// Copyright 2015 syzkaller project authors. All rights reserved.
|
// Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file.
|
|
#include <fcntl.h>
|
#include <signal.h>
|
#include <stdio.h>
|
#include <stdlib.h>
|
#include <sys/ioctl.h>
|
#include <sys/mman.h>
|
#include <sys/prctl.h>
|
#include <sys/syscall.h>
|
#include <unistd.h>
|
|
#define KCOV_INIT_TRACE32 _IOR('c', 1, uint32)
|
#define KCOV_INIT_TRACE64 _IOR('c', 1, uint64)
|
#define KCOV_ENABLE _IO('c', 100)
|
#define KCOV_DISABLE _IO('c', 101)
|
|
const unsigned long KCOV_TRACE_PC = 0;
|
const unsigned long KCOV_TRACE_CMP = 1;
|
|
static bool detect_kernel_bitness();
|
|
static void os_init(int argc, char** argv, void* data, size_t data_size)
|
{
|
prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
|
is_kernel_64_bit = detect_kernel_bitness();
|
if (mmap(data, data_size, PROT_READ | PROT_WRITE, MAP_ANON | MAP_PRIVATE | MAP_FIXED, -1, 0) != data)
|
fail("mmap of data segment failed");
|
}
|
|
static __thread cover_t* current_cover;
|
|
static long execute_syscall(const call_t* c, long a[kMaxArgs])
|
{
|
if (c->call)
|
return c->call(a[0], a[1], a[2], a[3], a[4], a[5], a[6], a[7], a[8]);
|
return syscall(c->sys_nr, a[0], a[1], a[2], a[3], a[4], a[5]);
|
}
|
|
static void cover_open(cover_t* cov)
|
{
|
int fd = open("/sys/kernel/debug/kcov", O_RDWR);
|
if (fd == -1)
|
fail("open of /sys/kernel/debug/kcov failed");
|
if (dup2(fd, cov->fd) < 0)
|
fail("filed to dup2(%d, %d) cover fd", fd, cov->fd);
|
close(fd);
|
const int kcov_init_trace = is_kernel_64_bit ? KCOV_INIT_TRACE64 : KCOV_INIT_TRACE32;
|
if (ioctl(cov->fd, kcov_init_trace, kCoverSize))
|
fail("cover init trace write failed");
|
size_t mmap_alloc_size = kCoverSize * (is_kernel_64_bit ? 8 : 4);
|
cov->data = (char*)mmap(NULL, mmap_alloc_size,
|
PROT_READ | PROT_WRITE, MAP_SHARED, cov->fd, 0);
|
if (cov->data == MAP_FAILED)
|
fail("cover mmap failed");
|
cov->data_end = cov->data + mmap_alloc_size;
|
}
|
|
static void cover_enable(cover_t* cov, bool collect_comps)
|
{
|
int kcov_mode = collect_comps ? KCOV_TRACE_CMP : KCOV_TRACE_PC;
|
// This should be fatal,
|
// but in practice ioctl fails with assorted errors (9, 14, 25),
|
// so we use exitf.
|
if (ioctl(cov->fd, KCOV_ENABLE, kcov_mode))
|
exitf("cover enable write trace failed, mode=%d", kcov_mode);
|
current_cover = cov;
|
}
|
|
static void cover_reset(cover_t* cov)
|
{
|
if (cov == 0)
|
cov = current_cover;
|
*(uint64*)cov->data = 0;
|
}
|
|
static void cover_collect(cover_t* cov)
|
{
|
// Note: this assumes little-endian kernel.
|
cov->size = *(uint32*)cov->data;
|
}
|
|
static bool cover_check(uint32 pc)
|
{
|
return true;
|
}
|
|
static bool cover_check(uint64 pc)
|
{
|
#if defined(__i386__) || defined(__x86_64__)
|
// Text/modules range for x86_64.
|
return pc >= 0xffffffff80000000ull && pc < 0xffffffffff000000ull;
|
#else
|
return true;
|
#endif
|
}
|
|
static bool detect_kernel_bitness()
|
{
|
if (sizeof(void*) == 8)
|
return true;
|
// It turns out to be surprisingly hard to understand if the kernel underneath is 64-bits.
|
// A common method is to look at uname.machine. But it is produced in some involved ways,
|
// and we will need to know about all strings it returns and in the end it can be overriden
|
// during build and lie (and there are known precedents of this).
|
// So instead we look at size of addresses in /proc/kallsyms.
|
bool wide = true;
|
int fd = open("/proc/kallsyms", O_RDONLY);
|
if (fd != -1) {
|
char buf[16];
|
if (read(fd, buf, sizeof(buf)) == sizeof(buf) &&
|
(buf[8] == ' ' || buf[8] == '\t'))
|
wide = false;
|
close(fd);
|
}
|
debug("detected %d-bit kernel\n", wide ? 64 : 32);
|
return wide;
|
}
|
|
// One does not simply exit.
|
// _exit can in fact fail.
|
// syzkaller did manage to generate a seccomp filter that prohibits exit_group syscall.
|
// Previously, we get into infinite recursion via segv_handler in such case
|
// and corrupted output_data, which does matter in our case since it is shared
|
// with fuzzer process. Loop infinitely instead. Parent will kill us.
|
// But one does not simply loop either. Compilers are sure that _exit never returns,
|
// so they remove all code after _exit as dead. Call _exit via volatile indirection.
|
// And this does not work as well. _exit has own handling of failing exit_group
|
// in the form of HLT instruction, it will divert control flow from our loop.
|
// So call the syscall directly.
|
NORETURN void doexit(int status)
|
{
|
volatile unsigned i;
|
syscall(__NR_exit_group, status);
|
for (i = 0;; i++) {
|
}
|
}
|
