aboutsummaryrefslogtreecommitdiffstats
path: root/pkg/fuzzer
diff options
context:
space:
mode:
authorDmitry Vyukov <dvyukov@google.com>2024-05-17 17:20:45 +0200
committerDmitry Vyukov <dvyukov@google.com>2024-05-21 09:46:36 +0000
commit1d3c25e7679384c386e7710ea11e364ce9f9e028 (patch)
treec154a9578f63037babef096e85fe9a34183ee640 /pkg/fuzzer
parenta38fb99b3fbff0c988e64bf4bf277071e18b18af (diff)
pkg/ipc: remove ProgInfo
Switch to flatrpc.ProgInfo. Note: this disables syz-runtest and syz-verifier.
Diffstat (limited to 'pkg/fuzzer')
-rw-r--r--pkg/fuzzer/fuzzer.go17
-rw-r--r--pkg/fuzzer/fuzzer_test.go12
-rw-r--r--pkg/fuzzer/job.go38
-rw-r--r--pkg/fuzzer/job_test.go14
-rw-r--r--pkg/fuzzer/queue/queue.go6
5 files changed, 47 insertions, 40 deletions
diff --git a/pkg/fuzzer/fuzzer.go b/pkg/fuzzer/fuzzer.go
index 92b4c8bf1..f079e1dc7 100644
--- a/pkg/fuzzer/fuzzer.go
+++ b/pkg/fuzzer/fuzzer.go
@@ -124,12 +124,12 @@ func (fuzzer *Fuzzer) processResult(req *queue.Request, res *queue.Result, flags
// If we are already triaging this exact prog, this is flaky coverage.
if req.ExecOpts.ExecFlags&flatrpc.ExecFlagCollectSignal > 0 && res.Info != nil && !inTriage {
for call, info := range res.Info.Calls {
- fuzzer.triageProgCall(req.Prog, &info, call, flags)
+ fuzzer.triageProgCall(req.Prog, info, call, flags)
}
- fuzzer.triageProgCall(req.Prog, &res.Info.Extra, -1, flags)
+ fuzzer.triageProgCall(req.Prog, res.Info.Extra, -1, flags)
}
if res.Info != nil {
- fuzzer.statExecTime.Add(int(res.Info.Elapsed.Milliseconds()))
+ fuzzer.statExecTime.Add(int(res.Info.Elapsed / 1e6))
}
}
@@ -148,7 +148,10 @@ type Config struct {
NewInputFilter func(call string) bool
}
-func (fuzzer *Fuzzer) triageProgCall(p *prog.Prog, info *ipc.CallInfo, call int, flags ProgTypes) {
+func (fuzzer *Fuzzer) triageProgCall(p *prog.Prog, info *flatrpc.CallInfo, call int, flags ProgTypes) {
+ if info == nil {
+ return
+ }
prio := signalPrio(p, info, call)
newMaxSignal := fuzzer.Cover.addRawMaxSignal(info.Signal, prio)
if newMaxSignal.Empty() {
@@ -166,18 +169,18 @@ func (fuzzer *Fuzzer) triageProgCall(p *prog.Prog, info *ipc.CallInfo, call int,
fuzzer.startJob(fuzzer.statJobsTriage, &triageJob{
p: p.Clone(),
call: call,
- info: *info,
+ info: info,
newSignal: newMaxSignal,
flags: flags,
queue: queue.Append(),
})
}
-func signalPrio(p *prog.Prog, info *ipc.CallInfo, call int) (prio uint8) {
+func signalPrio(p *prog.Prog, info *flatrpc.CallInfo, call int) (prio uint8) {
if call == -1 {
return 0
}
- if info.Errno == 0 {
+ if info.Error == 0 {
prio |= 1 << 1
}
if !p.Target.CallContainsAny(p.Calls[call]) {
diff --git a/pkg/fuzzer/fuzzer_test.go b/pkg/fuzzer/fuzzer_test.go
