From d7bccd30b388650dc50996a1f81efb9698d0781b Mon Sep 17 00:00:00 2001 From: Dmitry Vyukov Date: Mon, 12 Jan 2026 12:37:14 +0100 Subject: pkg/aflow/flow/assessment: add UAF moderation workflow Add workflow that can be used for moderation of UAF bugs (consistent/actionable reports), such UAF bugs can be upstreammed automatically, even if they happened only once and don't have a reproducer. --- dashboard/app/ai.go | 14 +++++++++++++- dashboard/app/ai_test.go | 1 + 2 files changed, 14 insertions(+), 1 deletion(-) (limited to 'dashboard') diff --git a/dashboard/app/ai.go b/dashboard/app/ai.go index e0847ea4a..9f620384f 100644 --- a/dashboard/app/ai.go +++ b/dashboard/app/ai.go @@ -16,6 +16,7 @@ import ( "github.com/google/syzkaller/dashboard/app/aidb" "github.com/google/syzkaller/dashboard/dashapi" "github.com/google/syzkaller/pkg/aflow/ai" + "github.com/google/syzkaller/pkg/report/crash" "github.com/google/syzkaller/pkg/vcs" db "google.golang.org/appengine/v2/datastore" ) @@ -322,6 +323,7 @@ func bugJobCreate(ctx context.Context, workflow string, typ ai.WorkflowType, bug Description: bug.displayTitle(), Link: fmt.Sprintf("/bug?id=%v", bug.keyHash(ctx)), Args: spanner.NullJSON{Valid: true, Value: map[string]any{ + "BugTitle": bug.Title, "ReproOpts": string(crash.ReproOpts), "ReproSyzID": crash.ReproSyz, "ReproCID": crash.ReproC, @@ -423,11 +425,21 @@ const currentAIJobCheckSeq = 1 func workflowsForBug(bug *Bug, manual bool) map[ai.WorkflowType]bool { workflows := make(map[ai.WorkflowType]bool) - if strings.HasPrefix(bug.Title, "KCSAN: data-race") { + typ := crash.TitleToType(bug.Title) + // UAF bugs stuck in last but one reporting. + if typ.IsUAF() && len(bug.Reporting) > 1 && + bug.Reporting[len(bug.Reporting)-1].Reported.IsZero() && + !bug.Reporting[len(bug.Reporting)-2].Reported.IsZero() { + workflows[ai.WorkflowModeration] = true + } + if typ == crash.KCSANDataRace { workflows[ai.WorkflowAssessmentKCSAN] = true } if manual { // Types we don't create automatically yet, but can be created manually. + if typ.IsUAF() { + workflows[ai.WorkflowModeration] = true + } if bug.HeadReproLevel > dashapi.ReproLevelNone { workflows[ai.WorkflowPatching] = true } diff --git a/dashboard/app/ai_test.go b/dashboard/app/ai_test.go index b5e686dfa..e378e77b4 100644 --- a/dashboard/app/ai_test.go +++ b/dashboard/app/ai_test.go @@ -124,6 +124,7 @@ func TestAIJob(t *testing.T) { require.NotEqual(t, resp.ID, "") require.Equal(t, resp.Workflow, "assessment-kcsan") require.Equal(t, resp.Args, map[string]any{ + "BugTitle": "KCSAN: data-race in foo / bar", "CrashReport": "report1", "KernelRepo": "repo1", "KernelCommit": "1111111111111111111111111111111111111111", -- cgit mrf-deployment