diff --git a/pkg/rpctype/rpctype.go b/pkg/rpctype/rpctype.go index 35aa75307328..f83eac3b3e17 100644 --- a/pkg/rpctype/rpctype.go +++ b/pkg/rpctype/rpctype.go @@ -11,21 +11,21 @@ import ( "github.com/google/syzkaller/pkg/signal" ) -type RPCInput struct { +type Input struct { Call string Prog []byte Signal signal.Serial Cover []uint32 } -type RPCCandidate struct { +type Candidate struct { Prog []byte Minimized bool Smashed bool } -type RPCProg struct { - Prog []byte +type Prog struct { + Bytes []byte ProgIdx int RunIdx int } @@ -63,7 +63,7 @@ type SyscallReason struct { type NewInputArgs struct { Name string - RPCInput + Input } type PollArgs struct { @@ -74,8 +74,8 @@ type PollArgs struct { } type PollRes struct { - Candidates []RPCCandidate - NewInputs []RPCInput + Candidates []Candidate + NewInputs []Input MaxSignal signal.Serial } @@ -121,8 +121,8 @@ type NextExchangeArgs struct { // NextExchaneRes contains the data passed from server to client namely // programs to execute on the VM. type NextExchangeRes struct { - // RPCProg contains the serialized program that will be sent to the client. - RPCProg + // Prog contains the serialized program that will be sent to the client. + Prog } type HubConnectArgs struct { diff --git a/syz-fuzzer/fuzzer.go b/syz-fuzzer/fuzzer.go index 6d723967ea4d..8e916f03464b 100644 --- a/syz-fuzzer/fuzzer.go +++ b/syz-fuzzer/fuzzer.go @@ -425,17 +425,17 @@ func (fuzzer *Fuzzer) poll(needCandidates bool, stats map[string]uint64) bool { return len(r.NewInputs) != 0 || len(r.Candidates) != 0 || maxSignal.Len() != 0 } -func (fuzzer *Fuzzer) sendInputToManager(inp rpctype.RPCInput) { +func (fuzzer *Fuzzer) sendInputToManager(inp rpctype.Input) { a := &rpctype.NewInputArgs{ - Name: fuzzer.name, - RPCInput: inp, + Name: fuzzer.name, + Input: inp, } if err := fuzzer.manager.Call("Manager.NewInput", a, nil); err != nil { log.Fatalf("Manager.NewInput call failed: %v", err) } } -func (fuzzer *Fuzzer) addInputFromAnotherFuzzer(inp rpctype.RPCInput) { +func (fuzzer *Fuzzer) addInputFromAnotherFuzzer(inp rpctype.Input) { p := fuzzer.deserializeInput(inp.Prog) if p == nil { return @@ -445,7 +445,7 @@ func (fuzzer *Fuzzer) addInputFromAnotherFuzzer(inp rpctype.RPCInput) { fuzzer.addInputToCorpus(p, sign, sig) } -func (fuzzer *Fuzzer) addCandidateInput(candidate rpctype.RPCCandidate) { +func (fuzzer *Fuzzer) addCandidateInput(candidate rpctype.Candidate) { p := fuzzer.deserializeInput(candidate.Prog) if p == nil { return diff --git a/syz-fuzzer/proc.go b/syz-fuzzer/proc.go index 96d10a7ecf54..b15560b6a86f 100644 --- a/syz-fuzzer/proc.go +++ b/syz-fuzzer/proc.go @@ -163,7 +163,7 @@ func (proc *Proc) triageInput(item *WorkTriage) { sig := hash.Hash(data) log.Logf(2, "added new input for %v to corpus:\n%s", logCallName, data) - proc.fuzzer.sendInputToManager(rpctype.RPCInput{ + proc.fuzzer.sendInputToManager(rpctype.Input{ Call: callName, Prog: data, Signal: inputSignal.Serialize(), diff --git a/syz-manager/hub.go b/syz-manager/hub.go index 25c628580703..f077548029f8 100644 --- a/syz-manager/hub.go +++ b/syz-manager/hub.go @@ -72,7 +72,7 @@ type HubConnector struct { // HubManagerView restricts interface between HubConnector and Manager. type HubManagerView interface { getMinimizedCorpus() (corpus, repros [][]byte) - addNewCandidates(candidates []rpctype.RPCCandidate) + addNewCandidates(candidates []rpctype.Candidate) } func (hc *HubConnector) loop() { @@ -201,7 +201,7 @@ func (hc *HubConnector) sync(hub *rpctype.RPCClient, corpus [][]byte) error { } func (hc *HubConnector) processProgs(inputs []rpctype.HubInput) (minimized, smashed, dropped int) { - candidates := make([]rpctype.RPCCandidate, 0, len(inputs)) + candidates := make([]rpctype.Candidate, 0, len(inputs)) for _, inp := range inputs { bad, disabled := checkProgram(hc.target, hc.enabledCalls, inp.Prog) if bad || disabled { @@ -217,7 +217,7 @@ func (hc *HubConnector) processProgs(inputs []rpctype.HubInput) (minimized, smas if smash { smashed++ } - candidates = append(candidates, rpctype.RPCCandidate{ + candidates = append(candidates, rpctype.Candidate{ Prog: inp.Prog, Minimized: min, Smashed: smash, diff --git a/syz-manager/manager.go b/syz-manager/manager.go index b07a885e2270..2a046810235a 100644 --- a/syz-manager/manager.go +++ b/syz-manager/manager.go @@ -70,9 +70,9 @@ type Manager struct { phase int targetEnabledSyscalls map[*prog.Syscall]bool - candidates []rpctype.RPCCandidate // untriaged inputs from corpus and hub + candidates []rpctype.Candidate // untriaged inputs from corpus and hub disabledHashes map[string]struct{} - corpus map[string]rpctype.RPCInput + corpus map[string]rpctype.Input seeds [][]byte newRepros [][]byte lastMinCorpus int @@ -162,7 +162,7 @@ func RunManager(cfg *mgrconfig.Config) { startTime: time.Now(), stats: &Stats{haveHub: cfg.HubClient != ""}, crashTypes: make(map[string]bool), - corpus: make(map[string]rpctype.RPCInput), + corpus: make(map[string]rpctype.Input), disabledHashes: make(map[string]struct{}), memoryLeakFrames: make(map[string]bool), dataRaceFrames: make(map[string]bool), @@ -534,7 +534,7 @@ func (mgr *Manager) loadProg(data []byte, minimized, smashed bool) bool { mgr.disabledHashes[hash.String(data)] = struct{}{} return true } - mgr.candidates = append(mgr.candidates, rpctype.RPCCandidate{ + mgr.candidates = append(mgr.candidates, rpctype.Candidate{ Prog: data, Minimized: minimized, Smashed: smashed, @@ -948,7 +948,7 @@ func (mgr *Manager) getMinimizedCorpus() (corpus, repros [][]byte) { return } -func (mgr *Manager) addNewCandidates(candidates []rpctype.RPCCandidate) { +func (mgr *Manager) addNewCandidates(candidates []rpctype.Candidate) { mgr.mu.Lock() defer mgr.mu.Unlock() mgr.candidates = append(mgr.candidates, candidates...) @@ -968,11 +968,11 @@ func (mgr *Manager) minimizeCorpus() { Context: inp, }) } - newCorpus := make(map[string]rpctype.RPCInput) + newCorpus := make(map[string]rpctype.Input) // Note: inputs are unsorted (based on map iteration). // This gives some intentional non-determinism during minimization. for _, ctx := range signal.Minimize(inputs) { - inp := ctx.(rpctype.RPCInput) + inp := ctx.(rpctype.Input) newCorpus[hash.String(inp.Prog)] = inp } log.Logf(1, "minimized corpus: %v -> %v", len(mgr.corpus), len(newCorpus)) @@ -1057,12 +1057,12 @@ func (mgr *Manager) collectSyscallInfoUnlocked() map[string]*CallCov { } func (mgr *Manager) fuzzerConnect(modules []host.KernelModule) ( - []rpctype.RPCInput, BugFrames, map[uint32]uint32, []byte, error) { + []rpctype.Input, BugFrames, map[uint32]uint32, []byte, error) { mgr.mu.Lock() defer mgr.mu.Unlock() mgr.minimizeCorpus() - corpus := make([]rpctype.RPCInput, 0, len(mgr.corpus)) + corpus := make([]rpctype.Input, 0, len(mgr.corpus)) for _, inp := range mgr.corpus { corpus = append(corpus, inp) } @@ -1098,7 +1098,7 @@ func (mgr *Manager) machineChecked(a *rpctype.CheckArgs, enabledSyscalls map[*pr mgr.firstConnect = time.Now() } -func (mgr *Manager) newInput(inp rpctype.RPCInput, sign signal.Signal) bool { +func (mgr *Manager) newInput(inp rpctype.Input, sign signal.Signal) bool { mgr.mu.Lock() defer mgr.mu.Unlock() if mgr.saturatedCalls[inp.Call] { @@ -1124,14 +1124,14 @@ func (mgr *Manager) newInput(inp rpctype.RPCInput, sign signal.Signal) bool { return true } -func (mgr *Manager) candidateBatch(size int) []rpctype.RPCCandidate { +func (mgr *Manager) candidateBatch(size int) []rpctype.Candidate { mgr.mu.Lock() defer mgr.mu.Unlock() - var res []rpctype.RPCCandidate + var res []rpctype.Candidate for i := 0; i < size && len(mgr.candidates) > 0; i++ { last := len(mgr.candidates) - 1 res = append(res, mgr.candidates[last]) - mgr.candidates[last] = rpctype.RPCCandidate{} + mgr.candidates[last] = rpctype.Candidate{} mgr.candidates = mgr.candidates[:last] } if len(mgr.candidates) == 0 { diff --git a/syz-manager/rpc.go b/syz-manager/rpc.go index d091bd01a339..8f9eb98b83fe 100644 --- a/syz-manager/rpc.go +++ b/syz-manager/rpc.go @@ -43,7 +43,7 @@ type RPCServer struct { type Fuzzer struct { name string rotated bool - inputs []rpctype.RPCInput + inputs []rpctype.Input newMaxSignal signal.Signal rotatedSignal signal.Signal machineInfo []byte @@ -57,10 +57,10 @@ type BugFrames struct { // RPCManagerView restricts interface between RPCServer and Manager. type RPCManagerView interface { fuzzerConnect([]host.KernelModule) ( - []rpctype.RPCInput, BugFrames, map[uint32]uint32, []byte, error) + []rpctype.Input, BugFrames, map[uint32]uint32, []byte, error) machineChecked(result *rpctype.CheckArgs, enabledSyscalls map[*prog.Syscall]bool) - newInput(inp rpctype.RPCInput, sign signal.Signal) bool - candidateBatch(size int) []rpctype.RPCCandidate + newInput(inp rpctype.Input, sign signal.Signal) bool + candidateBatch(size int) []rpctype.Candidate rotateCorpus() bool } @@ -125,7 +125,7 @@ func (serv *RPCServer) Connect(a *rpctype.ConnectArgs, r *rpctype.ConnectRes) er return nil } -func (serv *RPCServer) rotateCorpus(f *Fuzzer, corpus []rpctype.RPCInput) *rpctype.CheckArgs { +func (serv *RPCServer) rotateCorpus(f *Fuzzer, corpus []rpctype.Input) *rpctype.CheckArgs { // Fuzzing tends to stuck in some local optimum and then it fails to cover // other state space points since code coverage is only a very approximate // measure of logic coverage. To overcome this we introduce some variation @@ -174,8 +174,8 @@ func (serv *RPCServer) rotateCorpus(f *Fuzzer, corpus []rpctype.RPCInput) *rpcty return &result } -func (serv *RPCServer) selectInputs(enabled map[string]bool, inputs0 []rpctype.RPCInput, signal0 signal.Signal) ( - inputs []rpctype.RPCInput, signal signal.Signal) { +func (serv *RPCServer) selectInputs(enabled map[string]bool, inputs0 []rpctype.Input, signal0 signal.Signal) ( + inputs []rpctype.Input, signal signal.Signal) { signal = signal0.Copy() for _, inp := range inputs0 { calls, _, err := prog.CallSet(inp.Prog) @@ -250,9 +250,9 @@ func (serv *RPCServer) NewInput(a *rpctype.NewInputArgs, r *int) error { inputSignal := a.Signal.Deserialize() log.Logf(4, "new input from %v for syscall %v (signal=%v, cover=%v)", a.Name, a.Call, inputSignal.Len(), len(a.Cover)) - bad, disabled := checkProgram(serv.cfg.Target, serv.targetEnabledSyscalls, a.RPCInput.Prog) + bad, disabled := checkProgram(serv.cfg.Target, serv.targetEnabledSyscalls, a.Input.Prog) if bad || disabled { - log.Logf(0, "rejecting program from fuzzer (bad=%v, disabled=%v):\n%s", bad, disabled, a.RPCInput.Prog) + log.Logf(0, "rejecting program from fuzzer (bad=%v, disabled=%v):\n%s", bad, disabled, a.Input.Prog) return nil } serv.mu.Lock() @@ -269,7 +269,7 @@ func (serv *RPCServer) NewInput(a *rpctype.NewInputArgs, r *int) error { if !genuine && !rotated { return nil } - if !serv.mgr.newInput(a.RPCInput, inputSignal) { + if !serv.mgr.newInput(a.Input, inputSignal) { return nil } @@ -301,12 +301,12 @@ func (serv *RPCServer) NewInput(a *rpctype.NewInputArgs, r *int) error { serv.corpusSignal.Merge(inputSignal) serv.stats.corpusSignal.set(serv.corpusSignal.Len()) - a.RPCInput.Cover = nil // Don't send coverage back to all fuzzers. + a.Input.Cover = nil // Don't send coverage back to all fuzzers. for _, other := range serv.fuzzers { if other == f || other.rotated { continue } - other.inputs = append(other.inputs, a.RPCInput) + other.inputs = append(other.inputs, a.Input) } } return nil @@ -357,7 +357,7 @@ func (serv *RPCServer) Poll(a *rpctype.PollArgs, r *rpctype.PollRes) error { for i := 0; i < batchSize && len(f.inputs) > 0; i++ { last := len(f.inputs) - 1 r.NewInputs = append(r.NewInputs, f.inputs[last]) - f.inputs[last] = rpctype.RPCInput{} + f.inputs[last] = rpctype.Input{} f.inputs = f.inputs[:last] } if len(f.inputs) == 0 { diff --git a/syz-runner/runner.go b/syz-runner/runner.go index 26bdb26694e5..9317055d4797 100644 --- a/syz-runner/runner.go +++ b/syz-runner/runner.go @@ -93,7 +93,7 @@ func main() { log.Fatalf("failed to get initial program: %v", err) } - rn.Run(res.Prog, res.ProgIdx, res.RunIdx) + rn.Run(res.Prog.Bytes, res.ProgIdx, res.RunIdx) } // Run is responsible for requesting new programs from the verifier, executing them and then sending back the Result. @@ -131,7 +131,7 @@ func (rn *Runner) Run(firstProg []byte, idx, runIdx int) { if err := rn.vrf.Call("Verifier.NextExchange", a, r); err != nil { log.Fatalf("failed to make exchange with verifier: %v", err) } - p, pIdx, rIdx = r.Prog, r.ProgIdx, r.RunIdx + p, pIdx, rIdx = r.Prog.Bytes, r.ProgIdx, r.RunIdx if !rn.newEnv { continue diff --git a/syz-verifier/rpcserver.go b/syz-verifier/rpcserver.go index 8757b22cc670..e392e1c9e295 100644 --- a/syz-verifier/rpcserver.go +++ b/syz-verifier/rpcserver.go @@ -137,7 +137,7 @@ func (srv *RPCServer) NextExchange(a *rpctype.NextExchangeArgs, r *rpctype.NextE } newProg, pi, ri := srv.newProgram(a.Pool, a.VM) - r.RPCProg = rpctype.RPCProg{Prog: newProg, ProgIdx: pi, RunIdx: ri} + r.Prog = rpctype.Prog{Bytes: newProg, ProgIdx: pi, RunIdx: ri} return nil }