Build failures while modifying/adding descriptions

255 views
Skip to first unread message

Abhishek Sen

unread,
Mar 18, 2024, 5:18:53 AM3/18/24
to syzkaller
Hello, I am new to Syzkaller. I was trying to tinker a bit with the descriptions for capabilities (capset, capget)  in sys.txt, so after extracting the headers and generating the sys.txt.const file, it seems syz-sysgen is running into a build error when I execute make generate due to missing definitions for a few syscalls for arm64. 

~/syzkaller$ ./bin/syz-extract -build -os=linux -arch=arm64 sourcedir=/home/0xabs3n/linux sys.txt

generating linux/arm64...


~/syzkaller$ make generate
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
make descriptions
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' ./sys/syz-sysgen | grep -q false || go install ./sys/syz-sysgen
make .descriptions
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
compilation of linux/386 target failed:
sys/linux/sys.txt:305:40: PTRACE_ARCH_PRCTL is defined for none of the arches
sys/linux/sys.txt:1347:38: PTRACE_GETFPREGS is defined for none of the arches
sys/linux/sys.txt:1347:22: PTRACE_GETREGS is defined for none of the arches
sys/linux/sys.txt:1348:38: PTRACE_SETFPREGS is defined for none of the arches
sys/linux/sys.txt:1348:22: PTRACE_SETREGS is defined for none of the arches
sys/linux/sys.txt:519:1: __NR_alarm is defined for none of the arches
sys/linux/sys.txt:338:1: __NR_chmod is defined for none of the arches
sys/linux/sys.txt:341:1: __NR_chown is defined for none of the arches
sys/linux/sys.txt:108:1: __NR_creat is defined for none of the arches
sys/linux/sys.txt:127:1: __NR_dup2 is defined for none of the arches
sys/linux/sys.txt:169:1: __NR_epoll_create is defined for none of the arches
sys/linux/sys.txt:174:1: __NR_epoll_wait is defined for none of the arches
sys/linux/sys.txt:187:1: __NR_eventfd is defined for none of the arches
sys/linux/sys.txt:158:1: __NR_fstat64 is defined for none of the arches
sys/linux/sys.txt:159:1: __NR_fstatat64 is defined for none of the arches
sys/linux/sys.txt:350:1: __NR_futimesat is defined for none of the arches
sys/linux/sys.txt:533:1: __NR_get_thread_area is defined for none of the arches
sys/linux/sys.txt:431:1: __NR_getdents is defined for none of the arches
sys/linux/sys.txt:388:1: __NR_getpgrp is defined for none of the arches
sys/linux/sys.txt:464:1: __NR_ioperm is defined for none of the arches
sys/linux/sys.txt:463:1: __NR_iopl is defined for none of the arches
sys/linux/sys.txt:342:1: __NR_lchown is defined for none of the arches
sys/linux/sys.txt:408:1: __NR_link is defined for none of the arches
sys/linux/sys.txt:153:1: __NR_lstat is defined for none of the arches
sys/linux/sys.txt:157:1: __NR_lstat64 is defined for none of the arches
sys/linux/sys.txt:419:1: __NR_mkdir is defined for none of the arches
sys/linux/sys.txt:334:1: __NR_mknod is defined for none of the arches
sys/linux/sys.txt:537:1: __NR_modify_ldt is defined for none of the arches
sys/linux/sys.txt:103:1: __NR_open is defined for none of the arches
sys/linux/sys.txt:518:1: __NR_pause is defined for none of the arches
sys/linux/sys.txt:130:1: __NR_pipe is defined for none of the arches
sys/linux/sys.txt:163:1: __NR_poll is defined for none of the arches
sys/linux/sys.txt:414:1: __NR_readlink is defined for none of the arches
sys/linux/sys.txt:416:1: __NR_rename is defined for none of the arches
sys/linux/sys.txt:579:1: __NR_riscv_flush_icache is defined for none of the arches
sys/linux/sys.txt:421:1: __NR_rmdir is defined for none of the arches
sys/linux/sys.txt:165:1: __NR_select is defined for none of the arches
sys/linux/sys.txt:137:1: __NR_sendfile64 is defined for none of the arches
sys/linux/sys.txt:532:1: __NR_set_thread_area is defined for none of the arches
sys/linux/sys.txt:179:1: __NR_signalfd is defined for none of the arches
sys/linux/sys.txt:152:1: __NR_stat is defined for none of the arches
sys/linux/sys.txt:156:1: __NR_stat64 is defined for none of the arches
sys/linux/sys.txt:411:1: __NR_symlink is defined for none of the arches
sys/linux/sys.txt:443:1: __NR_sysfs is defined for none of the arches
sys/linux/sys.txt:501:1: __NR_time is defined for none of the arches
sys/linux/sys.txt:412:1: __NR_unlink is defined for none of the arches
sys/linux/sys.txt:447:1: __NR_uselib is defined for none of the arches
sys/linux/sys.txt:455:1: __NR_ustat is defined for none of the arches
sys/linux/sys.txt:348:1: __NR_utime is defined for none of the arches
sys/linux/sys.txt:349:1: __NR_utimes is defined for none of the arches
make[2]: *** [Makefile:157: .descriptions] Error 1
make[1]: *** [Makefile:154: descriptions] Error 2
make: *** [Makefile:245: generate] Error 2

