aboutsummaryrefslogtreecommitdiffstats
path: root/tools/syz-crush
Commit message (Collapse)AuthorAgeFilesLines
* vm: make sure vm.Pools are cleaned upCameron Finucane2024-09-191-0/+1
| | | | Add calls to Close() from all locations that call Create().
* pkg/instance: use execprog to do basic instance testingDmitry Vyukov2024-05-271-1/+1
| | | | | | | | | | | When we accept new kernels for fuzzing we need more extensive testing, but syz-ci switched to using syz-manager for this purpose. Now instance testing is used only for bisection and patch testing, which does not need such extensive image testing (it may even harm). So just run a simple program as a testing. It also uses the same features as the target reproducer, so e.g. if the reproducer does not use wifi, we won't test it, which reduces changes of unrelated kernel bugs.
* pkg/instance: always use default exit conditionsAleksandr Nogikh2024-05-231-3/+1
| | | | | | | We don't really need to overwrite it. For syz programs, don't ignore non-zero exit codes. This should enable syzkaller to find reproducers for "lost connection" bugs.
* vm: combine Run and MonitorExecutionDmitry Vyukov2024-04-111-1/+1
| | | | | | All callers of Run always call MonitorExecution right after it. Combine these 2 methods. This allows to hide some implementation details and simplify users of vm package.
* all: tools/syz-env make generate resultTaras Madan2023-02-241-1/+3
|
* all: ioutil is deprecated in go1.19 (#3718)Taras Madan2023-02-231-2/+1
|
* all: run strace on each found reproducerAleksandr Nogikh2022-04-291-0/+7
| | | | | | | | If `strace_bin` is specified, syzkaller will invoke a reproducer with it and save the output. This should help in debugging. If syz-manager is attached to a dashboard, upload the strace-powered output and report.
* vm: support variable output buffer sizeAleksandr Nogikh2022-04-291-5/+6
| | | | | Also update syz-crush to save RawOutput instead of output from the Report.
* all: use the same prog execution code throughout the projectAleksandr Nogikh2022-04-291-51/+21
| | | | | | | | | | Previously it was copypasted in pkg/instance, pkg/repro, tools/syz-crash. Use the single implementation instead. Also, this commit fixes a bug - the previous code always set collide to true while reproducing a bug, which led to an immediate syz-exexprog's exit. As a result, newer bugs with .syz repro only were never actually reproduced on #syz test requests.
* tools/syz-crush: fix default VM timeoutDmitry Vyukov2021-12-081-1/+1
|
* pkg/report: separate reporter wrapper from OS-specific implementationsAleksandr Nogikh2021-08-061-1/+1
| | | | | | | | | | | | | Currently a number of report post-processing activities are implemented as a decorator over the interface that defines OS-specific implementations. Following exactly the same interface is too restrictive in this case as adding extra parameters to the post-processing forces the developer to adjust all implementations thay may not need these parameters at all. Untie the wrapper from the Reporter interface. Use a package-private reporterImpl interface for the OS-specific implementations, while having an exported Reporter structure. Make sure that Reporter is stored and passed as a pointer.
* all: make timeouts configurableDmitry Vyukov2020-12-281-6/+7
| | | | | | Add sys/targets.Timeouts struct that parametrizes timeouts throughout the system. The struct allows to control syscall/program/no output timeouts for OS/arch/VM/etc. See comment on the struct for more details.
