prog: add test for cross-arch deserialization

Few managers recently crashed with:

panic: syscall mknod$loop: per proc arg 'proc' has bad value '4294967295'
        panic: sync: unlock of unlocked mutex

goroutine 35438 [running]:
sync.(*Mutex).Unlock(0xc42166e0c8)
        sync/mutex.go:184 +0xc1
panic(0xb98980, 0xc448971aa0)
        runtime/panic.go:491 +0x283
main.(*Manager).Connect(0xc42166e000, 0xc42056d060, 0xc42038f000, 0x0, 0x0)
        syz-manager/manager.go:868 +0x11cc

And a similar issue was reported on mailing list.
It's unclear where these bogus programs come from.
It seems that hub was somehow involved here.
4294967295 is (uint32)-1 which is trucated special
value for proc types.
The test did not uncover any bugs, bug since I wrote it
and it looks like a useful test, let's commit it anyway.
This commit is contained in:
Dmitry Vyukov 2018-01-09 09:45:03 +01:00
parent 0b470f2254
commit b5f6354179

View File

@ -6,7 +6,12 @@ package prog
import (
"bytes"
"fmt"
"math/rand"
"strings"
"testing"
"time"
targetsPkg "github.com/google/syzkaller/sys/targets"
)
func TestGeneration(t *testing.T) {
@ -98,3 +103,75 @@ func TestVmaType(t *testing.T) {
check(c.Args[4], c.Args[5], 7, 9)
}
}
// TestCrossTarget ensures that a program serialized for one arch can be
// deserialized for another arch. This happens when managers exchange
// programs via hub.
func TestCrossTarget(t *testing.T) {
for os, archs := range targetsPkg.List {
if len(archs) == 1 {
continue
}
if os != "linux" {
continue
}
for arch := range archs {
target, err := GetTarget(os, arch)
if err != nil {
t.Fatal(err)
}
var crossTargets []*Target
for crossArch := range archs {
if crossArch == arch {
continue
}
crossTarget, err := GetTarget(os, crossArch)
if err != nil {
t.Fatal(err)
}
crossTargets = append(crossTargets, crossTarget)
}
t.Run(fmt.Sprintf("%v/%v", os, arch), func(t *testing.T) {
t.Parallel()
testCrossTarget(t, target, crossTargets)
})
}
}
}
func testCrossTarget(t *testing.T, target *Target, crossTargets []*Target) {
seed := int64(time.Now().UnixNano())
t.Logf("seed=%v", seed)
rs := rand.NewSource(seed)
iters := 100
if testing.Short() {
iters /= 10
}
for i := 0; i < iters; i++ {
p := target.Generate(rs, 20, nil)
testCrossArchProg(t, p, crossTargets)
p, err := target.Deserialize(p.Serialize())
if err != nil {
t.Fatal(err)
}
testCrossArchProg(t, p, crossTargets)
p.Mutate(rs, 20, nil, nil)
testCrossArchProg(t, p, crossTargets)
p, _ = Minimize(p, -1, func(*Prog, int) bool {
return rs.Int63()%2 == 0
}, false)
testCrossArchProg(t, p, crossTargets)
}
}
func testCrossArchProg(t *testing.T, p *Prog, crossTargets []*Target) {
serialized := p.Serialize()
for _, crossTarget := range crossTargets {
_, err := crossTarget.Deserialize(serialized)
if err == nil || strings.Contains(err.Error(), "unknown syscall") {
continue
}
t.Fatalf("failed to deserialize for %v/%v: %v\n%s",
crossTarget.OS, crossTarget.Arch, err, serialized)
}
}