aboutsummaryrefslogtreecommitdiffstats
path: root/sys/test/test.txt
Commit message (Collapse)AuthorAgeFilesLines
* prog: pkg/compiler: docs: introduce the `no_squash` attributeAlexander Potapenko2025-09-091-0/+9
| | | | | | | | | | | | | | | | | The `no_squash` per-syscall attribute prevents the fuzzer from generating squashed arguments to a particular syscall. This is particularly helpful for pseudo-syscalls with elaborate arguments that are hard to reason about when they are squashed - e.g. for syz_kvm_add_vcpu() that takes a SYZOS program as an input. I've considered an alternative solution that prohibits ANY for all pseudo-syscalls. But there is a bunch of existing programs (both the tests and the repros) for syscalls like syz_mount_image() for which the benefit of not passing ANY is not immediately obvious. I therefore decided to go with an explicit attribute that can later be enforced for every pseudo-syscall at compile time.
* prog: annotate image assets with fsck logsFlorent Revest2024-12-091-0/+2
| | | | | | | | | | | | | | | | | | Syscall attributes are extended with a fsck command field which lets file system mount definitions specify a fsck-like command to run. This is required because all file systems have a custom fsck command invokation style. When uploading a compressed image asset to the dashboard, syz-manager also runs the fsck command and logs its output over the dashapi. The dashboard logs these fsck logs into the database. This has been requested by fs maintainer Ted Tso who would like to quickly understand whether a filesystem is corrupted or not before looking at a reproducer in more details. Ultimately, this could be used as an early triage sign to determine whether a bug is obviously critical.
* pkg/host: explicitly disable syz_execute_funcDmitry Vyukov2024-04-291-1/+1
| | | | | | | | | Disable the syscall in descriptions rather than in the code. This makes it more visible for users that it's disabled, and makes it less special (will not need to move this logic to host). Also change the condition in syz-sysgen to be more precise, otherwise syz_execute_func becomes unused function.
* prog: more compact exec encoding for addressesDmitry Vyukov2024-04-151-0/+1
| | | | | | | | | | 1. Don't write size/flags for addresses. 2. Write address w/o data offset (fewer bytes in leb128 encoding). Median exec size shrinks by 25%: - exec sizes: 10%:584 50%:1423 90%:7076 + exec sizes: 10%:448 50%:1065 90%:6319
* prog: fix selection of args eligible for squashingDmitry Vyukov2024-04-151-0/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This fixes 3 issues: 1. We intended to squash only 'in' pointer elems, but we looked at the pointer direction rather than elem direction. Since pointers themselves are always 'in' we squashed a number of types we didn't want to squash. 2. We can squash filenames, which can lead to generation of escaping filenames, e.g. fuzzer managed to create "/" filename for blockdev_filename as: mount(&(0x7f0000000000)=ANY=[@ANYBLOB='/'], ...) Don't squash filenames. 3. We analyzed a concrete arg to see if it contains something we don't want to squash (e.g. pointers). But the whole type can still contain unsupported things in inactive union options, or in 0-sized arrays. E.g. this happened in the mount case above. Analyze the whole type to check for unsupported things. This also moves most of the analysis to the compiler, so mutation will be a bit faster. This removes the following linux types from squashing. 1. These are not 'in': btrfs_ioctl_search_args_v2 btrfs_ioctl_space_args ethtool_cmd_u fscrypt_add_key_arg fscrypt_get_policy_ex_arg fsverity_digest hiddev_ioctl_string_arg hidraw_report_descriptor ifreq_dev_t[devnames, ptr[inout, ethtool_cmd_u]] ifreq_dev_t[ipv4_tunnel_names, ptr[inout, ip_tunnel_parm]] ifreq_dev_t["sit0", ptr[inout, ip_tunnel_prl]] io_uring_probe ip_tunnel_parm ip_tunnel_prl poll_cq_resp query_port_cmd query_qp_resp resize_cq_resp scsi_ioctl_probe_host_out_buffer sctp_assoc_ids sctp_authchunks sctp_getaddrs sctp_getaddrs_old 2. These contain pointers: binder_objects iovec[in, netlink_msg_route_sched] iovec[in, netlink_msg_route_sched_retired] msghdr_netlink[netlink_msg_route_sched] msghdr_netlink[netlink_msg_route_sched_retired] nvme_of_msg 3. These contain filenames: binfmt_script blockdev_filename netlink_msg_route_sched netlink_msg_route_sched_retired selinux_create_req
* prog: test len calculation of structs with conditionsAleksandr Nogikh2024-02-191-0/+12
|
* pkg/compiler: extend parent reference support in lenAleksandr Nogikh2024-02-191-0/+31
| | | | | | | | | | | | Earlier only len[parent, T] was supported and meant the size of the whole structure. Logically, len[parent:b, T] should be equivalent to just len[b, T]. Let len[parent:parent:a, T] refer to the structure that encloses the current one. Support len fields inside unions.