* tools/syz-crush: make the results saving more flexibleAlexander Popov2020-12-041-1/+1
| | | | | | | | | | | | | | | | Currently syz-crush saves the results in the syzkaller workdir. That brings a side effect: if you test two different reproducers giving crashes with the same title, syz-crush saves all your results in a single crash directory. Let's make it more flexible. Save syz-crush results in the directory containing the tested reproducer: - we have the original workflow, if all tested reproducers reside in the syzkaller workdir; - we can get the results separately, if all tested reproducers reside in separate directories. Signed-off-by: Alexander Popov <alex.popov@linux.com>
* tools/syz-crush: improve the outputAlexander Popov2020-12-011-6/+16
| | | | | | | | | | | | | Currently syz-crush saves the results in the syzkaller workdir. If you run this tool multiple times, you may lose the connection between your reproducers and the crash reports saved in workdir. Let's improve storeCrash(): 1. print the sequence number of the saved crash, 2. report about the errors during crash saving, 3. copy the reproducer to the workdir as well. Signed-off-by: Alexander Popov <alex.popov@linux.com>
* pkg/mgrconfig: remove Syz prefix from fieldsDmitry Vyukov2020-11-301-7/+7
| | | | | | | Everything in syzkaller is syz-something, it's pointless to add syz prefix to everything and unnecessary increases clutter. Remove the prefix. Also, rename ExecutorCmd in target to ExecutorBin to make it consistent with mgrconfig and ExecprogBin/FuzzerBin.
* pkg/mgrconfig: add prog&sys.targets targets to ConfigDmitry Vyukov2020-11-301-9/+3
| | | | | | These are widely used with the config as the refactoring shows. This removes a bunch of unnecessary code. Also fixes a number of bugs where we confused Arch with VMArch.
* tools/syz-crush: Add debug optionJukka Kaartinen2020-06-161-1/+2
| | | | Signed-off-by: Jukka Kaartinen <jukka.kaartinen@unikie.com>
* tools/syz-crush: use standard log packageDmitry Vyukov2020-06-151-21/+21
| | | | | We always use verbosity 0, there is no point in using our custom package. Switch to the standard one instead.
* tools/syz-crush: simplify and tidyDmitry Vyukov2020-06-151-115/+53
| | | | As discussed in #1798.
* tools/syz-crush: Add feature to run C-programJukka Kaartinen2020-06-151-44/+193
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | usage: syz-crush -config=config.json creprog.c Produced output is same as syz-manager produces. New directory called reproduced_with is added that lists all the reproducers that triggered the crash. Example: ~/workdir/crashes $ tree . ├── 2a8fff76c6267ecfeaf3530a602ed48afbc4a151 │   ├── description │   ├── log0 │   ├── log1 │   ├── log2 │   ├── report0 │   ├── report1 │   ├── report2 │   └── reproduced_with │   └── 17a6ed226769660f3e5dad7b22b13466b938e290.c ├── 2b6b921457afe8cebd0a96ca40f8569e6ee95174 │   ├── description │   ├── log0 │   ├── log1 │   ├── log2 │   ├── log3 │   ├── log4 │   ├── log5 │   ├── report0 │   ├── report1 │   ├── report2 │   ├── report3 │   ├── report4 │   ├── report5 │   └── reproduced_with │   ├── 9fb2f5b37bf4428382334e336bbbb201634c7c4c.c │   └── ab27002b46d19cafb1ebb8b040f0a3b0f8f88974.c Signed-off-by: Jukka Kaartinen <jukka.kaartinen@unikie.com>
* syz/targets: add SyzExecutorCmd flagMarco Vanotti2019-12-091-5/+11
| | | | | | | | | | | | | This commit adds a new attribute to syzkaller targets that tells syzkaller how to invoke the syz-executor command. Some systems, like Fuchsia, are now building syz-executor as part of the build, and there is no need to copy it over, or to run it from `/tmp`. In fact, that might stop working at some time in the future in Fuchsia. All places that used to copy syz-executor into the target machine will now check for the SyzExecutorCmd flag, and won't copy it if the flag is set.
* vm: allow fine-grained control over program exit conditionsDmitry Vyukov2018-12-241-1/+1
| | | | | | | | | Currently we only support canExit flag. However there are actually 3 separate conditions: - program can exit normally - program can timeout (e.g. fuzzer test or runtest can't) - program can exit with error (e.g. C test can) Allow to specify these 3 conditions separately.
