aboutsummaryrefslogtreecommitdiffstats
path: root/tools
Commit message (Collapse)AuthorAgeFilesLines
* tools/syz-prog2c: add vmlinux parsing stage for KFuzzTestEthan Graham2025-09-221-0/+9
| | | | | | | If vmlinux is specified as a flag, we perform a setup stage where we parse vmlinux for KFuzzTest targets. Signed-off-by: Ethan Graham <ethangraham@google.com>
* tools/kfuzztest-gen: add kfuzztest-gen toolEthan Graham2025-09-221-0/+47
| | | | | | | Add a tool for generating a syscaller description for every KFuzzTest target discovered in a vmlinux binary and outputting it to stdout. Signed-off-by: Ethan Graham <ethangraham@google.com>
* tools: add check-syzos.shAlexander Potapenko2025-09-111-0/+122
| | | | | | | | | | | | As shown in https://github.com/google/syzkaller/issues/5565, SYZOS code in the `guest` section cannot reference global data, because it is relocated into the guest memory. While arm64 executor has a dynamic check for data accesses, it is virtually impossible to do the same on x86 without implementing an x86 disassembler. Instead of doing so, introduce a build-time script that will detect instructions referencing global data on a best-effort basis.
* tools/syz-imagegen: rework ext4 flagsAleksandr Nogikh2025-08-291-23/+31
| | | | | Transform the hard-coded list of feature combinations in to individual groups of features.
* tools/syz-imagegen: rewrite combination generationAleksandr Nogikh2025-08-293-19/+252
| | | | | | | | | Introduce a new Filesystem parameter - the maximum number of resulting seeds. If the total number of flag combinations exceeds this number, switch to generating a covering array (that is, make sure that all flag value pairs are covered, or at least as many of them as possible).
* tools/syz-imagegen: accept filesystem descriptions as inputAleksandr Nogikh2025-08-291-10/+44
| | | | | | | | | Don't generate just the hard-coded list of filesystems, but also generate seeds for the externally supplied json description of a filesystem. Add a special syscall attribute to help syz-imagegen guess the actual filesystem name from the syz_mount_image variant name.
* tools/docker: install bazelisk instead of bazelKonstantin Bogomolov2025-08-281-3/+6
| | | | | | | The needed Bazel version to build gVisor got bumped. However, instead of doing the same bump in two places whenever this happens, we can simply use bazelisk in syzkaller to determine which bazel version to use automatically.
* tools/usbgen: extract driver namesAndrey Konovalov2025-08-212-39/+74
| | | | | | | | | | Change the kernel patch and the syz-usbgen tool to split the extracted USB IDs by the driver they belong to. This will allow for a more precise patching of class/driver-specific USB descriptors. Also update USB IDs with Linux kernel 6.16.
* tools/syz-lore: support bash wildcard resultsAleksandr Nogikh2025-08-121-15/+5
| | | | | | | | Instead of accepting a folder name and traversing all nested folders in it, accept the directories to process as separate arguments. This allows for more flexibility - one can either specify just one archive to process or one can use bash wildcards to achieve the previously default functionality.
* tools/syz-covermerger: document high-level descriptionTaras Madan2025-08-081-0/+50
|
* tools: openbsd workarounds to use clang-19Greg Steuck2025-08-071-3/+3
| | | | That's the current version in the tree.
* tools: put clang-format into PATH on openbsd GCE imageGreg Steuck2025-08-071-0/+1
|
* tools: fix llvm version used in the openbsd imageAleksandr Nogikh2025-08-051-1/+1
| | | | The old version prevents us from rebuiling ci-openbsd.
* pkg/csource: add call argument annotations to generated C-source filesEthan Graham2025-08-041-0/+1
| | | | | | | | | | | The structure of arguments passed into syscalls is often hard to parse since it is memcpy'd into mmap'd regions. Structural relations are often lost in translation, resulting in reproducers that take longer for a developer to understand. This patch adds functionality for parsing syscall arguments semantically and emitting a structured and human-readable comment which is inserted before each syscall in the resulting C-source.
* prog: generate choice table only for enabled callsAleksandr Nogikh2025-07-291-1/+2
| | | | | | | | | | | | | We used to generate a choice table and do its normalization for all present syscalls, also it was not considered during the /prio page generation. Enabled/disabled syscalls were accounted for in the choice table construction, but there's a chance that the resulting table was still somewhat skewed. The situation must have become worse after several thousands of auto syscalls were added.
