| Commit message (Collapse) | Author | Age | Files | Lines |
| | |
|
| | |
|
| | |
|
| | |
|
| |
|
|
|
|
|
|
|
|
|
| |
Large overhaul moves syscalls and arg types from sys to prog.
Sys package now depends on prog and contains only generated
descriptions of syscalls.
Introduce prog.Target type that encapsulates all targer properties,
like syscall list, ptr/page size, etc. Also moves OS-dependent pieces
like mmap call generation from prog to sys.
Update #191
|
| |
|
|
|
| |
In preparation for moving sys types to prog
to avoid confusion between sys.Call and prog.Call.
|
| | |
|
| | |
|
| |
|
|
|
|
|
|
| |
That's the condition we always want.
Currently we always check:
t.BitfieldOffset() == 0 || t.BitfieldLast()
now can check just:
!t.BitfieldMiddle()
|
| | |
|
| |
|
|
| |
This makes types constant during execution, everything is precomputed.
|
| | |
|
| | |
|
| |
|
|
|
| |
Use explicit size for vma.
This is the last use of hardcoded ptrSize in sys package.
|
| |
|
|
| |
Fixes #217
|
| |
|
|
| |
This is required to support ptr64 type.
|
| | |
|
| |
|
|
|
|
| |
Unfortunately this is sitll needed, see the added comment.
Update #191
|
| |
|
|
|
|
| |
Move most of the logic from sysgen to pkg/compiler.
Update #217
|
| | |
|
| |
|
|
|
| |
Export struct/union attributes so that they can be filled in
by a different package.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
We have implemented a new version of KCOV, which is able to dump
comparison operands' data, obtained from Clang's instrumentation hooks
__sanitizer_cov_trace_cmp[1248], __sanitizer_cov_trace_const_cmp[1248]
and __sanitizer_cov_trace_switch.
Current KCOV implementation can work in two modes: "Dump only the PCs"
or "Dump only comparisons' data". Mode selection is done by the
following series of calls:
fd = open(KCOV_PATH, ...); // works as previous
ioctl(fd, KCOV_INIT_TRACE, ...); // works as previous
mmap(fd, ...); // works as previous
ioctl(fd, KCOV_ENABLE, mode);
// mode = KCOV_MODE_TRACE_CMP or mode = KCOV_MODE_TRACE_PC
Note that this new interface is backwards compatible, as old KCOV
devices will just return -EINVAL for the last ioctl. This way we can
distinguish if the KCOV device is able to dump the comparisons.
Main changes in this commit:
1. Fuzzer now checks at startup which type (new/old) of KCOV device
is running.
2. Executor now receives an additional flag, which indicates if
executor should read the comparisons data from KCOV. The flag works on
per-call basis, so executor can collect PCs or Comps for each
individual syscall.
|
| |
|
|
|
| |
The previous commit removes errors on unsupported structs/resources,
but their usages still error. Fix that.
|
| |
|
|
|
|
| |
Currently unsupported consts in structs and resources break build.
However, that can well happen for arch-specific devices (e.g. Android).
Make this non-fatal as it used to be.
|
| | |
|
| |
|
|
| |
Now pkg/compiler deals with consts.
|
| | |
|
| |
|
|
|
|
|
|
|
|
| |
We currently use uintptr for all values.
This won't work for 32-bit archs.
Moreover in some cases we use uintptr but assume
that it is always 64-bits (e.g. in encodingexec).
Switch everything to uint64.
Update #324
|
| | |
|
| | |
|
| |
|
|
| |
In preparation for a stricter parser.
|
| |
|
|
|
|
| |
Move xattr syscalls to own file and better describe xattr names.
They usually have prefix+name structure and there are some
known values.
|
| |
|
|
|
| |
Update #211
Update #310
|
| |
|
|
| |
Update #211
|
| | |
|
| | |
|
| |
|
|
| |
recvmmsg has timeout argument.
|
| |
|
|
|
|
| |
1. Use proc type for fragment identifiers.
2. Remove dups from ipv6_types.
3. Fix ipv6_fragment_ext_header layout.
|
| |
|
|
|
|
|
|
| |
KVM_RUN ioctl must have arg set to 0, otherwise it returns EINVAL.
This can lead to syzkaller not able to generate a C repro.
Since arg value is undefined, it might have different values when
executing a program with syz-exeprog vs executing a compiled C repro.
|
| |
|
|
|
|
| |
ResultArg might have const value.
Also add a test.
|
| | |
|
| |
|
|
|
|
|
|
| |
When syzkaller generates arg that uses a few structs that reference each
other via pointers, it can go into infinite recursion and crash.
Fix this by forcing pointer args to be null when the depth of recursion
reaches 3 for some struct.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Right now Arg is a huge struct (160 bytes), which has many different fields
used for different arg kinds. Since most of the args we see in a typical
corpus are ArgConst, this results in a significant memory overuse.
This change:
- makes Arg an interface instead of a struct
- adds a SomethingArg struct for each arg kind we have
- converts all *Arg pointers into just Arg, since interface variable by
itself contains a pointer to the actual data
- removes ArgPageSize, now ConstArg is used instead
- consolidates correspondence between arg kinds and types, see comments
before each SomethingArg struct definition
- now LenType args that denote the length of VmaType args are serialized as
"0x1000" instead of "(0x1000)"; to preserve backwards compatibility
syzkaller is able to parse the old format for now
- multiple small changes all over to make the above work
After this change syzkaller uses twice less memory after deserializing a
typical corpus.
|
| |
|
|
|
|
| |
Add ioctl$sock_SIOCETHTOOL and ETHTOOL structures defined in uapi/linux/ethtool.h
http://elixir.free-electrons.com/linux/latest/source/include/uapi/linux/ethtool.h
|
| | |
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
We used to have all generated files checked in.
Later we removed them (now users are supposed to
run make to generate them). This causes several
problems:
- go get does not work as it tries to build everything
straight away (go get -d works, but users are confused)
- users don't run make and complain that build is broken
- users don't re-run make after updates and complain that
build is broken
- hard to integrate into other build system (even if they
support building Go, they don't support running sysgen
out-of-the-box)
Fixes #216
|
| |
|
|
|
|
|
|
| |
They were necessary when they were the source of constant values
extracted from kernel code (hard to do). Now constants are checked-in
separately, and these large files can be easily regenerated with 'make generate'.
Now they are only a source of large uninteresting diffs in commits.
Remove them.
|
| |
|
|
| |
76906672672365b9e31328a0047baf62db9190b6
|
| | |
|
| | |
|