i < %v; i++) {\n", len(calls))
		ctx.printf("\t\tpthread_create(&th[i], &attr, thr, (void*)i);\n")
		ctx.printf("\t\tusleep(rand()%%10000);\n")
		ctx.printf("\t}\n")
		if opts.Collide {
			ctx.printf("\tfor (i = 0; i < %v; i++) {\n", len(calls))
			ctx.printf("\t\tpthread_create(&th[%v+i], &attr, thr, (void*)i);\n", len(calls))
			ctx.printf("\t\tif (rand()%%2)\n")
			ctx.printf("\t\t\tusleep(rand()%%10000);\n")
			ctx.printf("\t}\n")
		}
		ctx.printf("\tusleep(rand()%%100000);\n")
		ctx.printf("}\n\n")
	}
}

func (ctx *context) generateSyscallDefines() {
	prefix := ctx.sysTarget.SyscallPrefix
	for name, nr := range ctx.calls {
		if strings.HasPrefix(name, "syz_") || !ctx.sysTarget.NeedSyscallDefine(nr) {
			continue
		}
		ctx.printf("#ifndef %v%v\n", prefix, name)
		ctx.printf("#define %v%v %v\n", prefix, name, nr)
		ctx.printf("#endif\n")
	}
	if ctx.target.OS == "linux" && ctx.target.PtrSize == 4 {
		// This is a dirty hack.
		// On 32-bit linux mmap translated to old_mmap syscall which has a different signature.
		// mmap2 has the right signature. syz-extract translates mmap to mmap2, do the same here.
		ctx.printf("#undef __NR_mmap\n")
		ctx.printf("#define __NR_mmap __NR_mmap2\n")
	}
	ctx.printf("\n")
}

func (ctx *context) generateCalls(p prog.ExecProg) ([]string, uint64) {
	resultRef := func(arg prog.ExecArgResult) string {
		res := fmt.Sprintf("r[%v]", arg.Index)
		if arg.DivOp != 0 {
			res = fmt.Sprintf("%v/%v", res, arg.DivOp)
		}
		if arg.AddOp != 0 {
			res = fmt.Sprintf("%v+%v", res, arg.AddOp)
		}
		return res
	}
	var calls []string
	csumSeq := 0
	for ci, call := range p.Calls {
		w := new(bytes.Buffer)
		// Copyin.
		for _, copyin := range call.Copyin {
			switch arg := copyin.Arg.(type) {
			case prog.ExecArgConst:
				if arg.BitfieldOffset == 0 && arg.BitfieldLength == 0 {
					fmt.Fprintf(w, "\tNONFAILING(*(uint%v_t*)0x%x = (uint%v_t)0x%x);\n",
						arg.Size*8, copyin.Addr, arg.Size*8, arg.Value)
				} else {
					fmt.Fprintf(w, "\tNONFAILING(STORE_BY_BITMASK(uint%v_t, 0x%x, 0x%x, %v, %v));\n",
						arg.Size*8, copyin.Addr, arg.Value, arg.BitfieldOffset, arg.BitfieldLength)
				}
			case prog.ExecArgResult:
				fmt.Fprintf(w, "\tNONFAILING(*(uint%v_t*)0x%x = %v);\n",
					arg.Size*8, copyin.Addr, resultRef(arg))
			case prog.ExecArgData:
				fmt.Fprintf(w, "\tNONFAILING(memcpy((void*)0x%x, \"%s\", %v));\n",
					copyin.Addr, toCString(arg.Data), len(arg.Data))
			case prog.ExecArgCsum:
				switch arg.Kind {
				case prog.ExecArgCsumInet:
					csumSeq++
					fmt.Fprintf(w, "\tstruct csum_inet csum_%d;\n", csumSeq)
					fmt.Fprintf(w, "\tcsum_inet_init(&csum_%d);\n", csumSeq)
					for i, chunk := range arg.Chunks {
						switch chunk.Kind {
						case prog.ExecArgCsumChunkData:
							fmt.Fprintf(w, "\tNONFAILING(csum_inet_update(&csum_%d, (const uint8_t*)0x%x, %d));\n", csumSeq, chunk.Value, chunk.Size)
						case prog.ExecArgCsumChunkConst:
							fmt.Fprintf(w, "\tuint%d_t csum_%d_chunk_%d = 0x%x;\n", chunk.Size*8, csumSeq, i, chunk.Value)
							fmt.Fprintf(w, "\tcsum_inet_update(&csum_%d, (const uint8_t*)&csum_%d_chunk_%d, %d);\n", csumSeq, csumSeq, i, chunk.Size)
						default:
							panic(fmt.Sprintf("unknown checksum chunk kind %v", chunk.Kind))
						}
					}
					fmt.Fprintf(w, "\tNONFAILING(*(uint16_t*)0x%x = csum_inet_digest(&csum_%d));\n", copyin.Addr, csumSeq)
				default:
					panic(fmt.Sprintf("unknown csum kind %v", arg.Kind))
				}
			default:
				panic(fmt.Sprintf("bad argument type: %+v", arg))
			}
		}

