aboutsummaryrefslogtreecommitdiffstats
path: root/prog/size.go
Commit message (Collapse)AuthorAgeFilesLines
* all: opt-out some functions to enforce linter checksTaras Madan2025-03-271-0/+1
| | | | New code will be limited to max 7 function params.
* prog: collect parents during arg traversalAleksandr Nogikh2024-03-211-37/+20
| | | | | This spares the need to construct a parents map for len[A, T] and conditional fields calculations.
* prog: support conditional fieldsAleksandr Nogikh2024-02-191-23/+41
| | | | | | | | | | | | | pkg/compiler restructures conditional fields in structures into unions, so we only have to implement the support for unions. Semantics is as follows: If a union has conditions, syzkaller picks the first field whose condition matches. Since we require the last union field to have no conditions, we can always construct an object. Changes from this commit aim at ensuring that the selected union fields always follow the rule above.
* pkg/compiler: extend parent reference support in lenAleksandr Nogikh2024-02-191-26/+48
| | | | | | | | | | | | Earlier only len[parent, T] was supported and meant the size of the whole structure. Logically, len[parent:b, T] should be equivalent to just len[b, T]. Let len[parent:parent:a, T] refer to the structure that encloses the current one. Support len fields inside unions.
* prog: don't mutate size of compressed imagesDmitry Vyukov2022-12-221-0/+6
| | | | If we do, then our code will fail/crash on decompression.
* pkg/compiler: add out_overlay field attributeDmitry Vyukov2022-01-111-7/+10
|
* prog: refactor ANY to not fabricate new typesDmitry Vyukov2020-05-051-1/+1
| | | | | | | | | | Currently ANY implementation fabricates new types dynamically. This is something we don't do anywhere else, generally types come from compiler and all are static. Dynamic types will conflict with use of Ref in Arg optimization. Move ANY types creation into compiler. Update #1580
* prog: introduce Field typeDmitry Vyukov2020-05-021-31/+39
| | | | | | | | | | | | | Remvoe FieldName from Type and add a separate Field type that holds field name. Use Field for struct fields, union options and syscalls arguments, only these really have names. Reduces size of sys/linux/gen/amd64.go from 5665583 to 5201321 (-8.2%). Allows to not create new type for squashed any pointer. But main advantages will follow, e.g. removing StructDesc, using TypeRef in Arg, etc. Update #1580
* prog: rename {PtrType,ArrayType}.Type to ElemDmitry Vyukov2020-05-011-2/+2
| | | | | | | Name "Type" is confusing when referring to pointer/array element type. Frequently there are too many Type/typ/typ1/t and typ.Type is not very informative. It _is_ a type, but what's usually more relevant is that it's an _element_ type. Let's leave type checking to compiler and give it a more meaningful name.
* prog: fix size assignment for squashed argsDmitry Vyukov2020-05-011-0/+6
| | | | | | | | We can have a situation where len target points into a squashed argument. In suca case we don't have the target argument. In such case we simply leave size argument as is. It can't happen during generation, only during mutation and mutation can set size to random values, so it should be fine. This is a lateny bug, we just never had such case before.
* prog: reduce len mutation priorityDmitry Vyukov2020-01-181-1/+1
| | | | | Mutating LenType only produces "incorrect" results according to descriptions, we generally try to do it less often (there is infinite space of incorrect inputs).
* sys/linux: improve ipv4/ipv6 vnet descriptionsDmitry Vyukov2020-01-031-7/+1
| | | | | | | | | | | | 1. Use optional[T] instead of array[T, 0:1]. 2. Deduplicate 3 copies of ARP packet. 3. Deduplicate IPOPT_LSRR/IPOPT_SSRR/IPOPT_RR. 4. More precise description of IPOPT_TIMESTAMP/IPOPT_LSRR/IPOPT_SSRR/IPOPT_RR. 5. Don't use IPOPT_END/IPOPT_NOOP in generic option (they have different format). 6. Restrict cipso doi values. 7. Fix IPOPT_RA value type (int16 instead of int32). 8. Match ipv4/ipv6 packet type with payload. 9. Prefer 0 frag_off for ipv4 packets (they are extremely hard to get right).
* prog: refactor bitfields representationDmitry Vyukov2019-12-191-3/+1
| | | | | | | | All callers of BitfieldMiddle just want static size (0 for middle). Make it so: Size for middle bitfields just returns 0. Removes lots of if's. Introduce Type.UnitSize, which now holds the underlying type for bitfields. This will be needed to fix #1542 b/c even if UnitSize=4 for last bitfield Size can be anywhere from 0 to 4 (not necessary equal to UnitSize due to overlapping).
* prog, pkg/compiler: alignment for integer rangesPaul Chaignon2019-10-251-2/+2
| | | | | | | | | Enables the syntax intN[start:end, alignment] for integer ranges. For instance, int32[0:10, 2] represents even 32-bit numbers between 0 and 10 included. With this change, two NEED tags in syscall descriptions can be addressed. Signed-off-by: Paul Chaignon <paul.chaignon@orange.com>
* prog: use type size when generating/mutating intsVeronica Radu2019-09-231-2/+2
| | | | Update #1381
* pkg/compiler: add offsetof typeDmitry Vyukov2019-05-161-7/+15
| | | | | | Similar to C offsetof gives offset of a field from the beginning of the parent struct. We have several TODOs in descriptions asking for this.
* prog: fix crash in assignSize on optional pointerDmitry Vyukov2019-05-141-0/+4
|
* pkg/compiler: allow to refer to syscall arguments in len pathsDmitry Vyukov2019-05-141-7/+10
| | | | This allows to use len[syscall:arg] expressions.
* pkg/compiler: refactor len target checkingDmitry Vyukov2019-05-141-2/+7
| | | | Create named const for "parent" and move some code into a helper function.
* prog: implement complex len target supportDmitry Vyukov2019-05-141-62/+69
| | | | | This actually implements support for complex len targets during program generation and mutation.
* pkg/compiler: generate complex len targetsDmitry Vyukov2019-05-141-16/+20
| | | | Change the generated format for len type to support multiple path elements.
* prog: support AUTO args in programsDmitry Vyukov2018-12-101-36/+40
| | | | | | | | | | | | | | | AUTO arguments can be used for: - consts - lens - pointers For const's and len's AUTO is replaced with the natural value, addresses for AUTO pointers are allocated linearly. This greatly simplifies writing test programs by hand as most of the time we want these natural values. Update tests to use AUTO.
* prog: add Prog.FinalizeDmitry Vyukov2018-12-061-4/+0
| | | | | | Prog.Finalize combines assignSizesCall, SanitizeCall and validate. Intended for users who build own programs, so that we don't need to expose all individual methods.
* tools/syz-trace2syz: add tool to convert strace output to programsshankarapailoor2018-12-061-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * fixing weird merge error * fixing presubmit * fixing presubmit * removing parsing code because of -Xraw option * fix presubmit * update * deleting vma_call_handlers as we are currently skipping most vma calls. This simplifies memory_tracker as we don't need to keep track of vma allocations * removing custom handling of bpf_instruction union * removing ifconf parsing * update * removed all expression types and replaced them with constant types. removing ipv6_addr parsing while -Xraw is getting fixed. Removing constants.go * removing ipv6 parsing * presubmit * moving direction check from ipv4_addr out to genUnion * removing code that parses kcov * removing redundant test * removing custom code in generate unions to fill ipv4_addr * proggen: changing order of imports to make external packages import first fixing presubmit * changing log messages to lower case to be consistent with other packages. * removing pointer type and simplifying memory_tracker removing comment * moving context and return_cache to seaparate files * deleting default argument generation when we should probably throw an error
* all: fix gometalinter warningsDmitry Vyukov2018-03-081-2/+1
| | | | Fix typos, non-canonical code, remove dead code, etc.