* prog: prefer precise constructorsAleksandr Nogikh2024-01-111-0/+10
| | | | | | | | | | During resource argument generation, we used to randomly select one of the matching resources. With so many descendants of fd, this becomes quite inefficient and most of the time syzkaller fails to build correct programs. Give precise resource contructions priority. Experiment with other resource types only in 1/3 of cases.
* compiler: support const as int first argumentPaul Chaignon2023-11-281-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This commit adds support for the following syntax: int8[constant] as an equivalent to: const[constant, int8] The goal is to have a unified const/flags definition that we can use in templates. For example: type template[CLASS, ...] { class int8:3[CLASS] // ... } type singleClassType template[SINGLE_CONST] type subClassType template[abc_class_flags] In this example, the CLASS template field can be either a constant or a flag. This is especially useful when defining both a generic instance of the template as well as specialized instances (ex. bpf_alu_ops and bpf_add_op). Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
* compiler: support flags as int first argumentPaul Chaignon2023-11-281-0/+7
| | | | | | | | | | | | | | | | | | | This commit adds support for the following syntax: int_flags = 1, 5, 8, 9 int32[int_flags] which is equivalent to: int_flags = 1, 5, 8, 9 flags[int_flags, int32] The second int type argument, align, is not allowed if the first argument is a flag. The compiler will also error if the first argument appears to be a flag (is ident and has no colon), but can't be found in the map of flags. Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
* prog, sys: test cases for struct AUTOPaul Chaignon2023-11-131-0/+15
| | | | | | | | | | This commit adds a few test cases for the support of AUTO for structs. It covers: - A simple struct with only const and len types. - A nested struct case. - An error case when a struct has an int type field. Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
* prog: more complex tests for getInputResourcesPaul Chaignon2023-10-091-2/+15
| | | | | | | | | | | | | This commit adds more complex unit tests to cover the bug in getInputResources fixed by the previous commit. required_res1 and test_args3 covers the case where a struct is included both as optional and required. required_res2 and test_args4 cover the case where a struct is included both as DirOut and DirIn. In both cases the resource should be recognized as being a required input resource for the syscall. Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
* prog: test optional input resources are skippedPaul Chaignon2023-10-091-0/+25
| | | | | | | | | | This commit adds a unit test for getInputResources, to verify in particular that it doesn't return input resources that are optional. Note we can't test the built-in "optional[]" because that relies on unions and those aren't supported yet. Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
* prog: introduce new Base64 syntax for dataHrutvik Kanabar2022-11-211-0/+2
| | | | | | | | | | | | | The new "$..." syntax is read as a Base64 encoding binary data. Note that users cannot specify the size of the Base64 syntax using the `"..."/<size>` notation. When serialising programs to human-readable form, only compressed types (determined by `IsCompressed()`) are represented using the new Base64 notation. Also add a couple of serialisation tests, checking behaviour for compressed and non-compressed types.
* prog: generate very long file namesDmitry Vyukov2022-08-101-0/+2
| | | | | Generate very long file names once in a while to provoke bugs like: https://github.com/google/gvisor/commit/f857f268eceb1cdee0b2bdfa218c969c84033fcd
* sys/linux: use out_overlay attributeDmitry Vyukov2022-01-111-2/+2
| | | | | | | Remove all uses of direction attributes on union fields and use out_overlay attribute instead. The attribute actually does what was the intention behind use of direction attribute on unions.
* prog: fix UnionType mutation for when per-field dir is specifiedNecip Fazil Yildiran2020-08-141-2/+7
| | | | prog/TestMutateRandom used to fail due to this.
