Commit Graph

2095 Commits

Author SHA1 Message Date
Dmitry Vyukov
42467f5b7b sys/linux: add syz_init_net_socket syscall
The new pseudo syscall allows opening sockets that can only
be created in init net namespace (BLUETOOTH, NFC, LLC).
Use it to open these sockets.

Unfortunately this only works with sandbox none at the moment.
The problem is that setns of a network namespace requires CAP_SYS_ADMIN
in the target namespace, and we've lost all privs in the init namespace
during creation of a user namespace.
2018-03-05 12:10:27 +01:00
Dmitry Vyukov
e91c118db9 sys/linux: make ifreq template, fix some usages 2018-03-05 12:10:27 +01:00
Dmitry Vyukov
70a1ddb939 prog: harden program parsing against description changes more
Handle most of type changes, e.g. const is changed to struct,
or struct to pointers. In all these cases we create default args.
They may not give the coverage anymore, but still better than
losing them right away.
2018-03-05 12:10:27 +01:00
Dmitry Vyukov
b99c76c405 prog: recover after type changes during program deserialization
Make program deserialization handle and recover after type changes
in descriptions.
2018-03-05 12:10:27 +01:00
Dmitry Vyukov
bd5df8f49b prog: handle excessive args and fields during program parsing
Tolerate excessive args and fields during program parsing.
This is useful after description changes to not lose corpus.
2018-03-05 12:10:27 +01:00
Dmitry Vyukov
f027f1a3f7 sys/linux: use size attributes on structs
1. Add size attribte on sockaddr.
2. Remove sockaddr's that are larger than 16 bytes from sockaddr.
3. Add size attribute on sockaddr_storage which wasn't actually 128 bytes.
4. Add size attribute to ifreq.
5. Fix ifmap field types as uncovered by the size attributes.
6. Fix sockaddr_storage_tcp from struct to union which is should be.
7. Make sockaddr_un_file fixed size as it should be.
8. Fix some explicit paddings that were only correct for 64 bits.
2018-03-05 12:10:27 +01:00
Dmitry Vyukov
002cecf202 pkg/compiler: allow specifying static size for filename's
Sometimes filenames are embed into structs and need to take fixed space.
2018-03-05 12:10:27 +01:00
Dmitry Vyukov
5ef8dbdf5a pkg/compiler: support size attribute for unions 2018-03-05 12:10:27 +01:00
Dmitry Vyukov
a339951e5f pkg/compiler: add size attribute for structs
The size attribute allows to pad a struct up to the specified size.
2018-03-05 12:10:27 +01:00
Dmitry Vyukov
5110ff445d pkg/compiler: switch attributes from Ident to Type
This allows parametrized attributes like size[10].
But this is not used for now.
2018-03-05 12:10:27 +01:00
Dmitry Vyukov
db01d57e91 sys/linux: a bunch of assorted improvements and fixes 2018-03-05 12:10:27 +01:00
Dmitry Vyukov
e28ba02d9d prog: harden program parsing
This fixes crash during parsing of existing programs in corpus
after vma<->ptr type change in descriptions.
2018-03-05 12:10:27 +01:00
Dmitry Vyukov
2c6f473e0f sys/linux: add remaining aux netfilter descriptions 2018-03-01 19:26:53 +01:00
Julia Hansbrough
c40895075b [docs] Add Linux network troubleshooting guidance.
It took me a bit to figure out this kernel configuration quirk, so
thought it may be helpful to add to the troubleshooting section!
2018-03-01 10:11:02 +01:00
Dmitry Vyukov
05b5a32cfd pkg/gce: fix a type 2018-02-27 12:08:16 +01:00
Dmitry Vyukov
6ceee05ad9 prog: extend a TODO about big-endian hints 2018-02-27 12:06:28 +01:00
Dmitry Vyukov
64482eb948 pkg/gce: use current instance network
The current instance is not necessary in the default network.
2018-02-27 11:58:41 +01:00
Dmitry Vyukov
6d41d29ecd
Update found_bugs.md 2018-02-27 09:37:36 +01:00
Dmitry Vyukov
b370d4a70c sys/linux: few assorted additions 2018-02-26 20:37:42 +01:00
Dmitry Vyukov
6284466bc9 prog: properly squash bitfields 2018-02-26 18:21:51 +01:00
Dmitry Vyukov
d1322dff4c prog: remove stale TODOs 2018-02-26 17:46:44 +01:00
Dmitry Vyukov
1d19aa5799 executor: simplify initialize_tun
Remove executor_pid, enable_tun and setup_tun.
2018-02-26 17:43:13 +01:00
Dmitry Vyukov
b37b65b0e6 sys/linux: remove proc type from network descriptions
We now always create net namespace for testing,
so socket ports and other IDs do not overlap between
different test processes.
Proc types play badly with squashing packets to ANYBLOB.
To squash into a block we need concrete value, but it depends
on process id.
Removing proc also makes tun setup and address descriptions simpler.
2018-02-26 16:48:31 +01:00
Dmitry Vyukov
67f0e5ba11 sys/linux: make tcp_seq_num asymmetric
Currently it's 0x42424242 so it's not possible to understand
the value endianess in hints code.
Make it assymmetric so that endinaness is clear.
2018-02-26 15:58:19 +01:00
Dmitry Vyukov
66cf309385 executor, pkg/csource: make fd numbers consistent
Currently when executor creates fd's it gets: 0, 3, 4.
When tun is enabled: 3, 4, 5.
For C programs: 3, 4, 5.
When run is enabled: 4, 5, 6.