* prog: rework address allocationDmitry Vyukov2018-02-191-1/+1
| | | | | | | | | | | | 1. mmap all memory always, without explicit mmap calls in the program. This makes lots of things much easier and removes lots of code. Makes mmap not a special syscall and allows to fuzz without mmap enabled. 2. Change address assignment algorithm. Current algorithm allocates unmapped addresses too frequently and allows collisions between arguments of a single syscall. The new algorithm analyzes actual allocations in the program and places new arguments at unused locations.
* prog: rework foreachArgDmitry Vyukov2018-02-191-11/+15
| | | | | | | | Make Foreach* callback accept the arg and a context struct that can contain lots of aux info. This (1) removes lots of unuser base/parent args, (2) provides foundation for stopping recursion, (3) allows to merge foreachSubargOffset.
* pkg/compiler: allow len of var-len arraysDmitry Vyukov2018-02-171-0/+3
| | | | | All netfilter subsystems use this unfortunately, so demote this to a warning.
* pkg/compiler, prog: fix template parent lensDmitry Vyukov2018-01-241-1/+7
| | | | | | | It's possible that a struct can have 2+ parents, which is the same template (differs only by arguments). See the new test case. Support such case.
* pkg/compiler: add bitsize typeDmitry Vyukov2018-01-061-12/+12
| | | | This is need for few crypto/xfrm descriptions.
* prog: mutate len argumentsDmitry Vyukov2017-12-311-0/+55
| | | | Fixes #183
* prog: support bytesizeN for vmaDmitry Vyukov2017-11-291-11/+11
| | | | | | I guess this is currently unused, but ignoring bytesizeN for vma looks wrong. If user asks for bytesizeN for vma, divide vma size by N.
* prog: remove default target and all global stateDmitry Vyukov2017-09-151-9/+9
| | | | | | Now each prog function accepts the desired target explicitly. No global, implicit state involved. This is much cleaner and allows cross-OS/arch testing, etc.
* prog, sys: move types to progDmitry Vyukov2017-09-051-8/+6
| | | | | | | | | | | Large overhaul moves syscalls and arg types from sys to prog. Sys package now depends on prog and contains only generated descriptions of syscalls. Introduce prog.Target type that encapsulates all targer properties, like syscall list, ptr/page size, etc. Also moves OS-dependent pieces like mmap call generation from prog to sys. Update #191
* prog: dot-import sysDmitry Vyukov2017-09-051-8/+8
| | | | In preparation for moving sys types to prog to reduce later diffs.
* sys, prog: switch values to to uint64Dmitry Vyukov2017-08-191-1/+1
| | | | | | | | | | We currently use uintptr for all values. This won't work for 32-bit archs. Moreover in some cases we use uintptr but assume that it is always 64-bits (e.g. in encodingexec). Switch everything to uint64. Update #324
* prog: split Arg into smaller structsAndrey Konovalov2017-07-171-27/+31
| | | | | | | | | | | | | | | | | | | | | | Right now Arg is a huge struct (160 bytes), which has many different fields used for different arg kinds. Since most of the args we see in a typical corpus are ArgConst, this results in a significant memory overuse. This change: - makes Arg an interface instead of a struct - adds a SomethingArg struct for each arg kind we have - converts all *Arg pointers into just Arg, since interface variable by itself contains a pointer to the actual data - removes ArgPageSize, now ConstArg is used instead - consolidates correspondence between arg kinds and types, see comments before each SomethingArg struct definition - now LenType args that denote the length of VmaType args are serialized as "0x1000" instead of "(0x1000)"; to preserve backwards compatibility syzkaller is able to parse the old format for now - multiple small changes all over to make the above work After this change syzkaller uses twice less memory after deserializing a typical corpus.
* prog: move size-related functions to size.goAndrey Konovalov2017-01-251-0/+106
generated by ggit (джигит) mrf-deployment (git 2.46.0) at 2026-03-11 18:06:44 +0000