| Commit message (Collapse) | Author | Age | Files | Lines |
| | |
|
| | |
|
| | |
|
| | |
|
| |
|
|
| |
probability coverage
|
| | |
|
| |
|
|
|
|
|
|
|
|
|
| |
Static prefix sums have been replaced with a Fenwick tree.
In the current syzkaller, program priority was set based on a Signal
received by a single system call. This commit allows priority to be
changed dynamically, making it possible to maintain priority based on
Signals from all system calls.
Signed-off-by: Grigory Bazilevich <g.bazilevich@ispras.ru>
|
| |
|
|
|
|
| |
Otherwise syz-ci will fail to build the project.
Signed-off-by: Denis Efremov <efremov@ispras.ru>
|
| |
|
|
|
|
|
| |
Add hash of actual kernel commit to crash metainfo if available.
Signed-off-by: Grigory Bazilevich <g.bazilevich@ispras.ru>
Signed-off-by: Sergey Zotov <svzotov@ispras.ru>
|
| |
|
|
|
|
|
| |
Fix corresponding test, remove incorrect tests
Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
Signed-off-by: Denis Efremov <efremov@ispras.ru>
|
| |
|
|
|
|
|
| |
The timeout for "go test ..." can now be specified in the syz-ci
settings in the `SyzkallerBuildParams` dictionary under `test_timeout`.
Signed-off-by: Grigory Bazilevich <g.bazilevich@ispras.ru>
|
| |
|
|
| |
Signed-off-by: Denis Efremov <efremov@ispras.ru>
|
| |
|
|
| |
Signed-off-by: Denis Efremov <efremov@ispras.ru>
|
| |
|
|
| |
Signed-off-by: Vladimir Telezhnikov <vtelezhnikov@astralinux.ru>
|
| |
|
|
| |
Signed-off-by: Denis Efremov <efremov@ispras.ru>
|
| |
|
|
| |
Signed-off-by: Denis Efremov <efremov@ispras.ru>
|
| |
|
|
| |
Signed-off-by: Denis Efremov <efremov@ispras.ru>
|
| |
|
|
| |
Signed-off-by: Grigory Bazilevich <g.bazilevich@ispras.ru>
|
| |
|
|
|
|
|
| |
The build timeout can now be specified in the manager settings in the
‘build’ dictionary under ‘timeout’.
Signed-off-by: Grigory Bazilevich <g.bazilevich@ispras.ru>
|
| |
|
|
|
|
|
|
|
|
|
| |
Save crashes and repros with corresponding kernel and syzkaller configs locally
in syz-manager even when they are published to syz-dashboard,
to be able to share the crashes with
Linux Verification Center (linuxtesting.org).
Signed-off-by: Grigory Bazilevich <g.bazilevich@ispras.ru>
Signed-off-by: Sergey Zotov <svzotov@ispras.ru>
Co-authored-by: Sergey Zotov <svzotov@ispras.ru>
|
| |
|
|
|
|
|
|
|
|
|
|
|
| |
Currently we added custom code to kernel build action,
and few others to expose verbose errors from executed binaries (notably make).
But lots of other binary executions missing this logic,
e.g. for git failure we currently see unuseful:
failed to run ["git" "fetch" "--force" "--tags" exit status 128
Instead of adding more and more custom code to do the same,
remove the custom code and always add verbose output
in syz-agent and tools/syz-aflow.
|
| | |
|
| |
|
|
|
|
|
|
|
| |
The tests fail on OpenBSD with:
expected: "bad expression: fatal: command line, 'bad expression (': Unmatched ( or \\("
actual : "bad expression: fatal: command line, 'bad expression (': parentheses not balanced"
Disable the tests on non-linux for now.
|
| |
|
|
|
| |
Requesting to return the program as one of the agent's outputs
enforces its structure and prevents LLM from using garbage formatting.
|
| |
|
|
|
|
|
| |
If we have duplicate names, then only one of the duplicates will be used at random.