		// Call itself.
		if ctx.opts.Fault && ctx.opts.FaultCall == ci {
			fmt.Fprintf(w, "\twrite_file(\"/sys/kernel/debug/failslab/ignore-gfp-wait\", \"N\");\n")
			fmt.Fprintf(w, "\twrite_file(\"/sys/kernel/debug/fail_futex/ignore-private\", \"N\");\n")
			fmt.Fprintf(w, "\tinject_fault(%v);\n", ctx.opts.FaultNth)
		}
		callName := call.Meta.CallName
		resCopyout := call.Index != prog.ExecNoCopyout
		argCopyout := len(call.Copyout) != 0
		emitCall := ctx.opts.EnableTun || callName != "syz_emit_ethernet" &&
			callName != "syz_extract_tcp_res"
		// TODO: if we don't emit the call we must also not emit copyin, copyout and fault injection.
		// However, simply skipping whole iteration breaks tests due to unused static functions.
		if emitCall {
			native := !strings.HasPrefix(callName, "syz_")
			fmt.Fprintf(w, "\t")
			if argCopyout {
				fmt.Fprintf(w, "if (")
				if resCopyout {
					fmt.Fprintf(w, "(")
				}
			}
			if resCopyout {
				fmt.Fprintf(w, "r[%v] = ", call.Index)
			}
			if native {
				fmt.Fprintf(w, "syscall(%v%v", ctx.sysTarget.SyscallPrefix, callName)
			} else {
				fmt.Fprintf(w, "%v(", callName)
			}
			for ai, arg := range call.Args {
				if native || ai > 0 {
					fmt.Fprintf(w, ", ")
				}
				switch arg := arg.(type) {
				case prog.ExecArgConst:
					fmt.Fprintf(w, "0x%xul", arg.Value)
				case prog.ExecArgResult:
					fmt.Fprintf(w, "%v", resultRef(arg))
				default:
					panic(fmt.Sprintf("unknown arg type: %+v", arg))
				}
			}
			fmt.Fprintf(w, ")")
			if argCopyout {
				if resCopyout {
					fmt.Fprintf(w, ")")
				}
				fmt.Fprintf(w, " != -1) {")
			} else {
				fmt.Fprintf(w, ";")
			}
			fmt.Fprintf(w, "\n")
		}

		// Copyout.
		for _, copyout := range call.Copyout {
			fmt.Fprintf(w, "\t\tNONFAILING(r[%v] = *(uint%v_t*)0x%x);\n",
				copyout.Index, copyout.Size*8, copyout.Addr)
		}
		if emitCall && argCopyout {
			fmt.Fprintf(w, "\t}\n")
		}

		calls = append(calls, w.String())
	}
	return calls, p.NumVars
}

func toCString(data []byte) []byte {
	if len(data) == 0 {
		return nil
	}
	readable := true
	for i, v := range data {
		// Allow 0 only as last byte.
		if !isReadable(v) && (i != len(data)-1 || v != 0) {
			readable = false
			break
		}
	}
	if !readable {
		buf := new(bytes.Buffer)
		for _, v := range data {
			buf.Write([]byte{'\\', 'x', toHex(v >> 4), toHex(v << 4 >> 4)})
		}
		return buf.Bytes()
	}
	if data[len(data)-1] == 0 {
		// Don't serialize last 0, C strings are 0-terminated anyway.
		data = data[:len(data)-1]
	}
	buf := new(bytes.Buffer)
	for _, v := range data {
		switch v {
		case '\t':
			buf.Write([]byte{'\\', 't'})
		case '\r':
			buf.Write([]byte{'\\', 'r'})
		case '\n':
			buf.Write([]byte{'\\', 'n'})
		case '\\':
			buf.Write([]byte{'\\', '\\'})
		case '"':
			buf.Write([]byte{'\\', '"'})
		default:
			if v < 0x20 || v >= 0x7f {
				panic("unexpected char during data serialization")
			}
			buf.WriteByte(v)
		}
	}
	return buf.Bytes()
}

func isReadable(v byte) bool {
	return v >= 0x20 && v < 0x7f || v == '\t' || v == '\r' || v == '\n'
}

func toHex(v byte) byte {
	if v < 10 {
		return '0' + v
	}
	return 'a' + v - 10
}