Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

tools/syz-declextract: Areas of improvement #5410

Open
pimyn-girgis opened this issue Oct 18, 2024 · 0 comments
Open

tools/syz-declextract: Areas of improvement #5410

pimyn-girgis opened this issue Oct 18, 2024 · 0 comments

Comments

@pimyn-girgis
Copy link
Collaborator

  1. Better integration with tools/*
    1. syz-trace2syz ignores auto-generated descriptions.
  2. Support more interfaces (See)
  3. Improve extraction
    1. Infer direction of non-const pointers.
      1. copy_to_user() and copy_from_user()
    2. Handling extern variables
      1. Extern variables are often defined in different translation units, and simply go unextracted. A promising solution is ASTImporter. Another more general solution is moving some processing to go.
    3. Syscall specific:
      1. Handle 32bit system calls passing 64bit arguments.
        For example, sync_file_range2 is translated to arm_sync_file_range and in linux/386, the pointer size is 32 bits, which means system call arguments cannot be longer (No int64). So while argument offset should have the type int64, it is currently given intptr to avoid the following error:
        compilation of linux/386 target failed:
        sys/linux/auto.txt:201:46: arm_sync_file_range$auto arg offset is larger than pointer size
      2. Infer if a system call returns a resource.
    4. Netlink specific:
      1. Netlink is converting to .yaml files (See Documentation/netlink/specs in kernel source code). The .yaml files are used to generate .c files during build, but the policies are defined as extern and not handled properly. 3.ii.a should improve the situation. Are any semantics lost in translation? Should we start focusing on yaml instead?
      2. Use more nla_policy fields to specify types and limits.
      3. Nested, Nested Array, and Bitfield 32 Netlink types.
    5. Handle pointers represented as u64 in structs. e.g.
  4. Add a test that ensures that automatic_helper attributes mark sufficient number of syscalls (enable all automatic + automatic_helper, check that none get transitively disabled; ensure that it will check precise resource types, e.g. if auto syscalls need fd, we have a syscall that returns fd, not only fd_namespace)
  5. Previous Issue: sys/linux: automatic syscall interface extraction #590
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant