aboutsummaryrefslogtreecommitdiffstats
path: root/prog/validation.go
Commit message (Collapse)AuthorAgeFilesLines
* prog: pkg/compiler: docs: introduce the `no_squash` attributeAlexander Potapenko2025-09-091-5/+11
| | | | | | | | | | | | | | | | | The `no_squash` per-syscall attribute prevents the fuzzer from generating squashed arguments to a particular syscall. This is particularly helpful for pseudo-syscalls with elaborate arguments that are hard to reason about when they are squashed - e.g. for syz_kvm_add_vcpu() that takes a SYZOS program as an input. I've considered an alternative solution that prohibits ANY for all pseudo-syscalls. But there is a bunch of existing programs (both the tests and the repros) for syscalls like syz_mount_image() for which the benefit of not passing ANY is not immediately obvious. I therefore decided to go with an explicit attribute that can later be enforced for every pseudo-syscall at compile time.
* prog: validate transient unionsAleksandr Nogikh2025-06-241-0/+4
| | | | | Ensure that there are no more transient unions in the fully constructed programs.
* prog: enable debug checking in all testsDmitry Vyukov2024-05-061-2/+7
|
* prog: fix validation of DataMmapProgDmitry Vyukov2024-05-061-13/+19
| | | | | | | Allow to serialize/deserialize DataMmapProg and fix validation in debug mode. Fixes #4750
* prog: add raw deserialization modeDmitry Vyukov2024-04-291-2/+3
| | | | | | | Raw deserialization mode does not do any program sanitization and allows to use global file names, prohibited ioctl's, etc. This will be useful for moving syscall/feature checking code to the host, we will need to probe opening global files, etc.
* prog: auto-set proper conditional fields in Deserialize()Aleksandr Nogikh2024-03-131-2/+12
| | | | | | | | | Treat all default union arguments as transient and reevaluate them after the call was fully parsed. Before conditional field patching, we do need to have performed arg validation, which also reevaluates conditions. To break the cycle, make validation configurable.
* Revert "prog: auto-set proper conditional fields in Deserialize()"Aleksandr Nogikh2024-03-081-12/+2
| | | | This reverts commit 8e75c913b6f9b09cab2ad31fd7d66ea0d1703de8.
* prog: auto-set proper conditional fields in Deserialize()Aleksandr Nogikh2024-03-081-2/+12
| | | | | | | | | Treat all default union arguments as transient and reevaluate them after the call was fully parsed. Before conditional field patching, we do need to have performed arg validation, which also reevaluates conditions. To break the cycle, make validation configurable.
* prog: support conditional fieldsAleksandr Nogikh2024-02-191-0/+3
| | | | | | | | | | | | | pkg/compiler restructures conditional fields in structures into unions, so we only have to implement the support for unions. Semantics is as follows: If a union has conditions, syzkaller picks the first field whose condition matches. Since we require the last union field to have no conditions, we can always construct an object. Changes from this commit aim at ensuring that the selected union fields always follow the rule above.
* prog: make validation errors more verboseAleksandr Nogikh2024-02-191-2/+2
| | | | Display the call that violated the rules.
* prog: validate call propertiesAleksandr Nogikh2023-11-221-0/+3
| | | | | | | | | Syz-executor fails if rerun > 0 && fail_nth > 0, but we don't do this check during prog validation. It works fine when syzkaller runs as a standalone app (because it never generates such programs), but it can be a problem when receiving progs from other instances via syz-hub.
* pkg/compiler: support (in) for union fieldsAleksandr Nogikh2023-10-061-0/+3
| | | | | | | | | | | | | We had a problem -- using inout ANYUNION leads to syzkaller generating copyout instructions for fmt[X, resource] types. Add a validation rule to detect this during tests. Fix this by supporting (in) for union fields. Previously, all union field direction attributes were banned as they were making things more complicated. The (in) attribute is definitely safe and allows for more flexibility.
* prog: preserve inout direction during squashingAleksandr Nogikh2023-09-281-1/+6
| | | | | | | | | Prohibit arg direction from being DirIn if other calls use the resource as input. Fix one case where we used to violate it - during argument squashing. Reported-by: John Miller <jm3228520@gmail.com>
* prog: deduce arg direction during validationAleksandr Nogikh2023-09-281-10/+13
| | | | | Unless overridden, arg directions are inherited from parent types. Let's follow the same logic in validation.go.
