4775 Commits

Author SHA1 Message Date
Dmitry Vyukov
0ee6c37319
docs: give syscall description language a name
It is a real language. We have a real compiler. It deserves a name.
Also useful for shorter references.

I hereby give it a name: syzlang.
2020-02-01 12:10:29 +01:00
Dmitry Vyukov
692266c73a sys/linux: use literal consts instead of hardcoded number 2020-02-01 11:33:32 +01:00
Christoph Paasch
326d4c7836 sys/linux: add IPPROTO_MPTCP support
Adding support for IPPROTO_MPTCP. Like SMC, it is on top of TCP and can
thus be treated like a regular TCP socket.
2020-02-01 11:14:31 +01:00
Dmitry Vyukov
0eb59c2768 sys/linux: regenerate files 2020-01-31 19:31:55 +01:00
Dmitry Vyukov
c30117b2ac pkg/report: don't attribute deadlocks to workqueue functions
In all cases we seen deadlocks in workqueue functions are related
to the subsystem that submits work items.
2020-01-31 19:14:47 +01:00
Dmitry Vyukov
96ce537b15 sys/linux: add some wireguard descriptions
Update #806
2020-01-31 19:12:16 +01:00
Dmitry Vyukov
5ed23f9aa6 dashboard/app: skip tests if dev_appserver.py is missing
Travis is not the right check. We also don't have dev_appserver.py
anywhere on syzbot, so builds fail. Check presence of dev_appserver.py
explicitly.
2020-01-29 16:15:37 +01:00
Dmitry Vyukov
0c6a2c3328 dashboard/app: disable tests on Travis
This is very frustrating. Testing with 'go test' does not really work.
All tests fail with:
util_test.go:51: Could not find dev_appserver.py: exec: "dev_appserver.py": executable file not found in $PATH
And I can't even now find a way to download this dev_appserver.py thing.

Update #1461
2020-01-29 16:01:06 +01:00
Dmitry Vyukov
b190f06061 dashboard/app: fix testing for go1.11 runtime
0. Remove aetest build tag. We don't need it anymore, go test should work.
1. IsDevAppServer does not return true in tests anymore, so don't use it
2. Use a different mechanism to register test/prod config.
We don't have aetest tag anymore, so we need something even more dynamic.
3. Fix new golangci-lint warnings: all test files are checked now.

Update #1461
2020-01-29 16:01:06 +01:00
Dmitry Vyukov
4705549800 vendor: update vendored files
Required to switch dashboard/app to go1.11.

Update #1461
2020-01-29 16:01:06 +01:00
Andrew Donnellan
c7484f6292 dashboard: update to go111 runtime
The old go 1.9 App Engine runtime is now deprecated. Update to the go 1.11
runtime, which still allows us to use the old App Engine library (removed
in the 1.12 runtime).

Closes: #1461 ("dashboard: port app to go111/go112 runtime")
Signed-off-by: Andrew Donnellan <ajd@linux.ibm.com>
2020-01-29 16:01:06 +01:00
Hye Sung Jung
c8e81ce4c7 docs: fix spelling errors 2020-01-28 17:23:51 +01:00
Dmitry Vyukov
d14236bc0a sys/linux: fix drm_mode_fb_cmd2 layout
Thanks to syz-check for catching this.

