Commit Graph

559 Commits

Author SHA1 Message Date
Dmitry Vyukov
f0a967b9bd tools/syz-cover: add cmdprof profiling
Update #2006
2020-09-28 09:41:25 +02:00
m5imunovic
84141e4bab tools/syz-cover: add command line option for coverage export
Add new command line option for exporting coverage information
calculated form rawcover file input into CSV file. The columns of
the exported file are:
Filename - function source file path
Function - function name
Percent  - coverage percentage
PCs      - number of total program counters

Signed-off-by: Jouni Hogander <jouni.hogander@unikie.com>
2020-09-26 17:47:37 +02:00
Jouni Hogander
6f0ea384b1 pkg/cover: implement function coverage calculation 2020-09-26 17:47:37 +02:00
Radoslav Gerganov
54289b0835 tools/create-gce-image.sh: mount the root filesystem read-write
Add fstab entry to mount the root filesystem read-write after boot. This
has been done with commit 873745 for create-image.sh. Maybe this hint is
not necessary for GCE but it is required when running on other platforms
(e.g. VMware).
2020-09-23 17:21:11 +02:00
Aleksandr Nogikh
9133037195 all: integrate with mac80211_hwsim
Two virtual wireless devices are instantiated during network devices
initialization.

A new flag (-wifi) is added that controls whether these virtual wifi
devices are instantiated and configured during proc initialization.

Also, two new pseudo syscalls are added:
1. syz_80211_inject_frame(mac_addr, packet, packet_len) -- injects an
arbitrary packet into the wireless stack. It is injected as if it
originated from the device identitied by mac_addr.
2. syz_80211_join_ibss(interface_name, ssid, ssid_len, mode) --
puts a specific network interface into IBSS state and joins an IBSS
network.

Arguments of syz_80211_join_ibss:
1) interface_name -- null-terminated string that identifies
a wireless interface
2) ssid, ssid_len -- SSID of an IBSS network to join to
3) mode -- mode of syz_80211_join_ibss operation (see below)

Modes of operation:
JOIN_IBSS_NO_SCAN (0x0) -- channel scan is not performed and
syz_80211_join_ibss waits until the interface reaches IF_OPER_UP.
JOIN_IBSS_BG_SCAN (0x1) -- channel scan is performed (takes ~ 9
seconds), syz_80211_join_ibss does not await IF_OPER_UP.
JOIN_IBSS_BG_NO_SCAN (0x2) -- channel scan is not performed,
syz_80211_join_ibss does not await IF_OPER_UP.

Local testing ensured that these syscalls are indeed able to set up an
operating network and inject packets into mac80211.
2020-09-22 10:12:23 +02:00
Jouni Hogander
bbb921d248 pkg/bisect: add ccache option
Add option to use ccache in kernel builds.

Signed-off-by: Jouni Hogander <jouni.hoegander@partner.bmw.de>
2020-09-21 11:23:04 +02:00
Dmitry Vyukov
9564d2e982 tools/syz-imagegen: add 20 more filesystems
And populate images with some files,
which should make both mounting and resulting dir more interesting.

Note: this adds 100MB of image files into the repo...
Maybe we need to think of some other way of string these images...
2020-09-20 15:12:12 +02:00
Dmitry Vyukov
9371418543 tools/syz-imagegen: add few more f2fs features
Add flexible_inline_xattr, inode_checksum, inode_crtime, project_quota features.
2020-09-20 15:12:12 +02:00
Dmitry Vyukov
1c1eb4919d tools/syz-imagegen: generate full test files instead of bash scripts
tools/create_{f2fs,btrfs}_image.sh are... well, shell scripts.
It's hard to scale this appraoch to more file systems
avoiding duplication and stupid errors while doing proper
error handling and parallelization.
Upgrade syz-imagegen to generate full test files and replace
the shell scripts.

f2fs -O=compression options is removed, it does not seem to be
supported by mkfs.f2fs, it always says:
Error: Wrong features
The shell script used it, but it seems that the way it passed
arguments (in a single '-quoted string) just made mkfs misparse
the arguments (use only the first one?) and so -O=compression
and most other arguments were simply ignored.
2020-09-20 15:12:12 +02:00
Andrew Donnellan
38962c8b05 tools/create-image.sh: map qemu -> Debian architecture names
create-image.sh assumes that the qemu name and the Debian name for the
target architecture are the same. This is not always true.

For comedy and/or historical reasons, Debian refers to 64-bit little
endian PowerPC as ppc64el, whereas qemu and most other things use ppc64le.
Debian refers to aarch64 as arm64, and 32-bit little endian arm as armel.
Add special cases to handle this.

Signed-off-by: Andrew Donnellan <ajd@linux.ibm.com>
2020-09-18 07:52:38 +02:00
Alexander Egorenkov
df4f5a9c4a tools/create-gce-image.sh: support s390x
Signed-off-by: Alexander Egorenkov <Alexander.Egorenkov@ibm.com>
2020-09-14 13:09:25 +02:00
Dmitry Vyukov
dfb4c36914 tools/create_btrfs_image.sh: fix up and re-run
The previous commit did not get all intended changes.

Follow up to 2066
2020-09-14 11:08:16 +02:00
Jiaheng Hu
bf0df4cba7 sys/linux: mount btrfs tests
Add several unit tests that mount different versions of btrfs images, and
the .sh file that generates these tests.
2020-09-14 10:56:04 +02:00
Dmitry Vyukov
fab7609913 tools/check-whitespace.sh: check for trailing whitespaces
File types that we don't format automatically can end up
with such basic untidiness as trailing whitespaces.
Check for these. Remove all existing precedents.
2020-09-14 09:55:45 +02:00
Seonghyun Park
75cbe1c0ce tools/create-image.sh: resolve mismatch between help message and opt parsing 2020-09-14 06:47:09 +02:00
Dmitry Vyukov
2d3cdd63ad tools/create_f2fs_image.sh: name tests after the syscall
Make things consistent.

Follow up to #2032
2020-09-13 19:28:47 +02:00
Dmitry Vyukov
55b6cd4333 pkg/runtest: test parsing of all tests
Currently we only test parsing in tools/syz-runtest
and for test OS in pkg/runtest tests.
This means errors in tests for other OSes won't be
noticed until somebody runs tests manually.
Test parsing of all tests in pkg/runtest tests.
Fix up 2 broken tests.
2020-09-13 19:28:47 +02:00
Dmitry Vyukov
c52d06e410 sys/linux/test: mark f2fs tests as manual
Introduce "manual" requirement for tests (only run if explicitly selected)
and mark f2fs tests as manual. There are too many of them.

Follow up to #2032
2020-09-13 19:28:47 +02:00
Jiaheng Hu
84b0c3d8f6 sys/linux: add mount f2fs test
Add several unit tests that mount different versions of  f2fs image, and
the .sh file that generates these tests.
2020-09-13 18:42:14 +02:00
Alexander Egorenkov
86bd8f9d48 tools/create-image.sh: support for foreign architectures
Also update sy-env to be able to build the root image inside.

Signed-off-by: Alexander Egorenkov <Alexander.Egorenkov@ibm.com>
2020-09-13 16:05:25 +02:00
Dmitry Vyukov
9296c80bbc tools/docker: mirror images on github
Some users don't have access to the gcr.io registry.
Mirror images on github as well.
2020-09-12 16:26:58 +02:00
Dmitry Vyukov
cc8045ff1f tools/syz-prog2c: add -repro flag
For manual testing of what pkg/repro uses.
2020-09-12 13:03:27 +02:00
Greg Steuck
abf9ba4fc7
tools/create-openbsd: auto-detect snapshot version (#2082)
Removed some never-used knobs as syzkaller always uses snapshots.
Resolved some ShellCheck'd lint.

TESTED=by installing Aug31 6.8 beta.
2020-09-01 10:54:55 -07:00
Dmitry Vyukov
df5c8fa25f tools/docker: add old-env
old-env is based on Ubuntu 16.04 and allows to test
executor build on older distributions.

Fixes #2055
2020-08-22 21:42:13 +02:00
Dmitry Vyukov
0dba77942f tools/docker/env: install qemu-user
qemu-user allows to run cross-arch binaries in tests.
2020-08-22 21:26:42 +02:00
Dmitry Vyukov
b6de93e603 pkg/compiler: merge const files into a single file
We now have 8 arches for Linux and .const files
produce lots of noise in PRs and lots of diffs.
If 3 .txt files are touched, the PR will have 24 .const files,
which will be intermixed with .txt files.
Frequently const values are equal across arches,
and even if they don't spreading a single value
across 8 files is inconvinient.

Merge all 8 *_arch.const files into a single .const file.
See the test for details of the new format.
The old format is still parsed for now,
we can't update all OSes at once.

For Linux this reduces number of const files/lines
from 1288/96599 to 158/11603.

Fixes #1983
2020-08-13 17:22:16 +02:00
Necip Fazil Yildiran
f5442bde55 pkg, prog: add per-field direction attribute 2020-08-13 13:50:25 +02:00
Dmitry Vyukov
ff51e5229e tools/syz-hubtool: fix up drain mode
We may want to drain hub without uploading any repros/corpus.
2020-08-07 18:39:45 +02:00
Dmitry Vyukov
bb468f3218 tools/syz-hubtool: add initial version
syz-hubtool uploads local reproducers to syz-hub.
2020-08-07 17:27:03 +02:00
Dmitry Vyukov
4ca1c0ea44 tools/check-commits.sh: use PR head instead of base
Base points to already commetted changes,
we really want to cheack head of the PR.
2020-08-06 11:49:45 +02:00
Marco Elver
f94b533a4b tools/check-commits: allow canonical 'git revert' format
Allow the canonical 'git revert' format.
2020-08-06 11:49:26 +02:00
Dmitry Vyukov
b712935571 tools/check-commits.sh: fix commit range detection
We currently check from github.event.pull_request.base.sha
to github.event.pull_request.head.sha, but they may be in
different branches if the PR commits are branched not from
the latest master HEAD (at the time of PR creation).
Then GH will create a merge commit, and the range we try
to check is not valid.

Check github.event.pull_request.commits commits backwards
from github.event.pull_request.head.sha commit.
2020-08-05 09:18:56 +02:00
Dmitry Vyukov
43f1389ddc Makefile: enable clang-tidy in presubmit tests
Fix all errors it points to.
The one in netlink_send_ext is concerning.
2020-08-04 16:54:02 +02:00
Dmitry Vyukov
d895b3be2c .github/workflows: check commit description format
Check PR commit subjects for the standard format we use "pkg/name: description of the change".
Check PR commit bodies for at most 120 characters.
2020-07-31 17:22:18 +02:00
Pedro Lopes
242b0eb219 pkg: get and store Maintainers data
Create a struct on pkg/vcs to store data of syzkaller email recipients
and update its users. The struct contains default name, email, and a
label to divide user into To and Cc when sending the emails.
2020-07-31 17:18:29 +02:00
TheOfficialFloW
b094755316
all: initialize vhci in linux
* all: initialize vhci in linux

* executor/common_linux.h: improve vhci initialization

* pkg/repro/repro.go: add missing vhci options

* executor/common_linux.h: fix type and add missing header

* executor, pkg: do it like NetInjection

* pkg/csource/csource.go: do not emit syz_emit_vhci if vhci is not enabled

* executor/common_linux.h: fix format string

* executor/common_linux.h: initialize with memset

For som reason {0} gets complains about missing braces...

