Documentation ¶
Index ¶
- Constants
- Variables
- func CallSet(data []byte) (map[string]struct{}, int, error)
- func CppName(name string) string
- func Debug()
- func DecodeFallbackSignal(s uint32) (callID, errno int)
- func EncodeData(buf *bytes.Buffer, data []byte, readable bool)
- func ForeachArg(c *Call, f func(Arg, *ArgCtx))
- func ForeachCallType(meta *Syscall, f func(t Type, ctx TypeCtx))
- func ForeachSubArg(arg Arg, f func(Arg, *ArgCtx))
- func ForeachType(syscalls []*Syscall, f func(t Type, ctx TypeCtx))
- func ForeachTypePost(syscalls []*Syscall, f func(t Type, ctx TypeCtx))
- func IsPad(t Type) bool
- func RegisterTarget(target *Target, types []Type, initArch func(target *Target))
- func RequiredFeatures(p *Prog) (bitmasks, csums bool)
- func RestoreLinks(syscalls []*Syscall, resources []*ResourceDesc, types []Type)
- func TestDeserializeHelper(t *testing.T, OS, arch string, transform func(*Target, *Prog), ...)
- type Arg
- type ArgCommon
- type ArgCtx
- type ArrayKind
- type ArrayType
- type BinaryFormat
- type BufferKind
- type BufferType
- type Builder
- type Call
- type CallFlags
- type CallInfo
- type ChoiceTable
- type CompMap
- type ConstArg
- type ConstType
- type ConstValue
- type CsumChunk
- type CsumChunkKind
- type CsumInfo
- type CsumKind
- type CsumType
- type DataArg
- type DeserializeMode
- type DeserializeTest
- type Dir
- type ExecArg
- type ExecArgConst
- type ExecArgCsum
- type ExecArgData
- type ExecArgResult
- type ExecCall
- type ExecCopyin
- type ExecCopyout
- type ExecCsumChunk
- type ExecProg
- type Field
- type FlagsType
- type Gen
- func (g *Gen) Alloc(ptrType Type, dir Dir, data Arg) (Arg, []*Call)
- func (g *Gen) GenerateArg(typ Type, dir Dir, pcalls *[]*Call) Arg
- func (g *Gen) GenerateSpecialArg(typ Type, dir Dir, pcalls *[]*Call) Arg
- func (g *Gen) MutateArg(arg0 Arg) (calls []*Call)
- func (g *Gen) NOutOf(n, outOf int) bool
- func (g *Gen) Rand() *rand.Rand
- func (g *Gen) Target() *Target
- type GroupArg
- type IntKind
- type IntType
- type IntTypeCommon
- func (t *IntTypeCommon) BitfieldLength() uint64
- func (t *IntTypeCommon) BitfieldOffset() uint64
- func (t *IntTypeCommon) Format() BinaryFormat
- func (t *IntTypeCommon) IsBitfield() bool
- func (t *IntTypeCommon) String() string
- func (t *IntTypeCommon) TypeBitSize() uint64
- func (t *IntTypeCommon) UnitOffset() uint64
- func (t *IntTypeCommon) UnitSize() uint64
- type LenType
- type LogEntry
- type PointerArg
- type ProcType
- type Prog
- func (p *Prog) Clone() *Prog
- func (p *Prog) FallbackSignal(info []CallInfo)
- func (p *Prog) Mutate(rs rand.Source, ncalls int, ct *ChoiceTable, corpus []*Prog)
- func (p *Prog) MutateWithHints(callIndex int, comps CompMap, exec func(p *Prog))
- func (p *Prog) Serialize() []byte
- func (p *Prog) SerializeForExec(buffer []byte) (int, error)
- func (p *Prog) SerializeVerbose() []byte
- func (p *Prog) String() string
- type PtrType
- type Ref
- func (ti Ref) BitfieldLength() uint64
- func (ti Ref) BitfieldOffset() uint64
- func (ti Ref) Clone() Type
- func (ti Ref) DefaultArg(dir Dir) Arg
- func (ti Ref) Format() BinaryFormat
- func (ti Ref) IsBitfield() bool
- func (ti Ref) Name() string