* pkg/mgrconfig: move from syz-manager/mgrconfigDmitry Vyukov2018-08-021-1/+1
| | | | | | | | mgrconfig was used only by syz-manager initially, but now it's used by a dozen of packages and it's weird to import from under a binary dir. pkg/ is much more reasonable dir for a widely used helper package.
* pkg/instance: pass -os to execprog/fuzzer only for akarosDmitry Vyukov2018-07-061-3/+3
| | | | | | Only akaros needs OS, because the rest assume host OS. But speciying OS for all OSes breaks patch testing on syzbot because old execprog does not have os flag.
* pkg/report: allow to specify suppressions per OSDmitry Vyukov2018-06-221-5/+2
| | | | | | | | | | | | | Currently all (linux-specific) suppressions are hardcoded in mgrconfig. This is very wrong. Move them to pkg/report and allow to specify per OS. Add gvisor-specific suppressions. This required a bit of refactoring. Introduce mgrconfig.KernelObj finally. Make report.NewReporter and vm.Create accept mgrconfig directly instead of passing it as multiple scattered args. Remove tools/syz-parse and it always did the same as tools/syz-symbolize. Simplify global vars in syz-manager/cover.go. Create reporter eagerly in manager. Use sort.Slice more. Overall -90 lines removed.
* pkg/report: pass vm type to NewReporterDmitry Vyukov2018-06-221-2/+2
| | | | | For the case when VM type affects output. Will be needed for gvisor. It is kinda linux, but kinda not.
* vm: pass instance to MonitorExecutionDmitry Vyukov2018-06-221-1/+1
| | | | | It may need it later to try to obtain additional diagnostic from hanged instances.
* pkg/host: rework host feature detection/setupDmitry Vyukov2018-06-121-1/+1
| | | | | | | | | | Currently host feature detection/setup code is spread across platform-independent fuzzer code, pkg/host, pkg/ipc and executor. Move this all into pkg/host and show readable info about features on manager start. Fixes #46
* all: get rid of underscores in identifiersDmitry Vyukov2018-05-071-1/+1
| | | | | | Underscores are against Go coding style. Update #538
* all: fix gometalinter warningsDmitry Vyukov2018-03-081-1/+0
| | | | Fix typos, non-canonical code, remove dead code, etc.
* tools/syz-crush: fix for new multi-target worldDmitry Vyukov2017-11-301-3/+4
|
* pkg/report: add Output to ReportDmitry Vyukov2017-11-291-2/+2
| | | | | | | | | Whole raw output is indivisble part of Report, currently we always pass Output separately along with Report. Make Output a Report field. Then, put whole Report into manager Crash and repro context and Result. There is little point in passing Report as aa bunch of separate fields.
* vm: return Report from MonitorExecutionDmitry Vyukov2017-11-211-7/+3
| | | | | | This allows callers to get access to Report.Corrupted. Better than adding 6-th return value and will allow to pipe other report properties if necessary.
* pkg/report, pkg/repro, syz-manager: name crash attributes consistentlyDmitry Vyukov2017-11-141-3/+3
| | | | | | | | | We currently have several names for crash attributes, which is disturbing. E.g. crash title is called "Title" or "Desc". Name them consistently. Title - single line bug identity. Report - whole crash text. Log - whole fuzzer/kernel output.
* vm: remove needOutput arg for MonitorExecutionDmitry Vyukov2017-11-141-1/+1
| | | | | | Always wait 10 secs for output. If anything this can only lead to missed crashes during repro. Let's unify manager and repro behavior.
* pkg/report: support multiple OSesDmitry Vyukov2017-10-181-29/+27
| | | | | | Introduce report.Reporter interface. Add an implementation per-OS. Make users be explicit about OS they are testing.
* prog: remove default target and all global stateDmitry Vyukov2017-09-151-1/+1
| | | | | | Now each prog function accepts the desired target explicitly. No global, implicit state involved. This is much cleaner and allows cross-OS/arch testing, etc.
