aboutsummaryrefslogtreecommitdiffstats
path: root/prog/hints_test.go
Commit message (Collapse)AuthorAgeFilesLines
* prog: skip large calls in TestHintsRandomAleksandr Nogikh2025-05-231-3/+11
| | | | | | | | | In the test mode that sets debug=true, MutateWithHints is essentially quadratic to the prog(call) size due to numerous validation checks. Skip calls that are too large in order to prevent test hangs. Closes #5637.
* all: follow new linter recommendationsTaras Madan2024-09-101-1/+1
|
* prog: restricts hints to at most 10 attempts per single kernel PCDmitry Vyukov2024-07-221-5/+77
| | | | | | | | | We are getting too many generated candidates, the fuzzer may not keep up with them at all (hints jobs keep growing infinitely). If a hint indeed came from the input w/o transformation, then we should guess it on the first attempt (or at least after few attempts). If it did not come from the input, or came with a non-trivial transformation, then any number of attempts won't help. So limit the total number of attempts (until the next restart).
* prog: reduce amount of hint replacementsDmitry Vyukov2024-07-021-15/+87
| | | | | | | | | | | | | | | | | | | | Several optimizations to reduce amount of hint replacements: 1. Don't mutate int's that are <= 8 bits. 2. Don't mutate data that is <= 3 bytes. 3. Restrict mutation of len only value >10 and < 1<<20. Values <= 10 we can produce during normal mutation. Values > 1<<20 are presumably not length of something and we have logic to produce various large bogus lengths. 4. Include all small ints <= 16 into specialInts and remove 31, 32, 63 (don't remember where they come from). 5. Don't produce other known flags (and combinations) for flags. And a larger part computes groups of related arguments so that we don't try to produce known ioctl's from other known ioctl's, and similarly for socket/socketpair/setsockopt/etc. See comments in Target.initRelatedFields for details. Update #477
* pkg/fuzzer: deflake comparisonsAleksandr Nogikh2024-05-151-0/+19
| | | | | | Do two exec hints to only leave stable comparison argument pairs. In local experiments, it allows to reduce their count by 30-40% (on average).
* prog: enable MutateWithHints() abortionAleksandr Nogikh2024-03-141-6/+10
| | | | | The call may potentially generate a very large number of possible mutations. Add a way to abort the process.
* prog: mutate compressed images with hintsDmitry Vyukov2022-12-221-1/+95
| | | | | | | | | | | | | | | | | | | | | | Images are very large so the generic algorithm for data arguments can produce too many mutants. For images we consider only 4/8-byte aligned ints. This is enough to handle all magic numbers and checksums. We also ignore 0 and ^uint64(0) source bytes, because there are too many of these in lots of images. With this change the fuzzer was able to get past magic checks in all of the following functions with our fake images: - in fs/befs/super.c befs_check_sb()  - in fs/freevxfs/vxfs_super.c vxfs_fill_super()  - in fs/hpfs/super.c hpfs_fill_super()  - in fs/omfs/inode.c omfs_fill_super()  - in fs/qnx6/inode.c qnx6_check_first_superblock()  - in fs/ufs/super.c ufs_fill_super() And even successfully mounted sysv filesystem and triggered "sleeping function called from invalid context in __getblk_gfp" when opening a file in the mounted filesystem.
* tools/syz-linter: fix comments checkDmitry Vyukov2020-07-101-1/+1
| | | | | | | Turns out ast.Inspect does not visit most comments. Walk file.Comments manually. Update #1876
* prog: refactor hints testsDmitry Vyukov2020-05-051-9/+11
| | | | | | | The way the tests fabricate types dynamically creates problems during any non-trivial changes to prog package. Use existing types from descriptions instead.
* prog: support disabled attributeDmitry Vyukov2020-05-041-2/+4
| | | | | Update #477 Update #502
* prog: introduce Field typeDmitry Vyukov2020-05-021-1/+1
| | | | | | | | | | | | | Remvoe FieldName from Type and add a separate Field type that holds field name. Use Field for struct fields, union options and syscalls arguments, only these really have names. Reduces size of sys/linux/gen/amd64.go from 5665583 to 5201321 (-8.2%). Allows to not create new type for squashed any pointer. But main advantages will follow, e.g. removing StructDesc, using TypeRef in Arg, etc. Update #1580
* prog: remove Dir from TypeDmitry Vyukov2020-05-011-4/+4
| | | | | | | | | | | | | | | | | | Having Dir is Type is handy, but forces us to duplicate lots of types. E.g. if a struct is referenced as both in and out, then we need to have 2 copies and 2 copies of structs/types it includes. If also prevents us from having the struct type as struct identity (because we can have up to 3 of them). Revert to the old way we used to do it: propagate Dir as we walk syscall arguments. This moves lots of dir passing from pkg/compiler to prog package. Now Arg contains the dir, so once we build the tree, we can use dirs as before. Reduces size of sys/linux/gen/amd64.go from 6058336 to 5661150 (-6.6%). Update #1580
* prog: simplify hints testDmitry Vyukov2020-04-281-14/+1
| | | | | It assumes too much about prog internals. Parse complete program instead.