- func (ti Ref) Optional() bool
- func (ti Ref) Size() uint64
- func (ti Ref) String() string
- func (ti Ref) TemplateName() string
- func (ti Ref) TypeBitSize() uint64
- func (ti Ref) UnitOffset() uint64
- func (ti Ref) UnitSize() uint64
- func (ti Ref) Varlen() bool
- type ResourceCtor
- type ResourceDesc
- type ResourceType
- type ResultArg
- type Rotator
- type StructType
- type Syscall
- type SyscallAttrs
- type Target
- func (target *Target) ArgContainsAny(arg0 Arg) (res bool)
- func (target *Target) BuildChoiceTable(corpus []*Prog, enabled map[*Syscall]bool) *ChoiceTable
- func (target *Target) CalculatePriorities(corpus []*Prog) [][]float32
- func (target *Target) CallContainsAny(c *Call) (res bool)
- func (target *Target) DataMmapProg() *Prog
- func (target *Target) DefaultChoiceTable() *ChoiceTable
- func (target *Target) Deserialize(data []byte, mode DeserializeMode) (*Prog, error)
- func (target *Target) DeserializeExec(exec []byte) (ExecProg, error)
- func (target *Target) Generate(rs rand.Source, ncalls int, ct *ChoiceTable) *Prog
- func (target *Target) GenerateAllSyzProg(rs rand.Source) *Prog
- func (target *Target) GetConst(name string) uint64
- func (target *Target) ParseLog(data []byte) []*LogEntry
- func (target *Target) PhysicalAddr(arg *PointerArg) uint64
- func (target *Target) TransitivelyEnabledCalls(enabled map[*Syscall]bool) (map[*Syscall]bool, map[*Syscall]string)
- type TextKind
- type Type
- type TypeCommon
- func (t *TypeCommon) BitfieldLength() uint64
- func (t *TypeCommon) BitfieldOffset() uint64
- func (t *TypeCommon) Format() BinaryFormat
- func (t *TypeCommon) IsBitfield() bool
- func (t *TypeCommon) Name() string
- func (t *TypeCommon) Optional() bool
- func (t *TypeCommon) Size() uint64
- func (t *TypeCommon) TemplateName() string
- func (t *TypeCommon) TypeBitSize() uint64
- func (t *TypeCommon) UnitOffset() uint64
- func (t *TypeCommon) UnitSize() uint64
- func (t *TypeCommon) Varlen() bool
- type TypeCtx
- type UnionArg
- type UnionType
- type VmaType
Constants ¶
const ( ExecArgCsumChunkData = uint64(iota) ExecArgCsumChunkConst )
const ( ExecBufferSize = 4 << 20 // keep in sync with kMaxInput in executor.cc ExecNoCopyout = ^uint64(0) )
const ( // "Recommended" number of calls in programs that we try to aim at during fuzzing. RecommendedCalls = 20 // "Recommended" max number of calls in programs. // If we receive longer programs from hub/corpus we discard them. MaxCalls = 40 )
const ( // Special reference to the outer struct used in len targets. ParentRef = "parent" // Special reference directly to syscall arguments used in len targets. SyscallRef = "syscall" )
const (
ExecArgCsumInet = uint64(iota)
)
const MaxArgs = 9
MaxArgs is maximum number of syscall arguments. Executor also knows about this value.
const (
MaxPids = 32
)
Variables ¶
var ( GitRevision string // emitted by Makefile, may contain + at the end GitRevisionBase string // without + GitRevisionDate time.Time // parsed from gitRevisionDate )
Functions ¶
func CallSet ¶
CallSet returns a set of all calls in the program. It does very conservative parsing and is intended to parse past/future serialization formats.
func DecodeFallbackSignal ¶
func ForeachArg ¶
func ForeachCallType ¶
func ForeachSubArg ¶
func ForeachType ¶
func ForeachTypePost ¶
func RegisterTarget ¶
func RequiredFeatures ¶
func RestoreLinks ¶
func RestoreLinks(syscalls []*Syscall, resources []*ResourceDesc, types []Type)
func TestDeserializeHelper ¶
Types ¶
type Arg ¶
type ArgCtx ¶
type ArgCtx struct { Parent *[]Arg // GroupArg.Inner (for structs) or Call.Args containing this arg Fields []Field // Fields of the parent struct/syscall Base *PointerArg // pointer to the base of the heap object containing this arg Offset uint64 // offset of this arg from the base Stop bool // if set by the callback, subargs of this arg are not visited }
type ArrayType ¶
type ArrayType struct { TypeCommon Elem Type Kind ArrayKind RangeBegin uint64 RangeEnd uint64 }
func (*ArrayType) DefaultArg ¶
type BinaryFormat ¶
type BinaryFormat int
const ( FormatNative BinaryFormat = iota FormatBigEndian FormatStrDec FormatStrHex FormatStrOct )
type BufferKind ¶
type BufferKind int
const ( BufferBlobRand BufferKind = iota BufferBlobRange BufferString BufferFilename BufferText )
type BufferType ¶
type BufferType struct { TypeCommon Kind BufferKind RangeBegin uint64 // for BufferBlobRange kind RangeEnd uint64 // for BufferBlobRange kind Text TextKind // for BufferText SubKind string Values []string // possible values for BufferString kind NoZ bool // non-zero terminated BufferString/BufferFilename }
func (*BufferType) DefaultArg ¶
func (t *BufferType) DefaultArg(dir Dir) Arg
func (*BufferType) String ¶
func (t *BufferType) String() string
type Builder ¶
type Builder struct {
// contains filtered or unexported fields
}
func MakeProgGen ¶
func (*Builder) AllocateVMA ¶
type ChoiceTable ¶
type ChoiceTable struct {
// contains filtered or unexported fields
}
ChooseTable allows to do a weighted choice of a syscall for a given syscall based on call-to-call priorities and a set of enabled syscalls.
func (*ChoiceTable) Enabled ¶
func (ct *ChoiceTable) Enabled(call int) bool
type CompMap ¶
Example: for comparisons {(op1, op2), (op1, op3), (op1, op4), (op2, op1)} this map will store the following:
m = { op1: {map[op2]: true, map[op3]: true, map[op4]: true}, op2: {map[op1]: true} }.
type ConstType ¶
type ConstType struct { IntTypeCommon Val uint64 IsPad bool }
func (*ConstType) DefaultArg ¶
type ConstValue ¶
type CsumChunk ¶
type CsumChunk struct { Kind CsumChunkKind Arg Arg // for CsumChunkArg Value uint64 // for CsumChunkConst Size uint64 // for CsumChunkConst }
type CsumChunkKind ¶
type CsumChunkKind int
const ( CsumChunkArg CsumChunkKind = iota CsumChunkConst )
type CsumType ¶
type CsumType struct { IntTypeCommon Kind CsumKind Buf string Protocol uint64 // for CsumPseudo }
func (*CsumType) DefaultArg ¶
type DataArg ¶
type DataArg struct { ArgCommon // contains filtered or unexported fields }
Used for BufferType.
