sys: allow to specify number of pages for vma type

Allows to write vma[4] or vma[5-10] to specify desired number of pages.

prog/prog_test.go

@@ -8,9 +8,12 @@ import (
 	"math/rand"
 	"testing"
 	"time"
+
+	"github.com/google/syzkaller/sys"
 )
 
 func initTest(t *testing.T) (rand.Source, int) {
+	t.Parallel()
 	iters := 10000
 	if testing.Short() {
 		iters = 100
@@ -49,3 +52,37 @@ func TestSerialize(t *testing.T) {
 		}
 	}
 }
+
+func TestVmaType(t *testing.T) {
+	rs, iters := initTest(t)
+	meta := sys.CallMap["syz_test$vma0"]
+	r := newRand(rs)
+	for i := 0; i < iters; i++ {
+		s := newState(nil)
+		calls := r.generateParticularCall(s, meta)
+		c := calls[len(calls)-1]
+		if c.Meta.Name != "syz_test$vma0" {
+			t.Fatalf("generated wrong call %v", c.Meta.Name)
+		}
+		if len(c.Args) != 6 {
+			t.Fatalf("generated wrong number of args %v", len(c.Args))
+		}
+		check := func(v, l *Arg, min, max uintptr) {
+			if v.Kind != ArgPointer {
+				t.Fatalf("vma has bad type: %v, want %v", v.Kind, ArgPointer)
+			}
+			if l.Kind != ArgPageSize {
+				t.Fatalf("len has bad type: %v, want %v", l.Kind, ArgPageSize)
+			}
+			if v.AddrPagesNum < min || v.AddrPagesNum > max {
+				t.Fatalf("vma has bad number of pages: %v, want [%v-%v]", v.AddrPagesNum, min, max)
+			}
+			if l.AddrPage < min || l.AddrPage > max {
+				t.Fatalf("len has bad number of pages: %v, want [%v-%v]", l.AddrPage, min, max)
+			}
+		}
+		check(c.Args[0], c.Args[1], 1, 1e5)
+		check(c.Args[2], c.Args[3], 5, 5)
+		check(c.Args[4], c.Args[5], 7, 9)
+	}
+}

prog/rand.go

@@ -596,6 +596,9 @@ func (r *randGen) generateArg(s *state, typ sys.Type) (arg *Arg, calls []*Call)
 		}
 	case *sys.VmaType:
 		npages := r.randPageCount()
+		if a.RangeBegin != 0 || a.RangeEnd != 0 {
+			npages = uintptr(int(a.RangeBegin) + r.Intn(int(a.RangeEnd-a.RangeBegin+1)))
+		}
 		arg := r.randPageAddr(s, a, npages, nil, true)
 		return arg, nil
 	case *sys.FlagsType:

sys/README.md

@@ -54,7 +54,8 @@ rest of the type-options are type-specific:
 		argname of the object
 	"bytesize": similar to "len", but always denotes the size in bytes, type-options:
 		argname of the object
-	"vma": a pointer to a set of pages (used as input for mmap/munmap/mremap/madvise)
+	"vma": a pointer to a set of pages (used as input for mmap/munmap/mremap/madvise), type-options:
+		optional number of pages (e.g. vma[7]), or a range of pages (e.g. vma[2-4])
 	"proc": per process int (see description below), type-options:
 		underlying type, value range start, how many values per process
 ```

sys/decl.go

@@ -143,6 +143,8 @@ func (t *BufferType) Align() uintptr {
 
 type VmaType struct {
 	TypeCommon
+	RangeBegin int64 // in pages
+	RangeEnd   int64
 }
 
 func (t *VmaType) Size() uintptr {

sys/test.txt

@@ -199,6 +199,10 @@ syz_end_var_struct {
 	f2	flags[syz_end_flags, int64be]
 } [packed]
 
+# Vma type.
+
+syz_test$vma0(v0 vma, l0 len[v0], v1 vma[5], l1 len[v1], v2 vma[7:9], l2 len[v2])
+
 # Regression tests.
 
 syz_test$regression0(a0 ptr[inout, syz_regression0_struct])

sysgen/sysgen.go

@@ -461,10 +461,15 @@ func generateArg(
 		fmt.Fprintf(out, "&BufferType{%v, Kind: BufferAlgName}", common())
 	case "vma":
 		canBeArg = true
-		if want := 0; len(a) != want {
-			failf("wrong number of arguments for %v arg %v, want %v, got %v", typ, name, want, len(a))
+		begin, end := "0", "0"
+		switch len(a) {
+		case 0:
+		case 1:
+			begin, end = parseRange(a[0], consts)
+		default:
+			failf("wrong number of arguments for %v arg %v, want 0 or 1, got %v", typ, name, len(a))
 		}
-		fmt.Fprintf(out, "&VmaType{%v}", common())
+		fmt.Fprintf(out, "&VmaType{%v, RangeBegin: %v, RangeEnd: %v}", common(), begin, end)
 	case "len", "bytesize", "bytesize2", "bytesize4", "bytesize8":
 		canBeArg = true
 		size := uint64(ptrSize)