Update #590
2020-01-28 15:37:49 +01:00
Dmitry Vyukov
5e48183c6e sys/linux: add ethtool netlink descriptions 2020-01-28 15:08:47 +01:00
Dmitry Vyukov
0692a5861f pkg/report: add a note about an existing suppression 2020-01-28 13:38:53 +01:00
Dmitry Vyukov
56cd6c9b80 sys/linux: add time namespace descriptions 2020-01-27 15:18:15 +01:00
Dmitry Vyukov
1079ec0d3f dashboard/config: disable CONFIG_EFI
It's build-broken:
https://syzkaller.appspot.com/bug?id=0b475699da0ed3c89a82bade3f11497af4f12b07
and we don't seem to use/test it in any way (?).
2020-01-27 15:04:50 +01:00
Dmitry Vyukov
dd56146d26 prog: remove unused ResourceDesc.Type 2020-01-26 11:30:18 +01:00
Dmitry Vyukov
55da6462ff pkg/serializer: do not write field names if it won't save space
If we are going to write all values, don't write field names.
This only increases size of generated files.
The change reduces size of generated files by 5.8%
(62870496-59410354=3460142 bytes saved).
2020-01-26 11:07:18 +01:00
Dmitry Vyukov
f4e7270e33 sys/linux: extend DRM ioctl descriptions
+ disable binderfs (see comments)
+ add few more missing tty ioctls
+ improve few minor things in hci descriptions
2020-01-25 22:30:06 +01:00
Dmitry Vyukov
2e95ab3357 pkg/build: switch to sha256
SHA-1 is insecure. See a representative summary of known attacks here:
https://en.wikipedia.org/wiki/Hash_function_security_summary
Some external build systems warn about sha1 uses and reject to build.
Whitelisting is pain. Switch to sha256.
2020-01-23 16:11:47 +01:00
Dmitry Vyukov
11ebf937fc sys/linux: restore FOU_ATTR_LOCAL/PEER_V6
They are being fixed in kernel:
https://lists.openwall.net/netdev/2020/01/23/122
2020-01-23 15:05:22 +01:00
Dmitry Vyukov
8d11a11a30 sys/linux: improve infiniband_rdma descriptions 2020-01-23 15:05:21 +01:00
Dmitry Vyukov
0e8428d26f tools/syz-check: add limited checking of varlen structs
Stop at the fist varlen field, but check the preceeding ones.
Frequently the varlen array is the last field,
so we should get good checking for these cases.

Update #590
2020-01-23 15:05:21 +01:00
Dmitry Vyukov
9ab9b329d9 sys/linux: check for missing/duplicate netlink attrs
Update #590
2020-01-23 15:05:20 +01:00
Dmitry Vyukov
46961c2ff5 sys/linux: fix more netlink warnings
Handle NLA_BITFIELD32.
Match string attribtues better.
Calculate and check min size for varlen structs.
Fix NLA_UNSPEC size check.
Fix some things in descriptions.

Update #590
2020-01-23 15:05:19 +01:00
Andrey Konovalov
190662322e
Update external_fuzzing_usb.md 2020-01-23 14:55:07 +01:00
Dmitry Vyukov
3334d684ce sys/linux: fix incorrect nlattr sizes
Update #590
2020-01-22 18:31:20 +01:00
Dmitry Vyukov
f5fe1f1fcf sys/linux: more fixing of netlink policy names
Update #590
2020-01-22 18:31:20 +01:00
Dmitry Vyukov
2bdcee05b5 sys/linux: mark all nested netlink attributes as nlnest
As far as I understand most subsystems don't care about
the nest flag, but some do. But marking them as nest
won't harm (?). Let's mark all of them.

Caught several cases where should have been used array[policy]
but used just policy.

Update #590
2020-01-22 18:31:19 +01:00
Dmitry Vyukov
e4c56f390e tools/syz-check: improve matching netlink attributes
1. Match policies that has a _suffix in our descriptions
(we frequently do this to improve precision or avoid dup names).
2. Rename policies in descriptions to match kernel names.
3. Match policy if there are several such names in kernel.
4. Recognize policies with helper sub-policies.

Update #590
2020-01-22 18:31:15 +01:00
Dmitry Vyukov
010feb8758 sys/linux: add new netlink warnings
Update #590
2020-01-22 12:19:53 +01:00
Dmitry Vyukov
02754a8f9a tools/syz-check: check netlink policy descriptions
Overall idea of netlink checking.
Currnetly we check netlink policies for common detectable mistakes.
First, we detect what looks like a netlink policy in our descriptions
(these are structs/unions only with nlattr/nlnext/nlnetw fields).
Then we find corresponding symbols (offset/size) in vmlinux using nm.
Then we read elf headers and locate where these symbols are in the rodata section.
Then read in the symbol data, which is an array of nla_policy structs.
These structs allow to easily figure out type/size of attributes.
Finally we compare our descriptions with the kernel policy description.