* pkg, prog: add per-field direction attributeNecip Fazil Yildiran2020-08-131-0/+43
|
* prog: refactor hints testsDmitry Vyukov2020-05-051-0/+9
| | | | | | | The way the tests fabricate types dynamically creates problems during any non-trivial changes to prog package. Use existing types from descriptions instead.
* prog: support disabled attributeDmitry Vyukov2020-05-041-0/+8
| | | | | Update #477 Update #502
* prog: add ignore_return and breaks_returns call attribtuesDmitry Vyukov2020-04-191-2/+1
| | | | | We had these hard-coded for fuchsia and linux accordingly. Replace with call attributes.
* pkg/compiler: refactor attribute handlingDmitry Vyukov2020-04-191-3/+3
| | | | | | | | | | | | Introduce common infrastructure for describing and parsing attribute instead of custom per-attribute code scattered across several locations. Change align attribute syntax from the weird align_N to align[N]. This also allows to use literal constants as N. Introduce notion of builtin constants. Currently we have only PTR_SIZE, which is needed to replace align_ptr with align[PTR_SIZE].
* pkg/compiler: check that flags values fit into base typeDmitry Vyukov2020-03-171-2/+2
| | | | | | | | flags[foo, int8] foo = 0x12345678 is always an error, detect these cases. Found some bugs in mptcp, packet sockets, kvm.
* pkg/compiler: check that const values fit into base typeDmitry Vyukov2020-03-171-1/+1
| | | | | const[0x12345678, int8] is always an error, detect these cases. Found some bugs in mptcp, socket proto and fuchsia fidl descriptions.
* pkg/compiler: ensure consistency of syscall argument typesDmitry Vyukov2020-03-171-13/+13
| | | | | | | | | | | | | | | | | | Ensure that we don't have conflicting sizes for the same argument of the same syscall, e.g.: foo$1(a int16) foo$2(a int32) This is useful for several reasons: - we will be able avoid morphing syscalls into other syscalls - we will be able to figure out more precise sizes for args (lots of them are implicitly intptr, which is the largest type on most important arches) - found few bugs in linux descriptions Update #477 Update #502
* prog: don't add fallback coverage after prctlDmitry Vyukov2020-01-151-0/+1
| | | | The same reason as with seccomp.
* prog: fix tests for string enforcementDmitry Vyukov2020-01-051-1/+1
| | | | | | | | String value enforcement broke a number of tests where we use different values. Be more string as to what string values we use in tests. Required to add tmpfs descriptions to test syz_mount_image. Also special-casing AF_ALG algorithms as these are auto-generated.
* prog: don't mutate strings with enumerated valuesDmitry Vyukov2020-01-051-0/+4
| | | | | | | | | | Strings with enumerated values are frequently file names or have complete enumeration of relevant values. Mutating complete enumeration if not very profitable. Mutating file names leads to escaping paths and fuzzer messing with things it is not supposed to mess with as in: r0 = openat$apparmor_task_exec(0xffffffffffffff9c, &(0x7f0000000440)='/proc/self//exe\x00', 0x3, 0x0)
* prog: don't fail decoding on non-default out argsDmitry Vyukov2019-12-211-0/+1
| | | | | | | We get them in cross-compilation test where an out const arg has different values in different archs. No reason to fail deserialization in that case, replace with default arg instead.
* prog: mutate length of output buffersVeronica Radu2019-10-101-0/+2
| | | | Update #480
* prog: implemented argument and call prioritiesVeronica Radu2019-09-041-0/+2
|
* prog: add special mutation for binary flagsVeronica Radu2019-08-091-0/+12
|
* prog: don't minimize ProcType to 0Dmitry Vyukov2019-07-261-0/+4
| | | | | | | | Default value for ProcType is 0 (same for all PID's). Usually 0 either does not make sense at all or make different PIDs collide (since we use ProcType to separate value ranges for different PIDs). So don't change ProcType to 0 unless the type is explicitly marked as opt (in that case we will also generate 0 anyway).
* pkg/compiler: add offsetof typeDmitry Vyukov2019-05-161-0/+21
| | | | | | Similar to C offsetof gives offset of a field from the beginning of the parent struct. We have several TODOs in descriptions asking for this.
