Commit Graph

3945 Commits

Author SHA1 Message Date
Dmitry Vyukov
e530ec1bef pkg/csource: test sys/*/test programs
Running sys/*/test programs requires real machines and kernels for each OS.
We can't do that in unit tests, but at least try to deserialize these programs
so that they don't get rotten.
2019-07-22 10:20:51 +02:00
Dmitry Vyukov
d8b4c311be pkg/mgrconfig: add example for "enable_syscalls" 2019-07-22 09:27:11 +02:00
Dmitry Vyukov
d6e6e5e69c docs: fix description of ptr type
ptr has direction as the first argument.
2019-07-22 09:23:10 +02:00
Dmitry Vyukov
18678d6989 pkg/report: support older format of "bad usercopy" 2019-07-22 09:07:23 +02:00
Greg Steuck
b3c615f51b tools/syz-execprog: remove unused parameter 2019-07-22 07:37:09 +02:00
Anton Lindqvist
919efc620a sys/openbsd: prevent swap partition device nodes from being created
Writing to the swap partition during fuzzing can lead to all kinds of
corruptions[1].

[1] https://syzkaller.appspot.com/bug?id=a2eca15e6e0be4be3ed1b0b2bab3332edc317b1c
2019-07-22 07:36:41 +02:00
Dmitry Vyukov
1656845f45 fuzz.yaml: rename to fuzzbuzz.yaml
Newsletter says we need to change the name.
2019-07-19 10:45:19 +02:00
Denis Efremov
9097c294da Update found_bugs.md 2019-07-19 10:37:26 +02:00
Dmitry Vyukov
8304907db0 tools/syz-env: restrict Makefile parallelism based on RAM
Ensure that we have at least 1GB per Makefile job.
Go compiler/linker can consume significant amount of memory
(observed to consume at least 600MB). See #1276 for context.
Update #1276
2019-07-19 09:51:07 +02:00
Dmitry Vyukov
7bb222f7bc syz-manager: fix argument order in generateCoverHTML 2019-07-18 09:47:33 +02:00
Dmitry Vyukov
f53c0235fa pkg/cover: fix objdump process hang
One instance we observed that objdump hanged due to stdout
pipe overflow due to panic in archCallInsn.
The reason for the original panic is still unclear,
but fix the objdump hang. We need to terminate objdump
and propagate the panic.
Also extend the panic messages.
2019-07-18 09:37:07 +02:00
Dmitry Vyukov
06616a2715 tools/syz-cover: skip empty lines in coverage file
If it's constructed manually, it's easy to add an empty line at the end.
2019-07-18 09:36:03 +02:00
Siddharth M
f613a7c41d pkg/cover: fix prefix computation
* pkg/cover: Modify parsing logic
1. Remove prefix computation
2. Add a mgrconfig for kernel build directory

* pkg/report: shorten reports with kernelBuildSrc instead of kernelSrc

* pkg/report: Fix failing tests

* pkg/report: fix formating issues

* tools/syz-cover: Fix unintended redefinition

* make changes to fix failing ci build

* pkg/report: fix issues
2019-07-17 11:58:23 +02:00
Marco Vanotti
0d10349cf0
sys/fuchsia: update zx_clock_get syscall (#1292)
* sys/fuchsia: update zx_clock_get.

zx_clock_get was deprecated and replaced by zx_clock_get_new. In a
recent CL[0], they replaced the zx_clock_get by zx_clock_get_new and
moved all client. This commit updates syzkaller to use the new function.

[0]: https://fuchsia-review.googlesource.com/c/fuchsia/+/298575

* run make extract && make generate
2019-07-16 17:09:43 -07:00
Dmitry Vyukov
4ec4ea4890 pkg/report: support new format of "held lock freed" linux bugs 2019-07-16 16:37:33 +02:00
Dmitry Vyukov
96b8132aaf sys/syz-extract: fix too long line 2019-07-16 16:34:29 +02:00
Marco Vanotti
d6d32e566b run make extract and make generate for fuchsia 2019-07-16 16:34:29 +02:00
Marco Vanotti
d862d22d79 sys/fuchsia: remove RESIZEABLE flags from vmo ops.
This change removes the ZX_VMO_NON_RESIZABLE flag for vmo create and the
ZX_VMO_CHILD_NON_RESIZEABLE flag from vmo create child.

