1079 Commits

Author SHA1 Message Date
Dmitry Vyukov
78f30a5156 pkg/report: fix linux path prefix trimming
After f613a7c4 ("pkg/cover: fix prefix computation") we stopped trimming
starting "/" from linux path names. This broke get_maintainers.pl script
which is now given non-existent absolute paths (e.g. "/mm/mmap.c"),
as the result syzbot can't find any maintainers for bug reports
and mails them into lkml limbo.

Trim starting slashes and dots. Extend tests for catch this.
2019-07-23 09:24:09 +02:00
Dmitry Vyukov
d9ec038e02 pkg/report: refactor argument passing
We now pass 5 arguments through a bunch of functions,
this is quite inconvinient when the set of arguments changes.
Incapsulate all arguments in a struct and pass/store it as a whole.
2019-07-23 09:15:43 +02:00
Marco Vanotti
f171a40c6b pkg/build: change gcc for clang in fuchsia
Recently fuchsia changed the default compiler from GCC to clang. This
change updates the paths in the build package.
2019-07-23 08:44:20 +02:00
Marco Vanotti
5aec592bda pkg/build: Add ssh keys for fuchsia
This change modifies the way fuchsia is built to add the ssh keys to the
zbi image after building it. Previously that was done via the
"extra_ssh_keys" argument to the build system, but that was removed
recently.
2019-07-23 08:44:20 +02:00
Dmitry Vyukov
f3ad684464 executor: drop CAP_SYS_NICE
A process with CAP_SYS_NICE can bring kernel down by asking for too high SCHED_DEADLINE priority,
as the result rcu and other system services that use kernel threads will stop functioning.
Some parameters for SCHED_DEADLINE should be OK, but we don't have means to enforce
values of indirect syscall arguments. Peter Zijlstra proposed sysctl_deadline_period_{min,max}
which could be used to enfore safe limits without droppping CAP_SYS_NICE, but we don't have it yet.
See the following bug for details:
https://groups.google.com/forum/#!topic/syzkaller-bugs/G6Wl_PKPIWI
2019-07-22 11:59:00 +02:00
Dmitry Vyukov
5181b54d45 executor: drop CAP_SYS_PTRACE with sandbox=none
We only drop CAP_SYS_PTRACE for sandbox=namespace,
but it can equally affect testing with sandbox=none.
Drop it for sandbox=none, add a test.
2019-07-22 11:51:53 +02:00
Dmitry Vyukov
e530ec1bef pkg/csource: test sys/*/test programs
Running sys/*/test programs requires real machines and kernels for each OS.
We can't do that in unit tests, but at least try to deserialize these programs
so that they don't get rotten.
2019-07-22 10:20:51 +02:00
Dmitry Vyukov
d8b4c311be pkg/mgrconfig: add example for "enable_syscalls" 2019-07-22 09:27:11 +02:00
Dmitry Vyukov
18678d6989 pkg/report: support older format of "bad usercopy" 2019-07-22 09:07:23 +02:00
Dmitry Vyukov
8304907db0 tools/syz-env: restrict Makefile parallelism based on RAM
Ensure that we have at least 1GB per Makefile job.
Go compiler/linker can consume significant amount of memory
(observed to consume at least 600MB). See #1276 for context.
Update #1276
2019-07-19 09:51:07 +02:00
Dmitry Vyukov
f53c0235fa pkg/cover: fix objdump process hang
One instance we observed that objdump hanged due to stdout
pipe overflow due to panic in archCallInsn.
The reason for the original panic is still unclear,
but fix the objdump hang. We need to terminate objdump
and propagate the panic.
Also extend the panic messages.
2019-07-18 09:37:07 +02:00
Siddharth M
f613a7c41d pkg/cover: fix prefix computation
* pkg/cover: Modify parsing logic
1. Remove prefix computation
2. Add a mgrconfig for kernel build directory

* pkg/report: shorten reports with kernelBuildSrc instead of kernelSrc

* pkg/report: Fix failing tests

* pkg/report: fix formating issues

* tools/syz-cover: Fix unintended redefinition

* make changes to fix failing ci build

* pkg/report: fix issues
2019-07-17 11:58:23 +02:00
Marco Vanotti
0d10349cf0
sys/fuchsia: update zx_clock_get syscall (#1292)
* sys/fuchsia: update zx_clock_get.

zx_clock_get was deprecated and replaced by zx_clock_get_new. In a
recent CL[0], they replaced the zx_clock_get by zx_clock_get_new and
moved all client. This commit updates syzkaller to use the new function.

