aboutsummaryrefslogtreecommitdiffstats
path: root/prog/encodingexec.go
Commit message (Collapse)AuthorAgeFilesLines
* prog: fix syz_kfuzztest_run allocation strategyEthan Graham2025-09-221-22/+34
| | | | | | | | | | | | | | | | | | | | Previously, the generated KFuzzTest programs were reusing the address of the top-level input struct. A problem could arise when the encoded blob is large and overflows into another allocated region - this certainly happens in the case where the input struct points to some large char buffer, for example. While this wasn't directly a problem, it could lead to racy behavior when running KFuzzTest targets concurrently. To fix this, we now introduce an additional buffer parameter into syz_kfuzztest_run that is as big as the maximum accepted input size in the KFuzzTest kernel code. When this buffer is allocated, we ensure that we have some allocated space in the program that can hold the entire encoded input. This works in practice, but has not been tested with concurrent KFuzzTest executions yet.
* kfuzztest: introduce syz_kfuzztest_run pseudo-syscallEthan Graham2025-09-221-0/+59
| | | | | | | | | | | | | Add syz_kfuzztest_run pseudo-syscall, KFuzzTest attribute, and encoding logic. KFuzzTest targets, which are invoked in the executor with the new syz_kfuzztest_run pseudo-syscall, require specialized encoding. To differentiate KFuzzTest calls from standard syzkaller calls, we introduce a new attribute called KFuzzTest or "kfuzz_test" in syzkaller descriptions that can be used to annotate calls. Signed-off-by: Ethan Graham <ethangraham@google.com>
* pkg/ipc: pass only exec encoding to ExecDmitry Vyukov2024-04-161-5/+5
| | | | | | | Does not require passing text program to ipc.Env.Exec. Make it possible to provide just the exec encoding. This requires moving fallback coverage to the host since it need the program.
* prog: include number of calls into exec encodingDmitry Vyukov2024-04-161-0/+1
| | | | | | Prepend total number of calls to the exec encoding. This will allow pkg/ipc to better parse executor response without full parsing of the encoded program.
* prog: don't require preallocated buffer for exec encodingDmitry Vyukov2024-04-161-19/+7
| | | | | | If we send exec encoding to the fuzzer, it's not necessary to serialize exec encoding into existing buffer (currnetly we serialize directly into shmem). So simplify code by serializing into a new slice.
* prog: more compact exec encoding for addressesDmitry Vyukov2024-04-151-4/+16
| | | | | | | | | | 1. Don't write size/flags for addresses. 2. Write address w/o data offset (fewer bytes in leb128 encoding). Median exec size shrinks by 25%: - exec sizes: 10%:584 50%:1423 90%:7076 + exec sizes: 10%:448 50%:1065 90%:6319
* prog: don't pad data in exec encodingDmitry Vyukov2024-04-151-9/+4
| | | | | | | | With leb128 ints it does not make any sense. Reduces exec sizes a bit more: - exec sizes: 10%:597 50%:1438 90%:7145 + exec sizes: 10%:584 50%:1423 90%:7076
* prog: use leb128 for exec encodingDmitry Vyukov2024-04-151-2/+3
| | | | | | | | | | | | Switch from uint64 to leb128 encoding for integers. This almost more than halves serialized size: - exec sizes: 10%:2160 50%:4792 90%:14288 + exec sizes: 10%:597 50%:1438 90%:7145 and makes it smaller than the text serialization: text sizes: 10%:837 50%:1591 90%:10156
* all: replace collide mode by `async` call propertyAleksandr Nogikh2021-12-101-1/+7
| | | | | | | | | | | | | Replace the currently existing straightforward approach to race triggering (that was almost entirely implemented inside syz-executor) with a more flexible one. The `async` call property instructs syz-executor not to block until the call has completed execution and proceed immediately to the next call. The decision on what calls to mark with `async` is made by syz-fuzzer. Ultimately this should let us implement more intelligent race provoking strategies as well as make more fine-grained reproducers.
* all: refactor fault injection into call propsAleksandr Nogikh2021-09-221-3/+7
| | | | | | | | | | | | Now that call properties mechanism is implemented, we can refactor fault injection. Unfortunately, it is impossible to remove all traces of the previous apprach. In reprolist and while performing syz-ci jobs, syzkaller still needs to parse the old format. Remove the old prog options-based approach whenever possible and replace it with the use of call properties.
* all: introduce call propertiesAleksandr Nogikh2021-09-221-1/+16
| | | | | | | | | Call properties let us specify how each individual call within a program must be executed. So far the only way to enforce extra rules was to pass extra program-level properties (e.g. that is how fault injection was done). However, it entangles the logic and not flexible enough. Implement an ability to pass properties along with each individual call.
* prog: detect copyout overflowDmitry Vyukov2021-03-041-1/+3
| | | | | | Detect the case when a program requires more copyout than executor can handle. Curretnly these result in: "SYZFAIL: command refers to bad result" failures. Now syz-fuzzer should ignore them.
