aboutsummaryrefslogtreecommitdiffstats
path: root/pkg
Commit message (Collapse)AuthorAgeFilesLines
* prog: fix syz_kfuzztest_run allocation strategyEthan Graham2025-09-223-3/+4
| | | | | | | | | | | | | | | | | | | | Previously, the generated KFuzzTest programs were reusing the address of the top-level input struct. A problem could arise when the encoded blob is large and overflows into another allocated region - this certainly happens in the case where the input struct points to some large char buffer, for example. While this wasn't directly a problem, it could lead to racy behavior when running KFuzzTest targets concurrently. To fix this, we now introduce an additional buffer parameter into syz_kfuzztest_run that is as big as the maximum accepted input size in the KFuzzTest kernel code. When this buffer is allocated, we ensure that we have some allocated space in the program that can hold the entire encoded input. This works in practice, but has not been tested with concurrent KFuzzTest executions yet.
* pkg/fuzzer: use a smaller number of recommended calls for KFuzzTestEthan Graham2025-09-222-1/+9
| | | | | | | Introduce a KFuzzTest mode for the fuzzer so that a smaller number of recommended calls can be used if we are fuzzing KFuzzTest targets. Signed-off-by: Ethan Graham <ethangraham@google.com>
* syz-kfuzztest: add syz-kfuzztest executableEthan Graham2025-09-222-0/+324
| | | | | | | | | syz-kfuzztest is a new standalone designed for fuzzing KFuzzTest on a live kernel VM (e.g., inside QEMU). It has no dependencies on the executor program, instead directly writing into a KFuzzTest target's debugfs entry. Signed-off-by: Ethan Graham <ethangraham@google.com>
* pkg/corpus: add Cover() method for returning the corpus' coverageEthan Graham2025-09-221-0/+4
| | | | Signed-off-by: Ethan Graham <ethangraham@google.com>
* pkg/mgrconfig: add experimental enable_kfuzztest boolean flagEthan Graham2025-09-221-0/+3
|
* pkg/kfuzztest: add pkg/kfuzztestEthan Graham2025-09-2212-0/+1340
| | | | | | | Add a new package, pkg/kfuzztest, that implements dynamic discovery of KFuzzTest targets by parsing a vmlinux kernel binary. Signed-off-by: Ethan Graham <ethangraham@google.com>
* kfuzztest: introduce syz_kfuzztest_run pseudo-syscallEthan Graham2025-09-221-0/+1
| | | | | | | | | | | | | Add syz_kfuzztest_run pseudo-syscall, KFuzzTest attribute, and encoding logic. KFuzzTest targets, which are invoked in the executor with the new syz_kfuzztest_run pseudo-syscall, require specialized encoding. To differentiate KFuzzTest calls from standard syzkaller calls, we introduce a new attribute called KFuzzTest or "kfuzz_test" in syzkaller descriptions that can be used to annotate calls. Signed-off-by: Ethan Graham <ethangraham@google.com>
* pkg/kcov: add pkg/kcovEthan Graham2025-09-222-0/+160
| | | | | | | | | | | | Add a Go-native KCOV package, with a helper functions for tracing a a function. This is in preparation for a standalone KFuzzTest tool, which should be written in Go in order to take advantage of existing fuzzing infrastructure. The hard-coded coverage buffer size is the same as the executor program, defined as `512 << 10` in `executor/executor.cc`. Signed-off-by: Ethan Graham <ethangraham@google.com>
* pkg/runtest: refactor checkCallResult()Alexander Potapenko2025-09-221-36/+54
| | | | | Break checkCallResult() down into smaller functions, checkCallStatus() and checkCallCoverage().
* executor: sys/linux/: pkg/runtest: pkg/vminfo: add syz_kvm_assert_syzos_kvm_exitAlexander Potapenko2025-09-192-46/+48
| | | | Implement a pseudo-syscall to check the value of kvm_run.exit_reason
* pkg/runtest: fix a null deref in checkCallResultAlexander Potapenko2025-09-191-15/+9
| | | | | | | | | | Pseudo-syscalls from noCovSyscalls may not generate any coverage, which leads to a crash in the following line: if len(inf.Signal) < 2 && !calls[callName] && len(info.Extra.Signal) Make sure that this check is only done for calls not belonging to noCovSyscalls.
