// Copyright 2015 syzkaller project authors. All rights reserved.
|
// Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file.
|
|
package main
|
|
import (
|
"flag"
|
"net/http"
|
_ "net/http/pprof"
|
"os"
|
"runtime"
|
"runtime/debug"
|
"sync"
|
"sync/atomic"
|
"time"
|
|
"github.com/google/syzkaller/pkg/hash"
|
"github.com/google/syzkaller/pkg/host"
|
"github.com/google/syzkaller/pkg/ipc"
|
"github.com/google/syzkaller/pkg/ipc/ipcconfig"
|
"github.com/google/syzkaller/pkg/log"
|
"github.com/google/syzkaller/pkg/osutil"
|
"github.com/google/syzkaller/pkg/rpctype"
|
"github.com/google/syzkaller/pkg/signal"
|
"github.com/google/syzkaller/prog"
|
_ "github.com/google/syzkaller/sys"
|
)
|
|
type Fuzzer struct {
|
name string
|
outputType OutputType
|
config *ipc.Config
|
execOpts *ipc.ExecOpts
|
procs []*Proc
|
gate *ipc.Gate
|
workQueue *WorkQueue
|
needPoll chan struct{}
|
choiceTable *prog.ChoiceTable
|
stats [StatCount]uint64
|
manager *rpctype.RPCClient
|
target *prog.Target
|
|
faultInjectionEnabled bool
|
comparisonTracingEnabled bool
|
|
corpusMu sync.RWMutex
|
corpus []*prog.Prog
|
corpusHashes map[hash.Sig]struct{}
|
|
signalMu sync.RWMutex
|
corpusSignal signal.Signal // signal of inputs in corpus
|
maxSignal signal.Signal // max signal ever observed including flakes
|
newSignal signal.Signal // diff of maxSignal since last sync with master
|
|
logMu sync.Mutex
|
}
|
|
type Stat int
|
|
const (
|
StatGenerate Stat = iota
|
StatFuzz
|
StatCandidate
|
StatTriage
|
StatMinimize
|
StatSmash
|
StatHint
|
StatSeed
|
StatCount
|
)
|
|
var statNames = [StatCount]string{
|
StatGenerate: "exec gen",
|
StatFuzz: "exec fuzz",
|
StatCandidate: "exec candidate",
|
StatTriage: "exec triage",
|
StatMinimize: "exec minimize",
|
StatSmash: "exec smash",
|
StatHint: "exec hints",
|
StatSeed: "exec seeds",
|
}
|
|
type OutputType int
|
|
const (
|
OutputNone OutputType = iota
|
OutputStdout
|
OutputDmesg
|
OutputFile
|
)
|
|
func main() {
|
debug.SetGCPercent(50)
|
|
var (
|
flagName = flag.String("name", "test", "unique name for manager")
|
flagOS = flag.String("os", runtime.GOOS, "target OS")
|
flagArch = flag.String("arch", runtime.GOARCH, "target arch")
|
flagManager = flag.String("manager", "", "manager rpc address")
|
flagProcs = flag.Int("procs", 1, "number of parallel test processes")
|
flagOutput = flag.String("output", "stdout", "write programs to none/stdout/dmesg/file")
|
flagPprof = flag.String("pprof", "", "address to serve pprof profiles")
|
flagTest = flag.Bool("test", false, "enable image testing mode") // used by syz-ci
|
flagRunTest = flag.Bool("runtest", false, "enable program testing mode") // used by pkg/runtest
|
)
|
flag.Parse()
|
outputType := parseOutputType(*flagOutput)
|
log.Logf(0, "fuzzer started")
|
|
target, err := prog.GetTarget(*flagOS, *flagArch)
|
if err != nil {
|
log.Fatalf("%v", err)
|
}
|
|
config, execOpts, err := ipcconfig.Default(target)
|
if err != nil {
|
log.Fatalf("failed to create default ipc config: %v", err)
|
}
|
sandbox := "none"
|
if config.Flags&ipc.FlagSandboxSetuid != 0 {
|
sandbox = "setuid"
|
} else if config.Flags&ipc.FlagSandboxNamespace != 0 {
|
sandbox = "namespace"
|
}
|
|
shutdown := make(chan struct{})
|
osutil.HandleInterrupts(shutdown)
|
go func() {
|
// Handles graceful preemption on GCE.
