reactos/syzkaller
1
0
Fork 0
mirror of https://github.com/reactos/syzkaller.git synced 2024-11-26 21:00:30 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

sys/linux: add descriptions for BPF LSM

Browse Source 
This commit includes the following changes:
* executor: add a new syz_btf_id_by_name psuedo-syscall
* sys/linux: add descriptions for BPF LSM subsystem
* sys/linux: add instructions on how to dump vmlinux and install
  bpftool
* sys/linux/test: add tests for the new psuedo-syscall
* pkg/host: add support detection for the new psuedo-syscall
* pkg/runtest: skip the coverage test when invoking the new
  psuedo-syscall

Update #533.
This commit is contained in:
Cheng-Min Chiang 2020-07-24 18:05:18 -07:00 committed by Dmitry Vyukov
parent cb436c69d9
commit 20a3465b97
15 changed files with 460 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

188
executor/common_linux.h
View File

@ -1563,6 +1563,194 @@ static long syz_io_uring_submit(volatile long a0, volatile long a1, volatile lon
#endif
#if SYZ_EXECUTOR || __NR_syz_btf_id_by_name
#include <errno.h>
#include <fcntl.h>
#include <stdbool.h>
#include <stddef.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/stat.h>
#include <unistd.h>
// Some items in linux/btf.h are relatively new, so we copy them here for
// backward compatibility.
#define BTF_MAGIC 0xeB9F
struct btf_header {
__u16 magic;
__u8 version;
__u8 flags;
__u32 hdr_len;
__u32 type_off;
__u32 type_len;
__u32 str_off;
__u32 str_len;
};
#define BTF_INFO_KIND(info) (((info) >> 24) & 0x0f)
#define BTF_INFO_VLEN(info) ((info)&0xffff)
#define BTF_KIND_INT 1
#define BTF_KIND_ARRAY 3
#define BTF_KIND_STRUCT 4
#define BTF_KIND_UNION 5
#define BTF_KIND_ENUM 6
#define BTF_KIND_FUNC_PROTO 13
#define BTF_KIND_VAR 14
#define BTF_KIND_DATASEC 15
struct btf_type {
__u32 name_off;
__u32 info;
union {
__u32 size;
__u32 type;
};
};
struct btf_enum {
__u32 name_off;
__s32 val;
};
struct btf_array {
__u32 type;
__u32 index_type;
__u32 nelems;
};
struct btf_member {
__u32 name_off;
__u32 type;
__u32 offset;
};
struct btf_param {
__u32 name_off;
__u32 type;
};
struct btf_var {
__u32 linkage;
};
struct btf_var_secinfo {
__u32 type;
__u32 offset;
__u32 size;
};
// Set the limit on the maximum size of btf/vmlinux to be 10 MiB.
#define VMLINUX_MAX_SUPPORT_SIZE (10 * 1024 * 1024)
// Read out all the content of /sys/kernel/btf/vmlinux to the fixed address
// buffer and return it. Return NULL if failed.
static char* read_btf_vmlinux()
{
static bool is_read = false;
static char buf[VMLINUX_MAX_SUPPORT_SIZE];
// There could be a race condition here, but it should not be harmful.
if (is_read)
return buf;
int fd = open("/sys/kernel/btf/vmlinux", O_RDONLY);
if (fd < 0)
return NULL;
unsigned long bytes_read = 0;
for (;;) {
ssize_t ret = read(fd, buf + bytes_read,
VMLINUX_MAX_SUPPORT_SIZE - bytes_read);
if (ret < 0 || bytes_read + ret == VMLINUX_MAX_SUPPORT_SIZE)
return NULL;
if (ret == 0)
break;
bytes_read += ret;
}
is_read = true;
return buf;
}
// Given a pointer to a C-string as the only argument a0, return the
// corresponding btf ID for this name. Return -1 if there is an error when
// opening the vmlinux file or the name is not found in vmlinux.
static long syz_btf_id_by_name(volatile long a0)
{
// syzlang: syz_btf_id_by_name(name ptr[in, string]) btf_id
// C: syz_btf_id_by_name(char* name)
char* target = (char*)a0;
char* vmlinux = read_btf_vmlinux();
if (vmlinux == NULL)
return -1;
struct btf_header* btf_header = (struct btf_header*)vmlinux;
if (btf_header->magic != BTF_MAGIC)
return -1;
// These offsets are bytes relative to the end of the header.
char* btf_type_sec = vmlinux + btf_header->hdr_len + btf_header->type_off;
char* btf_str_sec = vmlinux + btf_header->hdr_len + btf_header->str_off;
// Scan through the btf type section, and find a type description that
// matches the provided name.
unsigned int bytes_parsed = 0;
// BTF index starts at 1.
long idx = 1;
while (bytes_parsed < btf_header->type_len) {
struct btf_type* btf_type = (struct btf_type*)(btf_type_sec + bytes_parsed);
uint32 kind = BTF_INFO_KIND(btf_type->info);
uint32 vlen = BTF_INFO_VLEN(btf_type->info);
char* name = btf_str_sec + btf_type->name_off;
if (strcmp(name, target) == 0)
return idx;
// From /include/uapi/linux/btf.h, some kinds of types are
// followed by extra data.
size_t skip;
switch (kind) {
case BTF_KIND_INT:
skip = sizeof(uint32);
break;
case BTF_KIND_ENUM:
skip = sizeof(struct btf_enum) * vlen;
break;
case BTF_KIND_ARRAY:
skip = sizeof(struct btf_array);
break;
case BTF_KIND_STRUCT:
case BTF_KIND_UNION:
skip = sizeof(struct btf_member) * vlen;
break;
case BTF_KIND_FUNC_PROTO:
skip = sizeof(struct btf_param) * vlen;
break;
case BTF_KIND_VAR:
skip = sizeof(struct btf_var);
break;
case BTF_KIND_DATASEC:
skip = sizeof(struct btf_var_secinfo) * vlen;
break;
default:
skip = 0;
}
bytes_parsed += sizeof(struct btf_type) + skip;
idx++;
}
return -1;
}
#endif // SYZ_EXECUTOR || __NR_syz_btf_id_by_name
// Same as memcpy except that it accepts offset to dest and src.
#if SYZ_EXECUTOR || __NR_syz_memcpy_off
static long syz_memcpy_off(volatile long a0, volatile long a1, volatile long a2, volatile long a3, volatile long a4)

165
pkg/csource/generated.go
View File

@ -3659,6 +3659,171 @@ static long syz_io_uring_submit(volatile long a0, volatile long a1, volatile lon
#endif
#endif
#if SYZ_EXECUTOR || __NR_syz_btf_id_by_name
#include <errno.h>
#include <fcntl.h>
#include <stdbool.h>
#include <stddef.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/stat.h>
#include <unistd.h>
#define BTF_MAGIC 0xeB9F
struct btf_header {
__u16 magic;
__u8 version;
__u8 flags;
__u32 hdr_len;
__u32 type_off;
__u32 type_len;
__u32 str_off;
__u32 str_len;
};
#define BTF_INFO_KIND(info) (((info) >> 24) & 0x0f)
#define BTF_INFO_VLEN(info) ((info)&0xffff)
#define BTF_KIND_INT 1
#define BTF_KIND_ARRAY 3
#define BTF_KIND_STRUCT 4
#define BTF_KIND_UNION 5
#define BTF_KIND_ENUM 6
#define BTF_KIND_FUNC_PROTO 13
#define BTF_KIND_VAR 14
#define BTF_KIND_DATASEC 15
struct btf_type {
__u32 name_off;
__u32 info;
union {
__u32 size;
__u32 type;
};
};
struct btf_enum {
__u32 name_off;
__s32 val;
};
struct btf_array {
__u32 type;
__u32 index_type;
__u32 nelems;
};
struct btf_member {
__u32 name_off;
__u32 type;
__u32 offset;
};
struct btf_param {
__u32 name_off;
__u32 type;
};
struct btf_var {
__u32 linkage;
};
struct btf_var_secinfo {
__u32 type;
__u32 offset;
__u32 size;
};
#define VMLINUX_MAX_SUPPORT_SIZE (10 * 1024 * 1024)
static char* read_btf_vmlinux()
{
static bool is_read = false;
static char buf[VMLINUX_MAX_SUPPORT_SIZE];
if (is_read)
return buf;
int fd = open("/sys/kernel/btf/vmlinux", O_RDONLY);
if (fd < 0)
return NULL;
unsigned long bytes_read = 0;
for (;;) {
ssize_t ret = read(fd, buf + bytes_read,
VMLINUX_MAX_SUPPORT_SIZE - bytes_read);
if (ret < 0 || bytes_read + ret == VMLINUX_MAX_SUPPORT_SIZE)
return NULL;
if (ret == 0)
break;
bytes_read += ret;
}
is_read = true;
return buf;
}
static long syz_btf_id_by_name(volatile long a0)
{
char* target = (char*)a0;
char* vmlinux = read_btf_vmlinux();
if (vmlinux == NULL)
return -1;
struct btf_header* btf_header = (struct btf_header*)vmlinux;
if (btf_header->magic != BTF_MAGIC)
return -1;
char* btf_type_sec = vmlinux + btf_header->hdr_len + btf_header->type_off;
char* btf_str_sec = vmlinux + btf_header->hdr_len + btf_header->str_off;
unsigned int bytes_parsed = 0;
long idx = 1;
while (bytes_parsed < btf_header->type_len) {
struct btf_type* btf_type = (struct btf_type*)(btf_type_sec + bytes_parsed);
uint32 kind = BTF_INFO_KIND(btf_type->info);
uint32 vlen = BTF_INFO_VLEN(btf_type->info);
char* name = btf_str_sec + btf_type->name_off;
if (strcmp(name, target) == 0)
return idx;
size_t skip;
switch (kind) {
case BTF_KIND_INT:
skip = sizeof(uint32);
break;
case BTF_KIND_ENUM:
skip = sizeof(struct btf_enum) * vlen;
break;
case BTF_KIND_ARRAY:
skip = sizeof(struct btf_array);
break;
case BTF_KIND_STRUCT:
case BTF_KIND_UNION:
skip = sizeof(struct btf_member) * vlen;
break;
case BTF_KIND_FUNC_PROTO:
skip = sizeof(struct btf_param) * vlen;
break;
case BTF_KIND_VAR:
skip = sizeof(struct btf_var);
break;
case BTF_KIND_DATASEC:
skip = sizeof(struct btf_var_secinfo) * vlen;
break;
default:
skip = 0;
}
bytes_parsed += sizeof(struct btf_type) + skip;
idx++;
}
return -1;
}
#endif
#if SYZ_EXECUTOR || __NR_syz_memcpy_off
static long syz_memcpy_off(volatile long a0, volatile long a1, volatile long a2, volatile long a3, volatile long a4)

10
pkg/host/syscalls_linux.go
View File

@ -243,6 +243,13 @@ func isSyzIoUringSupported(c *prog.Syscall, target *prog.Target, sandbox string)
return isSupportedSyscall(ioUringSyscall, target)
}
func isBtfVmlinuxSupported(c *prog.Syscall, target *prog.Target, sandbox string) (bool, string) {
if err := osutil.IsAccessible("/sys/kernel/btf/vmlinux"); err != nil {
return false, err.Error()
}
return onlySandboxNone(sandbox)
}
var syzkallSupport = map[string]func(*prog.Syscall, *prog.Target, string) (bool, string){
"syz_open_dev": isSyzOpenDevSupported,
"syz_open_procfs": alwaysSupported,
@ -267,7 +274,8 @@ var syzkallSupport = map[string]func(*prog.Syscall, *prog.Target, string) (bool,
"syz_io_uring_setup": isSyzIoUringSupported,
// syz_memcpy_off is only used for io_uring descriptions, thus, enable it
// only if io_uring syscalls are enabled.
"syz_memcpy_off": isSyzIoUringSupported,
"syz_memcpy_off": isSyzIoUringSupported,
"syz_btf_id_by_name": isBtfVmlinuxSupported,
}
func isSupportedSyzkall(c *prog.Syscall, target *prog.Target, sandbox string) (bool, string) {

