aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* syz-manager: add comment explaining why we don't set corrupted for reprosDmitry Vyukov2018-01-102-0/+29
|
* sys/linux: add AF_NETLINK/NETLINK_NETFILTER descriptionsDmitry Vyukov2018-01-0921-2008/+2455
|
* syz-fuzzer: improve kmemleak supportDmitry Vyukov2018-01-098-9/+111
| | | | | | | | Don't print object size (can change from kernel to kernel and from config to config). Fix function extraction regexp (must be non-eager). Account for MSECS_MIN_AGE. Ignore some known false positives.
* tools/syz-symbolize: allow to symbolize arbitrary kernel outputDmitry Vyukov2018-01-091-2/+1
|
* sys/linux: add AF_NETLINK/NETLINK_GENERIC descriptionsDmitry Vyukov2018-01-0912-1932/+2453
|
* sys/linux: duplicate open/accept specializations with openat/accept4Dmitry Vyukov2018-01-0922-7395/+7551
| | | | | | | | open is not present on arm64, only openat. accept is not present on 386, only accept4. Duplicate all open/accept specializations with corresponding openat/accept4 specializations to enable testing on 386/arm64.
* prog: add test for cross-arch deserializationDmitry Vyukov2018-01-091-0/+77
| | | | | | | | | | | | | | | | | | | | | | | Few managers recently crashed with: panic: syscall mknod$loop: per proc arg 'proc' has bad value '4294967295' panic: sync: unlock of unlocked mutex goroutine 35438 [running]: sync.(*Mutex).Unlock(0xc42166e0c8) sync/mutex.go:184 +0xc1 panic(0xb98980, 0xc448971aa0) runtime/panic.go:491 +0x283 main.(*Manager).Connect(0xc42166e000, 0xc42056d060, 0xc42038f000, 0x0, 0x0) syz-manager/manager.go:868 +0x11cc And a similar issue was reported on mailing list. It's unclear where these bogus programs come from. It seems that hub was somehow involved here. 4294967295 is (uint32)-1 which is trucated special value for proc types. The test did not uncover any bugs, bug since I wrote it and it looks like a useful test, let's commit it anyway.
* sys/linux: add AF_NETLINK/NETLINK_CRYPTO descriptionsDmitry Vyukov2018-01-0922-1989/+2505
|
* sys/linux: add ion and ashmem devices supportDmitry Vyukov2018-01-0931-5865/+6674
| | | | | Note: ion supercedes the old android interface, which is moved to sys/android.
* Update found_bugs.mdDmitry Vyukov2018-01-091-0/+7
|
* Update found_bugs.mdDmitry Vyukov2018-01-091-1/+2
|
* dashboard/app: fix reporting filter skippingDmitry Vyukov2018-01-083-2/+58
| | | | | We must not skip reporting if we already reported a bug to it. This leaves orphaned bugs.
* syz-fuzzer: separate programs in output by newlineDmitry Vyukov2018-01-081-2/+2
| | | | Greatly improves log readability at a cost of minimal size increase.
* pkg/report: ignore kernel/workqueue.c as guilty fileDmitry Vyukov2018-01-082-2/+2
|
* pkg/compiler: add builtin bool type aliasesDmitry Vyukov2018-01-086-12/+46
| | | | | | | | | | | | | | | | This adds builtin: type bool8 int8[0:1] type bool16 int16[0:1] type bool32 int32[0:1] type bool64 int64[0:1] type boolptr intptr[0:1] We used to use just int's for bools. But bool types provide several advantages: - make true/false probability equal - improve description expressiveness - reduce search space (we will take advantage of this later)
* sys/linux: add type aliases for complex xfrm typesDmitry Vyukov2018-01-082-44/+48
|
* sys/linux: resolve few TODOsDmitry Vyukov2018-01-089-81/+74
|
* sys/linux: add type alias for socket portDmitry Vyukov2018-01-0812-23/+24
| | | | | | type sock_port proc[20000, 4, int16be] That was repeated a few times.
* pkg/compiler: make signalno a type aliasDmitry Vyukov2018-01-0810-158/+67
| | | | | | | We don't need compiler support for such things anymore, now we simply can do: type signalno int32[0:65]
* sys: support type aliases (aka typedefs)Dmitry Vyukov2018-01-0813-116/+324
| | | | | | | | | | | | | | | | | | | | | | Complex types that are often repeated can be given short type aliases using the following syntax: ``` type identifier underlying_type ``` For example: ``` type signalno int32[0:65] type net_port proc[20000, 4, int16be] ``` Then, type alias can be used instead of the underlying type in any contexts. Underlying type needs to be described as if it's a struct field, that is, with the base type if it's required. However, type alias can be used as syscall arguments as well. Underlying types are currently restricted to integer types, `ptr`, `ptr64`, `const`, `flags` and `proc` types.