|
<-shutdown
|
log.Logf(0, "SYZ-FUZZER: PREEMPTED")
|
os.Exit(1)
|
}()
|
|
checkArgs := &checkArgs{
|
target: target,
|
sandbox: sandbox,
|
ipcConfig: config,
|
ipcExecOpts: execOpts,
|
}
|
if *flagTest {
|
testImage(*flagManager, checkArgs)
|
return
|
}
|
|
if *flagPprof != "" {
|
go func() {
|
err := http.ListenAndServe(*flagPprof, nil)
|
log.Fatalf("failed to serve pprof profiles: %v", err)
|
}()
|
} else {
|
runtime.MemProfileRate = 0
|
}
|
|
log.Logf(0, "dialing manager at %v", *flagManager)
|
manager, err := rpctype.NewRPCClient(*flagManager)
|
if err != nil {
|
log.Fatalf("failed to connect to manager: %v ", err)
|
}
|
a := &rpctype.ConnectArgs{Name: *flagName}
|
r := &rpctype.ConnectRes{}
|
if err := manager.Call("Manager.Connect", a, r); err != nil {
|
log.Fatalf("failed to connect to manager: %v ", err)
|
}
|
if r.CheckResult == nil {
|
checkArgs.gitRevision = r.GitRevision
|
checkArgs.targetRevision = r.TargetRevision
|
checkArgs.enabledCalls = r.EnabledCalls
|
checkArgs.allSandboxes = r.AllSandboxes
|
r.CheckResult, err = checkMachine(checkArgs)
|
if err != nil {
|
r.CheckResult = &rpctype.CheckArgs{
|
Error: err.Error(),
|
}
|
}
|
r.CheckResult.Name = *flagName
|
if err := manager.Call("Manager.Check", r.CheckResult, nil); err != nil {
|
log.Fatalf("Manager.Check call failed: %v", err)
|
}
|
if r.CheckResult.Error != "" {
|
log.Fatalf("%v", r.CheckResult.Error)
|
}
|
}
|
log.Logf(0, "syscalls: %v", len(r.CheckResult.EnabledCalls))
|
for _, feat := range r.CheckResult.Features {
|
log.Logf(0, "%v: %v", feat.Name, feat.Reason)
|
}
|
periodicCallback, err := host.Setup(target, r.CheckResult.Features)
|
if err != nil {
|
log.Fatalf("BUG: %v", err)
|
}
|
if r.CheckResult.Features[host.FeatureNetworkInjection].Enabled {
|
config.Flags |= ipc.FlagEnableTun
|
}
|
if r.CheckResult.Features[host.FeatureNetworkDevices].Enabled {
|
config.Flags |= ipc.FlagEnableNetDev
|
}
|
if r.CheckResult.Features[host.FeatureFaultInjection].Enabled {
|
config.Flags |= ipc.FlagEnableFault
|
}
|
|
if *flagRunTest {
|
runTest(target, manager, *flagName, config.Executor)
|
return
|
}
|
|
needPoll := make(chan struct{}, 1)
|
needPoll <- struct{}{}
|
fuzzer := &Fuzzer{
|
name: *flagName,
|
outputType: outputType,
|
config: config,
|
execOpts: execOpts,
|
gate: ipc.NewGate(2**flagProcs, periodicCallback),
|
workQueue: newWorkQueue(*flagProcs, needPoll),
|
needPoll: needPoll,
|
manager: manager,
|
target: target,
|
faultInjectionEnabled: r.CheckResult.Features[host.FeatureFaultInjection].Enabled,
|
comparisonTracingEnabled: r.CheckResult.Features[host.FeatureComparisons].Enabled,
|
corpusHashes: make(map[hash.Sig]struct{}),
|
}
|
for i := 0; fuzzer.poll(i == 0, nil); i++ {
|
}
|
calls := make(map[*prog.Syscall]bool)
|
for _, id := range r.CheckResult.EnabledCalls[sandbox] {
|
calls[target.Syscalls[id]] = true
|
}
|
prios := target.CalculatePriorities(fuzzer.corpus)
|
fuzzer.choiceTable = target.BuildChoiceTable(prios, calls)
|
|
for pid := 0; pid < *flagProcs; pid++ {
|
proc, err := newProc(fuzzer, pid)
|
if err != nil {
|
log.Fatalf("failed to create proc: %v", err)
|
}
|
fuzzer.procs = append(fuzzer.procs, proc)
|
go proc.loop()
|
}
|
|
fuzzer.pollLoop()
|
}
|
|
func (fuzzer *Fuzzer) pollLoop() {
|
var execTotal uint64
|
var lastPoll time.Time
|
var lastPrint time.Time
|
ticker := time.NewTicker(3 * time.Second).C
|
for {
|
poll := false
|
select {
|
case <-ticker:
|
case <-fuzzer.needPoll:
|
poll = true
|
}
|
if fuzzer.outputType != OutputStdout && time.Since(lastPrint) > 10*time.Second {
|
// Keep-alive for manager.