* prog: don't use spaces in hints test namesDmitry Vyukov2020-03-241-27/+27
| | | | | | | Spaces are replaced with _ in testing output. The first thing you do on failure is search for the test name. No match. Figure out spaces were replaced. Replace each _ in the name with space. Counterproductive.
* prog: add helper to hints testsDmitry Vyukov2020-03-241-58/+64
| | | | Add a help to create uint64 sets with less code.
* prog: add size checks for const arguments during hints mutationVeronica Radu2019-10-031-54/+155
| | | | Update #507
* prog: use type size when generating/mutating intsVeronica Radu2019-09-231-4/+4
| | | | Update #1381
* prog: measure memory allocation in benchmarksDmitry Vyukov2019-08-131-7/+2
| | | | | | Enable ReportAllocs. Also factor out common code into a helper function (duplicated in 3 places now).
* Update hints_test.gohoujingyi2019-01-071-4/+4
|
* prog: don't produce the same program when mutating with hintsDmitry Vyukov2019-01-031-7/+8
| | | | | No point in producing the same program as result of mutation with hints. So don't do it.
* prog: remove several sources of non-determinismDmitry Vyukov2019-01-031-17/+20
| | | | | | | | | | | | | | Non-determinism is bad: - it leads to flaky coverage reports - it makes test failures non-reproducible Remove 4 sources of non-determinism related to maps: - file name generation - string generation - resource generation - hints generation All a test that ensures all main operations are fully deterministic.
* executor: overhaulDmitry Vyukov2018-07-241-1/+1
| | | | | | | | | | | | | | | | | Make as much code as possible shared between all OSes. In particular main is now common across all OSes. Make more code shared between executor and csource (in particular, loop function and threaded execution logic). Also make loop and threaded logic shared across all OSes. Make more posix/unix code shared across OSes (e.g. signal handling, pthread creation, etc). Plus other changes along similar lines. Also support test OS in executor (based on portable posix) and add 4 arches that cover all execution modes (fork server/no fork server, shmem/no shmem). This change paves way for testing of executor code and allows to preserve consistency across OSes and executor/csource.
* prog: parallelize testsDmitry Vyukov2018-05-041-0/+3
| | | | | Parallelize more tests and reduce number of iterations in random tests under race detector.
* prog: fix gometalinter warningsDmitry Vyukov2018-04-241-1/+1
|
* prog: support big-endian during hints matchingDmitry Vyukov2018-04-011-1/+30
| | | | | | | | | | | | Use big-endian match/replace for both blobs and ints. Sometimes we have unmarked blobs (no little/big-endian info); for ANYBLOBs we intentionally lose all marking; but even for marked ints we may need this too. Consider that kernel code does not convert the data (i.e. not ntohs(pkt->proto) == ETH_P_BATMAN), but instead converts the constant (i.e. pkt->proto == htons(ETH_P_BATMAN)). In such case we will see dynamic operand that does not match what we have in the program.
* prog: return concrete arg types from Make functionsDmitry Vyukov2018-02-241-1/+1
| | | | This removes a bunch of type assertions and makes code type safer.
* prog: rework address allocationDmitry Vyukov2018-02-191-1/+1
| | | | | | | | | | | | 1. mmap all memory always, without explicit mmap calls in the program. This makes lots of things much easier and removes lots of code. Makes mmap not a special syscall and allows to fuzz without mmap enabled. 2. Change address assignment algorithm. Current algorithm allocates unmapped addresses too frequently and allows collisions between arguments of a single syscall. The new algorithm analyzes actual allocations in the program and places new arguments at unused locations.
* prog: rework foreachArgDmitry Vyukov2018-02-191-2/+2
| | | | | | | | Make Foreach* callback accept the arg and a context struct that can contain lots of aux info. This (1) removes lots of unuser base/parent args, (2) provides foundation for stopping recursion, (3) allows to merge foreachSubargOffset.
* pkg/compiler: support void typeDmitry Vyukov2018-01-131-1/+1
| | | | | | "void": type with static size 0 mostly useful inside of templates and varlen unions can't be syscall argument
* prog: don't serialize output data argsDmitry Vyukov2017-12-171-16/+20
| | | | | | | | Fixes #188 We now will write just ""/1000 to denote a 1000-byte output buffer. Also we now don't store 1000-byte buffer in memory just to denote size. Old format is still parsed.
* sys: move test syscalls to a separate targetDmitry Vyukov2017-12-171-15/+2
| | | | | | We have them in linux solely for historical reasons. Fixes #462
* prog: speedup and simplify hints codeDmitry Vyukov2017-12-081-4/+7
| | | | | | | | | | | | | Clone program only once. Preallocate slices in clone. Remove the clone full mode. Always mutate args in place. Allocate replacers map lazily. Don't allocate res map at all (calculate valus on the go). Remove sliceToUint64, pad. benchmark old ns/op new ns/op delta BenchmarkHints 122100048 7466013 -93.89%
* prog: fix a data raceDmitry Vyukov2017-12-081-0/+29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The race initially showed up on the new benchmark (see race report below). The race indicated a wrong call passed to replaceArg, as the result we sanitized the wrong call and left the new call un-sanitized. Fix this. Add test that exposes this. Run benchmarks in race mode during presubmit (benchmarks have higher chances of uncovering races than tests). WARNING: DATA RACE Write at 0x00c42000d3f0 by goroutine 18: github.com/google/syzkaller/sys/linux.(*arch).sanitizeCall() sys/linux/init.go:155 +0x256 github.com/google/syzkaller/sys/linux.(*arch).(github.com/google/syzkaller/sys/linux.sanitizeCall)-fm() sys/linux/init.go:42 +0x4b github.com/google/syzkaller/prog.(*Prog).replaceArg() prog/prog.go:357 +0x239 github.com/google/syzkaller/prog.generateHints.func2() prog/hints.go:105 +0x124 github.com/google/syzkaller/prog.checkConstArg() prog/hints.go:128 +0xf3 github.com/google/syzkaller/prog.generateHints() prog/hints.go:120 +0x495 github.com/google/syzkaller/prog.(*Prog).MutateWithHints.func1() prog/hints.go:72 +0x67 github.com/google/syzkaller/prog.foreachSubargImpl.func1() prog/analysis.go:86 +0x9f github.com/google/syzkaller/prog.foreachSubargImpl() prog/analysis.go:104 +0xc8 github.com/google/syzkaller/prog.foreachArgArray() prog/analysis.go:113 +0x89 github.com/google/syzkaller/prog.foreachArg() prog/analysis.go:121 +0x50 github.com/google/syzkaller/prog.(*Prog).MutateWithHints() prog/hints.go:71 +0x18e github.com/google/syzkaller/prog.BenchmarkHints.func1() prog/hints_test.go:477 +0x77 testing.(*B).RunParallel.func1() testing/benchmark.go:626 +0x156 Previous read at 0x00c42000d3f0 by goroutine 17: github.com/google/syzkaller/prog.clone() prog/clone.go:38 +0xbaa github.com/google/syzkaller/prog.(*Prog).cloneImpl() prog/clone.go:21 +0x17f github.com/google/syzkaller/prog.generateHints() prog/hints.go:95 +0xd0 github.com/google/syzkaller/prog.(*Prog).MutateWithHints.func1() prog/hints.go:72 +0x67 github.com/google/syzkaller/prog.foreachSubargImpl.func1() prog/analysis.go:86 +0x9f github.com/google/syzkaller/prog.foreachSubargImpl() prog/analysis.go:104 +0xc8 github.com/google/syzkaller/prog.foreachArgArray() prog/analysis.go:113 +0x89 github.com/google/syzkaller/prog.foreachArg() prog/analysis.go:121 +0x50 github.com/google/syzkaller/prog.(*Prog).MutateWithHints() prog/hints.go:71 +0x18e github.com/google/syzkaller/prog.BenchmarkHints.func1() prog/hints_test.go:477 +0x77 testing.(*B).RunParallel.func1() testing/benchmark.go:626 +0x156
* prog: fix hints of data argsDmitry Vyukov2017-12-081-4/+67
| | | | | | | | | | | | Hints for data args don't work. We do all the work, but at the final stage we patch arg in the _old_ program, not in the _new_ one. So programs passed to the callback are all the same and don't contain any mutations. Tests did not catch this because they work right before that point (don't test the actual interface function MutateWithHints). Fix that and add a test that catches this.
* syz-fuzzer: generates hints only for the call that gave new coverageDmitry Vyukov2017-10-231-4/+3
| | | | | | During smashing we know what call gave new coverage, so we can concentrate just on it. This helps to reduce amount of hints generated (we have too many of them).
* prog: fix bugs in hints generationDmitry Vyukov2017-10-231-0/+52
| | | | Add a random hints test and fix bugs it uncovers.
* prog, sys: move types to progDmitry Vyukov2017-09-051-2/+0
| | | | | | | | | | | Large overhaul moves syscalls and arg types from sys to prog. Sys package now depends on prog and contains only generated descriptions of syscalls. Introduce prog.Target type that encapsulates all targer properties, like syscall list, ptr/page size, etc. Also moves OS-dependent pieces like mmap call generation from prog to sys. Update #191
* prog: dot-import sysDmitry Vyukov2017-09-051-3/+3
| | | | In preparation for moving sys types to prog to reduce later diffs.
* sys, pkg/compiler: move padding computation to compilerDmitry Vyukov2017-09-041-1/+1
| | | | This makes types constant during execution, everything is precomputed.
* hints: add some more tests for DataArgVictor Chibotaru2017-09-011-0/+58
|
* hints: add new mutations and testsVictor Chibotaru2017-09-011-0/+282
generated by ggit (джигит) mrf-deployment (git 2.46.0) at 2026-03-11 21:21:58 +0000