This page describes how to execute existing syzkaller programs for the purpose of bug reproduction. This way you can replay a single program or a whole execution log with several programs.
$HOME/goroot
.export GOROOT=$HOME/goroot export GOPATH=$HOME/gopath
git clone https://github.com/google/syzkaller
Note that your syzkaller revision must be the same as the one that generated the program you're trying to execute.
cd syzkaller
make
linux_amd64
as necessary):scp -P 10022 -i bullseye.img.key bin/linux_amd64/syz-execprog bin/linux_amd64/syz-executor program root@localhost:
./syz-execprog -repeat=0 -procs=8 program
Several useful syz-execprog
flags:
-procs int number of parallel processes to execute programs (default 1) -repeat int repeat execution that many times (0 for infinite loop) (default 1) -sandbox string sandbox for fuzzing (none/setuid/namespace) (default "setuid") -threaded use threaded mode in executor (default true)
If you pass -threaded=0
, programs will be executed as a simple single-threaded sequence of syscalls. -threaded=1
forces execution of each syscall in a separate thread, so that execution can proceed over blocking syscalls.
Older syzkaller versions also had the following flag:
-collide collide syscalls to provoke data races (default true)
-collide=1
forced second round of execution of syscalls when pairs of syscalls are executed concurrently. You might need to use this flag if you're running an old reproducer.
If you are replaying a reproducer program that contains a header along the following lines:
# {Threaded:true Repeat:true RepeatTimes:0 Procs:8 Slowdown:1 Sandbox:none Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true UseTmpDir:true HandleSegv:true Repro:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}
then you need to adjust syz-execprog
flags based on the values in the header. Namely, Threaded
/Procs
/Sandbox
directly relate to -threaded
/-procs
/-sandbox
flags. If Repeat
is set to true
, add -repeat=0
flag to syz-execprog
.