aboutsummaryrefslogtreecommitdiffstats
path: root/pkg/instance/instance.go
Commit message (Collapse)AuthorAgeFilesLines
* pkg/instance: extend image testing failed errorsAleksandr Nogikh2025-08-261-0/+6
| | | | | | | | Include a bit more info into the bug reports. The change is motivated by inactionable "image testing failed w/o kernel bug" errors like this: https://syzkaller.appspot.com/text?tag=CrashLog&x=17acec42580000
* pkg/instance: fix sandbox_arg passingAleksandr Nogikh2025-08-201-1/+1
| | | | We used the wrong name for the optional argument.
* pkg/instance: patch empty Sandbox for all syz-execprog callsAleksandr Nogikh2025-07-011-7/+7
| | | | | | | | | | Since #6123, the ability to run syz reproducers with Sandbox="" is also relevant for pkg/repro. Instead of patching the value at Env.Test(), do it right before the syz-execprog's invocation. Closes #6137.
* all: opt-out some functions to enforce linter checksTaras Madan2025-03-271-0/+2
| | | | New code will be limited to max 7 function params.
* pkg/instance: extract the smoke test methodAleksandr Nogikh2025-01-211-0/+39
| | | | | | | Move the logic from syz-ci to pkg/instance to make it reusable. In case of a failure without a crash report, report the issue as a SYZFATAL crash instead of just printing to the error log.
* all: use min/max functionsDmitry Vyukov2025-01-171-3/+1
| | | | They are shorter, more readable, and don't require temp vars.
* pkg/repro: accept a cancellable contextAleksandr Nogikh2024-11-131-3/+11
| | | | | | | | | | Refactor pkg/repro to accept a context.Context object. This will make it look more similar to other package interfaces and will eventually let us abort currently running repro jobs without having to shut down the whole application. Simplify the code by factoring out the parameters common both to RunSyzRepro() and RunCRepro().
* pkg/build: use the build environment in clean() callsFlorent Revest2024-10-141-11/+24
| | | | | | This unifies the build() and clean() interfaces such that if a custom compiler or make binary is provided in the manager or bisection config, they can be taken into account by the clean() interface.
* pkg/build/linux: support building with a custom make binaryFlorent Revest2024-10-141-0/+2
| | | | | | Certain environments might need a specific make command or wrap make calls with extra logic. This lets users provide a path to a custom make binary.
* pkg/instance: refactor ExecprogCmdAleksandr Nogikh2024-09-251-12/+8
| | | | Reduce the number of arguments by using a csource.Option value directly.
* tools/syz-execprog: pass the VM type to execprogLaura Peskin2024-09-241-2/+4
| | | | | | This makes it possible to skip certain machine checks depending on the VM type, as syz-manager already does.
* vm: make sure vm.Pools are cleaned upCameron Finucane2024-09-191-0/+1
| | | | Add calls to Close() from all locations that call Create().
* all: rename build_jobs to build_cpusAleksandr Nogikh2024-08-221-2/+2
| | | | The latter is a better suitable name.
* syz-ci: accept a BuildJobs parameterAleksandr Nogikh2024-08-221-0/+2
| | | | | The parameter defines the maximum number of CPUs involved in the kernel build process.
* pkg/instance: adjust FuzzingVMs in OverrideVMCount()Aleksandr Nogikh2024-08-141-0/+1
| | | | | We should not be setting FuzzingVMs to a value below the overall VM count.
* executor: add runner modeDmitry Vyukov2024-06-241-48/+1
| | | | | | | Move all syz-fuzzer logic into syz-executor and remove syz-fuzzer. Also restore syz-runtest functionality in the manager. Update #4917 (sets most signal handlers to SIG_IGN)
* pkg/instance: don't require a syz reproducerAleksandr Nogikh2024-06-181-4/+4
| | | | | | | | We currently panic if the syz reproducer was not provided, but it's actually a valid situation - it happens if we perform patch testing for build/boot/test errors. Closes #4907.
* pkg/flatrpc: send parameters to the fuzzer in RPCDmitry Vyukov2024-06-051-3/+2
| | | | | When we rewrite syz-fuzzer in C++ flag parsing will be painful, so send as many parameters to syz-fuzzer in RPC rather than as flags.
* syz-fuzzer: remove testing modeDmitry Vyukov2024-05-271-5/+7
| | | | It's not used anymore.
* pkg/instance: use execprog to do basic instance testingDmitry Vyukov2024-05-271-76/+44
| | | | | | | | | | | When we accept new kernels for fuzzing we need more extensive testing, but syz-ci switched to using syz-manager for this purpose. Now instance testing is used only for bisection and patch testing, which does not need such extensive image testing (it may even harm). So just run a simple program as a testing. It also uses the same features as the target reproducer, so e.g. if the reproducer does not use wifi, we won't test it, which reduces changes of unrelated kernel bugs.
* pkg/ipc: remove ExecOptsDmitry Vyukov2024-05-211-2/+2
| | | | Switch to flatrpc.ExecOpts.
