Commit Graph

4468 Commits

Author SHA1 Message Date
Dmitry Vyukov
8ff25100c2 sys/linux: add 80211 descriptions 2020-01-03 16:11:49 +01:00
Dmitry Vyukov
7ec787382c sys/linux: fix SIOCGIFINDEX
Mark ifindex as opt in SIOCGIFINDEX.
Otherwise it's considered inout and SIOCGIFINDEX can't be used
to produce ifindex'es on its own. It requires an input ifindex
first and only then it can output own ifindex.
2020-01-03 16:11:49 +01:00
Dmitry Vyukov
fca6a74d0c executor: connect virt_wifi to veth
virt_wifi docs say that the enslaved device won't be usable
on itself. It's probably not a good idea to make lo unusable.
Enslave a dedicated veth instead.
2020-01-03 16:11:49 +01:00
Dmitry Vyukov
5e3bc74104 pkg/cover: support out-of-tree linux build
Looks for source files in object dir.
This is required for out-of-tree linux builds.
E.g. security/selinux/flask.h contains some sources
with coverage callbacks, but it's auto-generated
and located in the build dir.
2020-01-03 16:11:49 +01:00
Dmitry Vyukov
4e3e3c8d4b sys/linux: add netlabel descriptions 2020-01-03 16:11:49 +01:00
Dmitry Vyukov
21d4f173c5 sys/linux: improve ipv4/ipv6 vnet descriptions
1. Use optional[T] instead of array[T, 0:1].
2. Deduplicate 3 copies of ARP packet.
3. Deduplicate IPOPT_LSRR/IPOPT_SSRR/IPOPT_RR.
4. More precise description of IPOPT_TIMESTAMP/IPOPT_LSRR/IPOPT_SSRR/IPOPT_RR.
5. Don't use IPOPT_END/IPOPT_NOOP in generic option (they have different format).
6. Restrict cipso doi values.
7. Fix IPOPT_RA value type (int16 instead of int32).
8. Match ipv4/ipv6 packet type with payload.
9. Prefer 0 frag_off for ipv4 packets (they are extremely hard to get right).
2020-01-03 16:11:49 +01:00
Dmitry Vyukov
7e52950696 syz-manager: init coverage without manager mutex
Coverage initialization takes very long time,
if we hold manager mutex we stall all rpc's and everything.
Do it without manager mutex.
2020-01-03 16:11:49 +01:00
Anton Lindqvist
9dcc1191cb pkg/report: normalize unhandled af report on OpenBSD 2020-01-03 08:37:12 +01:00
Dmitry Vyukov
25a0186eba sys/linux: add IPPROTO_L2TP descriptions 2019-12-31 10:52:22 +01:00
Dmitry Vyukov
7f117e28b8 sys/linux: add virt_wifi and xfrm devices
+ some netlink descriptions
2019-12-30 20:18:14 +01:00
Dmitry Vyukov
74da6acb21 syz-manager: add a note about corpus rotation
Update #1348
2019-12-30 18:03:59 +01:00
Dmitry Vyukov
6b36d33868 syz-manager: corpus rotation
Use a random subset of syscalls/corpus/coverage for each individual VM run.
Hypothesis is that this should allow fuzzer to get more coverage
find more bugs in saturated state (stuck in local optimum).
See the issue and comments for details.

Update #1348
2019-12-30 16:37:38 +01:00
Dmitry Vyukov
3203771359 prog: fix a typo in a comment 2019-12-30 16:37:38 +01:00
Dmitry Vyukov
1bd7cab318 .travis.yml: set go_import_path
This should help with testing of forks
(now they should be checked at the correct path).
2019-12-30 16:37:38 +01:00
Dmitry Vyukov
28a9676c17 sys/linux: add {MSG,SEM,SHM}_STAT_ANY 2019-12-30 16:37:38 +01:00
Anton Lindqvist
af6b8ef8f1 docs/openbsd: update found bugs.md 2019-12-28 11:21:02 +01:00
Dmitry Vyukov
be5c2c8197 sys/linux: fix 32-bit warnings
Lots of interesting findings...
Especially 2 byte uid/gid/pid.

Update #590
2019-12-23 10:56:16 +01:00
Dmitry Vyukov
4b042b7d67 sys/linux: fix int64 alignment on 386
Turns out int64 alignment is 4 on 386...
But on arm it's still 8.

Another amusing finding thanks to syz-check.

Update #590
2019-12-23 08:57:42 +01:00
Dmitry Vyukov
61f4e7ee54 tools/syz-check: check amd64 and 386 at the same time
Update #590
2019-12-22 19:34:12 +01:00
Dmitry Vyukov
8b96726707 sys/linux: fix warnings in template definition
Update #590
2019-12-22 11:39:02 +01:00
Dmitry Vyukov
c5907f7c7a tools/syz-check: check templates
Also rename some netfilter types to eliminate massive amounts of template warnings.

Update #590
2019-12-22 11:19:49 +01:00
Dmitry Vyukov
1461be9d82 tools/syz-check: add some TODOs 2019-12-22 10:15:24 +01:00
Dmitry Vyukov
9b81e6bdb8 sys/linux: fix warning in dev_video4linux.txt
Update #590
2019-12-22 10:15:24 +01:00
Dmitry Vyukov
8fecec2eb0 sys/linux: another batch of warning fixes
The only remaining part now is dev_video4linux.txt

Update #590
2019-12-22 09:29:44 +01:00
Dmitry Vyukov
bfdfc2603c prog: don't fail decoding on non-default out args
We get them in cross-compilation test where an out const
arg has different values in different archs.
No reason to fail deserialization in that case, replace with default
arg instead.
2019-12-21 14:53:37 +01:00
Dmitry Vyukov
bc5869180f sys/linux: fix 240 warnings in descriptions
Sweeping fix of everything up to socket_netlink_route.txt.

Update #590
2019-12-20 16:45:35 +01:00
Dmitry Vyukov
f83f92fd5e tools/syz-check: inject description compilation warnings
Currently we print them as part of `make genereate`,
but nobody reads them, too much output each time.
Don't print them in `make generate` and instead
print in syz-check, the warn files are a good mechanism
to handle "known warnings".
2019-12-20 16:45:34 +01:00
Dmitry Vyukov
ae5ed0b140 pkg/compiler: fix bitfield layout bug
Fixes #1542

Found thanks to syz-check. Update #590
2019-12-20 16:45:34 +01:00
Dmitry Vyukov
4bba9fd162 pkg/compiler: fix alignment of string-formatted values
We used size as alignment, this is very wrong.

Found thanks to syz-check. Update #590
2019-12-20 16:45:34 +01:00
Dmitry Vyukov
5655dc58a9 executor: make syz_compare output more handy to use 2019-12-20 16:45:33 +01:00
Dmitry Vyukov
08f0467614 sys/test: and another set of bitfield tests
Just trying to get my head around it (and fix this in tests).

Update #1542
2019-12-20 16:45:33 +01:00
Dmitry Vyukov
9be5bbcf09 pkg/compiler: refactor struct layout
Combine markBitfields and addAlignment functions.
Fixing #1542 will require doing both at the same time,
they are not really independent.
Also remove the special case for packed structs,
pad them as part of the common procedure.
No functional changes.
2019-12-20 16:45:33 +01:00
Jouni Hogander
aa56acc6b7 pkg/cover: Fix PreviousInstructionPC for MIPS64LE
PC from the target is address of "jal __sanitizer_cov_trace_pc" + 8.
E.g. case below has address ffffffff80b4eec4 in PC

ffffffff80b4eebc:       jal     ffffffff80232080 <__sanitizer_cov_trace_pc>
ffffffff80b4eec0:       nop
ffffffff80b4eec4:       move    a1,s0
2019-12-20 15:07:10 +01:00
Andrey Konovalov
34011c05c4
Update setup_linux-host_qemu-vm_arm64-kernel.md 2019-12-20 13:58:14 +01:00
Dmitry Vyukov
e30cbdae48 sys/test: and another bitfield test
Just trying to get my head around it (and fix this in tests).

