tools/syz-aflow/aflow.go: Add CrashReport, KernelRepo and KernelCommit to inputs when downloading a bug

[WojciechMat]

tools/syz-aflow/aflow.go: Add CrashReport, KernelRepo and KernelCommit to inputs when downloading a bug

When using tools/syz-aflow with -download-bug flag, the tool creates an inputs json file with inputs necessary for patching workflow.

This PR makes it download inputs needed for assessment-kcsan workflow as well.

Quickrun

(assuming disk.raw is available and make commands are run)

go run ./tools/syz-aflow -input=input-incomplete.json -download-bug=f98189ed18c1f5f32e00
jq --arg syzkaller "$PWD"   '.ReproOpts = "" | 
   .FixedRepository = "" | 
   .FixedBaseCommit = "" | 
   .Type = "qemu" | 
   .Syzkaller = $syzkaller | 
   .Image = ($syzkaller + "/disk.raw") | 
   .CodesearchToolBin = ($syzkaller + "/bin/syz-codesearch") | 
   .VM.cpu = 2 | 
   .VM.mem = 2048 | 
   .VM.cmdline = "root=/dev/sda1"'   input-incomplete.json > aflow-cfg.json


go run ./tools/syz-aflow -input=aflow-cfg.json \
    -workflow=assessment-kcsan -workdir=workdir -model=gemini-2.5-flash-preview    

Before:

flow inputs are missing: assessmenet.kcsanInputs: field "CrashReport" is not present when converting map
exit status 1

After:

2026/01/27 11:05:18 starting flow assessment-kcsan (0/0)...
2026/01/27 11:05:18 starting action kernel-checkouter (1/1)...
2026/01/27 11:06:22 finished action kernel-checkouter (1/1) in 1m3.718968086s
[...]

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[dvyukov]

Why is this needed? Dashboard should have proper git repo addresses that are usable as is. There were used to fetch the tested kernel.

[WojciechMat]

The kernel-source-git field contains (as far as I have seen) a git.kernel.org URL with /log/ path.
E.g. https://syzkaller.appspot.com/bug?extid=f98189ed18c1f5f32e00&json=1 :

"crashes": [
{
	"title": "kernel BUG in may_open",
	"syz-reproducer": "/text?tag=ReproSyz\u0026x=14a7d19a580000",
	"c-reproducer": "/text?tag=ReproC\u0026x=16a2f19a580000",
	"kernel-config": "/text?tag=KernelConfig\u0026x=7b058fb1d7dbe6b1",
	"kernel-source-git": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/log/?id=b6151c4e60e5f695fac8b5c3e011cfcfd6e27cba",
	"kernel-source-commit": "b6151c4e60e5f695fac8b5c3e011cfcfd6e27cba",
	"syzkaller-git": "https://github.com/google/syzkaller/commits/d6526ea3e6ad9081c902859bbb80f9f840377cb4",
	"syzkaller-commit": "d6526ea3e6ad9081c902859bbb80f9f840377cb4",
	"crash-report-link": "/text?tag=CrashReport\u0026x=15abc5fa580000"
},
[...]

pkg/vcs/git.go: fetchRemote that pkg/aflow/action/kernel/checkout.go: checkout uses, throws an error if this URL is not trimmed to end before /log/

[dvyukov]

Oh, damn.
IIRC we discussed that we need to export usable git repos in the API, but never actually did that. CC @tarasmadan

[dvyukov]

But this won't handle all cases, kernel repos can live anywhere (github, git.cmpxchg.org, gerrit).

Then please add a comment for this.
Not sure what we should do if the repo does not contain "git.kernel.org".

[WojciechMat]

This logic is

1. look for ".git" sequence in the URL (e.g. https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux .git /log/?id=b6151c4e60e5f695fac8b5c3e011cfcfd6e27cba")
2. Remove everything after .git

So it should work independently from where the code is (unless there is a host that has ".git" in the name - is that possible?)

[dvyukov]

Ok, let's try this.

[dvyukov]

Otherwise looks good.
But CI need to pass. Please look for CI action errors.

[dvyukov]

You will need to sign CLA (the bot should give a link to instruction), and rebase changes (we don't do merge commits).