* pkg/compiler: work around 0-array-size errors due to missing constsDmitry Vyukov2019-05-151-0/+2
| | | | | | | A const can be used as array size. Then if the const is not present on all arches, compiler will produce an error about 0-sized-array. There is no easy way to work around this for a user. Use value of 1 for missing consts. It's just a bit safer.
* pkg/compiler: allow to refer to syscall arguments in len pathsDmitry Vyukov2019-05-141-0/+1
| | | | This allows to use len[syscall:arg] expressions.
* prog: implement complex len target supportDmitry Vyukov2019-05-141-1/+29
| | | | | This actually implements support for complex len targets during program generation and mutation.
* pkg/compiler: generate complex len targetsDmitry Vyukov2019-05-141-0/+2
| | | | Change the generated format for len type to support multiple path elements.
* prog, pkg/csource: more readable serialization for stringsDmitry Vyukov2018-12-151-0/+5
| | | | | | | Always serialize strings in readable format (non-hex). Serialize binary data in readable format in more cases. Fixes #792
* prog: support AUTO args in programsDmitry Vyukov2018-12-101-0/+10
| | | | | | | | | | | | | | | AUTO arguments can be used for: - consts - lens - pointers For const's and len's AUTO is replaced with the natural value, addresses for AUTO pointers are allocated linearly. This greatly simplifies writing test programs by hand as most of the time we want these natural values. Update tests to use AUTO.
* executor: fix handling of big-endian bitfieldsDmitry Vyukov2018-12-081-0/+16
| | | | | Currently we apply big-endian-ness and bitfield-ness in the wrong order in copyin. This leads to totally bogus result. Fix this.
* sys/linux: add syz_execute_funcDmitry Vyukov2018-08-301-0/+2
| | | | | | The function executes random code. Update #310
* prog: don't add fallback signal after seccompDmitry Vyukov2018-08-191-1/+7
| | | | | seccomp filter can produce arbitrary errno values for subsequent syscalls. Don't trust anything afterwards.
* sys/test: add more testsDmitry Vyukov2018-08-031-1/+0
| | | | | | | | | | | | | | Add syz_errno syscall which sets errno to the argument, and add a test with different errno values. This mostly tests the testing infrastructure itself. Add syz_compare syscall which compare two blobs, this can be used for testing of argument memory layout. Implement syz_mmap and fix Makefile to allow building syz-execprog for test OS. Useful for debugging. Update #603
* executor: overhaulDmitry Vyukov2018-07-241-87/+88
| | | | | | | | | | | | | | | | | Make as much code as possible shared between all OSes. In particular main is now common across all OSes. Make more code shared between executor and csource (in particular, loop function and threaded execution logic). Also make loop and threaded logic shared across all OSes. Make more posix/unix code shared across OSes (e.g. signal handling, pthread creation, etc). Plus other changes along similar lines. Also support test OS in executor (based on portable posix) and add 4 arches that cover all execution modes (fork server/no fork server, shmem/no shmem). This change paves way for testing of executor code and allows to preserve consistency across OSes and executor/csource.
* pkg/compiler: check for unused declarationsDmitry Vyukov2018-06-301-0/+1
| | | | | Error on unused structs/unions/resources/flags. Finds tons of bugs.
* sys: mark output resources as optDmitry Vyukov2018-06-181-0/+7
| | | | | Mark output resources as opt in preparation for more precise constructor calculation.
* sys: dedup mmap code across OSesDmitry Vyukov2018-05-061-1/+1
| | | | Update #538
* pkg/compiler: support non-zero terminated filenamesDmitry Vyukov2018-04-021-2/+2
| | | | | | | | | | | | | | | Now file names become: string[filename] with a possibility of using other string features: stringnoz[filename] string[filename, CONST_SIZE] and filename is left as type alias as it is commonly used: type filename string[filename]
* prog: harden program parsing against description changes moreDmitry Vyukov2018-03-051-0/+5
| | | | | | | Handle most of type changes, e.g. const is changed to struct, or struct to pointers. In all these cases we create default args. They may not give the coverage anymore, but still better than losing them right away.
generated by ggit (джигит) mrf-deployment (git 2.46.0) at 2026-03-12 13:27:18 +0000