* syz-manager/mgrconfig: explicitly specify target in configDmitry Vyukov2017-09-151-1/+5
| | | | | Add target config parameter (e.g. linux/amd64) which controls target OS/arch. No more explicit assumptions about target.
* syz-manager/mgrconfig: move sshkey from vm config to manager configDmitry Vyukov2017-06-171-7/+1
| | | | | | | | | | | | | | Sshkey is a property of image, which is in manager config. Move sshkey to the same location as image. The motivation for the move is as follows. Continuous build produces an image and the key, both need to be passed manager instance. Continuous build system should not distinguish different VM types and mess with their configs. NOTE FOR USERS: this breaks manager configs again. Hopefully the last time for now. Docs are updated.
* syz-manager/mgrconfig: allow loading from memoryDmitry Vyukov2017-06-171-1/+1
| | | | | | Allow loading manager config from memory. Follow pkg/config naming convention, i.e. LoadFile/LoadData instead of Parse.
* syz-manager/config: rename to syz-manager/mgrconfigDmitry Vyukov2017-06-171-3/+3
| | | | | | | | | | | We have 2 packages with the same name: pkg/config and syz-manager/config. This leads to constant clashes. We either rename one to pkgconfig or another to mgrconfig. This is not good and will become worse when/if we have another program-specific config in a separate package. Rename manager config to mgrconfig. Other program-specific configs can use the same convention in future -- fooconfig.
* vm: overhaulDmitry Vyukov2017-06-031-20/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | VM infrastructure currently has several problems: - Config struct is complete mess with a superset of params for all VM types - verification of Config is mess spread across several places - there is no place where VM code could do global initialization like creating GCE connection, uploading GCE image to GCS, matching adb devices with consoles, etc - it hard to add private VM implementations such impl would need to add code to config package which would lead to constant merge conflicts - interface for VM implementation is mixed with interface for VM users this does not allow to provide best interface for both of them - there is no way to add common code for all VM implementations This change solves these problems by: - splitting VM interface for users (vm package) and VM interface for VM implementations (vmimpl pacakge), this in turn allows to add common code - adding Pool concept that allows to do global initialization and config checking at the right time - decoupling manager config from VM-specific config each VM type now defines own config Note: manager configs need to be changed after this change: VM-specific parts are moved to own "vm" subobject. Note: this change also drops "local" VM type. Its story was long unclear and there is now syz-stress which solves the same problem.
* pkg/log: move from logDmitry Vyukov2017-06-031-1/+1
|
* config: split and refactorDmitry Vyukov2017-06-011-1/+1
| | | | | | | | | Introduce generic config.Load function that can be reused across multiple programs (syz-manager, syz-gce, etc). Move the generic config functionality to pkg/config package. The idea is to move all helper (non-main) packages to pkg/ dir, because we have more and more of them and they pollute the top dir. Move the syz-manager config parts into syz-manager/config package.
* manager: add ability to ignore bugsDmitry Vyukov2016-12-191-2/+2
| | | | | | Add new config parameter "ignores" which contains list of regexp expressions. If one of the expressions is matched against oops line, crash report is not saved and VM is not restarted.
* manager: reproduce crashes on the flyDmitry Vyukov2016-11-251-1/+0
| | | | | | | With this change manager will run reproduction on crashes until reproducer is discovered, but at most 3 times. If reproducer is discovered it is saved with crashes and shown on the web UI.
* vm: add ability to interrupt commandsDmitry Vyukov2016-11-191-3/+3
| | | | This is required for crash reproduction in manager.
* tools/syz-crush: add new toolDmitry Vyukov2016-11-161-0/+136
syz-crush replays crash log on multiple VMs. Usage: syz-crush -config=config.file execution.log Intended for reproduction of particularly elusive crashes.
generated by ggit (джигит) mrf-deployment (git 2.46.0) at 2026-03-11 20:21:58 +0000