* all: use special placeholder for errorsTaras Madan2023-07-241-1/+1
|
* prog: reject escaping filenames during deserializationDmitry Vyukov2023-02-161-0/+4
| | | | | | | | We already try as hard as possible to not generate escaping (global) filenames. However, it's possible we read them from the corpus if it happens to contain some. Also check for escaping filenames during deserialization. Fixes #3678
* pkg, prog: add per-field direction attributeNecip Fazil Yildiran2020-08-131-3/+3
|
* prog: support disabled attributeDmitry Vyukov2020-05-041-0/+3
| | | | | Update #477 Update #502
* prog: introduce Field typeDmitry Vyukov2020-05-021-13/+6
| | | | | | | | | | | | | Remvoe FieldName from Type and add a separate Field type that holds field name. Use Field for struct fields, union options and syscalls arguments, only these really have names. Reduces size of sys/linux/gen/amd64.go from 5665583 to 5201321 (-8.2%). Allows to not create new type for squashed any pointer. But main advantages will follow, e.g. removing StructDesc, using TypeRef in Arg, etc. Update #1580
* prog: rename {PtrType,ArrayType}.Type to ElemDmitry Vyukov2020-05-011-2/+2
| | | | | | | Name "Type" is confusing when referring to pointer/array element type. Frequently there are too many Type/typ/typ1/t and typ.Type is not very informative. It _is_ a type, but what's usually more relevant is that it's an _element_ type. Let's leave type checking to compiler and give it a more meaningful name.
* prog: remove Dir from TypeDmitry Vyukov2020-05-011-15/+19
| | | | | | | | | | | | | | | | | | Having Dir is Type is handy, but forces us to duplicate lots of types. E.g. if a struct is referenced as both in and out, then we need to have 2 copies and 2 copies of structs/types it includes. If also prevents us from having the struct type as struct identity (because we can have up to 3 of them). Revert to the old way we used to do it: propagate Dir as we walk syscall arguments. This moves lots of dir passing from pkg/compiler to prog package. Now Arg contains the dir, so once we build the tree, we can use dirs as before. Reduces size of sys/linux/gen/amd64.go from 6058336 to 5661150 (-6.6%). Update #1580
* prog: fix a bunch of bugs in parsingDmitry Vyukov2019-03-291-1/+5
| | | | | | Add fuzzer for Deserialize and fix 5 or so bugs it found. Fixes #1086
* prog: add Prog.FinalizeDmitry Vyukov2018-12-061-4/+0
| | | | | | Prog.Finalize combines assignSizesCall, SanitizeCall and validate. Intended for users who build own programs, so that we don't need to expose all individual methods.
* tools/syz-trace2syz: add tool to convert strace output to programsshankarapailoor2018-12-061-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * fixing weird merge error * fixing presubmit * fixing presubmit * removing parsing code because of -Xraw option * fix presubmit * update * deleting vma_call_handlers as we are currently skipping most vma calls. This simplifies memory_tracker as we don't need to keep track of vma allocations * removing custom handling of bpf_instruction union * removing ifconf parsing * update * removed all expression types and replaced them with constant types. removing ipv6_addr parsing while -Xraw is getting fixed. Removing constants.go * removing ipv6 parsing * presubmit * moving direction check from ipv4_addr out to genUnion * removing code that parses kcov * removing redundant test * removing custom code in generate unions to fill ipv4_addr * proggen: changing order of imports to make external packages import first fixing presubmit * changing log messages to lower case to be consistent with other packages. * removing pointer type and simplifying memory_tracker removing comment * moving context and return_cache to seaparate files * deleting default argument generation when we should probably throw an error
* prog: allow escaping paths but don't generate themDmitry Vyukov2018-11-021-11/+0
| | | | | | | | | | | Filename generated escaping paths in the past. The reason for the check during validation is to wipe old program from corpuses. Now that they are hopefully wiped everywhere, we can relax the check to restrict only filename to not produce escaping paths, but allow existing programs with escaping paths. This is useful in particular if we generate syzkaller programs from strace output.
* prog: add concept of "special pointers"Dmitry Vyukov2018-08-301-11/+14
| | | | | | | | | | | | | | | | | Currently we only generate either valid user-space pointers or NULL. Extend NULL to a set of special pointers that we will use in programs. All targets now contain 3 special values: - NULL - 0xfffffffffffffff (invalid kernel pointer) - 0x999999999999999 (non-canonical address) Each target can add additional special pointers on top of this. Also generate NULL/special pointers for non-opt ptr's. This restriction was always too restrictive. We may want to generate them with very low probability, but we do want to generate them. Also change pointers to NULL/special during mutation (but still not in the opposite direction).
* prog: strenghten type checking during validationDmitry Vyukov2018-08-021-18/+23
| | | | | | Check that argument types match expected static types. I.e. detect when, say, syscall argument is a resource, but actual generated argument is a pointer.
* prog: introduce debugValidateDmitry Vyukov2018-08-021-0/+8
| | | | | | Move debug validation into a separate function. Update #538
* prog: refactor defaultArg/isDefaultArgDmitry Vyukov2018-08-021-10/+5
| | | | | | Refactor from single-big-switch to type methods. Update #538
* prog: refactor MinimizeDmitry Vyukov2018-07-311-5/+4
| | | | | | | | Reduce cyclomatic complexity of argument minimization by moving type-specific logic into separate functions. Fix few bugs along the way. Update #538
* prog: sanitize calls after hints mutationDmitry Vyukov2018-07-121-1/+5
| | | | | | | | Hints mutation could produce unsanitized calls. Sanitize calls after hints mutation. Also sanitize on load (in validate), because bad programs can already be in corpuses. And it's just the right thing to do because sanitization rules can change over time.
* prog: fix pointer validationDmitry Vyukov2018-07-081-9/+9
| | | | | Query size after validating the object itself, otherwise size can panic on corrupted object.
* prog: don't generate filenames that escape sandboxDmitry Vyukov2018-07-081-0/+11
| | | | | | All files that fuzzer works with must be in the working dir. Using "/" is known to cause problems when fuzzer removes files there or mounts something.
* prog: rework validation codeDmitry Vyukov2018-05-051-241/+169
| | | | | | | The current code is total, unstructured mess. Since we now have 1:1 type -> arg correspondence, rework validation around args. This makes code much cleaner and 30% shorter.
* prog: make c.Ret optionalDmitry Vyukov2018-05-051-13/+19
| | | | | No reason to allocate return value if there is no return type. c.Ret == nil is the reasonable indication that this is a "void" call.
* prog: simplify codeDmitry Vyukov2018-05-051-8/+6
| | | | | | Now that we don't have ReturnArg and only ResultArg's refer to other ResultArg's we can remove ArgUser/ArgUsed and devirtualize lots of code.
* prog: remove ReturnArgDmitry Vyukov2018-05-051-13/+5
| | | | It's not all that needed.
* gometalinter: enable cyclomatic complexity checkingDmitry Vyukov2018-05-041-251/+250
| | | | | | Refactor some functions to be simpler. Update #538
* gometalinter: enable line length checkingDmitry Vyukov2018-05-041-26/+52
| | | | | | | 120 columns looks like a reasonable limit and requires few changes to existing code. Update #538
* all: fix gometalinter warningsDmitry Vyukov2018-03-081-2/+2
| | | | Fix typos, non-canonical code, remove dead code, etc.
* prog: rework address allocationDmitry Vyukov2018-02-191-6/+17
| | | | | | | | | | | | 1. mmap all memory always, without explicit mmap calls in the program. This makes lots of things much easier and removes lots of code. Makes mmap not a special syscall and allows to fuzz without mmap enabled. 2. Change address assignment algorithm. Current algorithm allocates unmapped addresses too frequently and allows collisions between arguments of a single syscall. The new algorithm analyzes actual allocations in the program and places new arguments at unused locations.
* prog: don't serialize default argumentsDmitry Vyukov2018-02-011-1/+2
| | | | | | | This reduces size of a corpus in half. We store corpus on manager and on hub, so this will reduce their memory consumption. But also makes large programs more readable.
* prog: remove unused UnionArg.OptionTypeDmitry Vyukov2018-01-271-1/+1
|
* prog: support opt for proc typesDmitry Vyukov2018-01-061-1/+1
|
* prog: minor refactoring around argumentsDmitry Vyukov2017-12-171-3/+5
| | | | | | Introduce isUsed(arg) helper, use it in several places. Move method definitions closer to their types. Simplify presence check for ArgUsed.Used() in several places.
* prog: don't serialize output data argsDmitry Vyukov2017-12-171-9/+7
| | | | | | | | Fixes #188 We now will write just ""/1000 to denote a 1000-byte output buffer. Also we now don't store 1000-byte buffer in memory just to denote size. Old format is still parsed.
* prog: repair arrays/buffers with incorrect size in DeserializeDmitry Vyukov2017-11-281-1/+15
| | | | | | | | | | | | | For string[N] we successfully deserialize a string of any length. Similarly for a fixed-size array[T, N] we successfully deserialize an array of any size. Such programs later crash in foreachSubargOffset because static size Type.Size() does not match what we've calculated iterating over fields. The crash happens only in SerializeForExec in syz-fuzzer, which is especially bad. Fix this from both sides: 1. Validate sizes of arrays/buffers in Validate. 2. Repair incorrect sizes in Deserialize.
* prog, sys: move types to progDmitry Vyukov2017-09-051-2/+0
| | | | | | | | | | | Large overhaul moves syscalls and arg types from sys to prog. Sys package now depends on prog and contains only generated descriptions of syscalls. Introduce prog.Target type that encapsulates all targer properties, like syscall list, ptr/page size, etc. Also moves OS-dependent pieces like mmap call generation from prog to sys. Update #191
* prog: dot-import sysDmitry Vyukov2017-09-051-26/+26
| | | | In preparation for moving sys types to prog to reduce later diffs.
* sys, pkg/compiler: move padding computation to compilerDmitry Vyukov2017-09-041-3/+4
| | | | This makes types constant during execution, everything is precomputed.
generated by ggit (джигит) mrf-deployment (git 2.46.0) at 2026-03-12 00:35:10 +0000