type DeserializeMode ¶
type DeserializeMode int
const ( Strict DeserializeMode = iota NonStrict DeserializeMode = iota )
type DeserializeTest ¶
type ExecArgConst ¶
type ExecArgCsum ¶
type ExecArgCsum struct { Size uint64 Kind uint64 Chunks []ExecCsumChunk }
type ExecArgData ¶
type ExecArgResult ¶
type ExecCall ¶
type ExecCall struct { Meta *Syscall Index uint64 Args []ExecArg Copyin []ExecCopyin Copyout []ExecCopyout }
type ExecCopyin ¶
type ExecCopyout ¶
type ExecCsumChunk ¶
type FlagsType ¶
type FlagsType struct { IntTypeCommon Vals []uint64 // compiler ensures that it's not empty BitMask bool }
func (*FlagsType) DefaultArg ¶
type Gen ¶
type Gen struct {
// contains filtered or unexported fields
}
func (*Gen) GenerateSpecialArg ¶
type IntType ¶
type IntType struct { IntTypeCommon Kind IntKind RangeBegin uint64 RangeEnd uint64 Align uint64 }
func (*IntType) DefaultArg ¶
type IntTypeCommon ¶
type IntTypeCommon struct { TypeCommon ArgFormat BinaryFormat BitfieldOff uint64 BitfieldLen uint64 BitfieldUnit uint64 BitfieldUnitOff uint64 }
func (*IntTypeCommon) BitfieldLength ¶
func (t *IntTypeCommon) BitfieldLength() uint64
func (*IntTypeCommon) BitfieldOffset ¶
func (t *IntTypeCommon) BitfieldOffset() uint64
func (*IntTypeCommon) Format ¶
func (t *IntTypeCommon) Format() BinaryFormat
func (*IntTypeCommon) IsBitfield ¶
func (t *IntTypeCommon) IsBitfield() bool
func (*IntTypeCommon) String ¶
func (t *IntTypeCommon) String() string
func (*IntTypeCommon) TypeBitSize ¶
func (t *IntTypeCommon) TypeBitSize() uint64
Returns the size in bits for integers in binary format or 64 for string-formatted integers. The return value is used in computing limits and truncating other values.
func (*IntTypeCommon) UnitOffset ¶
func (t *IntTypeCommon) UnitOffset() uint64
func (*IntTypeCommon) UnitSize ¶
func (t *IntTypeCommon) UnitSize() uint64
type LenType ¶
type LenType struct { IntTypeCommon BitSize uint64 // want size in multiple of bits instead of array size Offset bool // offset from the beginning of the parent struct or base object Path []string }
func (*LenType) DefaultArg ¶
type LogEntry ¶
type LogEntry struct { P *Prog Proc int // index of parallel proc Start int // start offset in log End int // end offset in log Fault bool // program was executed with fault injection in FaultCall/FaultNth FaultCall int FaultNth int }
LogEntry describes one program in execution log.
type PointerArg ¶
type PointerArg struct { ArgCommon Address uint64 VmaSize uint64 // size of the referenced region for vma args Res Arg // pointee (nil for vma) }
Used for PtrType and VmaType.
func MakePointerArg ¶
func MakePointerArg(t Type, dir Dir, addr uint64, data Arg) *PointerArg
func MakeSpecialPointerArg ¶
func MakeSpecialPointerArg(t Type, dir Dir, index uint64) *PointerArg
func MakeVmaPointerArg ¶
func MakeVmaPointerArg(t Type, dir Dir, addr, size uint64) *PointerArg
func (*PointerArg) IsSpecial ¶
func (arg *PointerArg) IsSpecial() bool
func (*PointerArg) Size ¶
func (arg *PointerArg) Size() uint64
type ProcType ¶
type ProcType struct { IntTypeCommon ValuesStart uint64 ValuesPerProc uint64 }
func (*ProcType) DefaultArg ¶
type Prog ¶
func Minimize ¶
Minimize minimizes program p into an equivalent program using the equivalence predicate pred. It iteratively generates simpler programs and asks pred whether it is equal to the original program or not. If it is equivalent then the simplification attempt is committed and the process continues.
func (*Prog) FallbackSignal ¶
func (*Prog) Mutate ¶
Mutate program p.
p: The program to mutate. rs: Random source. ncalls: The allowed maximum calls in mutated program. ct: ChoiceTable for syscalls. corpus: The entire corpus, including original program p.
func (*Prog) MutateWithHints ¶
Mutates the program using the comparison operands stored in compMaps. For each of the mutants executes the exec callback.
