syzkaller/prog/mutation.go

// Copyright 2015 syzkaller project authors. All rights reserved.
// Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file.

package prog

import (
	"fmt"
	"math/rand"
	"unsafe"

	"github.com/google/syzkaller/sys"
)

func (p *Prog) Mutate(rs rand.Source, ncalls int, ct *ChoiceTable, corpus []*Prog) {
	r := newRand(rs)

	if r.oneOf(100) && corpus != nil {
		// Splice with another prog from corpus.
		p0 := corpus[r.Intn(len(corpus))]
		p0c := p0.Clone()
		idx := r.Intn(len(p.Calls))
		p.Calls = append(p.Calls[:idx], append(p0c.Calls, p.Calls[idx:]...)...)
	} else {
		// Mutate current prog without splicing.
		retry := false
		for stop := false; !stop || retry; stop = r.bin() {
			retry = false
			r.choose(
				20, func() {
					// Insert a new call.
					if len(p.Calls) >= ncalls {
						retry = true
						return
					}
					idx := r.biasedRand(len(p.Calls)+1, 5)
					var c *Call
					if idx < len(p.Calls) {
						c = p.Calls[idx]
					}
					s := analyze(ct, p, c)
					calls := r.generateCall(s, p)
					p.insertBefore(c, calls)
				},
				10, func() {
					// Change args of a call.
					if len(p.Calls) == 0 {
						retry = true
						return
					}
					c := p.Calls[r.Intn(len(p.Calls))]
					if len(c.Args) == 0 {
						retry = true
						return
					}
					s := analyze(ct, p, c)
					for stop := false; !stop; stop = r.bin() {
						args, bases := mutationArgs(c)
						if len(args) == 0 {
							retry = true
							return
						}
						idx := r.Intn(len(args))
						arg, base := args[idx], bases[idx]
						var baseSize uintptr
						if base != nil {
							if base.Kind != ArgPointer || base.Res == nil {
								panic("bad base arg")
							}
							baseSize = base.Res.Size()
						}
						switch a := arg.Type.(type) {
						case *sys.IntType, *sys.FlagsType, *sys.ResourceType, *sys.VmaType:
							arg1, calls1 := r.generateArg(s, arg.Type)
							p.replaceArg(c, arg, arg1, calls1)
						case *sys.BufferType:
							switch a.Kind {
							case sys.BufferBlobRand, sys.BufferBlobRange:
								var data []byte
								switch arg.Kind {
								case ArgData:
									data = append([]byte{}, arg.Data...)
								case ArgConst:
									// 0 is OK for optional args.
									if arg.Val != 0 {
										panic(fmt.Sprintf("BufferType has non-zero const value: %v", arg.Val))
									}
								default:
									panic(fmt.Sprintf("bad arg kind for BufferType: %v", arg.Kind))
								}
								minLen := int(0)
								maxLen := ^int(0)
								if a.Kind == sys.BufferBlobRange {
									minLen = int(a.RangeBegin)
									maxLen = int(a.RangeEnd)
								}
								arg.Data = mutateData(r, data, minLen, maxLen)
							case sys.BufferString:
								if r.bin() {
									arg.Data = mutateData(r, append([]byte{}, arg.Data...), int(0), ^int(0))
								} else {
									arg.Data = r.randString(s, a.Values, a.Dir())
								}
							case sys.BufferFilename:
								arg.Data = []byte(r.filename(s))
							case sys.BufferSockaddr:
								arg.Data = r.sockaddr(s)
							default:
								panic("unknown buffer kind")
							}
						case *sys.ArrayType:
							count := uintptr(0)
							switch a.Kind {
							case sys.ArrayRandLen:
								for count == uintptr(len(arg.Inner)) {
									count = r.rand(6)
								}
							case sys.ArrayRangeLen:
								if a.RangeBegin == a.RangeEnd {
									panic("trying to mutate fixed length array")
								}
								for count == uintptr(len(arg.Inner)) {
									count = r.randRange(int(a.RangeBegin), int(a.RangeEnd))
								}
							}
							if count > uintptr(len(arg.Inner)) {
								var calls []*Call
								for count > uintptr(len(arg.Inner)) {
									arg1, calls1 := r.generateArg(s, a.Type)
									arg.Inner = append(arg.Inner, arg1)
									for _, c1 := range calls1 {
										calls = append(calls, c1)
										s.analyze(c1)
									}
								}
								for _, c1 := range calls {
									sanitizeCall(c1)
								}
								sanitizeCall(c)
								p.insertBefore(c, calls)
							} else if count < uintptr(len(arg.Inner)) {
								for _, arg := range arg.Inner[count:] {
									p.removeArg(c, arg)
								}
								arg.Inner = arg.Inner[:count]
							}
							// TODO: swap elements of the array
						case *sys.PtrType:
							// TODO: we don't know size for out args
							size := uintptr(1)
							if arg.Res != nil {
								size = arg.Res.Size()
							}
							arg1, calls1 := r.addr(s, a, size, arg.Res)
							p.replaceArg(c, arg, arg1, calls1)
						case *sys.StructType:
							ctor := isSpecialStruct(a)
							if ctor == nil {
								panic("bad arg returned by mutationArgs: StructType")
							}
							arg1, calls1 := ctor(r, s)
							for i, f := range arg1.Inner {
								p.replaceArg(c, arg.Inner[i], f, calls1)
								calls1 = nil
							}
						case *sys.UnionType:
							optType := a.Options[r.Intn(len(a.Options))]
							for optType.Name() == arg.OptionType.Name() {
								optType = a.Options[r.Intn(len(a.Options))]
							}
							p.removeArg(c, arg.Option)
							opt, calls := r.generateArg(s, optType)
							arg1 := unionArg(a, opt, optType)
							p.replaceArg(c, arg, arg1, calls)
						case *sys.LenType:
							panic("bad arg returned by mutationArgs: LenType")
						case *sys.ConstType:
							panic("bad arg returned by mutationArgs: ConstType")
						default:
							panic(fmt.Sprintf("bad arg returned by mutationArgs: %#v, type=%#v", *arg, arg.Type))
						}

