Commit Graph

326 Commits

Author SHA1 Message Date
Dmitry Vyukov
e0c1bcbabc prog: move MaxPids const to prog
The const may be needed by other packages.
E.g. when checking manager config.
2018-07-25 10:39:29 +02:00
Dmitry Vyukov
9fe4bdc5f1 executor: overhaul
Make as much code as possible shared between all OSes.
In particular main is now common across all OSes.
Make more code shared between executor and csource
(in particular, loop function and threaded execution logic).
Also make loop and threaded logic shared across all OSes.
Make more posix/unix code shared across OSes
(e.g. signal handling, pthread creation, etc).
Plus other changes along similar lines.
Also support test OS in executor (based on portable posix)
and add 4 arches that cover all execution modes
(fork server/no fork server, shmem/no shmem).

This change paves way for testing of executor code
and allows to preserve consistency across OSes and executor/csource.
2018-07-24 12:04:27 +02:00
Anton Lindqvist
54bb6b9222 prog: add missing Default() implementation for ConstType 2018-07-23 11:11:32 +02:00
Dmitry Vyukov
06c33b3af0 prog: sanitize calls after hints mutation
Hints mutation could produce unsanitized calls.
Sanitize calls after hints mutation.
Also sanitize on load (in validate), because bad programs
can already be in corpuses. And it's just the right thing
to do because sanitization rules can change over time.
2018-07-12 12:40:30 +02:00
Dmitry Vyukov
fb2fc0f4dc prog: fix pointer validation
Query size after validating the object itself,
otherwise size can panic on corrupted object.
2018-07-08 22:52:24 +02:00
Dmitry Vyukov
1c667063a8 prog: don't generate filenames that escape sandbox
All files that fuzzer works with must be in the working dir.
Using "/" is known to cause problems when fuzzer
removes files there or mounts something.
2018-07-08 22:52:24 +02:00
Dmitry Vyukov
306ca0571c prog, pkg/compiler: support fmt type
fmt type allows to convert intergers and resources
to string representation.
2018-07-08 22:52:24 +02:00
Dmitry Vyukov
57799a834f prog: fix and improve fallback coverage
First we emitted fallbackSignalFlags inside of the loop,
while we need to this outside of the loop.
Second, make flags signal weaker otherwise we get all 256
signals for open, chmod, etc.
Third, simplify and speedup code.
2018-06-30 13:28:11 +02:00
Dmitry Vyukov
5012ddc8eb prog: detect when flags are a bitmask 2018-06-30 13:27:24 +02:00
Dmitry Vyukov
f7498af7af prog: add stronger fallback signal
Also mixin resource constructors and some signature
of flags values for successful calls into fallback coverage.
2018-06-29 20:34:43 +02:00
Dmitry Vyukov
dcb1eebb7f prog: more precise constructor calculation
Currently a call that both accepts and creates a resource
self-justifies itself and thus is always enabled.
A good example is accept call. Accepts are always self-enable
and thus enable all other syscalls that work with the socket.

Calculate TransitivelyEnabledCalls in the opposite direction
to resolve this. Start with empty set of enable syscalls,
then enable syscalls that don't accept any resources,
then enable syscalls that accept resources created by the
previous batch of syscalls, and so on.

This prevents self-enablement of accept.
2018-06-18 19:45:48 +02:00
Dmitry Vyukov
2dcee3b338 prog: use all resource special values for opt args 2018-06-18 19:45:46 +02:00
Dmitry Vyukov
598eb19243 prog: mutate fixed-size strings more
Allow removing/inserting ranges of bytes from fixed-size strings,
provided we truncate/extend resulting string to keep original size.
2018-06-12 19:09:26 +02:00
Dmitry Vyukov
9e0846e8a4 all: get rid of underscores in identifiers
Underscores are against Go coding style.

Update #538
2018-05-07 17:59:06 +02:00
Dmitry Vyukov
97d2b0e4c4 prog: refactor mutateArg from a big huge function
Update #538
2018-05-07 16:24:03 +02:00
Dmitry Vyukov
55a5e98a0a pkg/ifuzz: move generated code to a separate package
This helps to ignore generated code with gometalinter.
There is currently no other way:
https://github.com/alecthomas/gometalinter/issues/270

Update #538
2018-05-07 15:42:28 +02:00
Dmitry Vyukov
df6e2fb6df prog: deduplicate minimization test
Update #538
2018-05-07 14:55:53 +02:00
Dmitry Vyukov
8041642739 prog: dedup checksumming code
Update #538
2018-05-07 14:51:28 +02:00
Dmitry Vyukov
23b5913da9 prog: reorder checksum functions
Put the most important function at the top.
2018-05-07 14:46:17 +02:00
Dmitry Vyukov
068da17e1f prog: dedup mutation code
Update #538
2018-05-07 14:42:22 +02:00
Dmitry Vyukov
cda1fcb742 sys: dedup mmap code across OSes
Update #538
2018-05-06 16:58:38 +02:00
Dmitry Vyukov
6a0382b543 prog: rework validation code
The current code is total, unstructured mess.
Since we now have 1:1 type -> arg correspondence,
rework validation around args. This makes code
much cleaner and 30% shorter.
2018-05-05 11:43:00 +02:00
Dmitry Vyukov
afe402d20a prog: make c.Ret optional
No reason to allocate return value if there is no return type.
c.Ret == nil is the reasonable indication that this is a "void" call.
2018-05-05 10:25:45 +02:00
Dmitry Vyukov
9dfb5efa91 prog: simplify code
Now that we don't have ReturnArg and only ResultArg's refer
to other ResultArg's we can remove ArgUser/ArgUsed and
devirtualize lots of code.
2018-05-05 10:13:04 +02:00
Dmitry Vyukov
5ca897bd50 prog: remove ReturnArg
It's not all that needed.
2018-05-05 09:08:48 +02:00
Dmitry Vyukov
9846445c8e prog: parallelize tests
Parallelize more tests and reduce number of iterations
in random tests under race detector.
2018-05-04 20:07:32 +02:00
Dmitry Vyukov
2c7e14a847 gometalinter: enable cyclomatic complexity checking
Refactor some functions to be simpler.

Update #538
2018-05-04 18:03:46 +02:00
Dmitry Vyukov
08141db61a gometalinter: enable line length checking
120 columns looks like a reasonable limit
and requires few changes to existing code.

Update #538
2018-05-04 14:24:51 +02:00
Dmitry Vyukov
a630fd8b41 gometalinter: some fixes for unparam
But we still can't enable it as there are more [uninteresting] warnings.

Update #538
2018-05-03 15:48:26 +02:00
Dmitry Vyukov
39302300d9 gometalinter: check unkeyed composite literals
Update #538
2018-05-03 14:01:48 +02:00
Dmitry Vyukov
d169e0f3c4 prog: test TransitivelyEnabledCalls on all targets
Fixes #585
2018-05-03 13:40:21 +02:00
Julia Hansbrough
9ce14f4b01 prog: Fix page fault for syz-stress users.
In resources.go, haveGettime is False when SyscallMap["clock_gettime"]
is nil.

In this code, there's a branch that's entered only if Gettime is False,
which appends SyscallMap["clock_gettime"] to resourceCtors.  That is, it
appends nil to resourceCtors, then iterates through resourceCtors and
tries to dereference the .Name of each time, in this case, nil.Name.

This was causing a page fault on Fuchsia.

I'm not certain how the "standard" flow is supposed to work, since it
seems like any code that enters the `if cantCreate == "" && !haveGettime`
should fail... but, removing that section causes test failures, so let's
just enforce that SyscallMap["clock_gettime"] is non-nil.