func (*Prog) SerializeForExec ¶
SerializeForExec serializes program p for execution by process pid into the provided buffer. Returns number of bytes written to the buffer. If the provided buffer is too small for the program an error is returned.
func (*Prog) SerializeVerbose ¶
type PtrType ¶
type PtrType struct { TypeCommon Elem Type ElemDir Dir }
func (*PtrType) DefaultArg ¶
type Ref ¶
type Ref uint32
func (Ref) BitfieldLength ¶
func (Ref) BitfieldOffset ¶
func (Ref) DefaultArg ¶
func (Ref) Format ¶
func (ti Ref) Format() BinaryFormat
func (Ref) IsBitfield ¶
func (Ref) TemplateName ¶
func (Ref) TypeBitSize ¶
func (Ref) UnitOffset ¶
type ResourceCtor ¶
type ResourceDesc ¶
type ResourceDesc struct { Name string Kind []string Values []uint64 Ctors []ResourceCtor }
type ResourceType ¶
type ResourceType struct { TypeCommon ArgFormat BinaryFormat Desc *ResourceDesc }
func (*ResourceType) Default ¶
func (t *ResourceType) Default() uint64
func (*ResourceType) DefaultArg ¶
func (t *ResourceType) DefaultArg(dir Dir) Arg
func (*ResourceType) Format ¶
func (t *ResourceType) Format() BinaryFormat
func (*ResourceType) SpecialValues ¶
func (t *ResourceType) SpecialValues() []uint64
func (*ResourceType) String ¶
func (t *ResourceType) String() string
type ResultArg ¶
type ResultArg struct { ArgCommon Res *ResultArg // reference to arg which we use OpDiv uint64 // divide result (executed before OpAdd) OpAdd uint64 // add to result Val uint64 // value used if Res is nil // contains filtered or unexported fields }
Used for ResourceType. This is the only argument that can be used as syscall return value. Either holds constant value or reference another ResultArg.
func MakeReturnArg ¶
type Rotator ¶
type Rotator struct {
// contains filtered or unexported fields
}
Rotator selects a random subset of syscalls for corpus rotation.
func MakeRotator ¶
type StructType ¶
type StructType struct { TypeCommon Fields []Field AlignAttr uint64 }
func (*StructType) DefaultArg ¶
func (t *StructType) DefaultArg(dir Dir) Arg
func (*StructType) String ¶
func (t *StructType) String() string
type SyscallAttrs ¶
type SyscallAttrs struct { Disabled bool Timeout uint64 ProgTimeout uint64 IgnoreReturn bool BreaksReturns bool }
SyscallAttrs represents call attributes in syzlang.
This structure is the source of truth for the all other parts of the system. pkg/compiler uses this structure to parse descriptions. syz-sysgen uses this structure to generate code for executor.
Only bool's and uint64's are currently supported.
See docs/syscall_descriptions_syntax.md for description of individual attributes.
type Target ¶
type Target struct { OS string Arch string Revision string // unique hash representing revision of the descriptions PtrSize uint64 PageSize uint64 NumPages uint64 DataOffset uint64 Syscalls []*Syscall Resources []*ResourceDesc Consts []ConstValue // MakeDataMmap creates calls that mmaps target data memory range. MakeDataMmap func() []*Call // Neutralize neutralizes harmful calls by transforming them into non-harmful ones // (e.g. an ioctl that turns off console output is turned into ioctl that turns on output). Neutralize func(c *Call) // AnnotateCall annotates a syscall invocation in C reproducers. // The returned string will be placed inside a comment except for the // empty string which will omit the comment. AnnotateCall func(c ExecCall) string // SpecialTypes allows target to do custom generation/mutation for some struct's and union's. // Map key is struct/union name for which custom generation/mutation is required. // Map value is custom generation/mutation function that will be called // for the corresponding type. g is helper object that allows generate random numbers, // allocate memory, etc. typ is the struct/union type. old is the old value of the struct/union // for mutation, or nil for generation. The function returns a new value of the struct/union, // and optionally any calls that need to be inserted before the arg reference. SpecialTypes map[string]func(g *Gen, typ Type, dir Dir, old Arg) (Arg, []*Call) // Special strings that can matter for the target. // Used as fallback when string type does not have own dictionary. StringDictionary []string // Resources that play auxiliary role, but widely used throughout all syscalls (e.g. pid/uid). AuxResources map[string]bool // Additional special invalid pointer values besides NULL to use. SpecialPointers []uint64 // Filled by prog package: SyscallMap map[string]*Syscall ConstMap map[string]uint64 // contains filtered or unexported fields }
Target describes target OS/arch pair.