4
pkg/runtest/run.go
View File

@ -503,7 +503,9 @@ func checkResult(req *RunRequest) error {
if len(inf.Signal) < 2 && !calls[callName] && len(info.Extra.Signal) == 0 {
return fmt.Errorf("run %v: call %v: no signal", run, i)
}
if len(inf.Cover) == 0 {
// syz_btf_id_by_name is a pseudo-syscall that might not provide
// any coverage when invoked.
if len(inf.Cover) == 0 && callName != "syz_btf_id_by_name" {
return fmt.Errorf("run %v: call %v: no cover", run, i)
}
calls[callName] = true

14
sys/linux/bpf.txt
View File

@ -48,7 +48,7 @@ bpf$BPF_GET_PROG_INFO(cmd const[BPF_OBJ_GET_INFO_BY_FD], arg ptr[in, bpf_get_pro
bpf$BPF_GET_MAP_INFO(cmd const[BPF_OBJ_GET_INFO_BY_FD], arg ptr[in, bpf_get_map_info_arg], size len[arg])
bpf$BPF_GET_BTF_INFO(cmd const[BPF_OBJ_GET_INFO_BY_FD], arg ptr[in, bpf_get_btf_info_arg], size len[arg])
bpf$BPF_PROG_QUERY(cmd const[BPF_PROG_QUERY], arg ptr[in, bpf_prog_query], size len[arg])
bpf$BPF_RAW_TRACEPOINT_OPEN(cmd const[BPF_RAW_TRACEPOINT_OPEN], arg ptr[in, bpf_raw_tracepoint], size len[arg]) fd_perf_base
bpf$BPF_RAW_TRACEPOINT_OPEN(cmd const[BPF_RAW_TRACEPOINT_OPEN], arg ptr[in, bpf_raw_tracepoint], size len[arg]) fd_perf_base (timeout[500])
bpf$BPF_BTF_LOAD(cmd const[BPF_BTF_LOAD], arg ptr[in, bpf_btf_load], size len[arg]) fd_btf
bpf$BPF_BTF_GET_FD_BY_ID(cmd const[BPF_BTF_GET_FD_BY_ID], arg ptr[in, bpf_btf_id], size len[arg]) fd_btf
bpf$BPF_TASK_FD_QUERY(cmd const[BPF_TASK_FD_QUERY], arg ptr[inout, bpf_task_fd_query], size len[arg])
@ -162,8 +162,8 @@ bpf_batch_flags = BPF_F_LOCK
define BPF_LINE_INFO_SIZE sizeof(struct bpf_line_info)
define BPF_FUNC_INFO_SIZE sizeof(struct bpf_func_info)
bpf_prog {
type flags[bpf_prog_type, int32]
type bpf_prog_t[TYPE, ATTACH_TYPE, BTF_ID, PROG_FD] {
type TYPE
ninsn bytesize8[insns, int32]
insns ptr64[in, bpf_instructions]
license ptr64[in, string[bpf_licenses]]
@ -174,7 +174,7 @@ bpf_prog {
flags flags[bpf_prog_load_flags, int32]
prog_name array[const[0, int8], BPF_OBJ_NAME_LEN]
prog_ifindex ifindex[opt]
expected_attach_type flags[bpf_attach_type, int32]
expected_attach_type ATTACH_TYPE
btf_fd fd_btf[opt]
func_info_rec_size const[BPF_FUNC_INFO_SIZE, int32]
func_info ptr64[in, bpf_func_info]
@ -182,10 +182,12 @@ bpf_prog {
line_info_rec_size const[BPF_LINE_INFO_SIZE, int32]
line_info ptr64[in, bpf_line_info]
line_info_cnt len[line_info, int32]
attach_btf_id bpf_btf_id[opt]
attach_prog_fd fd_bpf_prog[opt]
attach_btf_id BTF_ID
attach_prog_fd PROG_FD
}
type bpf_prog bpf_prog_t[flags[bpf_prog_type, int32], flags[bpf_attach_type, int32], bpf_btf_id[opt], fd_bpf_prog[opt]]
bpf_licenses = "GPL", "syzkaller"
bpf_kern_version = 0x40f00, 0x41000, 0x41100

