Currently all (linux-specific) suppressions are hardcoded in mgrconfig.
This is very wrong. Move them to pkg/report and allow to specify per OS.
Add gvisor-specific suppressions.
This required a bit of refactoring. Introduce mgrconfig.KernelObj finally.
Make report.NewReporter and vm.Create accept mgrconfig directly
instead of passing it as multiple scattered args.
Remove tools/syz-parse and it always did the same as tools/syz-symbolize.
Simplify global vars in syz-manager/cover.go.
Create reporter eagerly in manager. Use sort.Slice more.
Overall -90 lines removed.
We currently have native cross-compilation logic duplicated
in Makefile and in sys/targets. Some pieces are missed in one
place, some are in another. Only pkg/csource knows how to check
for -static support.
Move all CC/CFLAGS logic to sys/targets and pull results in Makefile.
This should make Makefile work on distros that have broken x86_64-linux-gnu-gcc,
now we will use just gcc. And this removes the need to define NOSTATIC,
as it's always auto-detected.
This also paves the way for making pkg/csource work on OSes other than Linux.
Travis is still broken with:
E: Unable to locate package gcc-aarch64-linux-gnu
E: Unable to locate package gcc-arm-linux-gnueabihf
E: Unable to locate package gcc-powerpc64le-linux-gnu
https://travis-ci.org/google/syzkaller/jobs/378034948
Let's at least see what's OS is there and what gcc packages present.
Travis CI started failing with:
E: Unable to locate package gcc-aarch64-linux-gnu
E: Unable to locate package gcc-arm-linux-gnueabihf
E: Unable to locate package gcc-powerpc64le-linux-gnu
make: *** [install_prerequisites] Error 100
https://travis-ci.org/google/syzkaller/jobs/377740347
Let's try to ignore these packages.
syz-sysgen depends on prog which depends on pkg/ifuzz.
Currently we concurrently regenerate pkg/ifuzz and build
syz-sysgen, which can cause failures.
Make pkg/ifuzz dependent on syz-sysgen, so that it is
built before we regenerate ifuzz.
* fuchsia: Fix the `extractor` tool.
The include path in Zircon has changed; updated syz-extract/fuchsia.go
to include this, and re-ran extract to get updated *.const files.
* fuchsia: Update syzkaller to build with current Fuchsia API.
Fuchsia doesn't have a stable API right now, so alas, this will probably
continue to change until that's nailed down.
But, useful to get this up-to-date at least.
Relevant notes:
* zx_channel_call_finish and _retry aren't technically public; leave
them out until we have a less-cludgy way to expose them
* musl supports setjmp/longjmp but not _setjmp/_longjump
* remove some unsupported syscalls
* update the build invocation
Makefile falsely detected a modified git tree when the first ifeq
argument was unquoted. Also switch to the $(shell ... style for
consistency.
As requested, add myself to AUTHORS and CONTRIBUTORS.
The race initially showed up on the new benchmark (see race report below).
The race indicated a wrong call passed to replaceArg,
as the result we sanitized the wrong call and left the new call un-sanitized.
Fix this.
Add test that exposes this.
Run benchmarks in race mode during presubmit
(benchmarks have higher chances of uncovering races than tests).
WARNING: DATA RACE
Write at 0x00c42000d3f0 by goroutine 18:
github.com/google/syzkaller/sys/linux.(*arch).sanitizeCall()
sys/linux/init.go:155 +0x256
github.com/google/syzkaller/sys/linux.(*arch).(github.com/google/syzkaller/sys/linux.sanitizeCall)-fm()
sys/linux/init.go:42 +0x4b
github.com/google/syzkaller/prog.(*Prog).replaceArg()
prog/prog.go:357 +0x239
github.com/google/syzkaller/prog.generateHints.func2()
prog/hints.go:105 +0x124
github.com/google/syzkaller/prog.checkConstArg()
prog/hints.go:128 +0xf3
github.com/google/syzkaller/prog.generateHints()
prog/hints.go:120 +0x495
github.com/google/syzkaller/prog.(*Prog).MutateWithHints.func1()
prog/hints.go:72 +0x67
github.com/google/syzkaller/prog.foreachSubargImpl.func1()
prog/analysis.go:86 +0x9f
github.com/google/syzkaller/prog.foreachSubargImpl()
prog/analysis.go:104 +0xc8
github.com/google/syzkaller/prog.foreachArgArray()
prog/analysis.go:113 +0x89
github.com/google/syzkaller/prog.foreachArg()
prog/analysis.go:121 +0x50
github.com/google/syzkaller/prog.(*Prog).MutateWithHints()
prog/hints.go:71 +0x18e
github.com/google/syzkaller/prog.BenchmarkHints.func1()
prog/hints_test.go:477 +0x77
testing.(*B).RunParallel.func1()
testing/benchmark.go:626 +0x156
Previous read at 0x00c42000d3f0 by goroutine 17:
github.com/google/syzkaller/prog.clone()
prog/clone.go:38 +0xbaa
github.com/google/syzkaller/prog.(*Prog).cloneImpl()
prog/clone.go:21 +0x17f
github.com/google/syzkaller/prog.generateHints()
prog/hints.go:95 +0xd0
github.com/google/syzkaller/prog.(*Prog).MutateWithHints.func1()
prog/hints.go:72 +0x67
github.com/google/syzkaller/prog.foreachSubargImpl.func1()
prog/analysis.go:86 +0x9f
github.com/google/syzkaller/prog.foreachSubargImpl()
prog/analysis.go:104 +0xc8
github.com/google/syzkaller/prog.foreachArgArray()
prog/analysis.go:113 +0x89
github.com/google/syzkaller/prog.foreachArg()
prog/analysis.go:121 +0x50
github.com/google/syzkaller/prog.(*Prog).MutateWithHints()
prog/hints.go:71 +0x18e
github.com/google/syzkaller/prog.BenchmarkHints.func1()
prog/hints_test.go:477 +0x77
testing.(*B).RunParallel.func1()
testing/benchmark.go:626 +0x156
This commit adds tools/check_links.py script, that checks that all local
links from documentation files are valid; fixes some of the invalid links
that we had; and makes travis buildbot check them as well.
