diff options
| author | Dmitry Vyukov <dvyukov@google.com> | 2020-05-07 15:34:43 +0200 |
|---|---|---|
| committer | Dmitry Vyukov <dvyukov@google.com> | 2020-05-07 15:41:50 +0200 |
| commit | 413b991c26fa3ffadb04c4fe199dc3d1e1560232 (patch) | |
| tree | cf5dc1ac273938de421640b61c2857c7ebaf99bb /prog/prio.go | |
| parent | fa822db46ab32eb2cd92075f877e6eb1653a4f60 (diff) | |
syz-fuzzer: add more checks for disabled syscalls
We are seeing some panics that say that some disabled
syscalls somehow get into corpus.
I don't see where/how this can happen.
Add a check to syz-fuzzer to panic whenever we execute
a program with disabled syscall. Hopefull the panic
stack will shed some light.
Also add a check in manager as the last defence line
so that bad programs don't get into the corpus.
Diffstat (limited to 'prog/prio.go')
| -rw-r--r-- | prog/prio.go | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/prog/prio.go b/prog/prio.go index ccdab7bda..3a3f31b63 100644 --- a/prog/prio.go +++ b/prog/prio.go @@ -254,7 +254,7 @@ func (target *Target) BuildChoiceTable(corpus []*Prog, enabled map[*Syscall]bool return &ChoiceTable{target, run, enabledCalls} } -func (ct *ChoiceTable) enabled(call int) bool { +func (ct *ChoiceTable) Enabled(call int) bool { return ct.runs[call] != nil } @@ -262,13 +262,13 @@ func (ct *ChoiceTable) choose(r *rand.Rand, bias int) int { if bias < 0 { bias = ct.calls[r.Intn(len(ct.calls))].ID } - if !ct.enabled(bias) { + if !ct.Enabled(bias) { panic("bias to disabled syscall") } run := ct.runs[bias] x := r.Intn(run[len(run)-1]) + 1 res := sort.SearchInts(run, x) - if !ct.enabled(res) { + if !ct.Enabled(res) { panic("selected disabled syscall") } return res |