* all: simplify subsystem revision updatesAleksandr Nogikh2025-07-232-9/+14
| | | | | | Don't specify the subsystem revision in the dashboard config and instead let it be nested in the registered subsystems. This reduces the amount of the manual work needed to switch syzbot to a newer subsystem list.
* all: determine patched symbols for focused fuzzingAleksandr Nogikh2025-07-221-1/+1
| | | | | | | | | Hash the code section of the individual symbols from vmlinux.o and use it to determine the functions that changed their bodies between the base and the patched build. If the number of affected symbols is reasonable (<5%), fuzz it with the highest priority.
* all: apply linter auto fixesTaras Madan2025-07-171-1/+1
| | | | ./tools/syz-env bin/golangci-lint run ./... --fix
* tools: allow dependabot to commit long descriptionsTaras Madan2025-07-041-1/+3
| | | | Some dependencies update fail because of the len(descr_line)>120.
* tools/docker: update golang to 1.24.4Taras Madan2025-07-012-2/+2
|
* all: fix typosRoman A2025-06-161-1/+1
|
* tools: fix perf compiling on debootstrap imagesAlexandre Maloteaux2025-06-161-0/+2
|
* tools/syz-kconfig: suggest reasons for wrongly selected configsAleksandr Nogikh2025-06-131-1/+11
| | | | | | | | | | The most frustrating part of updating syzbot configs is figuring out what config options (possibly transivitely) selected the configs we wanted to stay disabled. For each "X is present in the final config" message, auto-generate a small list of enabled config options that may have transitively "select"ed X.
* tools/check_translation_update.py: check if the translations are up to dateQGrain2025-06-021-0/+223
| | | | | | | Check if the translations in docs/translations/LANG/FILES are update with docs/FILES with detailed outputs. Translations should be committed with "Update to commit HASH (TITLE)".
* tools: adjust EC2 rootfs network configurationBjoern Doebel2025-05-261-0/+3
| | | | | | | | | | In a previous change (https://github.com/google/syzkaller/pull/6023) we made a simplification, assuming that a non-existent Match section in systemd networkd's config would allow DHCP for any network interface. After more testing this turns out to be incorrect and we really only get an IP via DHCP with an explicit broad Name regex. Signed-off-by: Bjoern Doebel <doebel@amazon.de>
* tools/docker: add rust compilerAleksandr Nogikh2025-05-202-4/+30
| | | | | Add the new dependencies necessary for generating RUST=y Linux configs and for building RUST=y kernels.
* tools/syz-query-subsystems: introduce the kvm-x86 subsystemAlexander Potapenko2025-05-151-1/+1
| | | | | | | | | Split off kvm-x86 from kvm for better coverage accounting. Both subsystems will still share the CC lists, so bugs in x86 code won't be emailed twice. While at this, also fix the tool name in the generated comment and regenerate pkg/subsystem/lists/linux.go on v6.14-rc7.
* tools: widen network DHCP configuration for EC2 Root FSBjoern Doebel2025-05-141-3/+0
| | | | | | | | | The current EC2/AL2023 root file system only works for systems using the Intel e1000 driver. Remove the match clause to support all potential network interfaces and allow fuzzing with other network interfaces (such as virtio-net). Signed-off-by: Bjoern Doebel <doebel@amazon.de>
* tools/syz-symbolize: add -config to support module symbolizeJiao, Joey2025-05-141-5/+12
|
* pkg/vcs: extend ListCommitHashesAleksandr Nogikh2025-05-131-1/+1
| | | | | | | | | | Rename the method to LatestCommit and make it more flexible: 1) Return the commit date alongside the commit hash. 2) Rename the time filter to highlight that it's non-inclusive. 3) Make it possible to query the commits newer than the specified commit hash. It will let us poll lore archives more efficiently.
* tools: update create-buildroot-image.sh scriptAleksandr Nogikh2025-05-071-3/+12
| | | | | | | | | Use a newer Buildroot release. Use an appropriate arm instruction set for arm32. Reduce the syslogd logging level. Closes #5986. Closes #5452.