* syz-fuzzer: ignore encodingexec buffer overflow errorsDmitry Vyukov2020-10-011-1/+4
| | | | | | | We started to see lots of "provided buffer is too small" with seeded syz_mount_image programs. Currently it fails whole VM, which is not good. Ignoring them is not perfect, but there does not seem to be any better simple solution.
* prog: simplify execContext.writeDmitry Vyukov2020-06-231-5/+1
|
* ipc: fix endianness issuesAlexander Egorenkov2020-06-231-8/+5
| | | | | | | | Use native byte-order for IPC and program serialization. This way we will be able to support both little- and big-endian architectures. Signed-off-by: Alexander Egorenkov <Alexander.Egorenkov@ibm.com>
* prog/encodingexec: pad data args with zero bytesAlexander Egorenkov2020-06-221-0/+1
| | | | | | | | We must pad data arguments with known values when serializing them into the given destination buffer because it could be reused and contain random bytes from previous use. Signed-off-by: Alexander Egorenkov <Alexander.Egorenkov@ibm.com>
* prog: remove Dir from TypeDmitry Vyukov2020-05-011-1/+1
| | | | | | | | | | | | | | | | | | Having Dir is Type is handy, but forces us to duplicate lots of types. E.g. if a struct is referenced as both in and out, then we need to have 2 copies and 2 copies of structs/types it includes. If also prevents us from having the struct type as struct identity (because we can have up to 3 of them). Revert to the old way we used to do it: propagate Dir as we walk syscall arguments. This moves lots of dir passing from pkg/compiler to prog package. Now Arg contains the dir, so once we build the tree, we can use dirs as before. Reduces size of sys/linux/gen/amd64.go from 6058336 to 5661150 (-6.6%). Update #1580
* executor: increase input buffer sizeDmitry Vyukov2020-02-101-1/+1
| | | | | | | I bumped input buffer size on Go side in: a2af37f0 prog: increase encodingexec buffer size But I forgot to increase the size on the executor side. Do this and add comments re keeping them in sync.
* prog: increase encodingexec buffer sizeDmitry Vyukov2020-01-181-1/+1
| | | | | Some of the programs involving netfilter syscalls produce errors about insufficient buffer size. Bump it more.
* pkg/compiler: fix bitfield layout bugDmitry Vyukov2019-12-201-0/+1
| | | | | | Fixes #1542 Found thanks to syz-check. Update #590
* prog: refactor bitfields representationDmitry Vyukov2019-12-191-2/+2
| | | | | | | | All callers of BitfieldMiddle just want static size (0 for middle). Make it so: Size for middle bitfields just returns 0. Removes lots of if's. Introduce Type.UnitSize, which now holds the underlying type for bitfields. This will be needed to fix #1542 b/c even if UnitSize=4 for last bitfield Size can be anywhere from 0 to 4 (not necessary equal to UnitSize due to overlapping).
* prog, pkg/csource: more readable serialization for stringsDmitry Vyukov2018-12-151-1/+10
| | | | | | | Always serialize strings in readable format (non-hex). Serialize binary data in readable format in more cases. Fixes #792
* prog: add concept of "special pointers"Dmitry Vyukov2018-08-301-7/+0
| | | | | | | | | | | | | | | | | Currently we only generate either valid user-space pointers or NULL. Extend NULL to a set of special pointers that we will use in programs. All targets now contain 3 special values: - NULL - 0xfffffffffffffff (invalid kernel pointer) - 0x999999999999999 (non-canonical address) Each target can add additional special pointers on top of this. Also generate NULL/special pointers for non-opt ptr's. This restriction was always too restrictive. We may want to generate them with very low probability, but we do want to generate them. Also change pointers to NULL/special during mutation (but still not in the opposite direction).
* prog: introduce debugValidateDmitry Vyukov2018-08-021-5/+1
| | | | | | Move debug validation into a separate function. Update #538
* prog: refactor SerializeForExecDmitry Vyukov2018-08-021-94/+103
| | | | | | | Factor copyin, copyout and checksums into separate functions. Also slightly tidy csum analysis. Update #538
* prog: refactor SerializeForExecDmitry Vyukov2018-07-311-113/+117
| | | | | | Reduce cyclomatic complexity. Update #538
* prog, pkg/compiler: support fmt typeDmitry Vyukov2018-07-081-11/+9
| | | | | fmt type allows to convert intergers and resources to string representation.
* prog: make c.Ret optionalDmitry Vyukov2018-05-051-1/+1
| | | | | No reason to allocate return value if there is no return type. c.Ret == nil is the reasonable indication that this is a "void" call.
* prog: simplify codeDmitry Vyukov2018-05-051-10/+4
| | | | | | Now that we don't have ReturnArg and only ResultArg's refer to other ResultArg's we can remove ArgUser/ArgUsed and devirtualize lots of code.
