aboutsummaryrefslogtreecommitdiffstats
path: root/prog/encoding.go
Commit message (Collapse)AuthorAgeFilesLines
* prog: error if program variable refers to non-resourceDmitry Vyukov2022-01-111-0/+2
| | | | | Error if program variable refers to non-resource in strict parsing mode. Such errors are hard to diagnose otherwise since the variable is silently discarded.
* all: replace collide mode by `async` call propertyAleksandr Nogikh2021-12-101-0/+3
| | | | | | | | | | | | | Replace the currently existing straightforward approach to race triggering (that was almost entirely implemented inside syz-executor) with a more flexible one. The `async` call property instructs syz-executor not to block until the call has completed execution and proceed immediately to the next call. The decision on what calls to mark with `async` is made by syz-fuzzer. Ultimately this should let us implement more intelligent race provoking strategies as well as make more fine-grained reproducers.
* prog: don't use reflect.Value.IsZeroDmitry Vyukov2021-09-301-1/+2
| | | | | reflect.Value.IsZero is added in go1.13, not available in Appengine SDK. Replace it with DeepEqual+Zero.
* all: refactor fault injection into call propsAleksandr Nogikh2021-09-221-4/+2
| | | | | | | | | | | | Now that call properties mechanism is implemented, we can refactor fault injection. Unfortunately, it is impossible to remove all traces of the previous apprach. In reprolist and while performing syz-ci jobs, syzkaller still needs to parse the old format. Remove the old prog options-based approach whenever possible and replace it with the use of call properties.
* all: introduce call propertiesAleksandr Nogikh2021-09-221-2/+75
| | | | | | | | | Call properties let us specify how each individual call within a program must be executed. So far the only way to enforce extra rules was to pass extra program-level properties (e.g. that is how fault injection was done). However, it entangles the logic and not flexible enough. Implement an ability to pass properties along with each individual call.
* all: introduce a prog.Call constructorAleksandr Nogikh2021-09-221-5/+2
| | | | | Create a constructor for the prog.Call type. It allows to reduce the duplication of code now and during further changes.
* syz-manager, syz-fuzzer: filter stale glob values in the corpusDmitry Vyukov2021-06-261-1/+2
| | | | | | | | | | | | Corpus may accumulate glob values that are already filtered out by descriptions (e.g. some harmful files), for an example see: https://groups.google.com/g/syzkaller-bugs/c/W_R0O4XWpfY/m/sdwwg2_hAwAJ Pass glob files to the manager and filter out values that are not present in the glob already. Also use the same caching scheme we use for features and enabled syscalls so that fuzzers don't need to scan globs every time.
* pkg/compiler: add glob typeJoey Jiaojg2021-05-261-1/+1
| | | | | | | | | | | | | | | | | | | | * all: add new typename dirname The current way to check files under sysfs or proc is: - define a string to represent each file - open the file - pass the fd to write / read / close The issues above are: - Need to know what file present on target device - Need to write openat for each file With dirname added, which will open one file in the directory randomly and then pass the fd to write/read/close. * all: use typename glob to match filename Fixes #481
* prog: allow arbitrary long lines in serialized programsDmitry Vyukov2020-09-201-21/+23
| | | | | | | We use bufio.Scanner and it has mandatory limit on line length. The file system tests (sys/linux/test/syz_mount_image_*) has very long lines (megabytes). Remove the restriction on line length.
* prog: extend error message on deserialization errorDmitry Vyukov2020-09-201-1/+1
|
* pkg, prog: add per-field direction attributeNecip Fazil Yildiran2020-08-131-7/+10
|
* prog/alloc: align address allocation for aligned[addr]Albert van der Linde2020-07-141-1/+1
| | | | | | | | | Calls to alloc didn't respect the alignment attribute. Now Type.Alignment() is used to ensure each type is correctly aligned. Existing descriptions with [align[X]] don't have an issue as they align to small blocks and default align is to 64 bytes. This commits adds support for [align[X]] for an X larger than 64.
* .golangci.yml: enable whitespace checkerDmitry Vyukov2020-06-051-2/+0
| | | | Points to bad empty lines very precisely.
* prog: introduce Field typeDmitry Vyukov2020-05-021-17/+19
| | | | | | | | | | | | | Remvoe FieldName from Type and add a separate Field type that holds field name. Use Field for struct fields, union options and syscalls arguments, only these really have names. Reduces size of sys/linux/gen/amd64.go from 5665583 to 5201321 (-8.2%). Allows to not create new type for squashed any pointer. But main advantages will follow, e.g. removing StructDesc, using TypeRef in Arg, etc. Update #1580
* prog: rename {PtrType,ArrayType}.Type to ElemDmitry Vyukov2020-05-011-10/+9
| | | | | | | Name "Type" is confusing when referring to pointer/array element type. Frequently there are too many Type/typ/typ1/t and typ.Type is not very informative. It _is_ a type, but what's usually more relevant is that it's an _element_ type. Let's leave type checking to compiler and give it a more meaningful name.