28
sys/linux/bpf_lsm.txt Normal file
View File

File diff suppressed because one or more lines are too long

5
sys/linux/bpf_lsm_386.const Normal file
View File

@ -0,0 +1,5 @@
# AUTOGENERATED FILE
BPF_LSM_MAC = 27
BPF_PROG_LOAD = 5
BPF_PROG_TYPE_LSM = 29
__NR_bpf = 357

5
sys/linux/bpf_lsm_amd64.const Normal file
View File

@ -0,0 +1,5 @@
# AUTOGENERATED FILE
BPF_LSM_MAC = 27
BPF_PROG_LOAD = 5
BPF_PROG_TYPE_LSM = 29
__NR_bpf = 321

5
sys/linux/bpf_lsm_arm.const Normal file
View File

@ -0,0 +1,5 @@
# AUTOGENERATED FILE
BPF_LSM_MAC = 27
BPF_PROG_LOAD = 5
BPF_PROG_TYPE_LSM = 29
__NR_bpf = 386

5
sys/linux/bpf_lsm_arm64.const Normal file
View File

@ -0,0 +1,5 @@
# AUTOGENERATED FILE
BPF_LSM_MAC = 27
BPF_PROG_LOAD = 5
BPF_PROG_TYPE_LSM = 29
__NR_bpf = 280

5
sys/linux/bpf_lsm_mips64le.const Normal file
View File

@ -0,0 +1,5 @@
# AUTOGENERATED FILE
BPF_LSM_MAC = 27
BPF_PROG_LOAD = 5
BPF_PROG_TYPE_LSM = 29
__NR_bpf = 5315

5
sys/linux/bpf_lsm_ppc64le.const Normal file
View File

@ -0,0 +1,5 @@
# AUTOGENERATED FILE
BPF_LSM_MAC = 27
BPF_PROG_LOAD = 5
BPF_PROG_TYPE_LSM = 29
__NR_bpf = 361

5
sys/linux/bpf_lsm_riscv64.const Normal file
View File

@ -0,0 +1,5 @@
# AUTOGENERATED FILE
BPF_LSM_MAC = 27
BPF_PROG_LOAD = 5
BPF_PROG_TYPE_LSM = 29
__NR_bpf = 280

5
sys/linux/bpf_lsm_s390x.const Normal file
View File

@ -0,0 +1,5 @@
# AUTOGENERATED FILE
BPF_LSM_MAC = 27
BPF_PROG_LOAD = 5
BPF_PROG_TYPE_LSM = 29
__NR_bpf = 351

19
sys/linux/test/btf_id Normal file
View File

@ -0,0 +1,19 @@
# Query the btf_id of the hook name.
r0 = syz_btf_id_by_name$bpf_lsm(&AUTO='bpf_lsm_path_mkdir\x00')
# Load the bpf program.
r1 = bpf$BPF_LSM_PROG_LOAD(0x5, &AUTO={0x1d, AUTO, &AUTO=@framed={{AUTO, AUTO, AUTO, AUTO, 0x0, AUTO, AUTO, AUTO, 0x0}, [], {AUTO, AUTO, AUTO, AUTO}}, &AUTO='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x1b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0, 0x0}, 0x78)
# Attach the bpf program to the lsm hook.
r2 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &AUTO={0x0, r1}, 0x10)
# Run again to test that memorization works.
r3 = syz_btf_id_by_name$bpf_lsm(&AUTO='bpf_lsm_path_mkdir\x00')
r4 = bpf$BPF_LSM_PROG_LOAD(0x5, &AUTO={0x1d, AUTO, &AUTO=@framed={{AUTO, AUTO, AUTO, AUTO, 0x0, AUTO, AUTO, AUTO, 0x0}, [], {AUTO, AUTO, AUTO, AUTO}}, &AUTO='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x1b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r3, 0x0}, 0x78)
r5 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &AUTO={0x0, r4}, 0x10)