pkg/runtest: fix a null deref in checkCallResult

Pseudo-syscalls from noCovSyscalls may not generate any coverage, which
leads to a crash in the following line:

  if len(inf.Signal) < 2 && !calls[callName] && len(info.Extra.Signal)

Make sure that this check is only done for calls not belonging to
noCovSyscalls.

1 files changed, 9 insertions, 15 deletions

diff --git a/pkg/runtest/run.go b/pkg/runtest/run.go
index 36159b9a7..99c5f4698 100644
--- a/pkg/runtest/run.go
+++ b/pkg/runtest/run.go
@@ -20,6 +20,7 @@ import (
 	"path/filepath"
 	"regexp"
 	"runtime"
+	"slices"
 	"sort"
 	"strconv"
 	"strings"
@@ -553,27 +554,20 @@ func checkCallResult(req *runRequest, isC bool, run, call int, info *flatrpc.Pro
 		return nil
 	}
 	if req.ExecOpts.EnvFlags&flatrpc.ExecEnvSignal != 0 {
+		callName := req.Prog.Calls[call].Meta.CallName
+		// Pseudo-syscalls that might not provide any coverage when invoked.
+		noCovSyscalls := []string{"syz_btf_id_by_name", "syz_kvm_assert_syzos_uexit"}
+		isNoCov := slices.Contains(noCovSyscalls, callName)
 		// Signal is always deduplicated, so we may not get any signal
 		// on a second invocation of the same syscall.
 		// For calls that are not meant to collect synchronous coverage we
 		// allow the signal to be empty as long as the extra signal is not.
-		callName := req.Prog.Calls[call].Meta.CallName
-		if len(inf.Signal) < 2 && !calls[callName] && len(info.Extra.Signal) == 0 {
+		if !isNoCov && len(inf.Signal) < 2 && !calls[callName] &&
+			len(info.Extra.Signal) == 0 {
 			return fmt.Errorf("run %v: call %v: no signal", run, call)
 		}
-		// Pseudo-syscalls that might not provide any coverage when invoked.
-		noCovSyscalls := []string{"syz_btf_id_by_name", "syz_kvm_assert_syzos_uexit"}
-		if len(inf.Cover) == 0 {
-			found := true
-			for _, s := range noCovSyscalls {
-				if callName == s {
-					found = true
-					break
-				}
-			}
-			if !found {
-				return fmt.Errorf("run %v: call %v: no cover", run, call)
-			}
+		if !isNoCov && len(inf.Cover) == 0 {
+			return fmt.Errorf("run %v: call %v: no cover", run, call)
 		}
 		calls[callName] = true
 	} else {