When I check the local generated .const file, I see ??? next to the above syscalls, such as this: 

__NR_unlink = ???
__NR_unlinkat = arm64:35
__NR_uselib = ???
__NR_ustat = ???
__NR_utime = ???
__NR_utimes = ???

Comparing the local .const to the upstream version, I see a similarity for arm64, like this-

__NR_ustat = 62, amd64:136, arm64:riscv64:???, mips64le:5133
__NR_uselib = 86, amd64:134, arm64:mips64le:riscv64:???

For some, I don't even see an entry for arm64 where as on my local, there exists one, like this: 

Upstream
__NR_unlinkat = 35, 386:301, amd64:263, arm:328, mips64le:5253, ppc64le:292, s390x:294

Local:
__NR_unlinkat = arm64:35

Would really appreciate some insights into what could be the reason for the build error on my system, and how to resolve this.

Some additional info:
- Target kernel: 6.8 (mainline latest) 
- Host kernel :Ubuntu/5.4.0-173-generic
- Host machine where syzkaller is running: Multipass VM running on Mac M2 Pro, Arm64
- Target kernel builds successfully for AARCH64, I am also able to build syzkaller (as is) and start fuzzing over qemu. 


TIA! Abhishek..





Dmitry Vyukov

unread,
Mar 18, 2024, 6:10:18 AM3/18/24
to Abhishek Sen, syzkaller
Hi Abhishek,

You need to extract consts for all arches, or better you "make extract", see:
https://github.com/google/syzkaller/blob/master/docs/syscall_descriptions.md#describing-new-system-calls

Dmitry Vyukov

unread,
Mar 19, 2024, 8:15:58 AM3/19/24
to Abhishek Sen, syzkaller
+syzkaller mailing list (please keep in CC)

On Mon, 18 Mar 2024 at 13:17, Abhishek Sen <ab.se...@gmail.com> wrote:
>
> Thanks a lot Dmitry! I will do as you say and circle back if I still face some issues.
>
> So it seems like I need to install the cross compilers for all the archs, and it is also no longer possible to selectively generate .const file for a specific arch and build syzkaller. Is my understanding correct?

You can generate for 1 file for all arches.
Or you can restrict list of arches per file:
https://github.com/google/syzkaller/blob/master/sys/linux/dev_tlk_device.txt#L10

Or if you are working on a one-off experiment that you don't plan to
upstream, you can just comment out the check that fails.

Abhishek Sen

unread,
Mar 25, 2024, 8:04:38 AM3/25/24
to Dmitry Vyukov, syzkaller
Hi Dmitry,
Thanks again for the pointers. So it seems like I have managed to get past the extraction errors by installing the missing cross-compilers (the MAKEFILE probably needs some adjustment because make install_prerequisites could not install gcc-mips64el-linux-gnuabi64 on Ubuntu, as the actual package name is gcc-X-mips64el-linux-gnuabi64, X=9/10/11.. a version number). 

However, now I am running into some sysgen errors. FYI, target is now latest mainline 6.9-rc.1

Error logs:
0xabs3n@linuxfuzzing:~/syz-test/syzkaller$ make extract SOURCEDIR=/home/0xabs3n/linux

Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
GOOS=linux GOARCH=arm64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=0ea90952bdac100bde3149fa2a7818ba7af943b4+ -X 'github.com/google/syzkaller/prog.gitRevisionDate=20240322-161956'" -o bin/syz-extract ./sys/syz-extract
bin/syz-extract -build -os=linux -sourcedir=/home/0xabs3n/linux
make mrproper ARCH=i386
make mrproper ARCH=arm64
generating linux/386...
generating linux/amd64...
generating linux/arm...
generating linux/arm64...
generating linux/mips64le...
generating linux/ppc64le...
generating linux/riscv64...
generating linux/s390x...
dev_kvm.txt: KVM_DEV_IRQ_GUEST_INTX is unsupported on all arches (typo?)
dev_kvm.txt: KVM_DEV_IRQ_GUEST_MSI is unsupported on all arches (typo?)
landlock.txt: LANDLOCK_ACCESS_FS_IOCTL is unsupported on all arches (typo?)
dev_kvm.txt: KVM_DEV_IRQ_HOST_MSI is unsupported on all arches (typo?)
l2cap.txt: L2CAP_MOVE_CHAN_CFM is unsupported on all arches (typo?)
dev_kvm.txt: KVM_DEV_ASSIGN_MASK_INTX is unsupported on all arches (typo?)
dev_kvm.txt: KVM_DEV_IRQ_HOST_MSIX is unsupported on all arches (typo?)
l2cap.txt: L2CAP_MOVE_CHAN_REQ is unsupported on all arches (typo?)
l2cap.txt: L2CAP_MOVE_CHAN_CFM_RSP is unsupported on all arches (typo?)
dev_kvm.txt: KVM_DEV_ASSIGN_ENABLE_IOMMU is unsupported on all arches (typo?)
dev_kvm.txt: KVM_DEV_IRQ_HOST_INTX is unsupported on all arches (typo?)
l2cap.txt: L2CAP_CREATE_CHAN_REQ is unsupported on all arches (typo?)
l2cap.txt: L2CAP_MOVE_CHAN_RSP is unsupported on all arches (typo?)
dev_kvm.txt: KVM_DEV_ASSIGN_PCI_2_3 is unsupported on all arches (typo?)
dev_kvm.txt: KVM_DEV_IRQ_GUEST_MSIX is unsupported on all arches (typo?)
l2cap.txt: L2CAP_CREATE_CHAN_RSP is unsupported on all arches (typo?)

So I randomly did a quick check with the macros LANDLOCK_ACCESS_FS_IOCTL, it seems like this is not defined in linux/landlock.h but is defined in syzkaller's landlock.txt description. Similarly, KVM_DEV_IRQ_HOST_INTX is defined until 6.8 but no longer present in 6.9. 

What do you suggest under such circumstances? Should I remove these macros locally from the syzkaller descriptions and continue with my intended research, or is it also encouraged to push the modifications upstream? 

Best,
Abhishek

Abhishek Sen

unread,
Mar 25, 2024, 9:15:57 AM3/25/24
to Dmitry Vyukov, syzkaller
After removing the offending descriptions in my previous mail, this is now what I run into (at make generate). Seems like an endless trap of errors.. :( 

0xabs3n@linuxfuzzing:~/syz-test/syzkaller$ make extract SOURCEDIR=/home/0xabs3n/linux
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
GOOS=linux GOARCH=arm64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=0ea90952bdac100bde3149fa2a7818ba7af943b4+ -X 'github.com/google/syzkaller/prog.gitRevisionDate=20240322-161956'" -o bin/syz-extract ./sys/syz-extract
bin/syz-extract -build -os=linux -sourcedir=/home/0xabs3n/linux
generating linux/386...
generating linux/amd64...
generating linux/arm...
generating linux/arm64...
generating linux/mips64le...
generating linux/ppc64le...
generating linux/riscv64...
generating linux/s390x...

0xabs3n@linuxfuzzing:~/syz-test/syzkaller$ make generate

Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
make descriptions
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' ./sys/syz-sysgen | grep -q false || go install ./sys/syz-sysgen
make .descriptions
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
touch .descriptions
make generate_go

Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
clang-format --style=file -i executor/*.cc executor/*.h \
        executor/android/android_seccomp.h \
        tools/kcovtrace/*.c tools/kcovfuzzer/*.c tools/fops_probe/*.cc
go generate ./pkg/csource ./executor ./pkg/ifuzz ./pkg/build
go generate ./vm/proxyapp
panic: runtime error: invalid memory address or nil pointer dereference [recovered]
        panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x0 pc=0x36e2c4]

