mirror of
https://github.com/reactos/syzkaller.git
synced 2025-02-11 06:25:17 +00:00
prog: add test for cross-arch deserialization
Few managers recently crashed with: panic: syscall mknod$loop: per proc arg 'proc' has bad value '4294967295' panic: sync: unlock of unlocked mutex goroutine 35438 [running]: sync.(*Mutex).Unlock(0xc42166e0c8) sync/mutex.go:184 +0xc1 panic(0xb98980, 0xc448971aa0) runtime/panic.go:491 +0x283 main.(*Manager).Connect(0xc42166e000, 0xc42056d060, 0xc42038f000, 0x0, 0x0) syz-manager/manager.go:868 +0x11cc And a similar issue was reported on mailing list. It's unclear where these bogus programs come from. It seems that hub was somehow involved here. 4294967295 is (uint32)-1 which is trucated special value for proc types. The test did not uncover any bugs, bug since I wrote it and it looks like a useful test, let's commit it anyway.
This commit is contained in:
parent
0b470f2254
commit
b5f6354179
@ -6,7 +6,12 @@ package prog
|
||||
import (
|
||||
"bytes"
|
||||
"fmt"
|
||||
"math/rand"
|
||||
"strings"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
targetsPkg "github.com/google/syzkaller/sys/targets"
|
||||
)
|
||||
|
||||
func TestGeneration(t *testing.T) {
|
||||
@ -98,3 +103,75 @@ func TestVmaType(t *testing.T) {
|
||||
check(c.Args[4], c.Args[5], 7, 9)
|
||||
}
|
||||
}
|
||||
|
||||
// TestCrossTarget ensures that a program serialized for one arch can be
|
||||
// deserialized for another arch. This happens when managers exchange
|
||||
// programs via hub.
|
||||
func TestCrossTarget(t *testing.T) {
|
||||
for os, archs := range targetsPkg.List {
|
||||
if len(archs) == 1 {
|
||||
continue
|
||||
}
|
||||
if os != "linux" {
|
||||
continue
|
||||
}
|
||||
for arch := range archs {
|
||||
target, err := GetTarget(os, arch)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
var crossTargets []*Target
|
||||
for crossArch := range archs {
|
||||
if crossArch == arch {
|
||||
continue
|
||||
}
|
||||
crossTarget, err := GetTarget(os, crossArch)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
crossTargets = append(crossTargets, crossTarget)
|
||||
}
|
||||
t.Run(fmt.Sprintf("%v/%v", os, arch), func(t *testing.T) {
|
||||
t.Parallel()
|
||||
testCrossTarget(t, target, crossTargets)
|
||||
})
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func testCrossTarget(t *testing.T, target *Target, crossTargets []*Target) {
|
||||
seed := int64(time.Now().UnixNano())
|
||||
t.Logf("seed=%v", seed)
|
||||
rs := rand.NewSource(seed)
|
||||
iters := 100
|
||||
if testing.Short() {
|
||||
iters /= 10
|
||||
}
|
||||
for i := 0; i < iters; i++ {
|
||||
p := target.Generate(rs, 20, nil)
|
||||
testCrossArchProg(t, p, crossTargets)
|
||||
p, err := target.Deserialize(p.Serialize())
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
testCrossArchProg(t, p, crossTargets)
|
||||
p.Mutate(rs, 20, nil, nil)
|
||||
testCrossArchProg(t, p, crossTargets)
|
||||
p, _ = Minimize(p, -1, func(*Prog, int) bool {
|
||||
return rs.Int63()%2 == 0
|
||||
}, false)
|
||||
testCrossArchProg(t, p, crossTargets)
|
||||
}
|
||||
}
|
||||
|
||||
func testCrossArchProg(t *testing.T, p *Prog, crossTargets []*Target) {
|
||||
serialized := p.Serialize()
|
||||
for _, crossTarget := range crossTargets {
|
||||
_, err := crossTarget.Deserialize(serialized)
|
||||
if err == nil || strings.Contains(err.Error(), "unknown syscall") {
|
||||
continue
|
||||
}
|
||||
t.Fatalf("failed to deserialize for %v/%v: %v\n%s",
|
||||
crossTarget.OS, crossTarget.Arch, err, serialized)
|
||||
}
|
||||
}
|
||||
|
Loading…
x
Reference in New Issue
Block a user