Commit Graph

3951 Commits

Author SHA1 Message Date
Marco Vanotti
5aec592bda pkg/build: Add ssh keys for fuchsia
This change modifies the way fuchsia is built to add the ssh keys to the
zbi image after building it. Previously that was done via the
"extra_ssh_keys" argument to the build system, but that was removed
recently.
2019-07-23 08:44:20 +02:00
Andrey Konovalov
55e0c07757
sys/linux: extract USB HID ids (#1294)
* sys/linux: extract USB HID ids

As it turns out the HID kernel subsystem registers only one USB driver that
checks that the interface of the connected device has HID class and then looks
up its own list of vendor/device ids to find a matching driver. This means
that we currently don't generate proper vendor/device ids for USB HID devices.

This patch updates the syz-usbgen tool to also extract USB HID vendor/device
ids from a running kernel and makes the generated descriptions for HID devices
to be patched using the extracted ids.

This patch also contains some minor improvements to USB descriptions
(better HID descriptions and more replies for some USB classes/drivers).

* sys/linux: run make generate
2019-07-22 19:25:54 +02:00
Dmitry Vyukov
6a786da97c sys/linux: use AT_FDCWD only for directories
Currently we use AT_FDCWD as a special value for all file descriptors,
but it does not make sense for almost all of them (sockets, bpf, etc).
Use it as a special value only for fd_dir.
2019-07-22 13:05:39 +02:00
Dmitry Vyukov
f3ad684464 executor: drop CAP_SYS_NICE
A process with CAP_SYS_NICE can bring kernel down by asking for too high SCHED_DEADLINE priority,
as the result rcu and other system services that use kernel threads will stop functioning.
Some parameters for SCHED_DEADLINE should be OK, but we don't have means to enforce
values of indirect syscall arguments. Peter Zijlstra proposed sysctl_deadline_period_{min,max}
which could be used to enfore safe limits without droppping CAP_SYS_NICE, but we don't have it yet.
See the following bug for details:
https://groups.google.com/forum/#!topic/syzkaller-bugs/G6Wl_PKPIWI
2019-07-22 11:59:00 +02:00
Dmitry Vyukov
be348f6db3 sys/linux: improve sched_attr description
Today we have means to properly describe parent size.
2019-07-22 11:51:58 +02:00
Dmitry Vyukov
5181b54d45 executor: drop CAP_SYS_PTRACE with sandbox=none
We only drop CAP_SYS_PTRACE for sandbox=namespace,
but it can equally affect testing with sandbox=none.
Drop it for sandbox=none, add a test.
2019-07-22 11:51:53 +02:00
Dmitry Vyukov
e530ec1bef pkg/csource: test sys/*/test programs
Running sys/*/test programs requires real machines and kernels for each OS.
We can't do that in unit tests, but at least try to deserialize these programs
so that they don't get rotten.
2019-07-22 10:20:51 +02:00
Dmitry Vyukov
d8b4c311be pkg/mgrconfig: add example for "enable_syscalls" 2019-07-22 09:27:11 +02:00
Dmitry Vyukov
d6e6e5e69c docs: fix description of ptr type
ptr has direction as the first argument.
2019-07-22 09:23:10 +02:00
Dmitry Vyukov
18678d6989 pkg/report: support older format of "bad usercopy" 2019-07-22 09:07:23 +02:00
Greg Steuck
b3c615f51b tools/syz-execprog: remove unused parameter 2019-07-22 07:37:09 +02:00
Anton Lindqvist
919efc620a sys/openbsd: prevent swap partition device nodes from being created
Writing to the swap partition during fuzzing can lead to all kinds of
corruptions[1].

[1] https://syzkaller.appspot.com/bug?id=a2eca15e6e0be4be3ed1b0b2bab3332edc317b1c
2019-07-22 07:36:41 +02:00
Dmitry Vyukov
1656845f45 fuzz.yaml: rename to fuzzbuzz.yaml
Newsletter says we need to change the name.
2019-07-19 10:45:19 +02:00
Denis Efremov
9097c294da Update found_bugs.md 2019-07-19 10:37:26 +02:00
Dmitry Vyukov
8304907db0 tools/syz-env: restrict Makefile parallelism based on RAM
Ensure that we have at least 1GB per Makefile job.
Go compiler/linker can consume significant amount of memory
(observed to consume at least 600MB). See #1276 for context.
Update #1276
2019-07-19 09:51:07 +02:00
Dmitry Vyukov
7bb222f7bc syz-manager: fix argument order in generateCoverHTML 2019-07-18 09:47:33 +02:00
Dmitry Vyukov
f53c0235fa pkg/cover: fix objdump process hang
One instance we observed that objdump hanged due to stdout
pipe overflow due to panic in archCallInsn.
The reason for the original panic is still unclear,
but fix the objdump hang. We need to terminate objdump
and propagate the panic.
Also extend the panic messages.
2019-07-18 09:37:07 +02:00
Dmitry Vyukov
06616a2715 tools/syz-cover: skip empty lines in coverage file
If it's constructed manually, it's easy to add an empty line at the end.
2019-07-18 09:36:03 +02:00
Siddharth M
f613a7c41d pkg/cover: fix prefix computation
* pkg/cover: Modify parsing logic
1. Remove prefix computation
2. Add a mgrconfig for kernel build directory

