all: add fault injection capability

Systematically inject faults during smashing.
Requires kernel patch:
"fault-inject: support systematic fault injection"
(currently in linux-next).

1 files changed, 17 insertions, 5 deletions

diff --git a/tools/syz-execprog/execprog.go b/tools/syz-execprog/execprog.go
index 196c6bbb0..373bbf256 100644
--- a/tools/syz-execprog/execprog.go
+++ b/tools/syz-execprog/execprog.go
@@ -30,6 +30,8 @@ var (
 	flagRepeat    = flag.Int("repeat", 1, "repeat execution that many times (0 for infinite loop)")
 	flagProcs     = flag.Int("procs", 1, "number of parallel processes to execute programs")
 	flagOutput    = flag.String("output", "none", "write programs to none/stdout")
+	flagFaultCall = flag.Int("fault_call", -1, "inject fault into this call (0-based)")
+	flagFaultNth  = flag.Int("fault_nth", 0, "inject fault on n-th operation (0-based)")
 )
 
 func main() {
@@ -56,16 +58,26 @@ func main() {
 		return
 	}
 
+	execOpts := &ipc.ExecOpts{}
 	config, err := ipc.DefaultConfig()
 	if err != nil {
 		Fatalf("%v", err)
 	}
-	needCover := config.Flags&ipc.FlagSignal != 0
-	dedupCover := true
+	if config.Flags&ipc.FlagSignal != 0 {
+		execOpts.Flags |= ipc.FlagCollectCover
+	}
+	execOpts.Flags |= ipc.FlagDedupCover
 	if *flagCoverFile != "" {
 		config.Flags |= ipc.FlagSignal
-		needCover = true
-		dedupCover = false
+		execOpts.Flags |= ipc.FlagCollectCover
+		execOpts.Flags &^= ipc.FlagDedupCover
+	}
+
+	if *flagFaultCall >= 0 {
+		config.Flags |= ipc.FlagEnableFault
+		execOpts.Flags |= ipc.FlagInjectFault
+		execOpts.FaultCall = *flagFaultCall
+		execOpts.FaultNth = *flagFaultNth
 	}
 
 	handled := make(map[string]bool)
@@ -119,7 +131,7 @@ func main() {
 						Logf(0, "executing program %v:\n%s", pid, data)
 						logMu.Unlock()
 					}
-					output, info, failed, hanged, err := env.Exec(p, needCover, dedupCover)
+					output, info, failed, hanged, err := env.Exec(execOpts, p)
 					if atomic.LoadUint32(&shutdown) != 0 {
 						return false
 					}