aboutsummaryrefslogtreecommitdiffstats
path: root/prog/prog_test.go
Commit message (Collapse)AuthorAgeFilesLines
* prog: annotate image assets with fsck logsFlorent Revest2024-12-091-0/+16
| | | | | | | | | | | | | | | | | | Syscall attributes are extended with a fsck command field which lets file system mount definitions specify a fsck-like command to run. This is required because all file systems have a custom fsck command invokation style. When uploading a compressed image asset to the dashboard, syz-manager also runs the fsck command and logs its output over the dashapi. The dashboard logs these fsck logs into the database. This has been requested by fs maintainer Ted Tso who would like to quickly understand whether a filesystem is corrupted or not before looking at a reproducer in more details. Ultimately, this could be used as an early triage sign to determine whether a bug is obviously critical.
* prog: replace MinimizeParams with MinimizeModeDmitry Vyukov2024-08-071-1/+1
| | | | | | | | | | | | | | All callers shouldn't control lots of internal details of minimization (if we have more params, that's just more variations to test, and we don't have more, params is just a more convoluted way to say if we minimize for corpus or a crash). 2 bools also allow to express 4 options, but only 3 make sense. Also when I see MinimizeParams{} in the code, it's unclear what it means. Replace params with mode. And potentially "crash" minimization is not "light", it's just different. E.g. we can simplify int arguments for reproducers (esp in snapshot mode), but we don't need that for corpus.
* prog: make minimization parameters explicitAleksandr Nogikh2024-05-271-1/+1
| | | | Add an explicit parameter to only run call removal.
* all: adapt all cover and sig to 64bitJoey Jiao2024-05-271-13/+13
| | | | | | | | | | | | | | | | | | Taken some arm64 devices for example: kaslr_offset is diff at bits 12-40, and kernel modules are loaded at 2GB space, so we have `ffffffd342e10000 T _stext` where uppper 32bit is ffffffd3. However, if we check modules range, the 1st module is loaded at 0xffffffd2eeb2a000, while the last module is loaded at 0xffffffd2f42c4000. We can see the upper 32bits are diff for core kernel and modules. If we use current 32bits for covered PC, we will get wrong module address recovered. So we need to move to 64bit cover and signal: - change cover/sig to 64bit to fit for syz-executor change - remove kernel upper base logic as kernel upper base is not a constant when kaslr enabled for core kernel and modules. - remove unused pcBase
* tools/syz-linter: check t.Logf/Errorf/Fatalf messagesDmitry Vyukov2024-04-171-1/+1
| | | | | Fix checking of Logf, it has string in 0-th arg. Add checking of t.Errorf/Fatalf.
* pkg/testutil: add RandSource helperDmitry Vyukov2022-11-231-1/+1
| | | | | The code to send rand source is dublicated in several packages. Move it to testutil package.
* pkg/mgrconfig, prog, syz-fuzzer: manager-configurable syscall mutationHrutvik Kanabar2022-09-221-1/+1
| | | | | | | | | | | | | | | | | | Allow manager configuration to specify that certain syscalls should not be mutated. This is expected to be useful when mutating certain syscalls is unlikely to produce interesting executions. For example, mutating a `syz_mount_image` call will likely produce a corrupt image. Some implementation details: - Add a `no_mutate_syscalls` manager config entry, with the same format as `enable_syscalls`. Ensure this is parsed and stored in the config as a set of syscall IDs. - Send this set to fuzzers when they connect to their managers via RPC. Ensure each fuzzer stores a copy of the set. - When mutating arguments of a syscall, check first whether it has been specified as non-mutatable. - For all mutations not managed by a `syz-manager`, retain previous behaviour by ensuring that no syscalls are considered non-mutable.
* prog: pass ctx by pointer to ForeachType callbackDmitry Vyukov2022-01-111-2/+2
| | | | | This will allow callbacks to stop iteration early by setting ctx.Stop flag (as it works for ForeachArg).
