diff --git a/prog/hints.go b/prog/hints.go index e268d46a..b295b215 100644 --- a/prog/hints.go +++ b/prog/hints.go @@ -36,16 +36,7 @@ const ( maxDataLength = 100 ) -var ( - specialIntsSet uint64Set - - // A set of calls for which hints should not be generated. - hintNamesBlackList = map[string]bool{ - "mmap": true, - "open": true, - "close": true, - } -) +var specialIntsSet uint64Set func (m CompMap) AddComp(arg1, arg2 uint64) { if _, ok := m[arg1]; !ok { @@ -58,7 +49,7 @@ func (m CompMap) AddComp(arg1, arg2 uint64) { // For each of the mutants executes the exec callback. func (p *Prog) MutateWithHints(compMaps []CompMap, exec func(newP *Prog)) { for i, c := range p.Calls { - if _, ok := hintNamesBlackList[c.Meta.CallName]; ok { + if c.Meta == defaultTarget.MmapSyscall { continue } foreachArg(c, func(arg, _ Arg, _ *[]Arg) { diff --git a/prog/mutation.go b/prog/mutation.go index e793e28e..d92c9636 100644 --- a/prog/mutation.go +++ b/prog/mutation.go @@ -55,7 +55,7 @@ func (p *Prog) Mutate(rs rand.Source, ncalls int, ct *ChoiceTable, corpus []*Pro continue } // Mutating mmap() arguments almost certainly doesn't give us new coverage. - if c.Meta.Name == "mmap" && r.nOutOf(99, 100) { + if c.Meta == defaultTarget.MmapSyscall && r.nOutOf(99, 100) { retry = true continue } @@ -289,7 +289,7 @@ func Minimize(p0 *Prog, callIndex0 int, pred0 func(*Prog, int) bool, crash bool) // Remove all mmaps. for i := 0; i < len(p.Calls); i++ { c := p.Calls[i] - if i != callIndex && c.Meta.Name == "mmap" { + if i != callIndex && c.Meta == defaultTarget.MmapSyscall { p.removeCall(i) if i < callIndex { callIndex-- diff --git a/prog/prio.go b/prog/prio.go index c64ae319..e4a9b334 100644 --- a/prog/prio.go +++ b/prog/prio.go @@ -141,7 +141,8 @@ func calcDynamicPrio(corpus []*Prog) [][]float32 { id0 := c0.Meta.ID id1 := c1.Meta.ID // There are too many mmap's anyway. - if id0 == id1 || c0.Meta.Name == "mmap" || c1.Meta.Name == "mmap" { + if id0 == id1 || c0.Meta == defaultTarget.MmapSyscall || + c1.Meta == defaultTarget.MmapSyscall { continue } prios[id0][id1] += 1.0 diff --git a/prog/rand.go b/prog/rand.go index 5526427f..8439015e 100644 --- a/prog/rand.go +++ b/prog/rand.go @@ -438,7 +438,7 @@ func (r *randGen) generateCall(s *state, p *Prog) []*Call { c := p.Calls[r.Intn(len(p.Calls))].Meta call = c.ID // There is roughly half of mmap's so ignore them. - if c.Name != "mmap" { + if c != defaultTarget.MmapSyscall { break } } diff --git a/prog/target.go b/prog/target.go index 4faded02..b8e76919 100644 --- a/prog/target.go +++ b/prog/target.go @@ -18,6 +18,10 @@ type Target struct { Syscalls []*Syscall Resources []*ResourceDesc + // Syscall used by MakeMmap. + // It has some special meaning because there are usually too many of them. + MmapSyscall *Syscall + // MakeMmap creates call that maps [start, start+npages) page range. MakeMmap func(start, npages uint64) *Call @@ -59,6 +63,10 @@ func RegisterTarget(target *Target) { targets[key] = target } +func GetTarget(OS, arch string) *Target { + return targets[OS+"/"+arch] +} + // SetDefaultTarget sets default target for prog package. // Majority of the code is not prepared for multiple targets, // so we use default target as a temporary measure. @@ -72,10 +80,12 @@ func SetDefaultTarget(OS, arch string) error { } return fmt.Errorf("unknown target: %v (supported: %v)", key, supported) } - if len(Syscalls) != 0 { + if defaultTarget != nil { return fmt.Errorf("default target is already set") } + defaultTarget = target + Syscalls = target.Syscalls SyscallMap = target.syscallMap Resources = target.resourceMap @@ -124,6 +134,8 @@ var ( pageSize uint64 dataOffset uint64 + defaultTarget *Target + Syscalls []*Syscall SyscallMap map[string]*Syscall Resources map[string]*ResourceDesc diff --git a/sys/linux/init.go b/sys/linux/init.go index 8d96ac27..cbf93e96 100644 --- a/sys/linux/init.go +++ b/sys/linux/init.go @@ -20,6 +20,7 @@ func initArch(syscalls []*prog.Syscall, resources []*prog.ResourceDesc, DataOffset: dataOffset, Syscalls: syscalls, Resources: resources, + MmapSyscall: arch.mmapSyscall, MakeMmap: arch.makeMmap, AnalyzeMmap: arch.analyzeMmap, SanitizeCall: arch.sanitizeCall, diff --git a/syz-manager/manager.go b/syz-manager/manager.go index 3d8933e8..a7216b70 100644 --- a/syz-manager/manager.go +++ b/syz-manager/manager.go @@ -121,6 +121,8 @@ func main() { if err != nil { Fatalf("%v", err) } + // mmap is used to allocate memory. + syscalls[prog.GetTarget(cfg.TargetOS, cfg.TargetArch).MmapSyscall.ID] = true initAllCover(cfg.Vmlinux) RunManager(cfg, syscalls) } diff --git a/syz-manager/mgrconfig/mgrconfig.go b/syz-manager/mgrconfig/mgrconfig.go index 75df7e4d..1f981915 100644 --- a/syz-manager/mgrconfig/mgrconfig.go +++ b/syz-manager/mgrconfig/mgrconfig.go @@ -206,9 +206,6 @@ func ParseEnabledSyscalls(cfg *Config) (map[int]bool, error) { return nil, fmt.Errorf("unknown disabled syscall: %v", c) } } - // mmap is used to allocate memory. - syscalls[prog.SyscallMap["mmap"].ID] = true - return syscalls, nil }