* prog: pkg/compiler: docs: introduce the `no_squash` attributeAlexander Potapenko2025-09-091-0/+1
| | | | | | | | | | | | | | | | | The `no_squash` per-syscall attribute prevents the fuzzer from generating squashed arguments to a particular syscall. This is particularly helpful for pseudo-syscalls with elaborate arguments that are hard to reason about when they are squashed - e.g. for syz_kvm_add_vcpu() that takes a SYZOS program as an input. I've considered an alternative solution that prohibits ANY for all pseudo-syscalls. But there is a bunch of existing programs (both the tests and the repros) for syscalls like syz_mount_image() for which the benefit of not passing ANY is not immediately obvious. I therefore decided to go with an explicit attribute that can later be enforced for every pseudo-syscall at compile time.
* pkg/vcs: backport fixes for devm_drm_of_get_bridge link errorAleksandr Nogikh2025-09-021-0/+12
| | | | | | This should fix our broken bisections. Closes #6136.
* syz-cluster: consider global/static variable valuesAleksandr Nogikh2025-08-291-22/+46
| | | | | | | | | When determining whether a patch series is worth fuzzing, consider not only the hashes of .text symbols, but also the hashes of the global (static and non-static) variables. As before, calculate the hashes during build and process them at the beginning of the fuzz step.
* pkg/manager: add Rank column with tooltips to the main pageTaras Madan2025-08-286-12/+122
|
* pkg/manager: store titles stat in the crash dirTaras Madan2025-08-283-0/+167
|
* pkg/manager: store tail reportsTaras Madan2025-08-283-1/+53
| | | | Send only the first report to dashboard.
* vm: extract all the crashes from the logTaras Madan2025-08-284-6/+14
|
* tools/docker: install bazelisk instead of bazelKonstantin Bogomolov2025-08-281-1/+4
| | | | | | | The needed Bazel version to build gVisor got bumped. However, instead of doing the same bump in two places whenever this happens, we can simply use bazelisk in syzkaller to determine which bazel version to use automatically.
* pkg/manager: add missing thead and tbody HTML tagsJeongjun Park2025-08-289-4/+46
|
* pkg/manager: add Repro Attempt Count columnname29652025-08-281-1/+2
| | | | Add a new column next to it to list the number of repro attempts separately.
* pkg/instance: extend image testing failed errorsAleksandr Nogikh2025-08-261-0/+6
| | | | | | | | Include a bit more info into the bug reports. The change is motivated by inactionable "image testing failed w/o kernel bug" errors like this: https://syzkaller.appspot.com/text?tag=CrashLog&x=17acec42580000
* pkg/fuzzer/queue: copy more field in TeeAleksandr Nogikh2025-08-262-1/+36
| | | | | | | Copy everything that might be important during execution on other kernels/VM pools. Add a test to verify it. The functionality is actively used to clone requests in the diff fuzzer.
* pkg/manager: record the right base kernel crash titleAleksandr Nogikh2025-08-211-11/+11
| | | | | | | When we run a reproducer on a base kernel and it crashes, we must record the crash title observed on the base kernel. Rename the field to reduce the chance of confusion in the future.
* syz-cluster: share base kernel crashes between fuzzing sessionsAleksandr Nogikh2025-08-211-4/+43
| | | | | | Report base kernel crashes observed during fuzzing. Consult the common API for each patched kernel crash to see if it was already observed on the base kernel.
* pkg/instance: fix sandbox_arg passingAleksandr Nogikh2025-08-202-1/+5
| | | | We used the wrong name for the optional argument.
* pkg/rpcserver: add suffix to executor restartsAleksandr Nogikh2025-08-191-1/+1
| | | | | To be useful, the stat should have a different name depending on the VM pool name.
* pkg/symbolizer: fix parser handling of small hex valuesjodaco2025-08-181-1/+1
| | | | | | The parser in symbolizer was incorrectly handling values of 0x0-0xf. Fixes #6290
* pkg/build: move kernel release overrides to make argsAleksandr Nogikh2025-08-181-3/+5
| | | | | When set as env variables, these don't seem to have any effect, but start to work as indended when passed as explicit make arguments.
* pkg/rpcserver: move executor restart to named statsAleksandr Nogikh2025-08-181-6/+8
| | | | | This will let us see executor restart statistics per VM pool (relevant for diff fuzzing).
* report: add "BUG on" oops entry for gVisorKonstantin Bogomolov2025-08-141-0/+11
| | | | | | Following https://github.com/google/gvisor/commit/b47d21ef21a6f59b8f574eebf83c7936880c1c0d syzkaller should look for this message type.
