diff options
| author | Dmitry Vyukov <dvyukov@google.com> | 2017-09-14 10:32:29 +0200 |
|---|---|---|
| committer | Dmitry Vyukov <dvyukov@google.com> | 2017-09-15 16:02:37 +0200 |
| commit | 91def5c506951f8a55f31979ce54657de460f528 (patch) | |
| tree | 949774a5ae9e74524bb5a4e0b8a15bb7aa74332a | |
| parent | c0cabacda7db153dcdb0940972a680296a9e56f3 (diff) | |
prog: remove special knowledge about "mmap" syscall
Abstract "mmap" away as it can be called differently on another OS.
| -rw-r--r-- | prog/hints.go | 13 | ||||
| -rw-r--r-- | prog/mutation.go | 4 | ||||
| -rw-r--r-- | prog/prio.go | 3 | ||||
| -rw-r--r-- | prog/rand.go | 2 | ||||
| -rw-r--r-- | prog/target.go | 14 | ||||
| -rw-r--r-- | sys/linux/init.go | 1 | ||||
| -rw-r--r-- | syz-manager/manager.go | 2 | ||||
| -rw-r--r-- | syz-manager/mgrconfig/mgrconfig.go | 3 |
8 files changed, 23 insertions, 19 deletions
diff --git a/prog/hints.go b/prog/hints.go index e268d46a6..b295b2151 100644 --- a/prog/hints.go +++ b/prog/hints.go @@ -36,16 +36,7 @@ const ( maxDataLength = 100 ) -var ( - specialIntsSet uint64Set - - // A set of calls for which hints should not be generated. - hintNamesBlackList = map[string]bool{ - "mmap": true, - "open": true, - "close": true, - } -) +var specialIntsSet uint64Set func (m CompMap) AddComp(arg1, arg2 uint64) { if _, ok := m[arg1]; !ok { @@ -58,7 +49,7 @@ func (m CompMap) AddComp(arg1, arg2 uint64) { // For each of the mutants executes the exec callback. func (p *Prog) MutateWithHints(compMaps []CompMap, exec func(newP *Prog)) { for i, c := range p.Calls { - if _, ok := hintNamesBlackList[c.Meta.CallName]; ok { + if c.Meta == defaultTarget.MmapSyscall { continue } foreachArg(c, func(arg, _ Arg, _ *[]Arg) { diff --git a/prog/mutation.go b/prog/mutation.go index e793e28e4..d92c96361 100644 --- a/prog/mutation.go +++ b/prog/mutation.go @@ -55,7 +55,7 @@ func (p *Prog) Mutate(rs rand.Source, ncalls int, ct *ChoiceTable, corpus []*Pro continue } // Mutating mmap() arguments almost certainly doesn't give us new coverage. - if c.Meta.Name == "mmap" && r.nOutOf(99, 100) { + if c.Meta == defaultTarget.MmapSyscall && r.nOutOf(99, 100) { retry = true continue } @@ -289,7 +289,7 @@ func Minimize(p0 *Prog, callIndex0 int, pred0 func(*Prog, int) bool, crash bool) // Remove all mmaps. for i := 0; i < len(p.Calls); i++ { c := p.Calls[i] - if i != callIndex && c.Meta.Name == "mmap" { + if i != callIndex && c.Meta == defaultTarget.MmapSyscall { p.removeCall(i) if i < callIndex { callIndex-- diff --git a/prog/prio.go b/prog/prio.go index c64ae319b..e4a9b334f 100644 --- a/prog/prio.go +++ b/prog/prio.go @@ -141,7 +141,8 @@ func calcDynamicPrio(corpus []*Prog) [][]float32 { id0 := c0.Meta.ID id1 := c1.Meta.ID // There are too many mmap's anyway. - if id0 == id1 || c0.Meta.Name == "mmap" || c1.Meta.Name == "mmap" { + if id0 == id1 || c0.Meta == defaultTarget.MmapSyscall || + c1.Meta == defaultTarget.MmapSyscall { continue } prios[id0][id1] += 1.0 diff --git a/prog/rand.go b/prog/rand.go index 5526427f5..8439015e7 100644 --- a/prog/rand.go +++ b/prog/rand.go @@ -438,7 +438,7 @@ func (r *randGen) generateCall(s *state, p *Prog) []*Call { c := p.Calls[r.Intn(len(p.Calls))].Meta call = c.ID // There is roughly half of mmap's so ignore them. - if c.Name != "mmap" { + if c != defaultTarget.MmapSyscall { break } } diff --git a/prog/target.go b/prog/target.go index 4faded023..b8e76919d 100644 --- a/prog/target.go +++ b/prog/target.go @@ -18,6 +18,10 @@ type Target struct { Syscalls []*Syscall Resources []*ResourceDesc + // Syscall used by MakeMmap. + // It has some special meaning because there are usually too many of them. + MmapSyscall *Syscall + // MakeMmap creates call that maps [start, start+npages) page range. MakeMmap func(start, npages uint64) *Call @@ -59,6 +63,10 @@ func RegisterTarget(target *Target) { targets[key] = target } +func GetTarget(OS, arch string) *Target { + return targets[OS+"/"+arch] +} + // SetDefaultTarget sets default target for prog package. // Majority of the code is not prepared for multiple targets, // so we use default target as a temporary measure. @@ -72,10 +80,12 @@ func SetDefaultTarget(OS, arch string) error { } return fmt.Errorf("unknown target: %v (supported: %v)", key, supported) } - if len(Syscalls) != 0 { + if defaultTarget != nil { return fmt.Errorf("default target is already set") } + defaultTarget = target + Syscalls = target.Syscalls SyscallMap = target.syscallMap Resources = target.resourceMap @@ -124,6 +134,8 @@ var ( pageSize uint64 dataOffset uint64 + defaultTarget *Target + Syscalls []*Syscall SyscallMap map[string]*Syscall Resources map[string]*ResourceDesc diff --git a/sys/linux/init.go b/sys/linux/init.go index 8d96ac27a..cbf93e963 100644 --- a/sys/linux/init.go +++ b/sys/linux/init.go @@ -20,6 +20,7 @@ func initArch(syscalls []*prog.Syscall, resources []*prog.ResourceDesc, DataOffset: dataOffset, Syscalls: syscalls, Resources: resources, + MmapSyscall: arch.mmapSyscall, MakeMmap: arch.makeMmap, AnalyzeMmap: arch.analyzeMmap, SanitizeCall: arch.sanitizeCall, diff --git a/syz-manager/manager.go b/syz-manager/manager.go index 3d8933e81..a7216b709 100644 --- a/syz-manager/manager.go +++ b/syz-manager/manager.go @@ -121,6 +121,8 @@ func main() { if err != nil { Fatalf("%v", err) } + // mmap is used to allocate memory. + syscalls[prog.GetTarget(cfg.TargetOS, cfg.TargetArch).MmapSyscall.ID] = true initAllCover(cfg.Vmlinux) RunManager(cfg, syscalls) } diff --git a/syz-manager/mgrconfig/mgrconfig.go b/syz-manager/mgrconfig/mgrconfig.go index 75df7e4dd..1f9819154 100644 --- a/syz-manager/mgrconfig/mgrconfig.go +++ b/syz-manager/mgrconfig/mgrconfig.go @@ -206,9 +206,6 @@ func ParseEnabledSyscalls(cfg *Config) (map[int]bool, error) { return nil, fmt.Errorf("unknown disabled syscall: %v", c) } } - // mmap is used to allocate memory. - syscalls[prog.SyscallMap["mmap"].ID] = true - return syscalls, nil } |