The flags were removed upstream in cl:
https://fuchsia-review.googlesource.com/c/fuchsia/+/293991
2019-07-16 16:34:29 +02:00
Marco Vanotti
6aad7497a8 sys/syz-extract: Add "DefineGlibcUse" flag.
Instead of defining the __GLIBC_USE macro on every OS, we are just
defining it based on a parameter. That parameter is set to false for all
OSs except for fuchsia.
2019-07-16 16:34:29 +02:00
Marco Vanotti
75b7c614dd sys/fuchsia: rename vmo_clone to vmo_create_child.
This commit modifies the vmo_clone definition, renaming it to
vmo_create_child. This change happened in fuchsia a few weeks ago[0].

[0]: https://fuchsia-review.googlesource.com/c/fuchsia/+/272268/
2019-07-16 16:34:29 +02:00
Marco Vanotti
1472562444 sys/syz-extract: define __GLIBC_USE if not defined.
When I try to run `make extract` for fuchsia, the clang compiler
complains that __GLIBC_USE is undefined.

This CL just defines it to be an always false function-like macro if it
was not defined.
2019-07-16 16:34:29 +02:00
Marco Vanotti
de59bed3f8 sys/fuchsia: update paths for fdio and driver libs.
This commit updates the targets for fuchsia, modifying the clang flags
so that it uses the correct path to link against libfdio and libdriver.
2019-07-16 16:34:29 +02:00
Marco Vanotti
48bc210db4 sys/fuchsia: remove power fidl definitions.
This commit removes the fuchsia-power fidl definitions. The interface
doesn't have a service implementing it in fuchsia, and it is causing
issues in make extract.
2019-07-16 16:34:29 +02:00
Andrey Konovalov
9ba1e9ae4b prog: fix updating triedPaths when minimizing resources 2019-07-16 15:20:33 +02:00
Andrey Konovalov
e2b11c0ada dashboard: fix usb config extraction script
Fix extracting more configs that are actually enabled.
Regenerate upsteam-usb.config and sys/linux/init_vusb_ids.go.
2019-07-16 15:02:36 +02:00
Dmitry Vyukov
db842eb61c dashboard/app: add ConstFilter helper
Handy to use in configs if lots of filter just need to return a const.
2019-07-16 14:18:35 +02:00
Andrey Konovalov
6bc0be8b21
sys/linux, executor: improve USB descriptions
1. Change HID descriptions to allow devices to have two interrupt endpoints.
2. Remove unneeded responses to OUT control requests from descriptions.
3. Add some debugging code to detect and report missing descriptions.
2019-07-16 13:07:56 +02:00
Dmitry Vyukov
7e921b852d dashboard/app: add an empty test file
blaze+tricoder fail when all test files are excluded by tags.
Work around the bug by adding an empty test file.
2019-07-16 12:44:02 +02:00
Eric Biggers
f27c4411ef sys/linux: update fs-verity descriptions
The fs-verity API was redesigned, and we're planning to re-add the
fs-verity patches to linux-next soon.  Get the syzkaller descriptions up
to date with the new API [1]

[1] https://lkml.kernel.org/linux-fsdevel/20190701153237.1777-4-ebiggers@kernel.org
2019-07-16 12:10:18 +02:00
Paul Chaignon
36835e4e11 sys/linux: update BPF constants
Signed-off-by: Paul Chaignon <paul.chaignon@orange.com>
2019-07-16 11:38:43 +02:00
Dmitry Vyukov
a963689197 pkg/log: rename -v to -vv
To avoid conflicts with programs that import both syzkaller packages
and github.com/golang/glog which also defines -v flag.
2019-07-16 11:18:12 +02:00
Eric Biggers
84d08cdf2d sys/linux: update for v5.3 again
Update descriptions to be compatible with latest linux-next
(next-20190715), which in theory will match v5.3-rc1 when the merge
window closes.

- KEYCTL_GRANT_PERMISSION was reverted.  So remove its description.

- CRYPTO_ALG_TYPE_DIGEST was removed.  So remove its description.

- IB_QP_CREATE_SIGNATURE_EN was renamed to IB_QP_CREATE_INTEGRITY_EN.

Also remove the sys/linux/rdma_*.const files which were incorrectly
checked into git.  The real copies of those files are in
sys/linux/dev_infiniband_rdma_*.const.

For now I did *not* check for other new APIs that need to be described.
2019-07-16 10:08:43 +02:00
Alexander Popov
6732e2c033 qemu: support advanced hard drive configurations
Currently the 'image_device' config option in qemu.go doesn't properly
support the modern '-drive' argument for describing qemu hard disks.

In fact the various old ways to define qemu drives all boil down to
the common form '-drive if=TYPE,bus=BUS,unit=UNIT,OPTS...'
For example '-hda img' is equivalent to '-drive index=0,media=disk,file=img'.

Let's make the 'image_device' config option support both forms.