|
log.Logf(0, "alive, executed %v", execTotal)
|
lastPrint = time.Now()
|
}
|
if poll || time.Since(lastPoll) > 10*time.Second {
|
needCandidates := fuzzer.workQueue.wantCandidates()
|
if poll && !needCandidates {
|
continue
|
}
|
stats := make(map[string]uint64)
|
for _, proc := range fuzzer.procs {
|
stats["exec total"] += atomic.SwapUint64(&proc.env.StatExecs, 0)
|
stats["executor restarts"] += atomic.SwapUint64(&proc.env.StatRestarts, 0)
|
}
|
for stat := Stat(0); stat < StatCount; stat++ {
|
v := atomic.SwapUint64(&fuzzer.stats[stat], 0)
|
stats[statNames[stat]] = v
|
execTotal += v
|
}
|
if !fuzzer.poll(needCandidates, stats) {
|
lastPoll = time.Now()
|
}
|
}
|
}
|
}
|
|
func (fuzzer *Fuzzer) poll(needCandidates bool, stats map[string]uint64) bool {
|
a := &rpctype.PollArgs{
|
Name: fuzzer.name,
|
NeedCandidates: needCandidates,
|
MaxSignal: fuzzer.grabNewSignal().Serialize(),
|
Stats: stats,
|
}
|
r := &rpctype.PollRes{}
|
if err := fuzzer.manager.Call("Manager.Poll", a, r); err != nil {
|
log.Fatalf("Manager.Poll call failed: %v", err)
|
}
|
maxSignal := r.MaxSignal.Deserialize()
|
log.Logf(1, "poll: candidates=%v inputs=%v signal=%v",
|
len(r.Candidates), len(r.NewInputs), maxSignal.Len())
|
fuzzer.addMaxSignal(maxSignal)
|
for _, inp := range r.NewInputs {
|
fuzzer.addInputFromAnotherFuzzer(inp)
|
}
|
for _, candidate := range r.Candidates {
|
p, err := fuzzer.target.Deserialize(candidate.Prog)
|
if err != nil {
|
log.Fatalf("failed to parse program from manager: %v", err)
|
}
|
flags := ProgCandidate
|
if candidate.Minimized {
|
flags |= ProgMinimized
|
}
|
if candidate.Smashed {
|
flags |= ProgSmashed
|
}
|
fuzzer.workQueue.enqueue(&WorkCandidate{
|
p: p,
|
flags: flags,
|
})
|
}
|
return len(r.NewInputs) != 0 || len(r.Candidates) != 0 || maxSignal.Len() != 0
|
}
|
|
func (fuzzer *Fuzzer) sendInputToManager(inp rpctype.RPCInput) {
|
a := &rpctype.NewInputArgs{
|
Name: fuzzer.name,
|
RPCInput: inp,
|
}
|
if err := fuzzer.manager.Call("Manager.NewInput", a, nil); err != nil {
|
log.Fatalf("Manager.NewInput call failed: %v", err)
|
}
|
}
|
|
func (fuzzer *Fuzzer) addInputFromAnotherFuzzer(inp rpctype.RPCInput) {
|
p, err := fuzzer.target.Deserialize(inp.Prog)
|
if err != nil {
|
log.Fatalf("failed to deserialize prog from another fuzzer: %v", err)
|
}
|
