Hi, I have a question about the shared memory between syz-fuzzer and syz-executor. about syzkaller HOT 3 CLOSED

Hi,

For the next time: our mailing list [email protected] would be a better place for such questions that a github issue.

But I can't figure out why the 'kInFd' and 'kOutFd' should be 3, 4 in syz-executor.

That's how https://pkg.go.dev/os/exec works, see

	// ExtraFiles specifies additional open files to be inherited by the
	// new process. It does not include standard input, standard output, or
	// standard error. If non-nil, entry i becomes file descriptor 3+i.
	//
	// ExtraFiles is not supported on Windows.
	ExtraFiles []*[os](https://pkg.go.dev/os).[File](https://pkg.go.dev/os#File)

And I also print out the value of 'fd' created in syz-fuzzer but it isn't 3 and 4.

Which fd exactly? At what point do you print it?

from syzkaller.

Hi,

But I can't figure out why the 'kInFd' and 'kOutFd' should be 3, 4 in syz-executor.

That's how https://pkg.go.dev/os/exec works, see

	// ExtraFiles specifies additional open files to be inherited by the
	// new process. It does not include standard input, standard output, or
	// standard error. If non-nil, entry i becomes file descriptor 3+i.
	//
	// ExtraFiles is not supported on Windows.
	ExtraFiles []*[os](https://pkg.go.dev/os).[File](https://pkg.go.dev/os#File)

Hi,
Thanks! The child process inherits the shared memory via cmd.ExtraFiles which file descriptors begin with 3.

syzkaller/pkg/ipc/ipc.go

Lines 610 to 612 in 3ad490e

	if inFile != nil && outFile != nil {
	cmd.ExtraFiles = []*os.File{inFile, outFile}
	}

And I also print out the value of 'fd' created in syz-fuzzer but it isn't 3 and 4.

Which fd exactly? At what point do you print it?

I print it at the inf, inmem, err = osutil.CreateMemMappedFile(prog.ExecBufferSize).

For the next time: our mailing list [email protected] would be a better place for such questions that a github issue.

Yeah, I also think asking such questions here is a little unsuitable.

Anyway, thank you for your help!

from syzkaller.

I print it at the inf, inmem, err = osutil.CreateMemMappedFile(prog.ExecBufferSize).

These would be fd numbers for the syz-fuzzer process. When syz-fuzzer shares them with syz-executor, the same files would have fds 3 and 4 when accessed from the syz-executor process.

from syzkaller.