index cb58a4e10..07e09e25a 100644
--- a/pkg/fuzzer/fuzzer_test.go
+++ b/pkg/fuzzer/fuzzer_test.go
@@ -186,16 +186,16 @@ var crc32q = crc32.MakeTable(0xD5828281)
func emulateExec(req *queue.Request) (*queue.Result, string, error) {
serializedLines := bytes.Split(req.Prog.Serialize(), []byte("\n"))
- var info ipc.ProgInfo
+ var info flatrpc.ProgInfo
for i, call := range req.Prog.Calls {
- cover := uint32(call.Meta.ID*1024) +
- crc32.Checksum(serializedLines[i], crc32q)%4
- callInfo := ipc.CallInfo{}
+ cover := []uint32{uint32(call.Meta.ID*1024) +
+ crc32.Checksum(serializedLines[i], crc32q)%4}
+ callInfo := &flatrpc.CallInfo{}
if req.ExecOpts.ExecFlags&flatrpc.ExecFlagCollectCover > 0 {
- callInfo.Cover = []uint32{cover}
+ callInfo.Cover = cover
}
if req.ExecOpts.ExecFlags&flatrpc.ExecFlagCollectSignal > 0 {
- callInfo.Signal = []uint32{cover}
+ callInfo.Signal = cover
}
info.Calls = append(info.Calls, callInfo)
}
diff --git a/pkg/fuzzer/job.go b/pkg/fuzzer/job.go
index 4e605f1c2..a5a22b2e8 100644
--- a/pkg/fuzzer/job.go
+++ b/pkg/fuzzer/job.go
@@ -11,7 +11,6 @@ import (
"github.com/google/syzkaller/pkg/cover"
"github.com/google/syzkaller/pkg/flatrpc"
"github.com/google/syzkaller/pkg/fuzzer/queue"
- "github.com/google/syzkaller/pkg/ipc"
"github.com/google/syzkaller/pkg/signal"
"github.com/google/syzkaller/pkg/stats"
"github.com/google/syzkaller/prog"
@@ -83,7 +82,7 @@ func candidateRequest(fuzzer *Fuzzer, input Candidate) (*queue.Request, ProgType
type triageJob struct {
p *prog.Prog
call int
- info ipc.CallInfo
+ info *flatrpc.CallInfo
newSignal signal.Signal
flags ProgTypes
fuzzer *Fuzzer
@@ -172,7 +171,7 @@ func (job *triageJob) deflake(exec func(*queue.Request, ProgTypes) *queue.Result
stop = true
return
}
- if !reexecutionSuccess(result.Info, &job.info, job.call) {
+ if !reexecutionSuccess(result.Info, job.info, job.call) {
// The call was not executed or failed.
continue
}
@@ -213,7 +212,7 @@ func (job *triageJob) minimize(newSignal signal.Signal) (stop bool) {
return false
}
info := result.Info
- if !reexecutionSuccess(info, &job.info, call1) {
+ if !reexecutionSuccess(info, job.info, call1) {
// The call was not executed or failed.
continue
}
@@ -227,25 +226,28 @@ func (job *triageJob) minimize(newSignal signal.Signal) (stop bool) {
return stop
}
-func reexecutionSuccess(info *ipc.ProgInfo, oldInfo *ipc.CallInfo, call int) bool {
+func reexecutionSuccess(info *flatrpc.ProgInfo, oldInfo *flatrpc.CallInfo, call int) bool {
if info == nil || len(info.Calls) == 0 {
return false
}
if call != -1 {
// Don't minimize calls from successful to unsuccessful.
// Successful calls are much more valuable.