* tools/docker/env: update gcloud to 519Taras Madan2025-04-291-19/+7
| | | | | It requires appengine dependency update to match golang versions. gcloud-appengine-python patching is needed to fix #4785.
* all: format with clang-format-20Aleksandr Nogikh2025-04-241-1/+1
| | | | The tests began to fail after pushing the new env container.
* tools/docker: migrate to llvm-20Aleksandr Nogikh2025-04-242-21/+24
| | | | | | | clang-15 is now the minimum required version, so we're already on the verge of not being able to compile the Linux kernel. But keep clang-15 anyway - it will be used during bisections.
* tools/syz-kconf: don't proceed after failuresAleksandr Nogikh2025-04-231-4/+4
| | | | | | | | | It's almost never reasonable to keep on generating configs after some targets have already failed. We have a lot of different kernels and regenerating them all takes a very long time. Having to regenerate everything on each iteration slows down the development significantly.
* tools: repair syz-testbuildAleksandr Nogikh2025-04-221-5/+16
| | | | | | 1. Properly set up a manager config. 2. Use clang/ld.lld by default. 3. Set the right boot partition for qemu VMs.
* tools/docker: add ld.lld to envAleksandr Nogikh2025-04-171-1/+2
| | | | | We use the env container to update kernel configs and the lack of ld.lld in it prevents the usage of LLVM=1.
* all: use LLVM=1 for building Linux with clangAleksandr Nogikh2025-04-171-13/+13
| | | | | | | | | | | | This is the standard way now. Since our configuration permits multiple parameter value combinations, explicitly check for the compiler and linker that were to be passed via CC and LD, and replace that with LLVM=1 if they were clang and ld.lld correspondingly. Update syz-kconf to rely on pkg/build's exported functionality for generating Linux kernel build arguments.
* pkg/manager: provide diff fuzzer state dumpsAleksandr Nogikh2025-04-151-2/+2
| | | | | | Make the fuzzing step of syz-cluster create the manager.DiffStore object explicitly and dump its state to the logs after finishing the fuzzing session.
* tools/syz-declextract: ignore files with non US-ASCII charsDmitry Vyukov2025-04-151-0/+4
|
* tools/syz-declextract: update test golden filesDmitry Vyukov2025-04-152-2/+1
| | | | | Regenerate golden files with up-to-date clang tool. Missed part of commit c7e92da6cb06679b04062786481f50e42c585bfc.
* pkg/declextract: add open fileops callback to interface listDmitry Vyukov2025-04-151-1/+0
| | | | | | Add open callback if there are no other unique callbacks. This happens for e.g. seq files which only have unique open, while read is a common seq_read callback.
* pkg/declextract: more precise fileops callback resolutionDmitry Vyukov2025-04-151-5/+5
| | | | | | Use resolved Function references instead of string names for fileops callback resolution. Function names are not unique, a number of callbacks have the same names.
* tools/syz-declextract: extract function references more preciselyDmitry Vyukov2025-04-153-42/+70
| | | | | | Currently we misparse some function references, e.g. for: .write = (foo) ? bar : baz, we extract "foo". Extract first function reference from such expressions.
* tools/syz-declextract: extract enums declared with a typedefDmitry Vyukov2025-04-156-12/+120
|
* tools/syz-declextract: extract ioctls declared with enumsDmitry Vyukov2025-04-156-62/+109
| | | | | Some ioctls are declared inconsistently using enums rather than macros. Extract these as well.
* pkg/manager: make diff fuzzer artifacts folder configurableAleksandr Nogikh2025-04-111-1/+2
|
* tools/syz-declextract: export info about file ops interfacesDmitry Vyukov2025-04-112-1/+19
|
* tools/syz-declextract: add interface coverage infoDmitry Vyukov2025-04-1018-73/+372
| | | | | | Add coverage percent for kernel interfaces. The current data is generated with Mar coverage report on kernel commit 1e7857b28020ba57ca7fdafae7ac855ba326c697.
* pkg/declextract: export syscall variants as separate interfacesDmitry Vyukov2025-04-1011-83/+177
| | | | | | Export each syscall variant (e.g. fcnt$*) as a separate interface. Effectively these are separate syscalls. We will want this for ioctl as well (it's not 1 interface).
generated by ggit (джигит) mrf-deployment (git 2.46.0) at 2026-04-02 02:45:55 +0000