func AllTargets ¶
func AllTargets() []*Target
func (*Target) ArgContainsAny ¶
func (*Target) BuildChoiceTable ¶
func (target *Target) BuildChoiceTable(corpus []*Prog, enabled map[*Syscall]bool) *ChoiceTable
func (*Target) CalculatePriorities ¶
func (*Target) CallContainsAny ¶
func (*Target) DataMmapProg ¶
DataMmapProg creates program that maps data segment. Also used for testing as the simplest program.
func (*Target) DefaultChoiceTable ¶
func (target *Target) DefaultChoiceTable() *ChoiceTable
func (*Target) Deserialize ¶
func (target *Target) Deserialize(data []byte, mode DeserializeMode) (*Prog, error)
func (*Target) DeserializeExec ¶
func (*Target) Generate ¶
Generate generates a random program with ncalls calls. ct contains a set of allowed syscalls, if nil all syscalls are used.
func (*Target) GenerateAllSyzProg ¶
GenerateAllSyzProg generates a program that contains all pseudo syz_ calls for testing.
func (*Target) PhysicalAddr ¶
func (target *Target) PhysicalAddr(arg *PointerArg) uint64
type Type ¶
type Type interface { String() string Name() string TemplateName() string // for template structs name without arguments Optional() bool Varlen() bool Size() uint64 TypeBitSize() uint64 Format() BinaryFormat BitfieldOffset() uint64 BitfieldLength() uint64 IsBitfield() bool // For most of the types UnitSize is equal to Size. // These are different only for all but last bitfield in the group, // where Size == 0 and UnitSize equals to the underlying bitfield type size. UnitSize() uint64 UnitOffset() uint64 DefaultArg(dir Dir) Arg // contains filtered or unexported methods }
type TypeCommon ¶
type TypeCommon struct { TypeName string // Static size of the type, or 0 for variable size types and all but last bitfields in the group. TypeSize uint64 IsOptional bool IsVarlen bool // contains filtered or unexported fields }
func (*TypeCommon) BitfieldLength ¶
func (t *TypeCommon) BitfieldLength() uint64
func (*TypeCommon) BitfieldOffset ¶
func (t *TypeCommon) BitfieldOffset() uint64
func (*TypeCommon) Format ¶
func (t *TypeCommon) Format() BinaryFormat
func (*TypeCommon) IsBitfield ¶
func (t *TypeCommon) IsBitfield() bool
func (*TypeCommon) Name ¶
func (t *TypeCommon) Name() string
func (*TypeCommon) Optional ¶
func (t *TypeCommon) Optional() bool
func (*TypeCommon) Size ¶
func (t *TypeCommon) Size() uint64
func (*TypeCommon) TemplateName ¶
func (t *TypeCommon) TemplateName() string
func (*TypeCommon) TypeBitSize ¶
func (t *TypeCommon) TypeBitSize() uint64
func (*TypeCommon) UnitOffset ¶
func (t *TypeCommon) UnitOffset() uint64
func (*TypeCommon) UnitSize ¶
func (t *TypeCommon) UnitSize() uint64
func (*TypeCommon) Varlen ¶
func (t *TypeCommon) Varlen() bool
type UnionArg ¶
type UnionArg struct { ArgCommon Option Arg Index int // Index of the selected option in the union type. }
Used for UnionType.