sig := hash.Hash(inp.Prog)
|
sign := inp.Signal.Deserialize()
|
fuzzer.addInputToCorpus(p, sign, sig)
|
}
|
|
func (fuzzer *Fuzzer) addInputToCorpus(p *prog.Prog, sign signal.Signal, sig hash.Sig) {
|
fuzzer.corpusMu.Lock()
|
if _, ok := fuzzer.corpusHashes[sig]; !ok {
|
fuzzer.corpus = append(fuzzer.corpus, p)
|
fuzzer.corpusHashes[sig] = struct{}{}
|
}
|
fuzzer.corpusMu.Unlock()
|
|
if !sign.Empty() {
|
fuzzer.signalMu.Lock()
|
fuzzer.corpusSignal.Merge(sign)
|
fuzzer.maxSignal.Merge(sign)
|
fuzzer.signalMu.Unlock()
|
}
|
}
|
|
func (fuzzer *Fuzzer) corpusSnapshot() []*prog.Prog {
|
fuzzer.corpusMu.RLock()
|
defer fuzzer.corpusMu.RUnlock()
|
return fuzzer.corpus
|
}
|
|
func (fuzzer *Fuzzer) addMaxSignal(sign signal.Signal) {
|
if sign.Len() == 0 {
|
return
|
}
|
fuzzer.signalMu.Lock()
|
defer fuzzer.signalMu.Unlock()
|
fuzzer.maxSignal.Merge(sign)
|
}
|
|
func (fuzzer *Fuzzer) grabNewSignal() signal.Signal {
|
fuzzer.signalMu.Lock()
|
defer fuzzer.signalMu.Unlock()
|
sign := fuzzer.newSignal
|
if sign.Empty() {
|
return nil
|
}
|
fuzzer.newSignal = nil
|
return sign
|
}
|
|
func (fuzzer *Fuzzer) corpusSignalDiff(sign signal.Signal) signal.Signal {
|
fuzzer.signalMu.RLock()
|
defer fuzzer.signalMu.RUnlock()
|
return fuzzer.corpusSignal.Diff(sign)
|
}
|
|
func (fuzzer *Fuzzer) checkNewSignal(p *prog.Prog, info []ipc.CallInfo) (calls []int) {
|
fuzzer.signalMu.RLock()
|
defer fuzzer.signalMu.RUnlock()
|
for i, inf := range info {
|
diff := fuzzer.maxSignal.DiffRaw(inf.Signal, signalPrio(p.Target, p.Calls[i], &inf))
|
if diff.Empty() {
|
continue
|
}
|
calls = append(calls, i)
|
fuzzer.signalMu.RUnlock()
|
fuzzer.signalMu.Lock()
|
fuzzer.maxSignal.Merge(diff)
|
fuzzer.newSignal.Merge(diff)
|
fuzzer.signalMu.Unlock()
|
fuzzer.signalMu.RLock()
|
}
|
return
|
}
|
|
func signalPrio(target *prog.Target, c *prog.Call, ci *ipc.CallInfo) (prio uint8) {
|
if ci.Errno == 0 {
|
prio |= 1 << 1
|
}
|
if !target.CallContainsAny(c) {
|
prio |= 1 << 0
|
}
|
return
|
}
|
|
func parseOutputType(str string) OutputType {
|
switch str {
|
case "none":
|
return OutputNone
|
case "stdout":
|
return OutputStdout
|
case "dmesg":
|
return OutputDmesg
|
case "file":
|
return OutputFile
|
default:
|
log.Fatalf("-output flag must be one of none/stdout/dmesg/file")
|
return OutputNone
|
}
|
}
|
