Skip to content

Conversation

@WojciechMat
Copy link

@WojciechMat WojciechMat commented Jan 27, 2026

tools/syz-aflow/aflow.go: Add CrashReport, KernelRepo and KernelCommit to inputs when downloading a bug

When using tools/syz-aflow with -download-bug flag, the tool creates an inputs json file with inputs necessary for patching workflow.

This PR makes it download inputs needed for assessment-kcsan workflow as well.

Quickrun

(assuming disk.raw is available and make commands are run)

go run ./tools/syz-aflow -input=input-incomplete.json -download-bug=f98189ed18c1f5f32e00
jq --arg syzkaller "$PWD"   '.ReproOpts = "" | 
   .FixedRepository = "" | 
   .FixedBaseCommit = "" | 
   .Type = "qemu" | 
   .Syzkaller = $syzkaller | 
   .Image = ($syzkaller + "/disk.raw") | 
   .CodesearchToolBin = ($syzkaller + "/bin/syz-codesearch") | 
   .VM.cpu = 2 | 
   .VM.mem = 2048 | 
   .VM.cmdline = "root=/dev/sda1"'   input-incomplete.json > aflow-cfg.json


go run ./tools/syz-aflow -input=aflow-cfg.json \
    -workflow=assessment-kcsan -workdir=workdir -model=gemini-2.5-flash-preview    

Before:

flow inputs are missing: assessmenet.kcsanInputs: field "CrashReport" is not present when converting map
exit status 1

After:

2026/01/27 11:05:18 starting flow assessment-kcsan (0/0)...
2026/01/27 11:05:18 starting action kernel-checkouter (1/1)...
2026/01/27 11:06:22 finished action kernel-checkouter (1/1) in 1m3.718968086s
[...]

@google-cla
Copy link

google-cla bot commented Jan 27, 2026

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

repoURL, _ := crash["kernel-source-git"].(string)

// Clean the URL to end at .git
if dotGitIndex := strings.Index(repoURL, ".git"); dotGitIndex != -1 {
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why is this needed? Dashboard should have proper git repo addresses that are usable as is. There were used to fetch the tested kernel.

Copy link
Author

@WojciechMat WojciechMat Jan 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The kernel-source-git field contains (as far as I have seen) a git.kernel.org URL with /log/ path.
E.g. https://syzkaller.appspot.com/bug?extid=f98189ed18c1f5f32e00&json=1 :

"crashes": [
{
	"title": "kernel BUG in may_open",
	"syz-reproducer": "/text?tag=ReproSyz\u0026x=14a7d19a580000",
	"c-reproducer": "/text?tag=ReproC\u0026x=16a2f19a580000",
	"kernel-config": "/text?tag=KernelConfig\u0026x=7b058fb1d7dbe6b1",
	"kernel-source-git": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/log/?id=b6151c4e60e5f695fac8b5c3e011cfcfd6e27cba",
	"kernel-source-commit": "b6151c4e60e5f695fac8b5c3e011cfcfd6e27cba",
	"syzkaller-git": "https://github.com/google/syzkaller/commits/d6526ea3e6ad9081c902859bbb80f9f840377cb4",
	"syzkaller-commit": "d6526ea3e6ad9081c902859bbb80f9f840377cb4",
	"crash-report-link": "/text?tag=CrashReport\u0026x=15abc5fa580000"
},
[...]

pkg/vcs/git.go: fetchRemote that pkg/aflow/action/kernel/checkout.go: checkout uses, throws an error if this URL is not trimmed to end before /log/

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Oh, damn.
IIRC we discussed that we need to export usable git repos in the API, but never actually did that. CC @tarasmadan

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

But this won't handle all cases, kernel repos can live anywhere (github, git.cmpxchg.org, gerrit).

Then please add a comment for this.
Not sure what we should do if the repo does not contain "git.kernel.org".

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This logic is

  1. look for ".git" sequence in the URL (e.g. https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux .git /log/?id=b6151c4e60e5f695fac8b5c3e011cfcfd6e27cba")
  2. Remove everything after .git

So it should work independently from where the code is (unless there is a host that has ".git" in the name - is that possible?)

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ok, let's try this.

Copy link
Collaborator

@dvyukov dvyukov left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Otherwise looks good.
But CI need to pass. Please look for CI action errors.

@dvyukov
Copy link
Collaborator

dvyukov commented Jan 27, 2026

You will need to sign CLA (the bot should give a link to instruction), and rebase changes (we don't do merge commits).

@dvyukov dvyukov added the AI patching Feature requests and bugs related to AI-based kernel bug fix generation. label Jan 27, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

AI patching Feature requests and bugs related to AI-based kernel bug fix generation.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants