Commit Graph

4864 Commits

Author SHA1 Message Date
Dmitry Vyukov
2e9971bbbf
Update found_bugs.md 2020-03-07 07:46:22 +01:00
Dmitry Vyukov
fd2a5f28eb executor: prevent "NMI handler took too long" messages
nmi_check_duration() prints "INFO: NMI handler took too long" on slow debug kernels.
It happens a lot in qemu, and the messages are frequently corrupted
(intermixed with other kernel output as they are printed from NMI)
and are not matched against the suppression in pkg/report.
This write prevents these messages from being printed.
2020-03-06 13:38:53 +01:00
Dmitry Vyukov
7fb694ef82 prog: sort enabled syscalls for determinism
Makes tests deterministic and syz-mutate with -seed flag.

Pointed out by Jordan Frank (@jwf).
2020-03-06 09:01:48 +01:00
Dmitry Vyukov
850c989d4f dashboard/config: update linux config to 5.6.0-rc4 2020-03-05 17:50:17 +01:00
Anton Lindqvist
b655d91b8c sys/openbsd: prevent killing the ssh VM connection
This is one of the root causes of the 'no output from test machine'
panic. Issuing a DIOCKILLSTATES ioctl on a /dev/pf file descriptor will
cause state associated with ongoing connections to be purged;
effectively killing the ssh connection to the VM.

Including net/pfvar.h is necessary in order to make use of the
DIOCKILLSTATES define.
2020-03-05 09:14:28 +01:00
Andrey Konovalov
576fb9bc34 sys, docs: rename syzcall to pseudo-syscall 2020-03-04 19:28:09 +01:00
Anton Lindqvist
09d53fbb27 sys/syz-extract: favor clang on OpenBSD
Clang is the default compiler on amd64 which is the only supported
architecture by syzkaller right now.
2020-03-04 18:27:18 +01:00
Anton Lindqvist
9ef240be5f sys/syz-extract: fix handling of odd prefixed syscalls on OpenBSD
This makes syz-extract work again on OpenBSD.
2020-03-04 18:27:18 +01:00
Anton Lindqvist
4fb7265b97 sys/openbsd: remove unused define 2020-03-04 18:27:18 +01:00
Andrei Vagin
712198accc gvisor: code cleanups
* use RunCmd instead of osutil.Run.
* remove unneeded type casting from string to []byte.

Signed-off-by: Andrei Vagin <avagin@google.com>
2020-03-04 11:13:09 +01:00
Andrei Vagin
f60dc5d243 manager: check mgr.checkResult before accessing it
panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x30 pc=0xd5ef14]

goroutine 1 [running]:
main.(*Manager).needLocalRepro(0xc000582780, 0xc000416a40, 0xc00307e274)
	/usr/local/google/home/avagin/git/gopath/src/github.com/google/syzkaller/syz-manager/manager.go:697 +0x74
main.(*Manager).saveCrash(0xc000582780, 0xc000416a40, 0x24)
	/usr/local/google/home/avagin/git/gopath/src/github.com/google/syzkaller/syz-manager/manager.go:688 +0xce5
main.(*Manager).vmLoop(0xc000582780)
	/usr/local/google/home/avagin/git/gopath/src/github.com/google/syzkaller/syz-manager/manager.go:398 +0x174b
main.RunManager(0xc000120f00, 0xc000292000, 0xc00001edc0, 0xc000792000, 0xd11, 0x1000)
	/usr/local/google/home/avagin/git/gopath/src/github.com/google/syzkaller/syz-manager/manager.go:270 +0x7a6
main.main()
	/usr/local/google/home/avagin/git/gopath/src/github.com/google/syzkaller/syz-manager/manager.go:135 +0x365