* pkg/report: shorten reports with kernelBuildSrc instead of kernelSrc

* pkg/report: Fix failing tests

* pkg/report: fix formating issues

* tools/syz-cover: Fix unintended redefinition

* make changes to fix failing ci build

* pkg/report: fix issues
2019-07-17 11:58:23 +02:00
Marco Vanotti
0d10349cf0
sys/fuchsia: update zx_clock_get syscall (#1292)
* sys/fuchsia: update zx_clock_get.

zx_clock_get was deprecated and replaced by zx_clock_get_new. In a
recent CL[0], they replaced the zx_clock_get by zx_clock_get_new and
moved all client. This commit updates syzkaller to use the new function.

[0]: https://fuchsia-review.googlesource.com/c/fuchsia/+/298575

* run make extract && make generate
2019-07-16 17:09:43 -07:00
Dmitry Vyukov
4ec4ea4890 pkg/report: support new format of "held lock freed" linux bugs 2019-07-16 16:37:33 +02:00
Dmitry Vyukov
96b8132aaf sys/syz-extract: fix too long line 2019-07-16 16:34:29 +02:00
Marco Vanotti
d6d32e566b run make extract and make generate for fuchsia 2019-07-16 16:34:29 +02:00
Marco Vanotti
d862d22d79 sys/fuchsia: remove RESIZEABLE flags from vmo ops.
This change removes the ZX_VMO_NON_RESIZABLE flag for vmo create and the
ZX_VMO_CHILD_NON_RESIZEABLE flag from vmo create child.

The flags were removed upstream in cl:
https://fuchsia-review.googlesource.com/c/fuchsia/+/293991
2019-07-16 16:34:29 +02:00
Marco Vanotti
6aad7497a8 sys/syz-extract: Add "DefineGlibcUse" flag.
Instead of defining the __GLIBC_USE macro on every OS, we are just
defining it based on a parameter. That parameter is set to false for all
OSs except for fuchsia.
2019-07-16 16:34:29 +02:00
Marco Vanotti
75b7c614dd sys/fuchsia: rename vmo_clone to vmo_create_child.
This commit modifies the vmo_clone definition, renaming it to
vmo_create_child. This change happened in fuchsia a few weeks ago[0].

[0]: https://fuchsia-review.googlesource.com/c/fuchsia/+/272268/
2019-07-16 16:34:29 +02:00
Marco Vanotti
1472562444 sys/syz-extract: define __GLIBC_USE if not defined.
When I try to run `make extract` for fuchsia, the clang compiler
complains that __GLIBC_USE is undefined.

This CL just defines it to be an always false function-like macro if it
was not defined.
2019-07-16 16:34:29 +02:00
Marco Vanotti
de59bed3f8 sys/fuchsia: update paths for fdio and driver libs.
This commit updates the targets for fuchsia, modifying the clang flags
so that it uses the correct path to link against libfdio and libdriver.
2019-07-16 16:34:29 +02:00
Marco Vanotti
48bc210db4 sys/fuchsia: remove power fidl definitions.
This commit removes the fuchsia-power fidl definitions. The interface
doesn't have a service implementing it in fuchsia, and it is causing
issues in make extract.
2019-07-16 16:34:29 +02:00
Andrey Konovalov
9ba1e9ae4b prog: fix updating triedPaths when minimizing resources 2019-07-16 15:20:33 +02:00
Andrey Konovalov
e2b11c0ada dashboard: fix usb config extraction script
Fix extracting more configs that are actually enabled.
Regenerate upsteam-usb.config and sys/linux/init_vusb_ids.go.
2019-07-16 15:02:36 +02:00
Dmitry Vyukov
db842eb61c dashboard/app: add ConstFilter helper
Handy to use in configs if lots of filter just need to return a const.
2019-07-16 14:18:35 +02:00
Andrey Konovalov
6bc0be8b21
sys/linux, executor: improve USB descriptions
1. Change HID descriptions to allow devices to have two interrupt endpoints.
2. Remove unneeded responses to OUT control requests from descriptions.
3. Add some debugging code to detect and report missing descriptions.
2019-07-16 13:07:56 +02:00
Dmitry Vyukov
7e921b852d dashboard/app: add an empty test file
blaze+tricoder fail when all test files are excluded by tags.
Work around the bug by adding an empty test file.
2019-07-16 12:44:02 +02:00
Eric Biggers
f27c4411ef sys/linux: update fs-verity descriptions
The fs-verity API was redesigned, and we're planning to re-add the
fs-verity patches to linux-next soon.  Get the syzkaller descriptions up
to date with the new API [1]