[0]: https://fuchsia-review.googlesource.com/c/fuchsia/+/298575

* run make extract && make generate
2019-07-16 17:09:43 -07:00
Dmitry Vyukov
4ec4ea4890 pkg/report: support new format of "held lock freed" linux bugs 2019-07-16 16:37:33 +02:00
Andrey Konovalov
6bc0be8b21
sys/linux, executor: improve USB descriptions
1. Change HID descriptions to allow devices to have two interrupt endpoints.
2. Remove unneeded responses to OUT control requests from descriptions.
3. Add some debugging code to detect and report missing descriptions.
2019-07-16 13:07:56 +02:00
Dmitry Vyukov
a963689197 pkg/log: rename -v to -vv
To avoid conflicts with programs that import both syzkaller packages
and github.com/golang/glog which also defines -v flag.
2019-07-16 11:18:12 +02:00
Siddharth M
0b48f538f1 pkg/report: enable feature comparisons for NetBSD 2019-07-15 18:10:08 +03:00
R3x
a827bf70d7 pkg/report: Fix corrupted reports 2019-07-14 19:22:39 +03:00
Siddharth M
2bbe2f0558 executor: add network packet injection for NetBSD
* Initial Commit

* working build of network packet fuzzing

* Add missed csource file

* pkg/csource: fix build

* executor/common_bsd.h: Add comment stating reason for ifconfig create
2019-07-14 17:59:29 +03:00
Andrey Konovalov
baa5258a5e executor: fix out-of-bounds in USB fuzzing code
We might not have any string descriptors provided at all, use a hardcoded
string in this case.
2019-07-11 15:44:30 +02:00
Andrey Konovalov
186a30b993 executor: update USB fuzzing code to use new kernel API
The kernel API has changed and now differentiates between IN and OUT
control requests.
2019-07-11 15:03:48 +02:00
Anton Lindqvist
429efa16d6 executor: make errors during thread creation exit zero
On OpenBSD, the executor sometimes manages to set the memory resource
limit 0 causing any following memory allocation to fail. Since threads
are potentially created from such a thread which cannot allocate any
memory, the executor will exit non-zero which in turn will cause
false-positive panics to be reported. For more info see the
discussion[1] in PR #1243.

Instead, if hitting a fatal error during thread creation exit zero.

[1] https://github.com/google/syzkaller/pull/1243
2019-07-04 20:26:46 +02:00
Dmitry Vyukov
5f175e9c09 pkg/report: ignore __wake_up function on linux
They are very generic and a bug is almost always in the parent frame.
2019-07-02 09:03:49 +02:00
Andrey Konovalov
cccc4302d7 sys/linux, executor: run make extract and generate 2019-07-01 17:26:35 +02:00
Andrey Konovalov
13c3a99962 sys/linux, executor: add syz_usb_ep_read syzkall
syz_usb_ep_read reads data from USB endpoints other than #0.
2019-07-01 17:26:35 +02:00
R3x
df9270ba7f pkg/report: fix ASan report parsing bug 2019-07-01 16:28:15 +02:00
R3x
4d3422405e pkg/report: fix error in report symbolization 2019-06-26 11:19:18 +02:00
Andrey Konovalov
82c13b6b49 sys/linux, executor: run make extract and generate 2019-06-24 17:24:44 +02:00
Andrey Konovalov
fa26c3cf35 sys/linux, executor: add basic USB HID fuzzing support
This commit adds the necessary descriptions and executor adjustments to
enable targeted fuzzing of the enumeration process of USB HID devices.
2019-06-24 17:24:44 +02:00
R3x
35a4434115 pkg/build: add DEBUG also 2019-06-24 16:24:48 +02:00
R3x
3a7e9179b1 pkg/build: add LOCKDEBUG and KASAN_PANIC 2019-06-24 16:24:48 +02:00
Andrey Konovalov
2873954bda pkg/report: add KMSAN kernel-usb-infoleak title regex 2019-06-24 12:58:49 +02:00
Dmitry Vyukov
472f0082fd pkg/ifuzz: update to latest intelxed
Update all-enc-instructions.txt to b7231de4c808db821d64f4018d15412640c34113
and regenerate instruction info.
2019-06-23 15:10:27 +02:00
Dmitry Vyukov
da9246f6d7 pkg/report: fix up parsing of lockdep stacks 2019-06-23 14:48:05 +02:00
Siddharth M
a139f92fef pkg/report: Add initial support for report symbolisation
* pkg/report: initial netbsd commit

