4125 Commits

Author SHA1 Message Date
Andrey Konovalov
38634e3316 sys/linux: add more USB runtests 2019-09-24 16:42:10 +02:00
Andrey Konovalov
0942eab8c6 pkg/report: improve USB report titles 2019-09-24 15:15:04 +02:00
Veronica Radu
2cad5aaffa syz-fuzzer: add program priority in corpus
Update #534
2019-09-24 11:26:49 +02:00
Zubin Mithra
f8368f999a dashboard/app: no reporting fix bisection results for already fixed bugs
* Modify pollCompletedJobs(); for bugs that are already marked as fixed,
invalid or duplicate do not report bisection results.
* Add TestNotReportingAlreadyFixed() to test that reporting does not
occur for already fixed bugs.
2019-09-24 10:48:29 +02:00
Andrey Konovalov
c9f1048063 sys/linux: add USB hiddev runtest 2019-09-24 10:45:51 +02:00
Andrey Konovalov
792da3da86 executor, csource: adjust syz_open_dev$hiddev timeout
Looks like opening hiddev can take up to ~100 ms.
2019-09-24 10:45:51 +02:00
Andrey Konovalov
5ff4e14cb1 pkg/runtest: allow empty signal 2019-09-24 10:45:51 +02:00
Anton Lindqvist
aac00cc3db pkg/vcs: handle git commits without a body
OpenBSD uses cvs and does not enforce the standard Git convention for
commit messages of putting a summary followed by a new line and body.
If such commit[1] contains a `Reported-by` header, it's currently not
detected. Instead, if the body is empty try to extract data from the
commit summary.

[1] bdbfbec5ce
2019-09-24 10:43:57 +02:00
Mark Johnston
83620b5b4e pkg/report: deduplicate some common FreeBSD panics 2019-09-24 10:42:43 +02:00
Marco Elver
c68252d224 dashboard/config: Add KCSAN config generator and config 2019-09-23 18:02:39 +02:00
Andrey Konovalov
2b854f96b1 tools: add syz-expand
The syz-expand tools allows to parse a program and print it including all
the default values. This is mainly useful for debugging, like doing manual
program modifications while trying to come up with a reproducer for some
particular kernel behavior.
2019-09-23 17:13:23 +02:00
Veronica Radu
1e9788a0d9 prog: add insertionPoint param in generateCall func 2019-09-23 15:35:26 +02:00
Veronica Radu
8491e03fb2 prog: add better call-to-call priority calculation
Update #1380
2019-09-23 15:35:26 +02:00
Veronica Radu
d2db54aab7 tools/syz-showprio: add a tool to visualize the priority table 2019-09-23 15:35:26 +02:00
Veronica Radu
5a7028d005 pkg/db: moved ReadCorpus function to avoid duplicate code 2019-09-23 15:35:26 +02:00
Veronica Radu
bf7e28925b prog: use type size when generating/mutating ints
Update #1381
2019-09-23 15:33:19 +02:00
Dmitry Vyukov
d96e88f320 pkg/report: add a test case which we mis-handle now 2019-09-20 09:37:36 +02:00
Andrey Konovalov
4d3ae0b784 executor: handle USB IN requests with wLength == 0 2019-09-19 19:31:56 +02:00
Andrey Konovalov
0c00210ff3 executor: always provide DEVICE_QUALIFIER USB descriptor 2019-09-19 19:31:56 +02:00
Dmitry Vyukov
b4680d8341 dashboard/app: fix error wrapping
The current code does not do what it's supposed to do.
Converting error to error is always true.
Properly wrap errors.
2019-09-19 16:47:24 +02:00
Andrey Konovalov
2d1b3704eb docs/linux: update USB instructions 2019-09-19 16:20:57 +02:00
Andrey Konovalov
532aca508a tools/syz-usbgen: handle USB_DT_DEVICE_QUALIFIER in keyboard.c 2019-09-19 16:20:57 +02:00
Dmitry Vyukov
2dd371a3b1 tools/kcovfuzzer: add simple KCOV/libfuzzer glue 2019-09-19 15:56:24 +02:00
Andrey Konovalov
408e453738
Update external_fuzzing_usb.md 2019-09-19 15:53:52 +02:00
Andrey Konovalov
72ada85635
Update external_fuzzing_usb.md 2019-09-19 15:45:23 +02:00
Paul Chaignon
a32a318486 sys/linux: update BPF constants
Signed-off-by: Paul Chaignon <paul.chaignon@orange.com>
2019-09-19 15:31:20 +02:00
Eric Biggers
eb9400440d sys/linux: re-generate Linux descriptions from next-20190918 2019-09-19 09:38:51 +02:00
Eric Biggers
a4e87d4bb6 sys/linux: update fscrypt descriptions
- For v5.4: new ioctls FS_IOC_ADD_ENCRYPTION_KEY,
  FS_IOC_REMOVE_ENCRYPTION_KEY, FS_IOC_REMOVE_ENCRYPTION_KEY_ALL_USERS,
  FS_IOC_GET_ENCRYPTION_KEY_STATUS, and FS_IOC_GET_ENCRYPTION_POLICY_EX.

- For v5.4: FS_IOC_SET_ENCRYPTION_POLICY now accepts an
  fscrypt_policy_v2 argument in addition to the original fscrypt_policy
  which is now called fscrypt_policy_v1.

- For v5.4: the fscrypt definitions were moved to a new header
  <linux/fscrypt.h>, and some constants were given new FSCRYPT_* names
  instead of FS_*.  Handle this, and to keep things organized similarly
  move the syzkaller descriptions to a new file fscrypt.txt.

- For v5.0: remove the removed Speck modes and add Adiantum.

- For v5.0: add the DIRECT_KEY encryption policy flag.

Also fix the argument types for FS_IOC_GET_ENCRYPTION_POLICY and
FS_IOC_GET_ENCRYPTION_PWSALT, which had been mixed up.
2019-09-19 09:38:51 +02:00
Eric Biggers
6aa8d1eb8f sys/syz-extract: re-enable extraction for fsverity.txt
fsverity is now upstream, so re-enable extracting its consts.
2019-09-19 09:38:51 +02:00
Zubin Mithra
46c0be242e docs: update syzbot.md
Add in some information about fix bisection.
2019-09-18 15:09:15 +02:00
Siddharth Muralee
1037b42440 dashboard/config: Add netbsd kernel configs 2019-09-18 15:00:55 +02:00
Siddharth M
7fa5d0a69b pkg/build: build netbsd using config files 2019-09-18 15:00:55 +02:00
Andrey Konovalov
14d4158490 sys/targets: add ASAN compiler flag to optional
*BSD GCC doesn't have ASAN.
2019-09-18 14:02:33 +02:00
Andrey Konovalov
4dc46dd6c9 docs: fix USB Raspberry Pi instructions 2019-09-18 13:40:13 +02:00
Paul Chaignon
c2dcd7009f sys/linux: update BPF's anonymous structures
Signed-off-by: Paul Chaignon <paul.chaignon@orange.com>
2019-09-18 06:50:02 +02:00
Paul Chaignon
03e0d24559 sys/linux: basic support for bpf-to-bpf function calls
The BPF template currently only defines helper calls.  BPF function calls
(bpf-to-bpf calls) are however supported in Linux since v4.16.

This patch defines bpf-to-bpf calls in the template.

Signed-off-by: Paul Chaignon <paul.chaignon@orange.com>
2019-09-17 20:38:59 +02:00
Dmitry Vyukov
ad847b96aa pkg/report: ignore "INFO: recovery required on readonly filesystem"
This is not a kernel bug.
2019-09-17 16:14:31 +02:00
Andrey Konovalov
d62be7809c runtest: add a flag to specify tests to run 2019-09-17 15:58:29 +02:00
Andrey Konovalov
d555ee7ed1 executor: fix out-of-bounds access to syscalls array
Move accessing syscalls array to check for USB syscalls after we validate
the call_num value (it can be e.g. instr_copyin/out).
2019-09-17 15:10:25 +02:00
Andrey Konovalov
e9b387d18c sys/targets: build executor with ASAN for test target 2019-09-17 15:10:25 +02:00
Andrey Konovalov
5883acb646 pkg/report: improve some USB reports 2019-09-17 15:09:43 +02:00
Andrey Konovalov
669cade06a dashboard/config: add debian stretch options
See #760 for details.
2019-09-17 14:42:25 +02:00
Paul Chaignon
c9364a4648 sys/linux: support for loopkup-free map value accesses
A new BPF instruction that allows lookup-free map value accesses was added
in Linux v5.2, with commit d8eca5b ("bpf: implement lookup-free direct
value access for maps").  It enables direct access to map values without
having to call a BPF helper.  It is currently used to implement global
variable support.

This commit adds support for that new instruction.

Signed-off-by: Paul Chaignon <paul.chaignon@orange.com>
2019-09-17 14:41:41 +02:00
Veronica Radu
13dcda9b39 updated golangci.yml to exclude new errors 2019-09-17 13:02:55 +02:00
Andrey Konovalov
51ca0454d7 pkg/osutil: fix arm build
pkg/osutil/osutil_linux.go:44:13: cannot use info.Totalram (type uint32) as type uint64 in return argument
2019-09-16 14:15:38 +02:00
Michael Tuexen
cb93629971 sys/freebsd/sys.txt: update sendfile description
The signature of sendfile() on FreeBSD is different from the one
used on Linux.
2019-09-16 10:39:16 +02:00
Michael Tüxen
55c50e708b
sys/freebsd/vnet.txt: replace IPPROTO_SEP by IPPROTO_DCCP (#1401)
r350749 updated the constant from IPPROTO_SEP to IPPROTO_DCCP
to be consistent with the IANA registry.
2019-09-16 09:51:17 +02:00
Yevgeny Pats
32d593576a fix fuzzit script to work with latest CLI syntax
Signed-off-by: Yevgeny Pats <yp@fuzzit.dev>
2019-09-13 15:37:40 +01:00
Marco Vanotti
40fa42bc27 executor/fuchsia: close vmo handle in syz_mmap.
This commit fixes a handle leak in syz_mmap. The bug was pointed out by
mdempsky during a code review.

The `syz_mmap` function creates a VMO and maps it to a VMAR in the address
specified by the `syz_mmap` parameters. Once a VMO is mapped to a vmar,
the handle to the vmo can be closed without problems.

The new code makes sure that `zx_handle_close(vmo_handle)` gets called before
the `syz_mmap` function returns.
2019-09-12 21:17:27 -03:00
Yevgeny Pats
0b7672eeaf updated fuzzit to v2.4.46 2019-09-12 08:59:42 +01:00