If there's a better way to solve this, I'm open to suggestions.
2018-05-03 07:50:03 +02:00
Dmitry Vyukov
02bbd80e7c prog: fix gometalinter warnings 2018-04-24 13:23:01 +02:00
Dmitry Vyukov
2a9c3edcda pkg/prog: explain why syscalls are transitively disabled 2018-04-06 19:43:06 +02:00
Dmitry Vyukov
3e679c51c0 pkg/compiler: support non-zero terminated filenames
Now file names become:

string[filename]

with a possibility of using other string features:

stringnoz[filename]
string[filename, CONST_SIZE]

and filename is left as type alias as it is commonly used:

type filename string[filename]
2018-04-02 20:10:07 +02:00
Dmitry Vyukov
185ac3525e prog: support big-endian during hints matching
Use big-endian match/replace for both blobs and ints.
Sometimes we have unmarked blobs (no little/big-endian info);
for ANYBLOBs we intentionally lose all marking;
but even for marked ints we may need this too.
Consider that kernel code does not convert the data
(i.e. not ntohs(pkt->proto) == ETH_P_BATMAN),
but instead converts the constant (i.e. pkt->proto == htons(ETH_P_BATMAN)).
In such case we will see dynamic operand that does not
match what we have in the program.
2018-04-01 15:28:01 +02:00
Dmitry Vyukov
0174c6c8f7 prog: reduce nesting level in shrinkExpand 2018-03-31 18:55:59 +02:00
Dmitry Vyukov
7c923cf8d4 sys/linux: add support for mounting filesystem images 2018-03-30 19:51:27 +02:00
Dmitry Vyukov
7c62f71804 sys/linux: add netlink fou descriptions 2018-03-21 12:18:36 +01:00
Dmitry Vyukov
36d1c4540a all: fix gometalinter warnings
Fix typos, non-canonical code, remove dead code, etc.
2018-03-08 18:48:26 +01:00
Dmitry Vyukov
d0790618dc prog: fix isDefaultArg
Test that isDefaultArg returns true for result of DefaultArg.
Fix few bugs uncovered by this test.
2018-03-08 12:02:17 +01:00
Dmitry Vyukov
4bad061006 prog: extend some error messages 2018-03-05 12:58:29 +01:00
Dmitry Vyukov
bc09be4253 prog: fix 32-bit build
Currently fails with:
prog/mutation.go:442:24: constant 4294967296 overflows int
2018-03-05 12:10:27 +01:00
Dmitry Vyukov
70a1ddb939 prog: harden program parsing against description changes more
Handle most of type changes, e.g. const is changed to struct,
or struct to pointers. In all these cases we create default args.
They may not give the coverage anymore, but still better than
losing them right away.
2018-03-05 12:10:27 +01:00
Dmitry Vyukov
b99c76c405 prog: recover after type changes during program deserialization
Make program deserialization handle and recover after type changes
in descriptions.
2018-03-05 12:10:27 +01:00
Dmitry Vyukov
bd5df8f49b prog: handle excessive args and fields during program parsing
Tolerate excessive args and fields during program parsing.
This is useful after description changes to not lose corpus.
2018-03-05 12:10:27 +01:00
Dmitry Vyukov
002cecf202 pkg/compiler: allow specifying static size for filename's
Sometimes filenames are embed into structs and need to take fixed space.
2018-03-05 12:10:27 +01:00
Dmitry Vyukov
5ef8dbdf5a pkg/compiler: support size attribute for unions 2018-03-05 12:10:27 +01:00
Dmitry Vyukov
a339951e5f pkg/compiler: add size attribute for structs
The size attribute allows to pad a struct up to the specified size.
2018-03-05 12:10:27 +01:00
Dmitry Vyukov
e28ba02d9d prog: harden program parsing
This fixes crash during parsing of existing programs in corpus
after vma<->ptr type change in descriptions.
2018-03-05 12:10:27 +01:00