						// Update base pointer if size has increased.
						if base != nil && baseSize < base.Res.Size() {
							arg1, calls1 := r.addr(s, base.Type, base.Res.Size(), base.Res)
							for _, c1 := range calls1 {
								sanitizeCall(c1)
							}
							p.insertBefore(c, calls1)
							arg.AddrPage = arg1.AddrPage
							arg.AddrOffset = arg1.AddrOffset
							arg.AddrPagesNum = arg1.AddrPagesNum
						}

						// Update all len fields.
						assignSizesCall(c)
					}
				},
				1, func() {
					// Remove a random call.
					if len(p.Calls) == 0 {
						retry = true
						return
					}
					idx := r.Intn(len(p.Calls))
					p.removeCall(idx)
				},
			)
		}
	}

	for _, c := range p.Calls {
		sanitizeCall(c)
	}
	if err := p.validate(); err != nil {
		panic(err)
	}
}

// Minimize minimizes program p into an equivalent program using the equivalence
// predicate pred.  It iteratively generates simpler programs and asks pred
// whether it is equal to the orginal program or not. If it is equivalent then
// the simplification attempt is committed and the process continues.
func Minimize(p0 *Prog, callIndex0 int, pred func(*Prog, int) bool) (*Prog, int) {
	name0 := ""
	if callIndex0 != -1 {
		if callIndex0 < 0 || callIndex0 >= len(p0.Calls) {
			panic("bad call index")
		}
		name0 = p0.Calls[callIndex0].Meta.Name
	}

	// Try to glue all mmap's together.
	s := analyze(nil, p0, nil)
	hi := -1
	for i := 0; i < maxPages; i++ {
		if s.pages[i] {
			hi = i
		}
	}
	if hi != -1 {
		p := p0.Clone()
		callIndex := callIndex0
		// Remove all mmaps.
		for i := 0; i < len(p.Calls); i++ {
			c := p.Calls[i]
			if i != callIndex && c.Meta.Name == "mmap" {
				p.removeCall(i)
				if i < callIndex {
					callIndex--
				}
				i--
			}
		}
		// Prepend uber-mmap.
		mmap := createMmapCall(0, uintptr(hi)+1)
		p.Calls = append([]*Call{mmap}, p.Calls...)
		if callIndex != -1 {
			callIndex++
		}
		if pred(p, callIndex) {
			p0 = p
			callIndex0 = callIndex
		}
	}

	// Try to remove all calls except the last one one-by-one.
	for i := len(p0.Calls) - 1; i >= 0; i-- {
		if i == callIndex0 {
			continue
		}
		callIndex := callIndex0
		if i < callIndex {
			callIndex--
		}
		p := p0.Clone()
		p.removeCall(i)
		if !pred(p, callIndex) {
			continue
		}
		p0 = p
		callIndex0 = callIndex
	}
	// TODO: simplify individual arguments:
	// - replace constants with 0
	// - reset bits in constants
	// - remove offsets from addresses
	// - replace file descriptors with -1
	// etc
	if callIndex0 != -1 {
		if callIndex0 < 0 || callIndex0 >= len(p0.Calls) || name0 != p0.Calls[callIndex0].Meta.Name {
			panic(fmt.Sprintf("bad call index after minimizatoin: ncalls=%v index=%v call=%v/%v",
				len(p0.Calls), callIndex0, name0, p0.Calls[callIndex0].Meta.Name))
		}
	}
	return p0, callIndex0
}

func (p *Prog) TrimAfter(idx int) {
	if idx < 0 || idx >= len(p.Calls) {
		panic("trimming non-existing call")
	}
	for i := len(p.Calls) - 1; i > idx; i-- {
		c := p.Calls[i]
		foreachArg(c, func(arg, _ *Arg, _ *[]*Arg) {
			if arg.Kind == ArgResult {
				delete(arg.Res.Uses, arg)
			}
		})
	}
	p.Calls = p.Calls[:idx+1]
}

func mutationArgs(c *Call) (args, bases []*Arg) {
	foreachArg(c, func(arg, base *Arg, parent *[]*Arg) {
		switch typ := arg.Type.(type) {
		case *sys.StructType:
			if isSpecialStruct(typ) == nil {
				// For structs only individual fields are updated.
				return
			}
			// These special structs are mutated as a whole.
		case *sys.ArrayType:
			// Don't mutate fixed-size arrays.
			if typ.Kind == sys.ArrayRangeLen && typ.RangeBegin == typ.RangeEnd {
				return
			}
		case *sys.LenType:
			// Size is updated when the size-of arg change.
			return
		case *sys.ConstType:
			// Well, this is const.
			return
		case *sys.BufferType:
			if typ.Kind == sys.BufferString && len(typ.Values) == 1 {
				return // string const
			}
		}
		if arg.Type.Dir() == sys.DirOut {
			return
		}
		if base != nil {
			if _, ok := base.Type.(*sys.StructType); ok && isSpecialStruct(base.Type) != nil {
				// These special structs are mutated as a whole.
				return
			}
		}
		args = append(args, arg)
		bases = append(bases, base)
	})
	return
}

func swap16(v uint16) uint16 {
	v0 := byte(v >> 0)
	v1 := byte(v >> 8)
	v = 0
	v |= uint16(v1) << 0
	v |= uint16(v0) << 8
	return v
}

func swap32(v uint32) uint32 {
	v0 := byte(v >> 0)
	v1 := byte(v >> 8)
	v2 := byte(v >> 16)
	v3 := byte(v >> 24)
	v = 0
	v |= uint32(v3) << 0
	v |= uint32(v2) << 8
	v |= uint32(v1) << 16
	v |= uint32(v0) << 24
	return v
}

func swap64(v uint64) uint64 {
	v0 := byte(v >> 0)
	v1 := byte(v >> 8)
	v2 := byte(v >> 16)
	v3 := byte(v >> 24)
	v4 := byte(v >> 32)
	v5 := byte(v >> 40)
	v6 := byte(v >> 48)
	v7 := byte(v >> 56)
	v = 0
	v |= uint64(v7) << 0
	v |= uint64(v6) << 8
	v |= uint64(v5) << 16
	v |= uint64(v4) << 24
	v |= uint64(v3) << 32
	v |= uint64(v2) << 40
	v |= uint64(v1) << 48
	v |= uint64(v0) << 56
	return v
}