* pkg/report: add few more test cases where we failDmitry Vyukov2018-01-083-0/+297
|
* dashboard/app: receive and log email bouncesDmitry Vyukov2018-01-062-1/+15
|
* dashboard/app: limit error log line lengthDmitry Vyukov2018-01-061-0/+5
|
* pkg/report: add tests where we produce bad titleDmitry Vyukov2018-01-063-0/+245
|
* prog: support opt for proc typesDmitry Vyukov2018-01-0619-224/+269
|
* prog: add test for len mutationDmitry Vyukov2018-01-065-146/+163
| | | | Test we actually can get an unnatural len value.
* pkg/compiler: add bitsize typeDmitry Vyukov2018-01-0625-508/+538
| | | | This is need for few crypto/xfrm descriptions.
* pkg/ipc: always prepend handshake errors with executor pidDmitry Vyukov2018-01-061-6/+4
| | | | Helps to understand what program caused it.
* syz-manager/mgrconfig: add builtin suppression for crashing initDmitry Vyukov2018-01-061-0/+2
|
* pkg/csource: fix build of generated filesDmitry Vyukov2018-01-061-1/+1
| | | | | | | | | On another machine both clang and gcc produce: test.c:163:32: error: invalid suffix "+procid" on integer constant *(uint32_t*)0x20001004 = 0x25dfdbfe+procid*4; Not sure why this wasn't caught on buildbot.
* pkg/report: add few tests where we mis-detect title/guilty fileDmitry Vyukov2018-01-064-0/+439
|
* pkg/report: don't treat CONFIG_DEBUG_OBJECTS debug output as bugsDmitry Vyukov2018-01-062-0/+4
|
* prog: detect argument type mismatch during deserializationDmitry Vyukov2017-12-311-0/+5
|
* prog: mutate len argumentsDmitry Vyukov2017-12-314-14/+71
| | | | Fixes #183
* sys/linux: netlink xfrm supportDmitry Vyukov2017-12-3134-2467/+6599
|
* sys/linux: add multicast and ipv4 mapped ipv6 addressesDmitry Vyukov2017-12-298-1670/+2035
|
* sys/linux: describe ipv6 tlv optionsDmitry Vyukov2017-12-2912-53/+385
|
* sys/linux: improve bpf descriptionsDmitry Vyukov2017-12-2912-102/+1178
|
* sys/linux: improve perf descriptionsDmitry Vyukov2017-12-2912-4574/+4848
|
* sys/linux: assorted improvementsDmitry Vyukov2017-12-2943-7262/+8683
| | | | Mostly extensions of API in 4.15.
* sys/linux: fix some copy-paste errorsDmitry Vyukov2017-12-2826-6566/+6614
|
* dashboard/app: don't warn about emails with no command for closed bugsDmitry Vyukov2017-12-281-2/+6
| | | | Somebody discusses something, we don't care anymore.
* dashboard/app: ignore our own tags in emailsDmitry Vyukov2017-12-282-4/+16
| | | | | | When somebody sends us our own email back without quoting, we used to extract "#syz fix: exact-commit-title" from it. Ignore such emails.
* dashboard/app: make reporting filtering more flexibleDmitry Vyukov2017-12-282-32/+23
| | | | | | | Reporting statuses are not flexible as they can't encode all possible conditions. ReportingPassThrough is a good example. Replace Status with Filter which accepts bug and can contain arbitrary logic.
* pkg/email: don't add <> to email when name is emptyDmitry Vyukov2017-12-284-7/+29
| | | | Just unnecessary clutter.
* sys/linux: fix splice signatureDmitry Vyukov2017-12-2711-445/+463
| | | | ...was wrong all that time
* pkg/csource: tidy up generated code a bitDmitry Vyukov2017-12-272-16/+26
| | | | | | | Remove dup newlines around includes. Makes int values shorter if not hurting readability. Increase line len to 80. Remove {} when not needed during copyout.
* tools/syz-symbolize: assume that kernel is in the current dirDmitry Vyukov2017-12-271-2/+2
|
* syz-ci: don't mark build errors as corruptedDmitry Vyukov2017-12-271-1/+1
| | | | Otherwise they get merged with other corrupted reports.
* dashboard/app: handle no bug ID in emails betterDmitry Vyukov2017-12-271-1/+7
| | | | | | | We see these warnings when people CC syzbot on unrelated threads. If there is no command in the email, don't produce warning at all. On the other hand if there is a command, warn and send sender reply that syzbot can't find the corresponding bug.