* prog: remove ReturnArgDmitry Vyukov2018-05-051-3/+8
| | | | It's not all that needed.
* executor: use proper default values for resourcesDmitry Vyukov2018-02-261-0/+1
| | | | | | | | | We currently use -1 as default value for resources when the actual value is not available. -1 is good for fd's, but is not the right default value for pointers/keys/etc. Pass from prog and use in executor proper default value for resources.
* pkg/compiler: allow unions as syscall argumentsDmitry Vyukov2018-02-231-0/+2
| | | | | If all union options can be syscall arguments, allow the union itself as syscall argument.
* prog: rework address allocationDmitry Vyukov2018-02-191-8/+2
| | | | | | | | | | | | 1. mmap all memory always, without explicit mmap calls in the program. This makes lots of things much easier and removes lots of code. Makes mmap not a special syscall and allows to fuzz without mmap enabled. 2. Change address assignment algorithm. Current algorithm allocates unmapped addresses too frequently and allows collisions between arguments of a single syscall. The new algorithm analyzes actual allocations in the program and places new arguments at unused locations.
* prog: fix PhysicalAddr for NULL addressesDmitry Vyukov2018-02-191-9/+8
| | | | | | Turns out we never produced NULL pointers because what's meant to be NULL pointer was actually encoded as pointer to beginning of the data region.
* prog: merge foreachSubargOffset into foreachArgImplDmitry Vyukov2018-02-191-23/+20
|
* prog: rework foreachArgDmitry Vyukov2018-02-191-5/+2
| | | | | | | | Make Foreach* callback accept the arg and a context struct that can contain lots of aux info. This (1) removes lots of unuser base/parent args, (2) provides foundation for stopping recursion, (3) allows to merge foreachSubargOffset.
* prog: unexport Args and PyPhysicalAddrDmitry Vyukov2018-02-171-20/+3
|
* prog: give special type generators access to targetDmitry Vyukov2018-02-171-3/+3
|
* pkg/csource: fix handling of proc typesDmitry Vyukov2017-12-221-20/+20
| | | | | | | | | | Generated program always uses pid=0 even when there are multiple processes. Make each process use own pid. Unfortunately required to do quite significant changes to prog, because the current format only supported fixed pid. Fixes #490
* prog: use dense indexes for copyout instructionsDmitry Vyukov2017-12-171-13/+20
| | | | Fixes #174
* prog: add DeserializeExecDmitry Vyukov2017-12-171-17/+30
| | | | | | | | | Factor out program parsing from pkg/csource. csource code that parses program and at the same time formats output is very messy and complex. New aproach also allows to understand e.g. when a call has copyout instructions which is useful for better C source output.
* prog: remove unused writeArg argumentDmitry Vyukov2017-12-171-5/+6
|
* prog: minor refactoring around argumentsDmitry Vyukov2017-12-171-4/+3
| | | | | | Introduce isUsed(arg) helper, use it in several places. Move method definitions closer to their types. Simplify presence check for ArgUsed.Used() in several places.
* prog: don't serialize output data argsDmitry Vyukov2017-12-171-5/+7
| | | | | | | | Fixes #188 We now will write just ""/1000 to denote a 1000-byte output buffer. Also we now don't store 1000-byte buffer in memory just to denote size. Old format is still parsed.
* pkg/ipc: don't send program padding to executorDmitry Vyukov2017-10-121-3/+4
| | | | | | Currently we always send 2MB of data to executor in ipc_simple.go. Send only what's consumed by the program, and don't send the trailing zeros. Serialized programs usually take only few KBs.
* prog: remove default target and all global stateDmitry Vyukov2017-09-151-12/+14
| | | | | | Now each prog function accepts the desired target explicitly. No global, implicit state involved. This is much cleaner and allows cross-OS/arch testing, etc.
* prog, sys: move types to progDmitry Vyukov2017-09-051-5/+0
| | | | | | | | | | | Large overhaul moves syscalls and arg types from sys to prog. Sys package now depends on prog and contains only generated descriptions of syscalls. Introduce prog.Target type that encapsulates all targer properties, like syscall list, ptr/page size, etc. Also moves OS-dependent pieces like mmap call generation from prog to sys. Update #191
* prog: dot-import sysDmitry Vyukov2017-09-051-3/+3
| | | | In preparation for moving sys types to prog to reduce later diffs.
* prog: move ptrSize const to testDmitry Vyukov2017-09-041-1/+0
| | | | It is used only by a single test. Remove it from non-test code.
* sys, prog: switch values to to uint64Dmitry Vyukov2017-08-191-17/+17
| | | | | | | | | | We currently use uintptr for all values. This won't work for 32-bit archs. Moreover in some cases we use uintptr but assume that it is always 64-bits (e.g. in encodingexec). Switch everything to uint64. Update #324
generated by ggit (джигит) mrf-deployment (git 2.46.0) at 2026-03-12 01:53:22 +0000