func mutateData(r *randGen, data []byte, minLen, maxLen int) []byte {
	const maxInc = 35
	for stop := false; !stop; stop = r.bin() {
		r.choose(
			100, func() {
				// Append byte.
				if len(data) >= maxLen {
					return
				}
				data = append(data, byte(r.rand(256)))
			},
			100, func() {
				// Remove byte.
				if len(data) <= minLen {
					return
				}
				if len(data) == 0 {
					return
				}
				i := r.Intn(len(data))
				copy(data[i:], data[i+1:])
				data = data[:len(data)-1]
			},
			100, func() {
				// Replace byte with random value.
				if len(data) == 0 {
					return
				}
				data[r.Intn(len(data))] = byte(r.rand(256))
			},
			100, func() {
				// Flip bit in byte.
				if len(data) == 0 {
					return
				}
				byt := r.Intn(len(data))
				bit := r.Intn(8)
				data[byt] ^= 1 << uint(bit)
			},
			100, func() {
				// Swap two bytes.
				if len(data) < 2 {
					return
				}
				i1 := r.Intn(len(data))
				i2 := r.Intn(len(data))
				data[i1], data[i2] = data[i2], data[i1]
			},
			100, func() {
				// Add / subtract from a byte.
				if len(data) == 0 {
					return
				}
				i := r.Intn(len(data))
				delta := byte(r.rand(2*maxInc+1) - maxInc)
				if delta == 0 {
					delta = 1
				}
				data[i] += delta
			},
			100, func() {
				// Add / subtract from a uint16.
				if len(data) < 2 {
					return
				}
				i := r.Intn(len(data) - 1)
				p := (*uint16)(unsafe.Pointer(&data[i]))
				delta := uint16(r.rand(2*maxInc+1) - maxInc)
				if delta == 0 {
					delta = 1
				}
				if r.bin() {
					*p += delta
				} else {
					*p = swap16(swap16(*p) + delta)
				}
			},
			100, func() {
				// Add / subtract from a uint32.
				if len(data) < 4 {
					return
				}
				i := r.Intn(len(data) - 3)
				p := (*uint32)(unsafe.Pointer(&data[i]))
				delta := uint32(r.rand(2*maxInc+1) - maxInc)
				if delta == 0 {
					delta = 1
				}
				if r.bin() {
					*p += delta
				} else {
					*p = swap32(swap32(*p) + delta)
				}
			},
			100, func() {
				// Add / subtract from a uint64.
				if len(data) < 8 {
					return
				}
				i := r.Intn(len(data) - 7)
				p := (*uint64)(unsafe.Pointer(&data[i]))
				delta := uint64(r.rand(2*maxInc+1) - maxInc)
				if delta == 0 {
					delta = 1
				}
				if r.bin() {
					*p += delta
				} else {
					*p = swap64(swap64(*p) + delta)
				}
			},
			100, func() {
				// Set byte to an interesting value.
				if len(data) == 0 {
					return
				}
				data[r.Intn(len(data))] = byte(r.randInt())
			},
			100, func() {
				// Set uint16 to an interesting value.
				if len(data) < 2 {
					return
				}
				i := r.Intn(len(data) - 1)
				value := uint16(r.randInt())
				if r.bin() {
					value = swap16(value)
				}
				*(*uint16)(unsafe.Pointer(&data[i])) = value
			},
			100, func() {
				// Set uint32 to an interesting value.
				if len(data) < 4 {
					return
				}
				i := r.Intn(len(data) - 3)
				value := uint32(r.randInt())
				if r.bin() {
					value = swap32(value)
				}
				*(*uint32)(unsafe.Pointer(&data[i])) = value
			},
			100, func() {
				// Set uint64 to an interesting value.
				if len(data) < 8 {
					return
				}
				i := r.Intn(len(data) - 7)
				value := uint64(r.randInt())
				if r.bin() {
					value = swap64(value)
				}
				*(*uint64)(unsafe.Pointer(&data[i])) = value
			},
		)
	}
	return data
}