goroutine 5 [running]:
go/types.(*Checker).handleBailout(0x40004aa600, 0x40006edbe8)
        /home/0xabs3n/go/src/go/types/check.go:367 +0x9c
panic({0x47a5e0?, 0x8d2520?})
        /home/0xabs3n/go/src/runtime/panic.go:770 +0x124
go/types.(*StdSizes).Sizeof(0x0, {0x5d9f40, 0x8d74e0})
        /home/0xabs3n/go/src/go/types/sizes.go:228 +0x314
go/types.(*Config).sizeof(...)
        /home/0xabs3n/go/src/go/types/sizes.go:333
go/types.representableConst.func1({0x5d9f40?, 0x8d74e0?})
        /home/0xabs3n/go/src/go/types/const.go:76 +0x9c
go/types.representableConst({0x5dc820, 0x8af1a8}, 0x40004aa600, 0x8d74e0, 0x40006e9098)
        /home/0xabs3n/go/src/go/types/const.go:92 +0x138
go/types.(*Checker).representation(0x40004aa600, 0x40007f6d40, 0x8d74e0)
        /home/0xabs3n/go/src/go/types/const.go:256 +0x68
go/types.(*Checker).implicitTypeAndValue(0x40004aa600, 0x40007f6d40, {0x5d9f40, 0x8d74e0})
        /home/0xabs3n/go/src/go/types/expr.go:375 +0x304
go/types.(*Checker).convertUntyped(0x40004aa600, 0x40007f6d40, {0x5d9f40, 0x8d74e0})
        /home/0xabs3n/go/src/go/types/const.go:289 +0x30
go/types.(*Checker).isValidIndex(0x40004aa600, 0x40007f6d40, 0x34, {0x4ed28e, 0x5}, 0x0)
        /home/0xabs3n/go/src/go/types/index.go:384 +0x6c
go/types.(*Checker).index(0x40004aa600, {0x5dc030, 0x400007a620}, 0xffffffffffffffff)
        /home/0xabs3n/go/src/go/types/index.go:355 +0x9c
go/types.(*Checker).builtin(0x40004aa600, 0x40007f6c80, 0x4000234a80, 0x9)
        /home/0xabs3n/go/src/go/types/builtins.go:517 +0x4e4c
go/types.(*Checker).callExpr(0x40004aa600, 0x40007f6c80, 0x4000234a80)
        /home/0xabs3n/go/src/go/types/call.go:236 +0xc6c
go/types.(*Checker).exprInternal(0x40004aa600, 0x0, 0x40007f6c80, {0x5dc0f0, 0x4000234a80}, {0x0, 0x0})
        /home/0xabs3n/go/src/go/types/expr.go:1374 +0xd0
go/types.(*Checker).rawExpr(0x40004aa600, 0x0, 0x40007f6c80, {0x5dc0f0?, 0x4000234a80?}, {0x0?, 0x0?}, 0x0)
        /home/0xabs3n/go/src/go/types/expr.go:979 +0x12c
go/types.(*Checker).expr(0x40004aa600, 0x40007f6c80?, 0x40007f6c80, {0x5dc0f0?, 0x4000234a80?})
        /home/0xabs3n/go/src/go/types/expr.go:1513 +0x38
go/types.(*Checker).exprInternal(0x40004aa600, 0x0, 0x40007f6c80, {0x5dba60, 0x4000234b40}, {0x0, 0x0})
        /home/0xabs3n/go/src/go/types/expr.go:1162 +0x1c44
go/types.(*Checker).rawExpr(0x40004aa600, 0x0, 0x40007f6c80, {0x5dba60?, 0x4000234b40?}, {0x0?, 0x0?}, 0x0)
        /home/0xabs3n/go/src/go/types/expr.go:979 +0x12c
go/types.(*Checker).expr(0x40004aa600, 0x8d77c0?, 0x40007f6c80, {0x5dba60?, 0x4000234b40?})
        /home/0xabs3n/go/src/go/types/expr.go:1513 +0x38
go/types.(*Checker).unary(0x40004aa600, 0x40007f6c80, 0x400007a720)
        /home/0xabs3n/go/src/go/types/expr.go:127 +0x44
go/types.(*Checker).exprInternal(0x40004aa600, 0x0, 0x40007f6c80, {0x5dbb50, 0x400007a720}, {0x0, 0x0})
        /home/0xabs3n/go/src/go/types/expr.go:1406 +0x1328
go/types.(*Checker).rawExpr(0x40004aa600, 0x0, 0x40007f6c80, {0x5dbb50?, 0x400007a720?}, {0x0?, 0x0?}, 0x0)
        /home/0xabs3n/go/src/go/types/expr.go:979 +0x12c
go/types.(*Checker).expr(0x40004aa600, 0x0?, 0x40007f6c80, {0x5dbb50?, 0x400007a720?})
        /home/0xabs3n/go/src/go/types/expr.go:1513 +0x38
go/types.(*Checker).initVars(0x40004aa600, {0x40008527c8, 0x1, 0x0?}, {0x40004e3670, 0x1210428?, 0x1?}, {0x0, 0x0?})
        /home/0xabs3n/go/src/go/types/assignments.go:381 +0x570
go/types.(*Checker).shortVarDecl(0x40004aa600, {0x5d90a0, 0x40000ec810}, {0x40004e3630, 0x1, 0x1?}, {0x40004e3670, 0x1, 0x1})
        /home/0xabs3n/go/src/go/types/assignments.go:556 +0x6f4
go/types.(*Checker).stmt(0x40004aa600, 0x0, {0x5dbd30, 0x4000234b80})
        /home/0xabs3n/go/src/go/types/stmt.go:473 +0x10d4
go/types.(*Checker).stmtList(0x40004aa600, 0x0, {0x40004e6b80?, 0x0?, 0x0?})
        /home/0xabs3n/go/src/go/types/stmt.go:121 +0x88
go/types.(*Checker).funcBody(0x40004aa600, 0x5d9db0?, {0x4000555dec?, 0x40000e6070?}, 0x400057bd00, 0x4000f81b60, {0x0?, 0x0?})
        /home/0xabs3n/go/src/go/types/stmt.go:41 +0x21c
go/types.(*Checker).funcDecl.func1()
        /home/0xabs3n/go/src/go/types/decl.go:852 +0x44
go/types.(*Checker).processDelayed(0x40004aa600, 0x0)
        /home/0xabs3n/go/src/go/types/check.go:467 +0x12c
go/types.(*Checker).checkFiles(0x40004aa600, {0x40004e34a0, 0x2, 0x2})
        /home/0xabs3n/go/src/go/types/check.go:411 +0x188
go/types.(*Checker).Files(...)
        /home/0xabs3n/go/src/go/types/check.go:372
golang.org/x/tools/go/packages.(*loader).loadPackage(0x40000d82a0, 0x4000295cb0)
        /home/0xabs3n/syz-test/pkg/mod/golang.org/x/to...@v0.5.0/go/packages/packages.go:1044 +0x784
golang.org/x/tools/go/packages.(*loader).loadRecursive.func1()
        /home/0xabs3n/syz-test/pkg/mod/golang.org/x/to...@v0.5.0/go/packages/packages.go:851 +0x178
sync.(*Once).doSlow(0x18620?, 0x40000c4d80?)
        /home/0xabs3n/go/src/sync/once.go:74 +0x100
sync.(*Once).Do(...)
        /home/0xabs3n/go/src/sync/once.go:65
golang.org/x/tools/go/packages.(*loader).loadRecursive(0x0?, 0x817c4?)
        /home/0xabs3n/syz-test/pkg/mod/golang.org/x/to...@v0.5.0/go/packages/packages.go:839 +0x50
golang.org/x/tools/go/packages.(*loader).refine.func2(0x0?)
        /home/0xabs3n/syz-test/pkg/mod/golang.org/x/to...@v0.5.0/go/packages/packages.go:774 +0x30
created by golang.org/x/tools/go/packages.(*loader).refine in goroutine 1
        /home/0xabs3n/syz-test/pkg/mod/golang.org/x/to...@v0.5.0/go/packages/packages.go:773 +0xaa4
exit status 2
vm/proxyapp/proxyappclient_mocks_test.go:6: running "../../tools/mockery.sh": exit status 1
make[1]: *** [Makefile:251: generate_go] Error 1
make: *** [Makefile:246: generate] Error 2