* prog: remove Dir from TypeDmitry Vyukov2020-05-011-58/+60
| | | | | | | | | | | | | | | | | | Having Dir is Type is handy, but forces us to duplicate lots of types. E.g. if a struct is referenced as both in and out, then we need to have 2 copies and 2 copies of structs/types it includes. If also prevents us from having the struct type as struct identity (because we can have up to 3 of them). Revert to the old way we used to do it: propagate Dir as we walk syscall arguments. This moves lots of dir passing from pkg/compiler to prog package. Now Arg contains the dir, so once we build the tree, we can use dirs as before. Reduces size of sys/linux/gen/amd64.go from 6058336 to 5661150 (-6.6%). Update #1580
* prog: make program parsing more permissiveDmitry Vyukov2020-04-281-1/+2
| | | | | Don't error on wrong vma with value in non strict mode. Add more tests and fix use of cmp package (prog.Syscall is not comparable anymore).
* prog: rename target.SanitizeCall to NeutralizeDmitry Vyukov2020-03-171-2/+2
| | | | | | | | | | | | | We will need a wrapper for target.SanitizeCall that will do more than just calling the target-provided function. To avoid confusion and potential mistakes, give the target function and prog function different names. Prog package will continue to call this "sanitize", which will include target's "neutralize" + more. Also refactor API a bit: we need a helper function that sanitizes the whole program because that's needed most of the time. Fixes #477 Fixes #502
* prog: control program lengthDmitry Vyukov2020-03-131-6/+8
| | | | | | | | | | | | | | | | | | | We have _some_ limits on program length, but they are really soft. When we ask to generate a program with 10 calls, sometimes we get 100-150 calls. There are also no checks when we accept external programs from corpus/hub. Issue #1630 contains an example where this crashes VM (executor limit on number of 1000 resources is violated). Larger programs also harm the process overall (slower, consume more memory, lead to monster reproducers, etc). Add a set of measure for hard control over program length. Ensure that generated/mutated programs are not too long; drop too long programs coming from corpus/hub in manager; drop too long programs in hub. As a bonus ensure that mutation don't produce programs with 0 calls (which is currently possible and happens). Fixes #1630
* prog: dump orig prog if Deserialize panicsDmitry Vyukov2020-02-211-0/+6
| | | | | | | | | | We are seeing some one-off panics during Deserialization and it's unclear if it's machine memory corrpution or an actual bug in prog. I leam towards machine memory corruption but it's impossible to prove without seeing the orig program. Move git revision to prog and it's more base package (sys can import prog, prog can't import sys).
* pkg/compiler: fix another bitfield layout bugDmitry Vyukov2020-01-071-1/+1
| | | | See the added test for details.
* prog: fix tests for string enforcementDmitry Vyukov2020-01-051-1/+3
| | | | | | | | String value enforcement broke a number of tests where we use different values. Be more string as to what string values we use in tests. Required to add tmpfs descriptions to test syz_mount_image. Also special-casing AF_ALG algorithms as these are auto-generated.
* prog: don't mutate strings with enumerated valuesDmitry Vyukov2020-01-051-3/+17
| | | | | | | | | | Strings with enumerated values are frequently file names or have complete enumeration of relevant values. Mutating complete enumeration if not very profitable. Mutating file names leads to escaping paths and fuzzer messing with things it is not supposed to mess with as in: r0 = openat$apparmor_task_exec(0xffffffffffffff9c, &(0x7f0000000440)='/proc/self//exe\x00', 0x3, 0x0)
* prog: fix a typo in a commentDmitry Vyukov2019-12-301-1/+1
|
* prog: don't fail decoding on non-default out argsDmitry Vyukov2019-12-211-1/+8
| | | | | | | We get them in cross-compilation test where an out const arg has different values in different archs. No reason to fail deserialization in that case, replace with default arg instead.
* tools: add syz-expandAndrey Konovalov2019-09-231-10/+20
| | | | | | | The syz-expand tools allows to parse a program and print it including all the default values. This is mainly useful for debugging, like doing manual program modifications while trying to come up with a reproducer for some particular kernel behavior.
* prog: add implementation for resource centricVeronica Radu2019-09-031-1/+1
|
* prog: implement complex len target supportDmitry Vyukov2019-05-141-1/+1
| | | | | This actually implements support for complex len targets during program generation and mutation.
* prog, pkg/compiler: fix warningsDmitry Vyukov2019-03-291-2/+2
| | | | | | | | | | | | | gometalinter says: pkg/compiler/consts.go:192::warning: internal error: no range for "n" (vetshadow) pkg/compiler/consts.go:197::warning: internal error: no range for "n" (vetshadow) prog/encoding.go:862::warning: declaration of "v" shadows declaration at prog/encoding.go:852 (vetshadow) This somehow happens only with Go1.11 but not 1.12 so wasn't detected locally. The prog warnings looks legit. The pkg/compiler warning was amusingly introduced to please golangci-lint checker, revert that fix for now.