- if oldInfo.Errno == 0 && info.Calls[call].Errno != 0 {
+ if oldInfo.Error == 0 && info.Calls[call].Error != 0 {
return false
}
return len(info.Calls[call].Signal) != 0
}
- return len(info.Extra.Signal) != 0
+ return info.Extra != nil && len(info.Extra.Signal) != 0
}
-func getSignalAndCover(p *prog.Prog, info *ipc.ProgInfo, call int) (signal.Signal, []uint32) {
- inf := &info.Extra
+func getSignalAndCover(p *prog.Prog, info *flatrpc.ProgInfo, call int) (signal.Signal, []uint32) {
+ inf := info.Extra
if call != -1 {
- inf = &info.Calls[call]
+ inf = info.Calls[call]
+ }
+ if inf == nil {
+ return nil, nil
}
return signal.FromRaw(inf.Signal, signalPrio(p, inf, call)), inf.Cover
}
@@ -332,7 +334,7 @@ func (job *smashJob) faultInjection(fuzzer *Fuzzer) {
}
info := result.Info
if info != nil && len(info.Calls) > job.call &&
- info.Calls[job.call].Flags&ipc.CallFaultInjected == 0 {
+ info.Calls[job.call].Flags&flatrpc.CallFlagFaultInjected == 0 {
break
}
}
@@ -358,13 +360,17 @@ func (job *hintsJob) run(fuzzer *Fuzzer) {
if result.Stop() || result.Info == nil {
return
}
+ got := make(prog.CompMap)
+ for _, cmp := range result.Info.Calls[job.call].Comps {
+ got.AddComp(cmp.Op1, cmp.Op2)
+ }
+ if len(got) == 0 {
+ return
+ }
if i == 0 {
- comps = result.Info.Calls[job.call].Comps
- if len(comps) == 0 {
- return
- }
+ comps = got
} else {
- comps.InplaceIntersect(result.Info.Calls[job.call].Comps)
+ comps.InplaceIntersect(got)
}
}
diff --git a/pkg/fuzzer/job_test.go b/pkg/fuzzer/job_test.go
index b7718134b..70d083be5 100644
--- a/pkg/fuzzer/job_test.go
+++ b/pkg/fuzzer/job_test.go
@@ -6,8 +6,8 @@ package fuzzer
import (
"testing"
+ "github.com/google/syzkaller/pkg/flatrpc"
"github.com/google/syzkaller/pkg/fuzzer/queue"
- "github.com/google/syzkaller/pkg/ipc"
"github.com/google/syzkaller/pkg/signal"
"github.com/google/syzkaller/prog"
"github.com/google/syzkaller/sys/targets"
@@ -24,7 +24,7 @@ func TestDeflakeFail(t *testing.T) {
testJob := &triageJob{
p: prog,
- info: ipc.CallInfo{},
+ info: &flatrpc.CallInfo{},
newSignal: signal.FromRaw([]uint32{0, 1, 2, 3, 4}, 0),
}
@@ -50,7 +50,7 @@ func TestDeflakeSuccess(t *testing.T) {
testJob := &triageJob{
p: prog,
- info: ipc.CallInfo{},
+ info: &flatrpc.CallInfo{},
newSignal: signal.FromRaw([]uint32{0, 1, 2}, 0),
}
run := 0
@@ -80,12 +80,12 @@ func TestDeflakeSuccess(t *testing.T) {
assert.ElementsMatch(t, []uint32{0, 2}, ret.newStableSignal.ToRaw())
}
-func fakeResult(errno int, signal, cover []uint32) *queue.Result {
+func fakeResult(errno int32, signal, cover []uint32) *queue.Result {
return &queue.Result{
- Info: &ipc.ProgInfo{
- Calls: []ipc.CallInfo{
+ Info: &flatrpc.ProgInfo{
+ Calls: []*flatrpc.CallInfo{
{
- Errno: errno,
+ Error: errno,
Signal: signal,
Cover: cover,
},
diff --git a/pkg/fuzzer/queue/queue.go b/pkg/fuzzer/queue/queue.go
index 36226299a..0e578c6f9 100644
--- a/pkg/fuzzer/queue/queue.go
+++ b/pkg/fuzzer/queue/queue.go
@@ -135,7 +135,7 @@ func (r *Request) initChannel() {
}
type Result struct {
- Info *ipc.ProgInfo
+ Info *flatrpc.ProgInfo
Output []byte
Status Status
Err error // More details in case of ExecFailure.
@@ -143,9 +143,7 @@ type Result struct {
func (r *Result) clone() *Result {
ret := *r
- if ret.Info != nil {
- ret.Info = ret.Info.Clone()
- }
+ ret.Info = ret.Info.Clone()
return &ret
}