Best,
Abhishek

Dmitry Vyukov

unread,
Mar 25, 2024, 9:26:34 AM3/25/24
to Abhishek Sen, syzkaller
make install_prerequisites is likely to be very outdated.
The syz-env is now the official way to build syzkaller:
https://github.com/google/syzkaller/blob/master/tools/syz-env
It's not possible to make this work reliably on a random Linux distribution.

Abhishek Sen

unread,
Mar 25, 2024, 9:57:49 AM3/25/24
to Dmitry Vyukov, syzkaller
I see. I tried with syz-env yesterday, but since I am arch restricted by my Macbook (Apple silicon), I guess I have to set up Rosetta for amd64. Do you think you have an arm64 image, or are there any existing pointers to make syz-env work on an arm64 host?

Best,
Abhishek

Dmitry Vyukov

unread,
Mar 26, 2024, 9:38:11 AM3/26/24
to Abhishek Sen, syzkaller
IIRC we only have syzbot image built for arm64:
https://github.com/google/syzkaller/blob/master/tools/docker/syzbot/Dockerfile
I am not sure if it's enough to run 'make extract'.

许强

unread,
Nov 12, 2024, 11:44:12 PM11/12/24
to syzkaller
do you get the solution?
I get the failures tool. How to do it ?

Reply all
Reply to author
Forward
0 new messages