* prog: fix a bunch of bugs in parsingDmitry Vyukov2019-03-291-16/+38
| | | | | | Add fuzzer for Deserialize and fix 5 or so bugs it found. Fixes #1086
* prog: fix escaping of C stringsDmitry Vyukov2019-01-311-5/+15
| | | | | | C's \xHH hex constants in strings accept any number of hex digits (not just 2 or 4). So later non-hex escaped chars glue to the \x construct. Use \OOO instead as it accepts at most 3 octal digits.
* prog, pkg/csource: more readable serialization for stringsDmitry Vyukov2018-12-151-26/+87
| | | | | | | Always serialize strings in readable format (non-hex). Serialize binary data in readable format in more cases. Fixes #792
* prog: support AUTO args in programsDmitry Vyukov2018-12-101-6/+79
| | | | | | | | | | | | | | | AUTO arguments can be used for: - consts - lens - pointers For const's and len's AUTO is replaced with the natural value, addresses for AUTO pointers are allocated linearly. This greatly simplifies writing test programs by hand as most of the time we want these natural values. Update tests to use AUTO.
* prog: implement strict parsing modeDmitry Vyukov2018-12-101-18/+32
| | | | | | | Add bulk of checks for strict parsing mode. Probably not complete, but we can extend then in future as needed. Turns out we can't easily use it for serialized programs as they omit default args and during deserialization it looks like missing args.
* prog: introduce strict parsing modeDmitry Vyukov2018-12-101-32/+52
| | | | | | | | | | | Over time we relaxed parsing to handle all kinds of invalid programs (excessive/missing args, wrong types, etc). This is useful when reading old programs from corpus. But this is harmful for e.g. reading test inputs as they can become arbitrary outdated. For runtests which creates additional problem of executing not what is actually written in the test (or at least what author meant). Add strict parsing mode that does not tolerate any errors. For now it just checks excessive syscall arguments.
* prog: refactor deserialization codeDmitry Vyukov2018-12-101-46/+53
| | | | | | | Move target and vars into parser and make all parsing functions methods of the parser. This reduces number of args that we need to pass around and eases adding more state that needs to be passed around.
* prog: export Type.DefaultArgDmitry Vyukov2018-12-061-14/+14
| | | | | It's effectively exported anyway. So export it the proper way.
* prog: add concept of "special pointers"Dmitry Vyukov2018-08-301-6/+4
| | | | | | | | | | | | | | | | | Currently we only generate either valid user-space pointers or NULL. Extend NULL to a set of special pointers that we will use in programs. All targets now contain 3 special values: - NULL - 0xfffffffffffffff (invalid kernel pointer) - 0x999999999999999 (non-canonical address) Each target can add additional special pointers on top of this. Also generate NULL/special pointers for non-opt ptr's. This restriction was always too restrictive. We may want to generate them with very low probability, but we do want to generate them. Also change pointers to NULL/special during mutation (but still not in the opposite direction).
* prog: collect all prog commentsDmitry Vyukov2018-08-081-1/+13
| | | | | | Parse and collect and prog comments. Will be needed for runtest annotations (e.g. "requires threaded mode", etc).
* prog: introduce debugValidateDmitry Vyukov2018-08-021-5/+1
| | | | | | Move debug validation into a separate function. Update #538
* prog: refactor defaultArg/isDefaultArgDmitry Vyukov2018-08-021-18/+18
| | | | | | Refactor from single-big-switch to type methods. Update #538
* prog: refactor program serializationDmitry Vyukov2018-07-311-105/+137
| | | | | | | | Make argument serialization Arg method. This eliminates a very long function that serializes all arguments. Update #538
* prog: parse comments in serialized programsDmitry Vyukov2018-07-271-4/+17
| | | | | | Remember per-call comments, will be useful for annotating tests. Also support this form: call() # comment
* prog: make c.Ret optionalDmitry Vyukov2018-05-051-2/+2
| | | | | No reason to allocate return value if there is no return type. c.Ret == nil is the reasonable indication that this is a "void" call.
* prog: simplify codeDmitry Vyukov2018-05-051-22/+21
| | | | | | Now that we don't have ReturnArg and only ResultArg's refer to other ResultArg's we can remove ArgUser/ArgUsed and devirtualize lots of code.
* gometalinter: enable cyclomatic complexity checkingDmitry Vyukov2018-05-041-212/+238
| | | | | | Refactor some functions to be simpler. Update #538
* sys/linux: add support for mounting filesystem imagesDmitry Vyukov2018-03-301-1/+1
|
* all: fix gometalinter warningsDmitry Vyukov2018-03-081-3/+1
| | | | Fix typos, non-canonical code, remove dead code, etc.
* prog: fix isDefaultArgDmitry Vyukov2018-03-081-15/+0
| | | | | Test that isDefaultArg returns true for result of DefaultArg. Fix few bugs uncovered by this test.
* prog: harden program parsing against description changes moreDmitry Vyukov2018-03-051-27/+61
| | | | | | | Handle most of type changes, e.g. const is changed to struct, or struct to pointers. In all these cases we create default args. They may not give the coverage anymore, but still better than losing them right away.
generated by ggit (джигит) mrf-deployment (git 2.46.0) at 2026-03-22 04:00:26 +0000