This fails on bots with:
strip --strip-debug ./bin/linux_arm64/syz-executor
strip: Unable to recognise the format of the input file `./bin/linux_arm64/syz-executor'
We don't generate debug info for Go binaries to reduce their size.
Don't generate debug info for executor as well.
For akaros this reduces binary size from 4.5MB to 800KB.
We currently use more complex and functional protocol on linux,
and a simple ad-hoc protocol on other OSes.
This leads to code duplication in both ipc and executor.
Linux supports coverage, shared memory communication and fork server,
which would also be useful for most other OSes.
Unify communication protocol and parametrize it by
(1) use of shmem or only pipes, (2) use of fork server.
This reduces duplication in ipc and executor and will
allow to support the useful features for other OSes easily.
Finally, this fixes akaros support as it currently uses
syz-stress running on host (linux) and executor running on akaros.
We currently build fuzzer+stress+execprog per target,
since packages are not installed we build everything 3 times.
This takes time. Install packages before building binaries.
Build fails now and I don't know how to fix it.
"x86_64-linux-gnu-gcc" -o ./bin/linux_386/syz-executor executor/executor_linux.cc \
-pthread -Wall -Wframe-larger-than=8192 -Wparentheses -Werror -O1 -g \
"-m32" -static -DGIT_REVISION=\"8cb7d3dcfcbe11a6d5682743816409d1c8e8f6a0+\"
In file included from /usr/include/bits/errno.h:24:0,
from /usr/include/errno.h:35,
from executor/executor_linux.cc:7:
/usr/include/linux/errno.h:1:23: fatal error: asm/errno.h: No such file or directory
#include <asm/errno.h>
Currently we set GOOS/GOARCH only in host/target targets.
This makes "make fuzzer TARGETARCH=arm64" do a wrong thing,
it still builds for the default value of GOARCH.
Set GOOS/GOARCH for each target individually.
We currently build binaries for all targets into bin.
This makes mess in bin/ and does not allow testing of different archs.
Build target binaries into bin/OS_ARCH/ subdirs.
Host binaries are still built into bin/.
Update #333
Update #324
Update #191
- fix and reorder .PHONY targets
- `make all` now builds everything, to build only essentials run `make main`
- `make all-tools` rename to `make tools`
* Port console to Darwin
* Get syz-executor to build correctly
* Do not export unix and syscall constants
* Add presubmit test
* Add myself to contributors
We used to have all generated files checked in.
Later we removed them (now users are supposed to
run make to generate them). This causes several
problems:
- go get does not work as it tries to build everything
straight away (go get -d works, but users are confused)
- users don't run make and complain that build is broken
- users don't re-run make after updates and complain that
build is broken
- hard to integrate into other build system (even if they
support building Go, they don't support running sysgen
out-of-the-box)
Fixes#216
Stack usage warning currently breaks our internal build (with 16K frame limit).
Executor uses stacks of limited size, that's another reason to not
allow frames of arbitrary size.
Limit stack frame size to 8K.
Reduce tun packet size. We don't need to read out whole packet.
kcovtrace is like strace but show kernel coverage collected with KCOV.
It is very simplistic at this point and does not support multithreaded processes, etc.
It can be used to understand, for example, exact location where kernel bails out
with an error for a particular syscall.
Factor out repro logic from syz-repro tool,
so that it can be used in syz-manager.
Also, support sandboxes in code generated by
csoure. This is required to reproduce crashes
that require e.g. namespace sandbox.
Default make action invokes 'go generate'. That's not necessary.
File produced by 'go generate' are checked in. Do it in presubmit instead.
Default make action reformats source files. This is bad for users who
do not actually work on source code, but just use syzkaller:
1. requires clang-format to be installed
2. can change some source files (if they were checked in unformatted)
Don't reformat in 'make', instead do it in presubmit.
Also don't invoke 'go install ./...' as it can install too much
(e.g. all tools). Install just minimally necessary packages.
This splits generation process into two phases:
1. Extract values of constants from linux kernel sources.
2. Generate Go code.
Constant values are checked in.
The advantage is that the second phase is now completely independent
from linux source files, kernel version, presence of headers for
particular drivers, etc. This allows to change what Go code we generate
any time without access to all kernel headers (which in future won't be
limited to only upstream headers).
Constant extraction process does require proper kernel sources,
but this can be done only once by the person who added the driver
and has access to the required sources. Then the constant values
are checked in for others to use.
Consant extraction process is per-file/per-arch. That is,
if I am adding a driver that is not present upstream and that
works only on a single arch, I will check in constants only for
that driver and for that arch.
When regenerating system call tables, cope with a local kernel tree where
the kernel has been built into a separate directory (with `make O=...`) rather
than inline.
So:
- LINUX makefile var / -linux command line option give location of source tree
- LINUXBLD makefile var / -linuxbld command line option gives location of
built kernel