* pkg/rpctype: prepare for not using for target communicationDmitry Vyukov2024-05-031-5/+3
| | | | | | Remove things that are only needed for target VM communication: conditional compression, timeout scaling, traffic stats. To minimize diffs when we switch target VM communication to flatrpc.
* tools/syz-runtest: switch to the generic program executionDmitry Vyukov2024-05-031-10/+3
| | | | | | | | | syz-runtest effectively implemented the same execute program/return result mechanism we use now for normal fuzzing. So extend the general mechanism to allow collecting output/errors, repeating program, and executing a precompiled binary as a test. And switch syz-runtest to the general mechanism. This removes another chunk of code from syz-fuzzer.
* syz-manager, syz-fuzzer: pass ExecOpts in exec requestsDmitry Vyukov2024-04-301-2/+0
| | | | | | Move all ExecOpts logic from the fuzzer to the manager. This makes the fuzzer simpler and will allow to vary options across requests.
* vm: combine Run and MonitorExecutionDmitry Vyukov2024-04-111-4/+4
| | | | | | All callers of Run always call MonitorExecution right after it. Combine these 2 methods. This allows to hide some implementation details and simplify users of vm package.
* pkg/rpctype: make RPC compression optionalDmitry Vyukov2024-04-031-5/+7
| | | | | | | | RPC compression take up to 10% of CPU time in profiles, but it's unlikely to be beneficial for local VM runs (we are mostly copying memory in this case). Enable RPC compression based on the VM type (local VM don't use it, remove machines use it).
* all: experiment with an option to reset accumulated stateAleksandr Nogikh2024-01-231-4/+6
| | | | | | | | | | | | | | | | | In the cases where we do not / cannot sandbox individual prog executions well enough, some share of progs end up being dependent on the previously accumulated state of the whole VM. As the result, * We lose 5-10% of coverage/signal on every instance restart. * A share of our corpus programs do not actually trigger the coverage they were thought to reliably trigger. This significantly affects fuzzing efficiency and prevents syzkaller from accumulating bigger and better corpus over multiple runs. Let's see if the situation becomes better if we restart syz-executor before most of prog executions.
* all: refactor pprof endpoint configurationAleksandr Nogikh2024-01-221-0/+2
| | | | | | | | | | | | | In some cases (e.g. gVisor instances using host's network namespace) attempts to bind() all syz-fuzzer processes to the same port result in conflicts and fuzzing breakages. Refactor the code to enable custom pprof configuration depending on the vm type. For now, just disable pprof endpoints for gVisor VMs. Once we actually need the feature there, we can generate custom ports for every gVisor VM.
* all: use errors.As instead of .(type)Taras Madan2023-07-241-2/+5
|
* all: use special placeholder for errorsTaras Madan2023-07-241-12/+12
|
* pkg/report: move report.Type to pkg/report/crashAleksandr Nogikh2023-07-051-1/+2
| | | | | This will help avoid a circular dependency pkg/vcs -> pkg/report -> pkg/vcs.
* vm: separate boot time and infrastructure errorsAleksandr Nogikh2023-05-091-0/+7
| | | | | | | | | | | | | | | It's not correct to mix them since they point to fundamentally different issues: 1) Boot time errors are caused by a problematic kernel image and can only be resolved by using another kernel version or config. 2) Infrastructure errors are temporary, so we can just try again some time later. Reserve the existing BootError for (1) errors and let all other VM handling errors refer to (2). To make it possible to attach more output to the infra error, introduce the VerboseInfraError type.
* syz-ci: explicitly stop all running jobs on updateAleksandr Nogikh2023-01-191-6/+0
| | | | | | Otherwise we might end up in a situation when we have stopped all fuzzing, but wait for the job processor to report Done to the waitgroup object.
* syz-ci: gate concurrent env.Test executionsAleksandr Nogikh2023-01-191-1/+7
| | | | This will help reduce the number of overcommitted VMs.
* syz-ci: move build semaphore closer to buildsAleksandr Nogikh2023-01-191-1/+51
| | | | | | | | Currently it's held during the whole job processing, which can take too long. Adjust it so that it's only taken when we really begin to build the kernel or syzkaller.
* pkg/instance: move BuildKernel() args to structSpace Meyer2023-01-091-10/+19
|
* syz-ci/jobs: use linker supplied in syz-ci configSpace Meyer2023-01-091-2/+4
| | | | | | Previously we only used the linter from the syz-ci config when building the kernel for regular fuzzing. We were missing some plumbing to have this setting reach patch testing and bisection jobs.
* pkg/csource, pkg/instance, pkg/ipc, pkg/mgrconfig, tools/syz-prog2c, ↵Andrey Artemiev2022-08-061-8/+11
| | | | syz-manager: introduce a new setting 'sandbox_arg' (#3263)
* syz-ci: remember syzkaller builds logsAleksandr Nogikh2022-06-281-15/+21
| | | | | This might help get more insight into patch testing failures, especially for old bugs.
