471 Commits

Author SHA1 Message Date
Dmitry Vyukov
1c667063a8 prog: don't generate filenames that escape sandbox
All files that fuzzer works with must be in the working dir.
Using "/" is known to cause problems when fuzzer
removes files there or mounts something.
2018-07-08 22:52:24 +02:00
Dmitry Vyukov
306ca0571c prog, pkg/compiler: support fmt type
fmt type allows to convert intergers and resources
to string representation.
2018-07-08 22:52:24 +02:00
Dmitry Vyukov
57799a834f prog: fix and improve fallback coverage
First we emitted fallbackSignalFlags inside of the loop,
while we need to this outside of the loop.
Second, make flags signal weaker otherwise we get all 256
signals for open, chmod, etc.
Third, simplify and speedup code.
2018-06-30 13:28:11 +02:00
Dmitry Vyukov
5012ddc8eb prog: detect when flags are a bitmask 2018-06-30 13:27:24 +02:00
Dmitry Vyukov
f7498af7af prog: add stronger fallback signal
Also mixin resource constructors and some signature
of flags values for successful calls into fallback coverage.
2018-06-29 20:34:43 +02:00
Dmitry Vyukov
dcb1eebb7f prog: more precise constructor calculation
Currently a call that both accepts and creates a resource
self-justifies itself and thus is always enabled.
A good example is accept call. Accepts are always self-enable
and thus enable all other syscalls that work with the socket.

Calculate TransitivelyEnabledCalls in the opposite direction
to resolve this. Start with empty set of enable syscalls,
then enable syscalls that don't accept any resources,
then enable syscalls that accept resources created by the
previous batch of syscalls, and so on.

This prevents self-enablement of accept.
2018-06-18 19:45:48 +02:00
Dmitry Vyukov
2dcee3b338 prog: use all resource special values for opt args 2018-06-18 19:45:46 +02:00
Dmitry Vyukov
598eb19243 prog: mutate fixed-size strings more
Allow removing/inserting ranges of bytes from fixed-size strings,
provided we truncate/extend resulting string to keep original size.
2018-06-12 19:09:26 +02:00
Dmitry Vyukov
9e0846e8a4 all: get rid of underscores in identifiers
Underscores are against Go coding style.

Update #538
2018-05-07 17:59:06 +02:00
Dmitry Vyukov
97d2b0e4c4 prog: refactor mutateArg from a big huge function
Update #538
2018-05-07 16:24:03 +02:00
Dmitry Vyukov
55a5e98a0a pkg/ifuzz: move generated code to a separate package
This helps to ignore generated code with gometalinter.
There is currently no other way:
https://github.com/alecthomas/gometalinter/issues/270

Update #538
2018-05-07 15:42:28 +02:00
Dmitry Vyukov
df6e2fb6df prog: deduplicate minimization test
Update #538
2018-05-07 14:55:53 +02:00
Dmitry Vyukov
8041642739 prog: dedup checksumming code
Update #538
2018-05-07 14:51:28 +02:00
Dmitry Vyukov
23b5913da9 prog: reorder checksum functions
Put the most important function at the top.
2018-05-07 14:46:17 +02:00
Dmitry Vyukov
068da17e1f prog: dedup mutation code
Update #538
2018-05-07 14:42:22 +02:00
Dmitry Vyukov
cda1fcb742 sys: dedup mmap code across OSes
Update #538
2018-05-06 16:58:38 +02:00
Dmitry Vyukov
6a0382b543 prog: rework validation code
The current code is total, unstructured mess.
Since we now have 1:1 type -> arg correspondence,
rework validation around args. This makes code
much cleaner and 30% shorter.
2018-05-05 11:43:00 +02:00
Dmitry Vyukov
afe402d20a prog: make c.Ret optional
No reason to allocate return value if there is no return type.
c.Ret == nil is the reasonable indication that this is a "void" call.
2018-05-05 10:25:45 +02:00
Dmitry Vyukov
9dfb5efa91 prog: simplify code
Now that we don't have ReturnArg and only ResultArg's refer
to other ResultArg's we can remove ArgUser/ArgUsed and
devirtualize lots of code.
2018-05-05 10:13:04 +02:00
Dmitry Vyukov
5ca897bd50 prog: remove ReturnArg
It's not all that needed.
2018-05-05 09:08:48 +02:00
Dmitry Vyukov
9846445c8e prog: parallelize tests
Parallelize more tests and reduce number of iterations
in random tests under race detector.
2018-05-04 20:07:32 +02:00
Dmitry Vyukov
2c7e14a847 gometalinter: enable cyclomatic complexity checking
Refactor some functions to be simpler.

Update #538
2018-05-04 18:03:46 +02:00
Dmitry Vyukov
08141db61a gometalinter: enable line length checking
120 columns looks like a reasonable limit
and requires few changes to existing code.

Update #538
2018-05-04 14:24:51 +02:00
Dmitry Vyukov
a630fd8b41 gometalinter: some fixes for unparam
But we still can't enable it as there are more [uninteresting] warnings.

Update #538
2018-05-03 15:48:26 +02:00
Dmitry Vyukov
39302300d9 gometalinter: check unkeyed composite literals
Update #538
2018-05-03 14:01:48 +02:00
Dmitry Vyukov
d169e0f3c4 prog: test TransitivelyEnabledCalls on all targets
Fixes #585
2018-05-03 13:40:21 +02:00
Julia Hansbrough
9ce14f4b01 prog: Fix page fault for syz-stress users.
In resources.go, haveGettime is False when SyscallMap["clock_gettime"]
is nil.

In this code, there's a branch that's entered only if Gettime is False,
which appends SyscallMap["clock_gettime"] to resourceCtors.  That is, it
appends nil to resourceCtors, then iterates through resourceCtors and
tries to dereference the .Name of each time, in this case, nil.Name.

This was causing a page fault on Fuchsia.

I'm not certain how the "standard" flow is supposed to work, since it
seems like any code that enters the `if cantCreate == "" && !haveGettime`
should fail... but, removing that section causes test failures, so let's
just enforce that SyscallMap["clock_gettime"] is non-nil.

If there's a better way to solve this, I'm open to suggestions.
2018-05-03 07:50:03 +02:00
Dmitry Vyukov
02bbd80e7c prog: fix gometalinter warnings 2018-04-24 13:23:01 +02:00
Dmitry Vyukov
2a9c3edcda pkg/prog: explain why syscalls are transitively disabled 2018-04-06 19:43:06 +02:00
Dmitry Vyukov
3e679c51c0 pkg/compiler: support non-zero terminated filenames
Now file names become:

string[filename]

with a possibility of using other string features:

stringnoz[filename]
string[filename, CONST_SIZE]

and filename is left as type alias as it is commonly used:

type filename string[filename]
2018-04-02 20:10:07 +02:00
Dmitry Vyukov
185ac3525e prog: support big-endian during hints matching
Use big-endian match/replace for both blobs and ints.
Sometimes we have unmarked blobs (no little/big-endian info);
for ANYBLOBs we intentionally lose all marking;
but even for marked ints we may need this too.
Consider that kernel code does not convert the data
(i.e. not ntohs(pkt->proto) == ETH_P_BATMAN),
but instead converts the constant (i.e. pkt->proto == htons(ETH_P_BATMAN)).
In such case we will see dynamic operand that does not
match what we have in the program.
2018-04-01 15:28:01 +02:00
Dmitry Vyukov
0174c6c8f7 prog: reduce nesting level in shrinkExpand 2018-03-31 18:55:59 +02:00
Dmitry Vyukov
7c923cf8d4 sys/linux: add support for mounting filesystem images 2018-03-30 19:51:27 +02:00
Dmitry Vyukov
7c62f71804 sys/linux: add netlink fou descriptions 2018-03-21 12:18:36 +01:00
Dmitry Vyukov
36d1c4540a all: fix gometalinter warnings
Fix typos, non-canonical code, remove dead code, etc.
2018-03-08 18:48:26 +01:00
Dmitry Vyukov
d0790618dc prog: fix isDefaultArg
Test that isDefaultArg returns true for result of DefaultArg.
Fix few bugs uncovered by this test.
2018-03-08 12:02:17 +01:00
Dmitry Vyukov
4bad061006 prog: extend some error messages 2018-03-05 12:58:29 +01:00
Dmitry Vyukov
bc09be4253 prog: fix 32-bit build
Currently fails with:
prog/mutation.go:442:24: constant 4294967296 overflows int
2018-03-05 12:10:27 +01:00
Dmitry Vyukov
70a1ddb939 prog: harden program parsing against description changes more
Handle most of type changes, e.g. const is changed to struct,
or struct to pointers. In all these cases we create default args.
They may not give the coverage anymore, but still better than
losing them right away.
2018-03-05 12:10:27 +01:00
Dmitry Vyukov
b99c76c405 prog: recover after type changes during program deserialization
Make program deserialization handle and recover after type changes
in descriptions.
2018-03-05 12:10:27 +01:00
Dmitry Vyukov
bd5df8f49b prog: handle excessive args and fields during program parsing
Tolerate excessive args and fields during program parsing.
This is useful after description changes to not lose corpus.
2018-03-05 12:10:27 +01:00
Dmitry Vyukov
002cecf202 pkg/compiler: allow specifying static size for filename's
Sometimes filenames are embed into structs and need to take fixed space.
2018-03-05 12:10:27 +01:00
Dmitry Vyukov
5ef8dbdf5a pkg/compiler: support size attribute for unions 2018-03-05 12:10:27 +01:00
Dmitry Vyukov
a339951e5f pkg/compiler: add size attribute for structs
The size attribute allows to pad a struct up to the specified size.
2018-03-05 12:10:27 +01:00
Dmitry Vyukov
e28ba02d9d prog: harden program parsing
This fixes crash during parsing of existing programs in corpus
after vma<->ptr type change in descriptions.
2018-03-05 12:10:27 +01:00
Dmitry Vyukov
6ceee05ad9 prog: extend a TODO about big-endian hints 2018-02-27 12:06:28 +01:00
Dmitry Vyukov
6284466bc9 prog: properly squash bitfields 2018-02-26 18:21:51 +01:00
Dmitry Vyukov
d1322dff4c prog: remove stale TODOs 2018-02-26 17:46:44 +01:00
Dmitry Vyukov
b37b65b0e6 sys/linux: remove proc type from network descriptions
We now always create net namespace for testing,
so socket ports and other IDs do not overlap between
different test processes.
Proc types play badly with squashing packets to ANYBLOB.
To squash into a block we need concrete value, but it depends
on process id.
Removing proc also makes tun setup and address descriptions simpler.
2018-02-26 16:48:31 +01:00
Dmitry Vyukov
14dae29c2a executor: use proper default values for resources
We currently use -1 as default value for resources
when the actual value is not available.
-1 is good for fd's, but is not the right default
value for pointers/keys/etc.
Pass from prog and use in executor proper default
value for resources.
2018-02-26 15:00:46 +01:00