Update #1542
2019-12-19 20:00:44 +01:00
Dmitry Vyukov
20c6855484 prog: refactor bitfields representation
All callers of BitfieldMiddle just want static size (0 for middle).
Make it so: Size for middle bitfields just returns 0. Removes lots of if's.
Introduce Type.UnitSize, which now holds the underlying type for bitfields.
This will be needed to fix #1542 b/c even if UnitSize=4 for last bitfield
Size can be anywhere from 0 to 4 (not necessary equal to UnitSize due to overlapping).
2019-12-19 19:32:45 +01:00
Dmitry Vyukov
af9047c60a sys/linux: prohibit TIOCSSERIAL
Replace TIOCSSERIAL with TIOCGSERIAL.
TIOCSSERIAL can do nasty things under root, like causing writes to random memory
pretty much like /dev/mem, but this is also working as intended.
For details see:
https://groups.google.com/g/syzkaller-bugs/c/1rVENJf9P4U/m/QtGpapRxAgAJ
https://syzkaller.appspot.com/bug?extid=f4f1e871965064ae689e
TODO: TIOCSSERIAL does some other things that are not dangerous
and would be nice to test, if/when we can sanitize based on sandbox value
we could prohibit it only under sandbox=none.
2019-12-19 19:32:45 +01:00
Andrey Konovalov
fa392d3014 tools/create-image.sh: install tcpdump
It's quite useful for debugging network related stuff.
2019-12-19 18:52:51 +01:00
Andrey Konovalov
36650b4b2c
Update external_fuzzing_usb.md 2019-12-19 14:25:37 +01:00
Andrey Konovalov
a3bceb3706
Update external_fuzzing_usb.md 2019-12-19 14:24:17 +01:00
Dmitry Vyukov
79b211f74b sys/linux: fix caps test for new descriptions 2019-12-18 17:34:36 +01:00
Dmitry Vyukov
52395b6ee8 sys/test: add few other tests for tricky bitfields
Update #1542
2019-12-18 16:42:17 +01:00
Dmitry Vyukov
6a19144a4d pkg/ipc: don't use rate limiting for test os
It's not needed for test os and slows down pkg/runtest tests.
2019-12-18 16:35:53 +01:00
Dmitry Vyukov
73c3845438 pkg/compiler: fix incorrect alignment calculation for padding
We assumed that for ConstType alignment is equal to size,
which is perfectly reasonable for normal int8/16/32/64/ptr.
However, padding is also represented by ConstType of arbitrary size,
so if we added 157 bytes of padding that becomes alignment of
the padding field and as the result of the whole struct.
This affects very few structs, but quite radically and quite
important structs.

Discovered thanks to syz-check.

Update #590
2019-12-18 14:44:12 +01:00
Dmitry Vyukov
42dc692776 sys/linux: another batch of syz-check fixes
Update #590
2019-12-18 14:38:24 +01:00
Dmitry Vyukov
fa33c32796 tools/syz-check: don't print our/kernel field name twice if equal 2019-12-18 12:04:56 +01:00
Dmitry Vyukov
82b3c9dfee sys/linux: fix few bugs
Fix some descirptions disperancies with kernel and regenerate warnings on next-20191218.
2019-12-18 12:00:12 +01:00
Dmitry Vyukov
6462728414 tools/syz-check: print descriptions compilation errors
If one changes descriptions concurrently with re-running syz-check,
it's likely something won't compile first time. Print errors.
2019-12-18 11:58:49 +01:00
Dmitry Vyukov
240ba66ba8 dashboard/config: update upstream-kasan.config to next-20191218 2019-12-18 11:27:18 +01:00
Dmitry Vyukov
1b49002e79 tools/syz-check: don't print line numbers for warnings
Line numbers create huge diffs when lines change slightly.
That's very unhandy b/c we want to look at added/removed warnings.
2019-12-18 10:50:24 +01:00