* all: remember console output for all patch testsAleksandr Nogikh2022-06-081-24/+33
| | | | | | Currently syzbot only saves a log if there was a build/test error. Closes #3185
* pkg/instance: fix nil derefs in patch testing and bisectionsDmitry Vyukov2022-05-091-2/+5
| | | | | | | | | | | | | | | | | | | Fix these crashes: panic: runtime error: invalid memory address or nil pointer dereference [signal SIGSEGV: segmentation violation code=0x1 addr=0x0 pc=0xd430ae] goroutine 875 [running]: github.com/google/syzkaller/pkg/instance.(*inst).testRepro.func1(...) pkg/instance/instance.go:371 github.com/google/syzkaller/pkg/instance.(*inst).testRepro(0xc0005a2c80) pkg/instance/instance.go:396 +0x26e github.com/google/syzkaller/pkg/instance.(*inst).test(0xc0005a2c80) pkg/instance/instance.go:293 +0xf2 github.com/google/syzkaller/pkg/instance.(*env).Test.func1() pkg/instance/instance.go:237 +0x26 created by github.com/google/syzkaller/pkg/instance.(*env).Test pkg/instance/instance.go:237 +0x1d7 syz-ci.service: Main process exited, code=exited, status=2/INVALIDARGUMENT
* all: use the same prog execution code throughout the projectAleksandr Nogikh2022-04-291-62/+24
| | | | | | | | | | Previously it was copypasted in pkg/instance, pkg/repro, tools/syz-crash. Use the single implementation instead. Also, this commit fixes a bug - the previous code always set collide to true while reproducing a bug, which led to an immediate syz-exexprog's exit. As a result, newer bugs with .syz repro only were never actually reproduced on #syz test requests.
* all: fix patch testing for bugs witout C reproAleksandr Nogikh2022-04-191-1/+1
| | | | | | | | | | | | | | | | | | Syzbot tests patches with -collide=true in order to trigger more bugs, but now that -collide flag is deprecated, this no longer makes sense. Moreover, it actually prevents the testing of bugs with syz repro now - syz-execprog immediately exits due to -collide=true and env.Test() accepts it as a normal outcome. Set -collide=true only for those bugs, where collide was set to true by the reproducer (and therefore syzkaller at that revision supported it). Don't exit from syz-execprog immediately if -collide is set to true. This will prevent such bugs from happening later and make the problem more visible. This was initially part of #3083, but seems to be more urgent to merge, so pushing it as a separate PR.
* pkg/instance: explicitly specify optional fuzzer argumentsAleksandr Nogikh2022-04-061-12/+17
| | | | | | | | Otherwise we get problems while testing patches for older syzkaller versions, which didn't support optional arguments. Adjust tests so that problems with how OldFuzzerCmd handles such arguments could be seen.
* all: collect raw coverageAleksandr Nogikh2022-03-281-4/+10
| | | | | | | | | Raw coverage might be important when e.g. analysing the origins of out-of-place coverage in coverage reports or understanding why the fuzzer could not reach deeper code. If "raw_cover" is set to true, syzkaller will remember unsorted and unduplicated coverage (PCs) for each its corpus program.
* pkg/instance: refactor FuzzerCmd()Aleksandr Nogikh2022-03-281-13/+31
| | | | | | The method already has too many arguments, which complicates the further addition of new features. Introduce FuzzerCmdArgs structure to overcome the problem.
* pkg/instance: support older syzkaller revisionsAleksandr Nogikh2022-03-171-3/+6
| | | | | | | | | | | | | | | | | | | | | Now we use go1.16+, but sometimes syz-ci still has to compile and run old syzkaller revisions, which were not meant to be compiled with modern Go. In particular, this leads to the following errors: syzkaller build failed: failed to run ["make" "target"]: exit status 2 tools/syz-make/make.go:14:2: no required module provides package github.com/google/syzkaller/pkg/osutil: go.mod file not found in current directory or any parent directory; see 'go help modules' tools/syz-make/make.go:15:2: no required module provides package github.com/google/syzkaller/sys/targets: go.mod file not found in current directory or any parent directory; see 'go help modules' Makefile:39: *** syz-make failed. Stop. Fix this by adding GO111MODULE=auto to the environment variables. Reported-by: Taylor R Campbell <riastradh@netbsd.org>
* syz-verifier: don't use -collide in the runner (#3032)Taras Madan2022-03-161-2/+2
|
* all: refactor fault injection into call propsAleksandr Nogikh2021-09-221-4/+10
| | | | | | | | | | | | Now that call properties mechanism is implemented, we can refactor fault injection. Unfortunately, it is impossible to remove all traces of the previous apprach. In reprolist and while performing syz-ci jobs, syzkaller still needs to parse the old format. Remove the old prog options-based approach whenever possible and replace it with the use of call properties.
* all: use entire log to detect reports to suppressAleksandr Nogikh2021-08-061-1/+1
| | | | | | | | | | Currently syzkaller only applies its suppressions regexps to the oops message itself and a small number of its preceding bytes. A case has been reported (#2685), where it was important to analyse a bigger portion of output data. Pass the whole log and a starting position to the `Report.Parse` method separately instead of passing an already cut log there. Adjust use cases of the `Report.Parse` method to handle its new behavior.
generated by ggit (джигит) mrf-deployment (git 2.46.0) at 2026-03-12 06:23:53 +0000