1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
|
// Copyright 2026 syzkaller project authors. All rights reserved.
// Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file.
package diff
import (
"fmt"
"regexp"
"sort"
"strings"
"github.com/google/syzkaller/pkg/log"
"github.com/google/syzkaller/pkg/mgrconfig"
"github.com/google/syzkaller/pkg/osutil"
"github.com/google/syzkaller/pkg/vcs"
)
const (
symbolsArea = "symbols"
filesArea = "files"
includesArea = "included"
)
func PatchFocusAreas(cfg *mgrconfig.Config, gitPatches [][]byte, baseHashes, patchedHashes map[string]string) {
funcs := modifiedSymbols(baseHashes, patchedHashes)
if len(funcs) > 0 {
log.Logf(0, "adding modified_functions to focus areas: %q", funcs)
var regexps []string
for _, name := range funcs {
regexps = append(regexps, fmt.Sprintf("^%s$", regexp.QuoteMeta(name)))
}
cfg.Experimental.FocusAreas = append(cfg.Experimental.FocusAreas,
mgrconfig.FocusArea{
Name: symbolsArea,
Filter: mgrconfig.CovFilterCfg{
Functions: regexps,
},
Weight: 6.0,
})
}
direct, transitive := affectedFiles(cfg, gitPatches)
if len(direct) > 0 {
sort.Strings(direct)
log.Logf(0, "adding directly modified files to focus areas: %q", direct)
cfg.Experimental.FocusAreas = append(cfg.Experimental.FocusAreas,
mgrconfig.FocusArea{
Name: filesArea,
Filter: mgrconfig.CovFilterCfg{
Files: direct,
},
Weight: 3.0,
})
}
if len(transitive) > 0 {
sort.Strings(transitive)
log.Logf(0, "adding transitively affected to focus areas: %q", transitive)
cfg.Experimental.FocusAreas = append(cfg.Experimental.FocusAreas,
mgrconfig.FocusArea{
Name: includesArea,
Filter: mgrconfig.CovFilterCfg{
Files: transitive,
},
Weight: 2.0,
})
}
// Still fuzz the rest of the kernel.
if len(cfg.Experimental.FocusAreas) > 0 {
cfg.Experimental.FocusAreas = append(cfg.Experimental.FocusAreas,
mgrconfig.FocusArea{
Weight: 1.0,
})
}
}
func affectedFiles(cfg *mgrconfig.Config, gitPatches [][]byte) (direct, transitive []string) {
const maxAffectedByHeader = 50
directMap := make(map[string]struct{})
transitiveMap := make(map[string]struct{})
var allFiles []string
for _, patch := range gitPatches {
for _, diff := range vcs.ParseGitDiff(patch) {
allFiles = append(allFiles, diff.Name)
}
}
for _, file := range allFiles {
directMap[file] = struct{}{}
if !strings.HasSuffix(file, ".h") || cfg.KernelSrc == "" {
continue
}
// For .h files, we want to determine all the .c files that include them.
// Ideally, we should combine this with the recompilation process - then we know
// exactly which files were affected by the patch.
matching, err := osutil.GrepFiles(cfg.KernelSrc, `.c`,
[]byte(`<`+strings.TrimPrefix(file, "include/")+`>`))
if err != nil {
log.Logf(0, "failed to grep for includes: %s", err)
continue
}
if len(matching) >= maxAffectedByHeader {
// It's too widespread. It won't help us focus on anything.
log.Logf(0, "the header %q is included in too many files (%d)", file, len(matching))
continue
}
for _, name := range matching {
transitiveMap[name] = struct{}{}
}
}
for name := range directMap {
direct = append(direct, name)
}
for name := range transitiveMap {
if _, ok := directMap[name]; ok {
continue
}
transitive = append(transitive, name)
}
return
}
// If there are too many different symbols, they are no longer specific enough.
// Don't use them to focus the fuzzer.
const modifiedSymbolThreshold = 0.05
func modifiedSymbols(baseHashes, patchedHashes map[string]string) []string {
var ret []string
for name, hash := range patchedHashes {
if baseHash, ok := baseHashes[name]; !ok || baseHash != hash {
ret = append(ret, name)
if float64(len(ret)) > float64(len(patchedHashes))*modifiedSymbolThreshold {
return nil
}
}
}
sort.Strings(ret)
return ret
}
|