* pkg/report: fix netbsd errors and add comments to help

* fix spelling error
2019-06-13 18:39:32 +02:00
mspecter
d2f63c9b49 pkg/host: improve openat check
* Add support for non-obvious open commands

* Adding Michael Specter to CONTRIBUTORS

* update

* /pkg/host/host_linux.go: leverage .txt for OpenAt

Allows users to specify OpenAt flags. Currently, Syzkaller will
automatically attempt to open device nodes at startup, and ignore
descriptions that do not exist. Unfortunately, Syzkaller only opens with
read-only permissions, and some device drivers will
return -EINVAL or likewise if the correct flags are not specified.
2019-06-11 12:06:50 +02:00
R3x
5b5826d065 pkg/build: fix the failing build
1. Add MKCTF option
2. Remove the command to make the kcov node. Since do it in the script.
2019-06-11 11:49:04 +02:00
Dmitry Vyukov
f5dd5568d2 pkg/report: improve should_fail regexp
Some kernels print hex PC value before frames.
Account for that in should_fail-matching regexp.
2019-06-06 09:26:26 +02:00
Andrey Konovalov
f41f5458bb pkg/host: enable evdev, hidraw and hiddev when USB fuzzing is on 2019-06-06 09:26:18 +02:00
Dmitry Vyukov
ad87cdf3c7 pkg/runtest: detect and ignore flakes
Add retry logic that detects and ignores episodic flakes.
This test episodically flakes on syzbot.
We run with the default timeout, but require a test
to pass in 50+% of cases.
Running 72 test binaries in parallel I am getting 35-44 failures out of 72
with 1 retry. With 3 retries it drops to ~7. With 5 it is close to 0.
Use 7 retries for now. Let's see if it still flakes.
2019-06-04 14:57:43 +02:00
Dmitry Vyukov
61f5c63922 pkg/report: skip refcount_* functions
These are too generic and don't point to any subsystem. Skip them.
2019-06-04 08:53:37 +02:00
Aditya Basu
4a4d36b4af pkg/build: update env variables for akaros
* Remove the environment variable: AKAROS_XCC_ROOT
(refer to commit: brho/akaros bdab8c3a)
* Add environment variable AKAROS_TOOLCHAINS which
points to the parent directory of the old AKAROS_XCC_ROOT.
(refer to commit: brho/akaro 62ec5c3c)
* Add "$AKAROS_TOOLCHAINS/x86_64-ucb-akaros-gcc/bin" to PATH.

Signed-off-by: Aditya Basu <mitthu@google.com>
2019-06-03 18:58:22 +02:00
Andrey Konovalov
63bf051fc1 pkg/report: add del_timer_sync to skip patterns 2019-06-03 13:14:08 +02:00
Dmitry Vyukov
5368a448e4 pkg/host: disable syz_execute_func
See the added comment for explanation.
2019-06-03 13:13:56 +02:00
Andrey Konovalov
142ce68175 pkg/runtest: add simple USB runtest 2019-05-31 13:35:25 +02:00
Andrey Konovalov
c054a92dde pkg/csource: generate timeouts for USB syzcalls
This patch only covers per call timeouts, per prog one is not adjusted yet.
2019-05-31 13:35:25 +02:00
Andrey Konovalov
2673c53079 pkg/report: ignore more frames for warnings in usb_submit_urb 2019-05-29 16:16:46 +02:00
Dmitry Vyukov
f5a25d38ac pkg/cover: factor out common code into combinePrefix
Combining of prefixes is now repeated in 2 places.
Factor it out into a common function.
2019-05-29 14:58:40 +02:00
Michael Tuexen
59a32682c0 pkg/cover: further improve prefix computation
When computing the prefix, take the covered and uncovered PCs into
account.
2019-05-29 14:58:36 +02:00
Michael Tuexen
17c2df6f20 pkg/cover: improve prefix computation
When the prefix becomes the empty string during the computation,
stop computing it, since the empty string is the result.
2019-05-29 14:58:31 +02:00