| Commit message (Collapse) | Author | Age | Files | Lines |
| | |
|
| | |
|
| | |
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Mark tests as parallel where makes sense.
Speed up sys.TransitivelyEnabledCalls.
Execution time is now:
ok github.com/google/syzkaller/config 0.172s
ok github.com/google/syzkaller/cover 0.060s
ok github.com/google/syzkaller/csource 3.081s
ok github.com/google/syzkaller/db 0.395s
ok github.com/google/syzkaller/executor 0.060s
ok github.com/google/syzkaller/fileutil 0.106s
ok github.com/google/syzkaller/host 1.530s
ok github.com/google/syzkaller/ifuzz 0.491s
ok github.com/google/syzkaller/ipc 1.374s
ok github.com/google/syzkaller/log 0.014s
ok github.com/google/syzkaller/prog 2.604s
ok github.com/google/syzkaller/report 0.045s
ok github.com/google/syzkaller/symbolizer 0.062s
ok github.com/google/syzkaller/sys 0.365s
ok github.com/google/syzkaller/syz-dash 0.014s
ok github.com/google/syzkaller/syz-hub/state 0.427s
ok github.com/google/syzkaller/vm 0.052s
However, main time is still taken by rebuilding sys package.
Fixes #182
|
| |
|
|
|
|
|
| |
Systematically inject faults during smashing.
Requires kernel patch:
"fault-inject: support systematic fault injection"
(currently in linux-next).
|
| | |
|
| |
|
|
|
|
|
|
|
|
|
| |
Currently syzkaller uses per-call basic block (BB) coverage.
This change implements edge (not-per-call) coverage.
Edge coverage is more detailed than BB coverage as it captures
not-taken branches, looping, etc. So it provides better feedback signal.
This coverage is now called "signal" throughout the code.
BB code coverage is also collected as it is required for visualisation.
Not doing per-call coverage reduces corpus ~6-7x (from ~35K to ~5K),
this has profound effect on fuzzing efficiency.
|
| |
|
|
|
|
| |
Check for compiler warnings during compilation.
Don't require -std=c99.
Fix existing compiler warnings.
|
| | |
|
| | |
|
| |
|
|
| |
It was duplicated in 3 programs.
|
| |
|
|
|
| |
It is not working and not tested,
and can't be restored with new namespace sandboxing code.
|
| |
|
|
|
|
| |
IPC timeout must be larger than executor timeout.
Otherwise IPC kills parent executor but does not
kill child executor.
|
| |
|
|
|
| |
So far it has found only false positives.
Let's leave this to KMSAN.
|
| |
|
|
| |
Move some file utilities into a separate package.
|
| |
|
|
|
| |
Move C source generation into a separate package.
Prog is too bloated already.
|
| | |
|
| | |
|
| |
|