Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

executor: better support for globs #5685

Merged
merged 2 commits into from
Jan 28, 2025
Merged

executor: better support for globs #5685

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
d737a2e
executor: mount /syz-inputs dir to fuzzing sandbox
keddad Jan 22, 2025
75deab3
executor: increase timeouts for glob requests
keddad Jan 27, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion executor/common.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -696,17 +696,21 @@ static void loop(void)
// then the main thread hangs when it wants to page in a page.
// Below we check if the test process still executes syscalls
// and kill it after ~1s of inactivity.
// (Globs are an exception: they can be slow, so we allow up to ~120s)
uint64 min_timeout_ms = program_timeout_ms * 3 / 5;
uint64 inactive_timeout_ms = syscall_timeout_ms * 20;
uint64 glob_timeout_ms = program_timeout_ms * 120;

uint64 now = current_time_ms();
uint32 now_executed = output_data->completed.load(std::memory_order_relaxed);
if (executed_calls != now_executed) {
executed_calls = now_executed;
last_executed = now;
}

// TODO: adjust timeout for progs with syz_usb_connect call.
// If the max program timeout is exceeded, kill unconditionally.
if (now - start > program_timeout_ms)
if ((now - start > program_timeout_ms && request_type != rpc::RequestType::Glob) || (now - start > glob_timeout_ms && request_type == rpc::RequestType::Glob))
goto kill_test;
// If the request type is not a normal test program (currently, glob expansion request),
// then wait for the full timeout (these requests don't update number of completed calls
Expand Down
10 changes: 10 additions & 0 deletions executor/common_linux.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3953,6 +3953,16 @@ static void sandbox_common_mount_tmpfs(void)
fail("mount(smackfs) failed");
if (mount("/proc/sys/fs/binfmt_misc", "./syz-tmp/newroot/proc/sys/fs/binfmt_misc", NULL, bind_mount_flags, NULL) && errno != ENOENT)
fail("mount(binfmt_misc) failed");

// If user wants to supply custom inputs, those can be placed to /syz-inputs
// That folder will be mounted to fuzzer sandbox
// https://groups.google.com/g/syzkaller/c/U-DISFjKLzg
if (mkdir("./syz-tmp/newroot/syz-inputs", 0700))
fail("mkdir(/syz-inputs) failed");

if (mount("/syz-inputs", "./syz-tmp/newroot/syz-inputs", NULL, bind_mount_flags | MS_RDONLY, NULL) && errno != ENOENT)
fail("mount(syz-inputs) failed");

#if SYZ_EXECUTOR || SYZ_CGROUPS
initialize_cgroups();
#endif
Expand Down
Loading