[1] https://lkml.kernel.org/linux-fsdevel/20190701153237.1777-4-ebiggers@kernel.org
2019-07-16 12:10:18 +02:00
Paul Chaignon
36835e4e11 sys/linux: update BPF constants
Signed-off-by: Paul Chaignon <paul.chaignon@orange.com>
2019-07-16 11:38:43 +02:00
Dmitry Vyukov
a963689197 pkg/log: rename -v to -vv
To avoid conflicts with programs that import both syzkaller packages
and github.com/golang/glog which also defines -v flag.
2019-07-16 11:18:12 +02:00
Eric Biggers
84d08cdf2d sys/linux: update for v5.3 again
Update descriptions to be compatible with latest linux-next
(next-20190715), which in theory will match v5.3-rc1 when the merge
window closes.

- KEYCTL_GRANT_PERMISSION was reverted.  So remove its description.

- CRYPTO_ALG_TYPE_DIGEST was removed.  So remove its description.

- IB_QP_CREATE_SIGNATURE_EN was renamed to IB_QP_CREATE_INTEGRITY_EN.

Also remove the sys/linux/rdma_*.const files which were incorrectly
checked into git.  The real copies of those files are in
sys/linux/dev_infiniband_rdma_*.const.

For now I did *not* check for other new APIs that need to be described.
2019-07-16 10:08:43 +02:00
Alexander Popov
6732e2c033 qemu: support advanced hard drive configurations
Currently the 'image_device' config option in qemu.go doesn't properly
support the modern '-drive' argument for describing qemu hard disks.

In fact the various old ways to define qemu drives all boil down to
the common form '-drive if=TYPE,bus=BUS,unit=UNIT,OPTS...'
For example '-hda img' is equivalent to '-drive index=0,media=disk,file=img'.

Let's make the 'image_device' config option support both forms.

Signed-off-by: Alexander Popov <alex.popov@linux.com>
2019-07-15 18:12:29 +03:00
Siddharth M
0b48f538f1 pkg/report: enable feature comparisons for NetBSD 2019-07-15 18:10:08 +03:00
Eric Biggers
139ac68a73 sys/linux: update key descriptions
- Add KEYCTL_MOVE (new in v5.3)
- Add KEYCTL_CAPABILITIES (new in v5.3)
- Add KEYCTL_GRANT_PERMISSION (new in v5.3)
- Remove KEY_PERM_UNDEF (was only ever in an internal kernel header,
  not in UAPI; removed in v5.3)
2019-07-15 13:44:02 +03:00
R3x
a827bf70d7 pkg/report: Fix corrupted reports 2019-07-14 19:22:39 +03:00
Siddharth M
2bbe2f0558 executor: add network packet injection for NetBSD
* Initial Commit

* working build of network packet fuzzing

* Add missed csource file

* pkg/csource: fix build

* executor/common_bsd.h: Add comment stating reason for ifconfig create
2019-07-14 17:59:29 +03:00
Anton Lindqvist
e6fb0f1316 docs/openbsd: update found_bugs.md 2019-07-13 09:20:32 +02:00
Andrey Konovalov
baa5258a5e executor: fix out-of-bounds in USB fuzzing code
We might not have any string descriptors provided at all, use a hardcoded
string in this case.
2019-07-11 15:44:30 +02:00
Andrey Konovalov
186a30b993 executor: update USB fuzzing code to use new kernel API
The kernel API has changed and now differentiates between IN and OUT
control requests.
2019-07-11 15:03:48 +02:00
Anton Lindqvist
ff7bf04c7c sys/openbsd: add diskmap descriptions 2019-07-10 22:37:39 +02:00
Dmitry Vyukov
f62e1e85cf dashboard/config: update linux configs
Update configs to the current linux-next (16c474c9ba39ede5fd1cd835ac52b3760d7820b7).
Enable CONFIG_GVE=y, we may be able to reach it on GCE.
2019-07-05 11:51:08 +02:00
Denis Efremov
a0626693a0 sys/linux: fix floppy description
* sys/linux: fix floppy description

Fix typo in the FDGETPRM ioctl.

* sys/linux: extract && generate for floppy

Signed-off-by: Denis Efremov <efremov@linux.com>
2019-07-05 09:16:10 +02:00
Anton Lindqvist
429efa16d6 executor: make errors during thread creation exit zero
On OpenBSD, the executor sometimes manages to set the memory resource
limit 0 causing any following memory allocation to fail. Since threads
are potentially created from such a thread which cannot allocate any
memory, the executor will exit non-zero which in turn will cause
false-positive panics to be reported. For more info see the
discussion[1] in PR #1243.

Instead, if hitting a fatal error during thread creation exit zero.

[1] https://github.com/google/syzkaller/pull/1243
2019-07-04 20:26:46 +02:00