| Commit message (Collapse) | Author | Age | Files | Lines |
| | |
|
| | |
|
| | |
|
| |
|
|
| |
Fixes #217
|
| | |
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
We have implemented a new version of KCOV, which is able to dump
comparison operands' data, obtained from Clang's instrumentation hooks
__sanitizer_cov_trace_cmp[1248], __sanitizer_cov_trace_const_cmp[1248]
and __sanitizer_cov_trace_switch.
Current KCOV implementation can work in two modes: "Dump only the PCs"
or "Dump only comparisons' data". Mode selection is done by the
following series of calls:
fd = open(KCOV_PATH, ...); // works as previous
ioctl(fd, KCOV_INIT_TRACE, ...); // works as previous
mmap(fd, ...); // works as previous
ioctl(fd, KCOV_ENABLE, mode);
// mode = KCOV_MODE_TRACE_CMP or mode = KCOV_MODE_TRACE_PC
Note that this new interface is backwards compatible, as old KCOV
devices will just return -EINVAL for the last ioctl. This way we can
distinguish if the KCOV device is able to dump the comparisons.
Main changes in this commit:
1. Fuzzer now checks at startup which type (new/old) of KCOV device
is running.
2. Executor now receives an additional flag, which indicates if
executor should read the comparisons data from KCOV. The flag works on
per-call basis, so executor can collect PCs or Comps for each
individual syscall.
|
| |
|
|
| |
Update #217
|
| | |
|
| | |
|
| |
|
|
|
|
| |
Move xattr syscalls to own file and better describe xattr names.
They usually have prefix+name structure and there are some
known values.
|
| |
|
|
|
| |
Update #211
Update #310
|
| |
|
|
| |
Update #211
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Right now Arg is a huge struct (160 bytes), which has many different fields
used for different arg kinds. Since most of the args we see in a typical
corpus are ArgConst, this results in a significant memory overuse.
This change:
- makes Arg an interface instead of a struct
- adds a SomethingArg struct for each arg kind we have
- converts all *Arg pointers into just Arg, since interface variable by
itself contains a pointer to the actual data
- removes ArgPageSize, now ConstArg is used instead
- consolidates correspondence between arg kinds and types, see comments
before each SomethingArg struct definition
- now LenType args that denote the length of VmaType args are serialized as
"0x1000" instead of "(0x1000)"; to preserve backwards compatibility
syzkaller is able to parse the old format for now
- multiple small changes all over to make the above work
After this change syzkaller uses twice less memory after deserializing a
typical corpus.
|
| |
|
|
| |
Signed-off-by: Jess Frazelle <acidburn@google.com>
|
| |
|
|
|
|
|
|
|
| |
The statx syscall was added in Linux 4.11, check out the kernel
documentation[1] for more information.
[1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a528d35e8bfcc521d7cb70aaf03e1bd296c8493f
Signed-off-by: Jess Frazelle <acidburn@google.com>
|
| | |
|
| |
|
|
| |
It is going to be removed from kernel.
|
| | |
|
| |
|
|
|
|
| |
mknod mode also includes ownership flags, so filter out the node type.
Also allow creation of loop nodes.
Remove mount$fs as it does not seem to make any sense.
|
| |
|
|
|
| |
This just moves syscall descriptions and fixes up includes
without any semantic changes.
|
| | |
|
| | |
|
| | |
|
| |
|
|
| |
Also embed tcp checksums into packets.
|
| | |
|
| |
|
|
|
|
|
|
| |
Change all 'filename' to 'ptr[in, filename]' and don't imply pointer indirection for filename type.
This is necessary because in some bases we want to embed filename directly into a struct (e.g. unix sock addr).
Similar change was already done for string type for similar reasons. Generally, we want to imply as less as possible.
NOTE: IF YOU HAVE PRIVATE DESCRIPTIONS, YOU NEED TO DO THE SAME REPLACEMENT.
|
| |
|
|
| |
kdbus haven't been merged into mainline, unmaintained and seems to be replaced by bus1.
|
| |
|
|
|
| |
In lots of cases we don't need the special syz_open_dev call,
openat will do just fine. Standard syscalls are preferrable, so use them.
|
| | |
|
| | |
|
| | |
|
| |
|
|
| |
These were just added to net-next.
|
| | |
|
| |
|
|
|
|
| |
/dev/console known to cause problems on at least two different kernels.
It can turn off all output or produce massive amounts of garbage on console.
Disable it for now.
|
| | |
|
| | |
|
| |
|
|
|
|
|
|
|
|
| |
Allow to define string flags in txt descriptions. E.g.:
filesystem = "ext2", "ext3", "ext4"
and then use it in string type:
ptr[in, string[filesystem]]
|
| |
|
|
|
| |
In preparation for extending string functionality
and to make it less magical.
|
| |
|
|
|
| |
FileoffType is effectively an int, no need for a separate type.
Also remove fd option from fileoff as it is unused and use story is unclear.
|
| | |
|
| | |
|
| |
|
|
|
|
| |
Currently to add a new resource one needs to modify multiple source files,
which complicates descirption of new system calls.
Move resource descriptions from source code to text desciptions.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
This splits generation process into two phases:
1. Extract values of constants from linux kernel sources.
2. Generate Go code.
Constant values are checked in.
The advantage is that the second phase is now completely independent
from linux source files, kernel version, presence of headers for
particular drivers, etc. This allows to change what Go code we generate
any time without access to all kernel headers (which in future won't be
limited to only upstream headers).
Constant extraction process does require proper kernel sources,
but this can be done only once by the person who added the driver
and has access to the required sources. Then the constant values
are checked in for others to use.
Consant extraction process is per-file/per-arch. That is,
if I am adding a driver that is not present upstream and that
works only on a single arch, I will check in constants only for
that driver and for that arch.
|
| |
|
|
|
| |
We can't use '-' because '-' can denote negative numbers.
Colon is used is several range notations (e.g. Go, Mathlab, Excel).
|
| |
|
|
|
| |
IOPRIO_WHO_PGRP, IOPRIO_WHO_USER, and IOPRIO_WHO_PROCESS are defined in
linux/ioprio.h.
|
| | |
|
| | |
|
| | |
|
| | |
|
| |
|
|
|
|
|
|
| |
This solves several problems:
- host usually have outdates headers, so previously we need to define missing consts
- host may not have some headers at all
- generation depends on linux distribution and version
- some of the consts cannot be defined at all (e.g. ioctls that use struct arguments)
|