* pkg/testutil: add packageDmitry Vyukov2021-12-211-1/+3
| | | | | | | | Add package with RaceEnabled const that can be used in test to skip long tests in race mode. Switch existing tests to use the new package. Update #2886
* prog: reduce size of tests in race modeDmitry Vyukov2020-10-011-0/+3
| | | | | More race timeouts on CI. Exclude more tests. This reduces prog test time fron 81 to 15 sec with GOMAXPROCS=1.
* sys/targets: fix mknod neutralize for netbsdDmitry Vyukov2020-06-231-14/+21
| | | | | mknod on netbsd can now also accept a resource for the last arg. Fix that and add a test that will catch such things more reliably.
* prog: support disabled attributeDmitry Vyukov2020-05-041-7/+17
| | | | | Update #477 Update #502
* prog: remove StructDescDmitry Vyukov2020-05-031-10/+8
| | | | | | | | | | | | Remove StructDesc, KeyedStruct, StructKey and all associated logic/complexity in prog and pkg/compiler. We can now handle recursion more generically with the Ref type, and Dir/FieldName are not a part of the type anymore. This makes StructType/UnionType simpler and more natural. Reduces size of sys/linux/gen/amd64.go from 5201321 to 4180861 (-20%). Update #1580
* prog: remove Dir from TypeDmitry Vyukov2020-05-011-6/+11
| | | | | | | | | | | | | | | | | | Having Dir is Type is handy, but forces us to duplicate lots of types. E.g. if a struct is referenced as both in and out, then we need to have 2 copies and 2 copies of structs/types it includes. If also prevents us from having the struct type as struct identity (because we can have up to 3 of them). Revert to the old way we used to do it: propagate Dir as we walk syscall arguments. This moves lots of dir passing from pkg/compiler to prog package. Now Arg contains the dir, so once we build the tree, we can use dirs as before. Reduces size of sys/linux/gen/amd64.go from 6058336 to 5661150 (-6.6%). Update #1580
* prog: add ignore_return and breaks_returns call attribtuesDmitry Vyukov2020-04-191-4/+4
| | | | | We had these hard-coded for fuchsia and linux accordingly. Replace with call attributes.
* prog: rename target.SanitizeCall to NeutralizeDmitry Vyukov2020-03-171-3/+1
| | | | | | | | | | | | | We will need a wrapper for target.SanitizeCall that will do more than just calling the target-provided function. To avoid confusion and potential mistakes, give the target function and prog function different names. Prog package will continue to call this "sanitize", which will include target's "neutralize" + more. Also refactor API a bit: we need a helper function that sanitizes the whole program because that's needed most of the time. Fixes #477 Fixes #502
* prog: don't add fallback coverage after clone+ptraceDmitry Vyukov2020-01-151-12/+8
| | | | | clone+ptrace combo cause fallback coverage explosion under gvisor. Mechanics of that are unclear, but effect is very clear.
* prog: don't add fallback coverage after prctlDmitry Vyukov2020-01-151-0/+34
| | | | The same reason as with seccomp.
* tools: add syz-expandAndrey Konovalov2019-09-231-4/+24
| | | | | | | The syz-expand tools allows to parse a program and print it including all the default values. This is mainly useful for debugging, like doing manual program modifications while trying to come up with a reproducer for some particular kernel behavior.
* prog: add implementation for resource centricVeronica Radu2019-09-031-2/+2
|
* all: switch to Go 1.12Dmitry Vyukov2019-03-141-5/+5
| | | | | | | | Differences in code formatting between Go versions cause constant problems for us (https://github.com/golang/go/issues/25161). Currently we support 1.9 and 1.10. Switch to newer 1.11 and 1.12. Fixes #1013
* all: reformat with Go 1.10Dmitry Vyukov2019-02-111-5/+5
|
* sys/linux: add NDISC packet formats to vnet.txtDan Robertson2019-02-111-5/+5
| | | | Add the basic NDISC (RFC 4861) packet formats to sys/linux/vnet.txt.