Signed-off-by: Alexander Popov <alex.popov@linux.com>
2019-07-15 18:12:29 +03:00
Siddharth M
0b48f538f1 pkg/report: enable feature comparisons for NetBSD 2019-07-15 18:10:08 +03:00
Eric Biggers
139ac68a73 sys/linux: update key descriptions
- Add KEYCTL_MOVE (new in v5.3)
- Add KEYCTL_CAPABILITIES (new in v5.3)
- Add KEYCTL_GRANT_PERMISSION (new in v5.3)
- Remove KEY_PERM_UNDEF (was only ever in an internal kernel header,
  not in UAPI; removed in v5.3)
2019-07-15 13:44:02 +03:00
R3x
a827bf70d7 pkg/report: Fix corrupted reports 2019-07-14 19:22:39 +03:00
Siddharth M
2bbe2f0558 executor: add network packet injection for NetBSD
* Initial Commit

* working build of network packet fuzzing

* Add missed csource file

* pkg/csource: fix build

* executor/common_bsd.h: Add comment stating reason for ifconfig create
2019-07-14 17:59:29 +03:00
Anton Lindqvist
e6fb0f1316 docs/openbsd: update found_bugs.md 2019-07-13 09:20:32 +02:00
Andrey Konovalov
baa5258a5e executor: fix out-of-bounds in USB fuzzing code
We might not have any string descriptors provided at all, use a hardcoded
string in this case.
2019-07-11 15:44:30 +02:00
Andrey Konovalov
186a30b993 executor: update USB fuzzing code to use new kernel API
The kernel API has changed and now differentiates between IN and OUT
control requests.
2019-07-11 15:03:48 +02:00
Anton Lindqvist
ff7bf04c7c sys/openbsd: add diskmap descriptions 2019-07-10 22:37:39 +02:00
Dmitry Vyukov
f62e1e85cf dashboard/config: update linux configs
Update configs to the current linux-next (16c474c9ba39ede5fd1cd835ac52b3760d7820b7).
Enable CONFIG_GVE=y, we may be able to reach it on GCE.
2019-07-05 11:51:08 +02:00
Denis Efremov
a0626693a0 sys/linux: fix floppy description
* sys/linux: fix floppy description

Fix typo in the FDGETPRM ioctl.

* sys/linux: extract && generate for floppy

Signed-off-by: Denis Efremov <efremov@linux.com>
2019-07-05 09:16:10 +02:00
Anton Lindqvist
429efa16d6 executor: make errors during thread creation exit zero
On OpenBSD, the executor sometimes manages to set the memory resource
limit 0 causing any following memory allocation to fail. Since threads
are potentially created from such a thread which cannot allocate any
memory, the executor will exit non-zero which in turn will cause
false-positive panics to be reported. For more info see the
discussion[1] in PR #1243.

Instead, if hitting a fatal error during thread creation exit zero.

[1] https://github.com/google/syzkaller/pull/1243
2019-07-04 20:26:46 +02:00
Willem de Bruijn
deef5fbc83 docs/linux: add references to syzkaller build instructions
In the various linux build instructions, add pointers to the main
doc with instructions for building syzkaller.

These instructions were present before commit d23e90a7b4 ("all:
switch to Go 1.12"). They were duplicated across files. Since the
commit the instructions are in one place. Make it easier to find
them from the platform-specific setup guides.

Also clarify in the x86_64 guide that using a precompiled compiler
from the supplied list is optional if the distribution provided
compiler is recent enough. Before commit d28f4ce ("Update
setup_ubuntu-host_qemu-vm_x86-64-kernel.md") the file had explicit
build instructions. Those are no longer needed.
2019-07-04 19:37:16 +02:00
Dmitry Vyukov
55565fa037 prog: fix minimization bugs
Fix several nasty bugs in minimization that could lead
to almost arbitrary results. These bugs affected both
crash minimization and corpus population.
Extend the randomized test to catch these bugs.
Add additional asserts to code to catch similar bugs in future.

Reported-by @xairy
2019-07-02 14:49:44 +02:00
Dmitry Vyukov
5f175e9c09 pkg/report: ignore __wake_up function on linux
They are very generic and a bug is almost always in the parent frame.
2019-07-02 09:03:49 +02:00
Andrey Konovalov
cccc4302d7 sys/linux, executor: run make extract and generate 2019-07-01 17:26:35 +02:00
Andrey Konovalov
13c3a99962 sys/linux, executor: add syz_usb_ep_read syzkall
syz_usb_ep_read reads data from USB endpoints other than #0.
2019-07-01 17:26:35 +02:00
R3x
df9270ba7f pkg/report: fix ASan report parsing bug 2019-07-01 16:28:15 +02:00