Theoretically it should not matter,
but these fd numbers are probably sometimes are used as data.
So make them consistent in all these cases (3, 4, 5).
2018-02-26 15:54:02 +01:00
Dmitry Vyukov
14dae29c2a executor: use proper default values for resources
We currently use -1 as default value for resources
when the actual value is not available.
-1 is good for fd's, but is not the right default
value for pointers/keys/etc.
Pass from prog and use in executor proper default
value for resources.
2018-02-26 15:00:46 +01:00
Dmitry Vyukov
41f6f2579b prog: fix address analysis
Even during mutation of a call we want to analyze whole program
to find all used addresses (rather then stop on the selected call).
Also update address during ANY mutation if size has increased.
2018-02-26 13:33:11 +01:00
Dmitry Vyukov
17ad67b472 prog: better error message when failed to create a resource 2018-02-26 12:15:08 +01:00
Dmitry Vyukov
afccdb6cff dashboard/app: preserve at least 1 crash per manager
When purging crashes we currently sort by priority (manager) first,
as the result if we have enough month-old crashes on upstream,
we stop saving any new crashes on other branches.
Sort by time first, but keep at least 1 crash per manager.
2018-02-26 12:08:01 +01:00
Dmitry Vyukov
bd660019ee dashboard/app: select only normal builds during reporting
Don't select job builds during reporting,
they contain random git repositories.
2018-02-26 11:35:10 +01:00
Dmitry Vyukov
9f8b1dde96 dashboard/app: save fewer crashes
Reduce threshold from 1000 to maxCrashes,
we don't save more than maxCrashes crashes,
so this looks like a good threshold to reduce
load on datastore.
2018-02-26 10:45:17 +01:00
Dmitry Vyukov
951ea18d6a dashboard/app: remove redundant field update
NumCrashesBad is set in updateBugBadness.
2018-02-26 10:31:53 +01:00
Dmitry Vyukov
572ed211ce dashboard/app: fix check for closed bugs
Template if's do not work this way!
2018-02-26 10:31:12 +01:00
Dmitry Vyukov
9fe8aa42c5 prog: add arbitrary mutation of complex structs
Squash complex structs into flat byte array and mutate this array
with generic blob mutations. This allows to mutate what we currently
consider as paddings and add/remove paddings from structs, etc.
2018-02-25 18:22:02 +01:00
Dmitry Vyukov
2145057cb8 pkg/compiler: fix alignment corner case
Fix alignemnt calculation for packed structs with alignment and bitfields.
Amusingly this affected only a single real struct -- ipv6_fragment_ext_header.
2018-02-25 14:44:29 +01:00
Dmitry Vyukov
1f4ae3f413 pkg/compiler: don't assign call IDs statically
IDs change whenever a call is added or removed,
this leads to large diffs unnecessarly.
Assign IDs dynamically.
2018-02-25 14:31:40 +01:00
Dmitry Vyukov
44f66b4026 prog: return concrete arg types from Make functions
This removes a bunch of type assertions and makes code type safer.
2018-02-24 17:00:34 +01:00
Dmitry Vyukov
5c1e020706 pkg/compiler: prohibit len of other union options 2018-02-23 14:00:41 +01:00
Dmitry Vyukov
7a7c747c6f pkg/compiler: allow unions as syscall arguments
If all union options can be syscall arguments,
allow the union itself as syscall argument.
2018-02-23 13:50:02 +01:00
Dmitry Vyukov
e229ac7779 sys: fix descriptions for strickter return type checks
Mostly remove vma as return from some mm syscalls.
This is unnecessary and we never used these.
2018-02-23 13:42:41 +01:00
Dmitry Vyukov
3be86de046 sys/linux: prevent programs from doing arbitrary writes with ARCH_SET_FS 2018-02-23 11:55:37 +01:00
Dmitry Vyukov
3346415848 dashboard/app: prefix email replies with Re:
This plays an important role at least for job replies.
If we CC a kernel mailing list and it uses Patchwork,
then any emails with a patch attached create a new patch
entry pending for review. The prefix makes Patchwork
treat it as a comment for a previous patch.
2018-02-23 11:24:43 +01:00
Dmitry Vyukov
8d8e249484 sys/linux: add AF_SMC sockets 2018-02-22 20:33:52 +01:00
Dmitry Vyukov
87044370b8 syz-manager: ask reproducers from hub only if connected to dashboard
All reproducers from hub produce too much load on local managers.
2018-02-22 20:21:07 +01:00
Dmitry Vyukov
6153a72ee1 executor: bring up bond and veth devices 2018-02-22 20:16:37 +01:00
Dmitry Vyukov
907d649fc3 sys/linux: add few ip and tcp options 2018-02-22 20:14:36 +01:00
Dmitry Vyukov
02fb42327b dashboard/app: extend tests for access control
Add a patched bug to the mix.
Check contents of crash logs/reports, kernel configs, etc.
2018-02-22 14:25:14 +01:00
Dmitry Vyukov
7daaa06d53 dashboard/app: restrict patch testing result CC list
Currently dashboard sends patch testing result to full bug CC list
(which includes kernel mailing lists). This is unnecessary and causes
problems with patchwork.
Reply only to people in the testing request CC list
(adding our mailing list if it was missing).

Fixes #526
2018-02-22 13:08:34 +01:00
Dmitry Vyukov
04cbdbd1ae syz-fuzzer: prioritize signal from successful syscalls
Signal on successful syscalls is more valuable than
signal on unsuccessful syscalls.y
2018-02-20 20:51:41 +01:00
Dmitry Vyukov
e5db1f4f47
Update issue_template.txt 2018-02-20 20:21:07 +01:00