* prog, pkg/{csource,ifuzz,ipc,repro}: make tests deterministic on travisDmitry Vyukov2019-01-021-4/+1
| | | | | Don't use random seed on travis as it produces flaky coverage reports, and probably generally better for CI setting.
* prog: implement strict parsing modeDmitry Vyukov2018-12-101-4/+4
| | | | | | | Add bulk of checks for strict parsing mode. Probably not complete, but we can extend then in future as needed. Turns out we can't easily use it for serialized programs as they omit default args and during deserialization it looks like missing args.
* prog: introduce strict parsing modeDmitry Vyukov2018-12-101-5/+5
| | | | | | | | | | | Over time we relaxed parsing to handle all kinds of invalid programs (excessive/missing args, wrong types, etc). This is useful when reading old programs from corpus. But this is harmful for e.g. reading test inputs as they can become arbitrary outdated. For runtests which creates additional problem of executing not what is actually written in the test (or at least what author meant). Add strict parsing mode that does not tolerate any errors. For now it just checks excessive syscall arguments.
* prog: export Type.DefaultArgDmitry Vyukov2018-12-061-1/+1
| | | | | It's effectively exported anyway. So export it the proper way.
* prog: allow escaping paths but don't generate themDmitry Vyukov2018-11-021-13/+4
| | | | | | | | | | | Filename generated escaping paths in the past. The reason for the check during validation is to wipe old program from corpuses. Now that they are hopefully wiped everywhere, we can relax the check to restrict only filename to not produce escaping paths, but allow existing programs with escaping paths. This is useful in particular if we generate syzkaller programs from strace output.
* sys/openbsd: disable mknod sanitization as tests failDmitry Vyukov2018-08-301-0/+16
| | | | | | | TestSerializeDeserializeRandom fails from time to time because program is different after we serialize/deserialize it. Turns out openbsd SanitizeCall is not idempotent. Add a test for this and disable the logic for now.
* prog: don't add fallback signal after seccompDmitry Vyukov2018-08-191-0/+153
| | | | | seccomp filter can produce arbitrary errno values for subsequent syscalls. Don't trust anything afterwards.
* prog: refactor defaultArg/isDefaultArgDmitry Vyukov2018-08-021-2/+2
| | | | | | Refactor from single-big-switch to type methods. Update #538
* executor: overhaulDmitry Vyukov2018-07-241-2/+2
| | | | | | | | | | | | | | | | | Make as much code as possible shared between all OSes. In particular main is now common across all OSes. Make more code shared between executor and csource (in particular, loop function and threaded execution logic). Also make loop and threaded logic shared across all OSes. Make more posix/unix code shared across OSes (e.g. signal handling, pthread creation, etc). Plus other changes along similar lines. Also support test OS in executor (based on portable posix) and add 4 arches that cover all execution modes (fork server/no fork server, shmem/no shmem). This change paves way for testing of executor code and allows to preserve consistency across OSes and executor/csource.
* prog: don't generate filenames that escape sandboxDmitry Vyukov2018-07-081-0/+34
| | | | | | All files that fuzzer works with must be in the working dir. Using "/" is known to cause problems when fuzzer removes files there or mounts something.
* sys: dedup mmap code across OSesDmitry Vyukov2018-05-061-24/+21
| | | | Update #538
* prog: parallelize testsDmitry Vyukov2018-05-041-0/+1
| | | | | Parallelize more tests and reduce number of iterations in random tests under race detector.
* prog: fix isDefaultArgDmitry Vyukov2018-03-081-4/+8
| | | | | Test that isDefaultArg returns true for result of DefaultArg. Fix few bugs uncovered by this test.
* prog: rework address allocationDmitry Vyukov2018-02-191-8/+10
| | | | | | | | | | | | 1. mmap all memory always, without explicit mmap calls in the program. This makes lots of things much easier and removes lots of code. Makes mmap not a special syscall and allows to fuzz without mmap enabled. 2. Change address assignment algorithm. Current algorithm allocates unmapped addresses too frequently and allows collisions between arguments of a single syscall. The new algorithm analyzes actual allocations in the program and places new arguments at unused locations.