Add a check that we don't have duplicate names.
Currently it's only "crash-reproducer" (both action and a tool).
Also ignore "set-results" tool, and all tools created in tests.
|
| |
|
|
| |
Fixes #6897
|
| |
|
|
|
|
|
|
|
| |
There is no point in using Provide more than once,
and anywhere besides the first action of a flow.
So it's not really an action, but more of a flow property.
Add Flow.Consts field to handle this case better.
Also provide slightly less verbose syntax by using a map
instead of a struct, and add tests.
|
| |
|
|
|
|
|
| |
LLM seems to have some knowledge about syzkaller program syntax,
but presumably it's still useful to give it all details about syntax.
Update #6878
|
| |
|
|
|
|
|
|
|
|
| |
It's useful to be able to look at the kernel source code
when creating a reproducer for a bug. So give the agent
codesearch tools.
Also slightly refine prompt wording.
Update #6878
|
| |
|
|
|
|
|
| |
Provide some instructions on how tools should be named, implemented
and registered.
Update #6878
|
| |
|
|
|
|
| |
Teach the repro flow about the `read-description` tool.
Update #6878
|
| |
|
|
|
|
|
|
|
|
|
| |
Adds a tool that allows an agent to read the content of syzlang
description files (e.g., `sys.txt`, `socket.txt`).
Providing the ability to fetch exact system call definitions helps
reasoning models generate correct and compiling programs from crash
reports.
Update #6878
|
| | |
|
| |
|
|
|
|
|
| |
Collect code coverage for test programs.
This is likley to be needed for #6878 and seed generation workflow.
For now it's not wired into any workflow/tool and is not tested.
But this should provide most of the plumbing to wire it up.
|
| | |
|
| |
|
|
|
|
| |
When we combine tool sets for agents, there is always a protential
problem with aliasing existing slices and introducing subtle bugs.
Add Tools function that can append tool/tool sets w/o aliasing problem.
|
| |
|
|
|
|
|
| |
This commit won't be used by workflows b/c dashboard always send
SyzkallerCommit associated with the job crash.
Update #6878
|
| |
|
|
| |
Update #6878
|
| |
|
|
| |
Update #6878
|
| | |
|
| |
|
|
| |
It is not used.
|
| |
|
|
|
|
|
|
| |
The current implementation runs into problems if we modify the same file
several times in the patch series since the sequential blob hashes will
not be found in the reproducer.
Fix it by moving the check for already processed files up.
|
| |
|
|
|
| |
There's no workflow implementation, but having the const there will let
us implement the dashboard side in parallel.
|
| |
|
|
| |
Use current namespace instead of the hardcoded one.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
This patch enables syzos for riscv64 and implements
the corresponding pseudo syscalls.
Pseudo syscalls:
- syz_kvm_setup_syzos_vm
- syz_kvm_add_vcpu
- syz_kvm_assert_syzos_uexit
Syzos guest support:
- guest_uexit
- guest_execute_code
- guest_handle_csrr and guest_handle_csrw
Test seeds:
- riscv64-syz_kvm_setup_syzos_vm
- riscv64-syz_kvm_setup_syzos_vm-csrr
- riscv64-syz_kvm_setup_syzos_vm-csrw
|
| |
|
|
|
|
| |
This allows auto-upstreamming of actionable bugs.
Fixes #6779
|
| |
|
|
|
|
| |
This will prevent duplication of the same logic later. Specifically, it
will be needed when rerunning reproducers in syz-cluster and potentially
when aggregating the results of multiple reproducer runs in syz-agent.
|
| |
|
|
|
|
|
| |
Currently we crash on nil deref, if LLM specifies explicit 'nil'
for an optional (pointer) argument. Handle such cases properly.
Fixes #6811
|
| |
|
|
| |
Update #6811
|
| |
|
|
|
|
| |
The MCP server exports all aflow tools (and actions as tools) we have.
Fixes #6763
|