Update #590
2020-01-22 12:19:53 +01:00
Dmitry Vyukov
8eda0b957e
docs: add KOOBE research paper 2020-01-20 16:17:10 +01:00
Dmitry Vyukov
d2557fb5ca pkg/report: treat nfnetlink_rcv_msg as anchor frame
There is tremendous branching after that frame to all
existing netlink callbacks which are effectively completely
different syscalls.
2020-01-20 10:57:28 +01:00
Dmitry Vyukov
c40da18cc3 sys/linux: fix IFLA_BR_GROUP_ADDR type 2020-01-20 10:29:45 +01:00
Dmitry Vyukov
0342f8c7bc sys/linux: add more device descriptions (geneve, lowpan, ipoib, cfhsi) 2020-01-19 13:51:21 +01:00
Dmitry Vyukov
bc8bc756c2 tools/syz-trace2syz/proggen: fix test
For some reason it started using a different syscall...
2020-01-18 21:20:35 +01:00
Dmitry Vyukov
4668877967 sys/linux: add some batadv descriptions 2020-01-18 21:02:24 +01:00
Dmitry Vyukov
543c012b4e executor: create macvtap, macsec devices 2020-01-18 21:02:24 +01:00
Dmitry Vyukov
2fd6bd0d1b prog: reduce len mutation priority
Mutating LenType only produces "incorrect" results according to descriptions,
we generally try to do it less often (there is infinite space of incorrect inputs).
2020-01-18 21:02:24 +01:00
Dmitry Vyukov
de577addbf prog: tune flags generation/mutation
Tune flags to generate more sane values over insane values
based on examination of results for common cases.
2020-01-18 21:02:24 +01:00
Dmitry Vyukov
22535fecd5 pkg/compiler: don't mark flags with 0 as bitmask
They can't be a bitmask. This fixes important cases
of "0, 1" and "0, 1, 2" flags. Fix some descriptions
that added 0 to bitmasks explicitly (we should do it
automatically instead).
2020-01-18 21:02:24 +01:00
Dmitry Vyukov
d412ea5e8e pkg/compiler: sort flags values
Will simplify runtime analysis of flags.
Also just no reason to make it more deterministic
and avoid unnecessary diffs in future if values are reordered.
2020-01-18 21:02:24 +01:00
Dmitry Vyukov
132dcea0af pkg/compiler: generate const[0] for flags w/o values
Generate const[0] for flags without values and for flags
with a single value which is 0.
This is the intention in all existing cases (e.g. an enum with types
of something, but there is really only 1 type exists).
2020-01-18 21:02:24 +01:00
Dmitry Vyukov
d2f8d5ab46 sys/linux: fix sigset_t/sigaction layout on arm
Update #590
2020-01-18 21:02:24 +01:00
Dmitry Vyukov
773117bf81 tools/syz-check: also check arm/arm64
They mostly duplicate the warnings we already have for amd64/386.
But uncovered few very interesting local things (e.g. epoll_event
is packed only on amd64, so arm/arm64 layout is wrong, but 386
is correct because int64 alignment is different).

Update #590
2020-01-18 21:02:24 +01:00
Dmitry Vyukov
2ec9a3ad9a sys/linux: update warn files
Just regenerate with current descriptions and current linux-next.
Few uninteresting changes.
2020-01-18 21:02:24 +01:00
Dmitry Vyukov
a2af37f08c prog: increase encodingexec buffer size
Some of the programs involving netfilter syscalls
produce errors about insufficient buffer size. Bump it more.
2020-01-18 21:02:24 +01:00
Dmitry Vyukov
3de7aabbb7 pkg/vcs: disable CONFIG_DEBUG_KOBJECT during bisection
We disabled it in configs, now also disable during bisection.
This config only adds debug output. It should not be enabled at all,
but it was accidentially enabled on some instances for some periods of time,
and kernel is boot-broken for prolonged ranges of commits with deadlock
which makes bisections take weeks.
2020-01-16 11:31:02 +01:00