* prog: reorder Minimize argumentsDmitry Vyukov2018-02-191-2/+2
| | | | | Make the predicate the last argument. It's more common and convenient (arguments are not separated by multiple lines).
* prog: fix TestSpecialStructsDmitry Vyukov2018-01-311-0/+3
| | | | | We should not try to generate/mutate output arguments. SpecialTypes generators are meant to accept inout arguments.
* sys/linux: extend netfilter descriptionsDmitry Vyukov2018-01-271-0/+28
|
* prog: add test for cross-arch deserializationDmitry Vyukov2018-01-091-0/+77
| | | | | | | | | | | | | | | | | | | | | | | Few managers recently crashed with: panic: syscall mknod$loop: per proc arg 'proc' has bad value '4294967295' panic: sync: unlock of unlocked mutex goroutine 35438 [running]: sync.(*Mutex).Unlock(0xc42166e0c8) sync/mutex.go:184 +0xc1 panic(0xb98980, 0xc448971aa0) runtime/panic.go:491 +0x283 main.(*Manager).Connect(0xc42166e000, 0xc42056d060, 0xc42038f000, 0x0, 0x0) syz-manager/manager.go:868 +0x11cc And a similar issue was reported on mailing list. It's unclear where these bogus programs come from. It seems that hub was somehow involved here. 4294967295 is (uint32)-1 which is trucated special value for proc types. The test did not uncover any bugs, bug since I wrote it and it looks like a useful test, let's commit it anyway.
* sys: move test syscalls to a separate targetDmitry Vyukov2017-12-171-1/+1
| | | | | | We have them in linux solely for historical reasons. Fixes #462
* prog: remove default target and all global stateDmitry Vyukov2017-09-151-16/+16
| | | | | | Now each prog function accepts the desired target explicitly. No global, implicit state involved. This is much cleaner and allows cross-OS/arch testing, etc.
* syz-manager/mgrconfig: explicitly specify target in configDmitry Vyukov2017-09-151-2/+0
| | | | | Add target config parameter (e.g. linux/amd64) which controls target OS/arch. No more explicit assumptions about target.
* prog, sys: move types to progDmitry Vyukov2017-09-051-26/+9
| | | | | | | | | | | Large overhaul moves syscalls and arg types from sys to prog. Sys package now depends on prog and contains only generated descriptions of syscalls. Introduce prog.Target type that encapsulates all targer properties, like syscall list, ptr/page size, etc. Also moves OS-dependent pieces like mmap call generation from prog to sys. Update #191
* prog: dot-import sysDmitry Vyukov2017-09-051-4/+4
| | | | In preparation for moving sys types to prog to reduce later diffs.
* sys: rename Call to SyscallDmitry Vyukov2017-09-051-3/+3
| | | | | In preparation for moving sys types to prog to avoid confusion between sys.Call and prog.Call.
* sys, prog: switch values to to uint64Dmitry Vyukov2017-08-191-1/+1
| | | | | | | | | | We currently use uintptr for all values. This won't work for 32-bit archs. Moreover in some cases we use uintptr but assume that it is always 64-bits (e.g. in encodingexec). Switch everything to uint64. Update #324
* prog: fix restoration of default argumentsDmitry Vyukov2017-08-091-0/+16
| | | | | | | | Currently fails on: - pointers - VMAs - structs - fixed-size structs
* prog: generate missing syscall args when decodingAndrey Konovalov2017-08-011-0/+9
| | | | | | | | After a change in syscall description the number of syscall arguments might change and some of the programs in corpus get invalidated. This change makes syzkaller to generate missing arguments when decoding a program as an attempt to fix and keep more programs from corpus.
generated by ggit (джигит) mrf-deployment (git 2.46.0) at 2026-03-11 17:39:21 +0000