Skip to content

tools/syz-aflow/aflow.go: Add CrashReport, KernelRepo and KernelCommit to inputs when downloading a bug #6705

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
WojciechMat wants to merge 4 commits into
base: master
Choose a base branch
from
+27 −3
Open

tools/syz-aflow/aflow.go: Add CrashReport, KernelRepo and KernelCommit to inputs when downloading a bug #6705

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
871ea38
tools/syz-aflow/aflow.go: when using -download-bug include inputs nee…
WojciechMat Jan 27, 2026
e83a445
Merge branch 'master' of https://github.com/google/syzkaller into mat…
WojciechMat Jan 27, 2026
f9a3d87
tools/syz-aflow/aflow.go: trim KernelRepo url to end with [...].git
WojciechMat Jan 27, 2026
7cd685a
tools/syz-aflow/aflow.go: sort imports
WojciechMat Jan 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 27 additions & 3 deletions tools/syz-aflow/aflow.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,7 @@
"net/http"
"os"
"path/filepath"
"strings"

"github.com/google/syzkaller/pkg/aflow"
_ "github.com/google/syzkaller/pkg/aflow/flow"
Expand Down Expand Up @@ -121,18 +122,41 @@
return err
}
crash := info["crashes"].([]any)[0].(map[string]any)

repoURL, _ := crash["kernel-source-git"].(string)

// Clean the URL to end at .git

Check failure on line 128 in tools/syz-aflow/aflow.go

View workflow job for this annotation

GitHub Actions / build 

lint: Add a period at the end of the comment (syz-linter)
if dotGitIndex := strings.Index(repoURL, ".git"); dotGitIndex != -1 {
Copy link
Collaborator

@dvyukov dvyukov Jan 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why is this needed? Dashboard should have proper git repo addresses that are usable as is. There were used to fetch the tested kernel.

Copy link
Author

@WojciechMat WojciechMat Jan 27, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The kernel-source-git field contains (as far as I have seen) a git.kernel.org URL with /log/ path.
E.g. https://syzkaller.appspot.com/bug?extid=f98189ed18c1f5f32e00&json=1 :

"crashes": [
{
	"title": "kernel BUG in may_open",
	"syz-reproducer": "/text?tag=ReproSyz\u0026x=14a7d19a580000",
	"c-reproducer": "/text?tag=ReproC\u0026x=16a2f19a580000",
	"kernel-config": "/text?tag=KernelConfig\u0026x=7b058fb1d7dbe6b1",
	"kernel-source-git": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/log/?id=b6151c4e60e5f695fac8b5c3e011cfcfd6e27cba",
	"kernel-source-commit": "b6151c4e60e5f695fac8b5c3e011cfcfd6e27cba",
	"syzkaller-git": "https://github.com/google/syzkaller/commits/d6526ea3e6ad9081c902859bbb80f9f840377cb4",
	"syzkaller-commit": "d6526ea3e6ad9081c902859bbb80f9f840377cb4",
	"crash-report-link": "/text?tag=CrashReport\u0026x=15abc5fa580000"
},
[...]

pkg/vcs/git.go: fetchRemote that pkg/aflow/action/kernel/checkout.go: checkout uses, throws an error if this URL is not trimmed to end before /log/

Copy link
Collaborator

@dvyukov dvyukov Jan 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Oh, damn.
IIRC we discussed that we need to export usable git repos in the API, but never actually did that. CC @tarasmadan

Copy link
Collaborator

@dvyukov dvyukov Jan 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

But this won't handle all cases, kernel repos can live anywhere (github, git.cmpxchg.org, gerrit).

Then please add a comment for this.
Not sure what we should do if the repo does not contain "git.kernel.org".

Copy link
Author

@WojciechMat WojciechMat Jan 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This logic is

  1. look for ".git" sequence in the URL (e.g. https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux .git /log/?id=b6151c4e60e5f695fac8b5c3e011cfcfd6e27cba")
  2. Remove everything after .git

So it should work independently from where the code is (unless there is a host that has ".git" in the name - is that possible?)

Copy link
Collaborator

@dvyukov dvyukov Jan 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ok, let's try this.

repoURL = repoURL[:dotGitIndex+4]
}

inputs := map[string]any{
"SyzkallerCommit": crash["syzkaller-commit"],
"KernelRepo": repoURL,
"KernelCommit": crash["kernel-source-commit"],
}

fetchText := func(key string) (string, error) {
path, ok := crash[key].(string)
if !ok || path == "" {
return "", nil
}
return get(path, token)
}

inputs["ReproSyz"], err = fetchText("syz-reproducer")
if err != nil {
return err
}
inputs["ReproSyz"], err = get(crash["syz-reproducer"].(string), token)
inputs["ReproC"], err = fetchText("c-reproducer")
if err != nil {
return err
}
inputs["ReproC"], err = get(crash["c-reproducer"].(string), token)
inputs["KernelConfig"], err = fetchText("kernel-config")
if err != nil {
return err
}
inputs["KernelConfig"], err = get(crash["kernel-config"].(string), token)
inputs["CrashReport"], err = fetchText("crash-report-link")
if err != nil {
return err
}
Expand Down
Loading