Signed-off-by: Andrei Vagin <avagin@google.com>
2020-03-04 11:13:09 +01:00
Alexander Popov
1f73b64b12 Add my ISPRASOPEN-2019 talk 2020-03-03 13:01:28 +01:00
Dmitry Vyukov
181be2d924 tools/syz-reprolist: cache errors 2020-03-03 09:35:16 +01:00
Dmitry Vyukov
350a7a2647 docs: add talks page
Move all tech talks and articles to a separate page,
there are too many of them now to list on the main page.
Extend talks list with new talks.
2020-03-03 09:02:26 +01:00
Andrei Vagin
4a4e0509de vm/gvisor: allocate a separate stream of GO's runtime messges
GO's runtime calls the write system call twice to print "panic:"
and "the reason of this panic", so here is a race window when
other threads can print something to the log and we will see
something like this:

panic: log messages from another thread
The reason of the panic.

This confuses the syzkaller blacklist and dedup detection.

Signed-off-by: Andrei Vagin <avagin@google.com>
2020-03-01 20:11:27 +01:00
Anton Lindqvist
c88c7b75a4 pkg/report: normalize soreceive report on OpenBSD
At last!
2020-02-27 20:12:33 +01:00
Andrei Vagin
40bcfdd59e executor: don't exit if NETLINK_GENERIC isnt' supported
NETLINK_GENERIC isn't supported in gVisor.

Fixes: c5ed587f4a ("wireguard: setup some initial devices in a triangle")
Signed-off-by: Andrei Vagin <avagin@google.com>
2020-02-27 09:31:19 +01:00
Andrey Konovalov
251aabb77e dashboard/config: switch to ORC unwinder
Jann pointed out that the frame pointer unwinder fails to unwind double
fault stacks. Switch to using the ORC unwinder instead.

https://www.kernel.org/doc/html/latest/x86/orc-unwinder.html

Suggested-by: Jann Horn <jannh@google.com>
2020-02-26 13:28:48 +01:00
Andrey Konovalov
4f58811192
Update internals.md 2020-02-25 15:01:46 +01:00
Andrey Konovalov
0ab513798b
Update setup.md 2020-02-25 14:51:56 +01:00
Andrey Konovalov
b9b2aa2fc2
Update contributing.md 2020-02-25 14:51:46 +01:00
Andrey Konovalov
4c886d6a76
Update setup_ubuntu-host_qemu-vm_x86-64-kernel.md 2020-02-25 14:46:54 +01:00
Andrey Konovalov
8da3e519da
Update contributing.md 2020-02-25 14:42:56 +01:00
Andrey Konovalov
3ab0a8d9ef
Update contributing.md 2020-02-25 14:41:56 +01:00
Andrey Konovalov
b66a1338d0
Update setup_ubuntu-host_qemu-vm_x86-64-kernel.md 2020-02-25 14:37:49 +01:00
Andrey Konovalov
59b5759358
Update external_fuzzing_usb.md 2020-02-24 17:19:54 +01:00
Dmitry Vyukov
03937d8528
Update README.md 2020-02-24 16:27:59 +01:00
Dmitry Vyukov
ff3dfa26b0
Update research.md 2020-02-24 16:12:18 +01:00
Dmitry Vyukov
5e0e1d1450 executor: uncomment accidentially commented code
unshare(CLONE_NEWPID) was commented out in 4428511d10 accidentially.
Uncomment it.
Spotted by @xairy:
4428511d10 (r37456572)
2020-02-24 16:05:43 +01:00
Mark Johnston
1253d6f07f tools: specify the search path for find(1) 2020-02-24 10:18:37 +01:00
Mark Johnston
502ca6cde7 tools: avoid hard-coding the path to interpreters
On BSD they are usually installed under /usr/local/.
2020-02-24 10:18:37 +01:00
Andrey Konovalov
d801cb0223
Update setup_ubuntu-host_qemu-vm_x86-64-kernel.md 2020-02-23 21:45:45 +01:00
Kamil Rytarowski
2c36e7a75f pkg/report: Improve parsing of the UBSan reports 2020-02-22 10:06:14 +01:00
Kamil Rytarowski
775a8882a6 pkg/build: Raise the timeout limit to 30min for building LLVM (tools) 2020-02-22 10:02:01 +01:00
Dmitry Vyukov
2ffa6679c4 sys/linux: add NETLINK_SOCK_DIAG descriptions
Incomplete, but something.
2020-02-21 19:09:56 +01:00
Dmitry Vyukov
a35df73a56 tools/check-copyright.sh: also check cc/h/S files 2020-02-21 17:56:49 +01:00
Dmitry Vyukov
4428511d10 sys/linux: add NETLINK_RDMA descriptions 2020-02-21 17:38:10 +01:00
Dmitry Vyukov
ed54dfe305 sys/linux: add NETLINK_AUDIT descriptions 2020-02-21 11:32:08 +01:00
Dmitry Vyukov
82d32c2951 sys/syz-extract: fix output formatting
Remove spaces in the beginning of the message.
The message is actually multi-line and the spaces
are added only before the first line, which makes
the subsequent lines inconsistently offsetted.
2020-02-21 11:19:15 +01:00
Dmitry Vyukov
b6ed147834 prog: dump orig prog if Deserialize panics
We are seeing some one-off panics during Deserialization
and it's unclear if it's machine memory corrpution or
an actual bug in prog. I leam towards machine memory corruption
but it's impossible to prove without seeing the orig program.

Move git revision to prog and it's more base package
(sys can import prog, prog can't import sys).
2020-02-21 10:22:07 +01:00
Dmitry Vyukov
bd2a74a31f sys/linux: add smc_pnetid genetlink descriptions 2020-02-20 18:42:57 +01:00
Zubin Mithra
02698d8bc4 vm/isolated: add initial support for fuzzing chromebooks
(WIP PR)

Add support for StartupScript.
* Modify Config{} to contain PostRepairScript.
* Allow repair() to execute a startup_script after reboot. The contents
of this script execute on the DUT.

Add pstore support:
* Modify Config{} to contain Pstore.
* Modify Diagnose() to reboot the DUT and fetch pstore logs,
conditional on inst.cfg.Pstore.
* Add readPstoreContents().
* Allow clearing previous pstore logs upon Create() and after use inside
readPstoreContents().
* Fetching pstore crashlogs relies on reliably getting lost connection
on DUT reboot. Use "ServerAliveInterval=6 ServerAliveCountMax=5" ssh
options when running syz-fuzzer with Pstore support enabled.

Allow parsing pstore contents:
* Diagnose() now returns pstore contents.

Refactoring:
* Move out some reusable parts of repair() to waitRebootAndSSH().
* Have an early return inside repair() if inst.waitForSSH() fails.
2020-02-20 17:37:54 +01:00
Leo Neat
81230308c6
CIFuzz: update config file
* Update CIFuzz config

* Update CIFuzz config
2020-02-20 07:22:42 +01:00
Andrey Konovalov
b690a6e336
Update syzbot.md 2020-02-19 14:11:29 +01:00
Andrey Konovalov
47fae6e922
Update syzbot.md 2020-02-19 13:20:36 +01:00
Andrey Konovalov
b4e5deb436
Update syzbot.md 2020-02-19 13:14:38 +01:00
Dmitry Vyukov
135c18aadb tools: add script that checks copyright headers
Fixes #1604
2020-02-18 16:05:10 +01:00
Dmitry Vyukov
012fbc3229 sys/linux: add descriptions of wireguard packets 2020-02-18 10:31:04 +01:00
Dmitry Vyukov
d52d4872e3 sys/linux: don't extract from futex.txt and watch_queue.txt
These are not present in linux-next.
2020-02-18 10:31:03 +01:00
Dmitry Vyukov
105edea6a3 sys/linux: fix udp test
Fix the packet injection in udp test.
Now we know how to do it!
And without IFF_NAPI_FRAGS it actually reaches the socket.

Update #1594
2020-02-18 10:31:02 +01:00