* executor/common_linux.h: simplify vhci init

* executor/common_linux.h: try to bring all available hci devices up

* executor/common_linux.h: find which hci device has been registered

* executor/common_linux.h: use HCI_VENDOR_PKT response to retrieve device id

* sys/linux/dev_vhci.txt: fix structs of inquiry and report packets

* executor/common_linux.h: remove unnecessary return statement and check vendor_pkt read size

* executor/common_linux.h: remove unnecessary return statement and check vendor_pkt read size

* sys/linux/dev_vhci.txt: pack extended_inquiry_info_t

* sys/linux/l2cap.txt: add l2cap_conf_opt struct

* executor/common_linux.h: just fill bd addr will 0xaa

* executor/common_linux.h: just fill bd addr will 0xaa
2020-07-30 11:33:48 +02:00
Dmitry Vyukov
a3d497bf6c all: fix marking of auto-generated files
Update the copyright checking script and more files
for the standard convention of marking auto-generated files.
2020-07-29 13:36:11 +02:00
Zubin Mithra
18d3096670 tools: add udev rule for i915
Add a udev rule to create /dev/i915, a symlink to /dev/dri/card#.

This prevents i915 related syscalls from being exercised during fuzzing
if the driver is not used.
2020-07-17 15:26:11 +02:00
Albert van der Linde
6f4580264a prog/alloc: align address allocation for aligned[addr]
Calls to alloc didn't respect the alignment attribute. Now
Type.Alignment() is used to ensure each type is correctly
aligned. Existing descriptions with [align[X]] don't have an
issue as they align to small blocks and default align is to
64 bytes. This commits adds support for [align[X]] for an X
larger than 64.
2020-07-14 12:20:37 +02:00
Dmitry Vyukov
115e19300f tools/syz-linter: check comments format
Check for capitalization, dots at the end
and two spaces after a period.

Update #1876
2020-07-12 08:22:44 +02:00
Dmitry Vyukov
78178cfb8c tools/syz-linter: fix comments check
Turns out ast.Inspect does not visit most comments.
Walk file.Comments manually.

Update #1876
2020-07-10 19:15:46 +02:00
Dmitry Vyukov
d4c58caef7 tools/syz-linter: enable some standard linters
Enable some x/tools linters that are not enabled in vet.

Update #1876
2020-07-10 18:16:58 +02:00
Dmitry Vyukov
9f9845eb28 tools/syz-check: improve warning for NLA_REJECT 2020-07-08 17:14:54 +02:00
Dmitry Vyukov
ac5a135b30 tools/syz-linter: introduce helper Pass type
Introduce a helper Pass type so that we can have
some helper methods on it.

Update #1876
2020-07-06 08:23:03 +02:00
Dmitry Vyukov
3e0ce485a1 tools/syz-linter: check variable declarations
Warn about:

var x int = foo

In most cases this can be expressed shorter as:

var x int
x := foo
x := int(foo)

Update #1876
2020-07-06 08:23:03 +02:00
Dmitry Vyukov
ed2ced4c69 tools/syz-linter: check for \n at the end of log/error text
Update #1876
2020-07-06 08:23:03 +02:00
Dmitry Vyukov
22f8756722 tools/syz-linter: check log/error text ending with dot
Update #1876
2020-07-05 10:55:16 +02:00
Dmitry Vyukov
214e3e269c tools/syz-linter: check log/error text starting with capital letter
Update #1876
2020-07-05 10:55:16 +02:00
Dmitry Vyukov
24d7f50531 tools/syz-linter: add check for dup types in func args
Add check for:

func foo(a int, b int) -> func foo(a, b int)

Update #1876
2020-07-04 15:05:30 +02:00
Dmitry Vyukov
85b1d37b14 tools/syz-linter: add check for comment format
Update #1876
2020-07-04 15:05:30 +02:00