search

google / syzkaller

syzkaller is an unsupervised coverage-guided kernel fuzzer
Apache License 2.0
5.36k stars 1.23k forks source link

syzkaller: resource values #5325

Open a-nogikh opened 1 month ago

a-nogikh commented 1 month ago

5323 provided a quick solution for the problem of passing the same value to several different arguments.

The downsides are that it's actually an extra call that we will have to carry on in our reproducers and that puts extra burden on our resource generation/mutation code.

I wonder if we can reimplement in a cleaner way, e.g. by introducing some resource values like:

value x[int16[0:10]]
value y[int16]: 2, 4, 8, 16

which will act like resources (and which would be represented exactly like resources: using *prog.ResourceType, *prog.ResourceDesc, *prog.ResultArg), but they won't require any extra pseudo syscalls and we won't be able to return them from fuctions.

There can also be some synergy with https://github.com/google/syzkaller/issues/1621

dvyukov commented 1 month ago

Will this work for the original use for ptr[in, filename]?

We could also "inline" syz_create_resource in C reproducers, and specialize it during generation/mutation.