* pkg: move gcpsecret to a separate packageAleksandr Nogikh2025-08-111-1/+1
| | | | | It simplifies the dependency tree and fixes a build error for the send-test-email container.
* pkg/gce: set GVNIC feature for Compute imagesAleksandr Nogikh2025-08-081-1/+11
| | | | | | Google Cloud cannot automatically infer it from our images, so we need to explicitly set it. The flag is required to create a GVNIC-based GCE instance (the only type for C4A machines).
* pkg/gce: set minimum disk size for C4A instancesAleksandr Nogikh2025-08-082-0/+16
| | | | It must be more than 10GB.
* vm: refactoringTaras Madan2025-08-073-7/+11
| | | | | 1. func Run optionally accepts the opts. 2. Some refactoring, more comments.
* pkg/manager: embed BugInfo into UICrashTypeAleksandr Nogikh2025-08-073-27/+15
| | | | This reduces the redundancy a bit.
* pkg/manager: display repro attemptsAleksandr Nogikh2025-08-072-20/+23
| | | | | | On the syz-manager's html dashboard, dispay the number of repro attempts per each bug. It will help distinguish the bugs where reproduction was attempted and failed from those that have never been reproduced yet.
* pkg/coveragedb: update file to subsystem info periodicallyTaras Madan2025-08-073-24/+62
| | | | | | #6070 explains the problem of data propagation. 1. Add weekly /cron/update_coverdb_subsystems. 2. Stop updating subsystems from coverage receiver API.
* pkg/manager: fetch boot errors during patch fuzzingAleksandr Nogikh2025-08-061-0/+17
| | | | The VM pool expects us to listen on the boot error channel.
* pkg/manager: fix a NeedRepro checkAleksandr Nogikh2025-08-062-13/+13
| | | | | It's been checking the inverse of what was needed. Rename the helper function to reduce confusion in the future.
* pkg/manager: remove a dependency on grepAleksandr Nogikh2025-08-053-11/+51
| | | | | | Instead of calling grep (the implementations of which may differ in different environments), traverse the directory and grep files with a special pkg/osutil helper functionality.
* pkg/fuzzer: improve TestFuzzAleksandr Nogikh2025-08-051-5/+11
| | | | | | | | Ensure that corpus and signal are non-zero after the bugs have been found. Fix coverage configuration - the test was de facto running on a fallback coverage.
* pkg/fuzzer: add stats for overflowed coverage/compsAlexander Potapenko2025-08-052-0/+8
|
* pkg/gce.go: replace deprecated methodTaras Madan2025-08-051-6/+5
| | | | Bonus: add error processing.
* pkg/csource: add call argument annotations to generated C-source filesEthan Graham2025-08-047-13/+518
| | | | | | | | | | | The structure of arguments passed into syscalls is often hard to parse since it is memcpy'd into mmap'd regions. Structural relations are often lost in translation, resulting in reproducers that take longer for a developer to understand. This patch adds functionality for parsing syscall arguments semantically and emitting a structured and human-readable comment which is inserted before each syscall in the resulting C-source.
* pkg/runtest: typo fixAlexander Potapenko2025-07-311-1/+1
|
* pkg/flatrpc, pkg/vminfo, executor: introduce readonly coverageAlexander Potapenko2025-07-315-70/+87
| | | | | | | | | | | | | Add a new vminfo feature, FeatureKcovResetIoctl, that is true if the kernel supports ioctl(KCOV_RESET_TRACE) making it possible to reset the coverage buffer on the kernel side. This, in turn, allows us to map the coverage buffer read-only, which will prevent all sorts of userspace-generated corruptions at a cost of an extra syscall per program execution. The corresponding exec env flag, ExecEnv::ReadOnlyCoverage, turns on read-only coverage in the executor. It is enabled by default if FeatureKcovResetIoctl is on.
* pkg/manager: display manager nameAleksandr Nogikh2025-07-312-1/+3
| | | | If the manager name is set, display it in the header.
* pkg/manager: improve patched crash skip rulesAleksandr Nogikh2025-07-292-6/+26
| | | | | | | The rules were too generic - there are plenty of functions that have "stall" as substring, yet they do not relate to rcu stall bugs. Improve the rules list and add a unit test.
* pkg/coveragedb: document how to create the BQ table and data transferTaras Madan2025-07-292-0/+165
|
generated by ggit (джигит) mrf-deployment (git 2.46.0) at 2026-03-22 10:50:17 +0000