| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <CACT4Y+Ynbn9qAmk3jVBs6pUjDAz6gJMD5YHM4+EyzEuwBj+4-Q@mail.gmail.com>
Date: Sun, 8 Apr 2018 15:18:39 +0200
From: Dmitry Vyukov <dvyukov@...gle.com>
To: "Theodore Y. Ts'o" <tytso@....edu>,
Eric Biggers <ebiggers@...gle.com>,
Dave Chinner <david@...morbit.com>,
Matthew Wilcox <willy@...radead.org>,
Dmitry Vyukov <dvyukov@...gle.com>,
linux-fsdevel <linux-fsdevel@...r.kernel.org>,
LKML <linux-kernel@...r.kernel.org>,
syzkaller <syzkaller@...glegroups.com>,
Al Viro <viro@...iv.linux.org.uk>
Subject: Re: Running syzkaller repros using kvm-xfstests
On Sun, Apr 8, 2018 at 8:31 AM, Theodore Y. Ts'o <tytso@....edu> wrote:
> On Thu, Apr 05, 2018 at 09:37:41PM -0400, Theodore Y. Ts'o wrote:
>> Note that I haven't just been complaining about it. I've been working
>> on ways so that the gce-xfstests and kvm-xfstests test appliances can
>> more easily be used to work on Syzbot reports. If I can make myself
>> more efficient, or help other people be more efficient, that's
>> arguably more important than trying to fix some of the 174 currently
>> open Syzbot issues --- unless you can tell me that certain ones are
>> super urgent because they (for example) result in CVSS score > 8.
>
> I've got an initial version of this working for kvm-xfstests. To try
> it out, grab the latest version of xfstests-bld from [1], and the
> kvm-xfstests image from [2]. For people who have never tried using
> kvm-xfstests, see [3].
>
> [1] https://github.com/tytso/xfstests-bld
> [2] https://www.kernel.org/pub/linux/kernel/people/tytso/kvm-xfstests/testing/root_fs.img.x86_64
> [3] https://github.com/tytso/xfstests-bld/blob/master/Documentation/kvm-quickstart.md
>
> If you're interested, please try it out, and send me comments.
>
> Sample usage:
>
> kvm-xfstest syz <path/to/repro.{c,syz}>
> kvm-xfstest syz <URL to repro.{c,syz}>
>
> Example run:
>
> % kvm-xfstests syz https://syzkaller.appspot.com/x/repro.syz?id=5709211904245760
/\/\/\/\/\/\/\/\
Nice!
But note that syzkaller is under active development, so pre-canned
binaries may not always work. Mismatching binary may not understand
all syscalls, fail to parse program, interpret arguments differently,
execute program differently, setup a different environment for the
test, etc. Now a C program captures all of this, because code that
transforms syzkaller programs into C is versioned along with the rest
of the system.
Strictly saying, for syzkaller reproducers one needs to use the exact
syzkaller revision listed along with the reproducer, see for example:
https://syzkaller.appspot.com/bug?id=3fb9c4777053e79a6d2a65ac3738664c87629a21
The "#syz test" syzbot command does this. Using a different syzkaller
revision may or may not work.
> % Total % Received % Xferd Average Speed Time Time Time Current
> Dload Upload Total Spent Left Speed
> 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0100 533 100 533 0 0 2157 0 --:--:-- --:--:-- --:--:-- 2157
> Saved downloaded copy at /tmp/tytso-downloaded-repro.syz
> Networking disabled.
> KERNEL: kernel 4.16.0-xfstests-09576-g38c23685b273 #134 SMP Sun Apr 8 01:36:01 EDT 2018 x86_64
> FSTESTVER: e2fsprogs v1.43.6-85-g7595699d0 (Wed, 6 Sep 2017 22:04:14 -0400)
> FSTESTVER: fio fio-3.2 (Fri, 3 Nov 2017 15:23:49 -0600)
> FSTESTVER: quota 59b280e (Mon, 5 Feb 2018 16:48:22 +0100)
> FSTESTVER: stress-ng 977ae35 (Wed, 6 Sep 2017 23:45:03 -0400)
> FSTESTVER: syzkaller 66f22a7f (Sat, 7 Apr 2018 14:02:03 +0200)
> FSTESTVER: xfsprogs v4.15.1 (Mon, 26 Feb 2018 19:50:56 -0600)
> FSTESTVER: xfstests-bld 3be913e (Sun, 8 Apr 2018 01:19:21 -0400)
> FSTESTVER: xfstests linux-v3.8-1925-g62cc6d02 (Fri, 23 Mar 2018 22:26:41 -0400)
> FSTESTCFG: "all"
> FSTESTSET: "syz/001"
> FSTESTEXC: ""
> FSTESTOPT: "aex"
> MNTOPTS: ""
> CPUS: "2"
> MEM: "1684.65"
> total used free shared buff/cache available
> Mem: 1684 140 1479 8 65 1507
> Swap: 0 0 0
> BEGIN TEST 4k (1 test): Ext4 4k block Sun Apr 8 01:49:02 EDT 2018
> DEVICE: /dev/vdd
> EXT_MKFS_OPTIONS: -b 4096
> EXT_MOUNT_OPTIONS: -o block_validity
> FSTYP -- ext4
> PLATFORM -- Linux/x86_64 kvm-xfstests 4.16.0-xfstests-09576-g38c23685b273
> MKFS_OPTIONS -- -b 4096 /dev/vdc
> MOUNT_OPTIONS -- -o acl,user_xattr -o block_validity /dev/vdc /vdc
>
> syz/001 [01:49:04][ 22.859794] run fstests syz/001 at 2018-04-08 01:49:04
> [ 23.385195] EXT4-fs (vdc): mounted filesystem with ordered data mode. Opts: acl,user_xattr,block_validity
> [ 23.797611] EXT4-fs (vda): shut down requested (0)
> [ 23.855759] ------------[ cut here ]------------
> [ 23.860823] DEBUG_LOCKS_WARN_ON(sem->owner != get_current())
> [ 23.860881] WARNING: CPU: 1 PID: 1332 at /usr/projects/linux/ext4/kernel/locking/rwsem.c:133 up_write+0x113/0x150
> [ 23.876121] CPU: 1 PID: 1332 Comm: syz-executor0 Not tainted 4.16.0-xfstests-09576-g38c23685b273 #134
> [ 23.880836] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014
> [ 23.884080] RIP: 0010:up_write+0x113/0x150
> [ 23.885873] RSP: 0018:ffff88005e0b7a68 EFLAGS: 00010286
> [ 23.887902] RAX: dffffc0000000008 RBX: ffff880066069038 RCX: ffffffff9002f2ce
> [ 23.890392] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000293
> [ 23.892200] RBP: ffff8800660690a0 R08: fffffbfff245d71d R09: fffffbfff245d71d
> [ 23.894877] R10: ffff88007ffca050 R11: fffffbfff245d71c R12: ffff880066068ce0
> [ 23.897244] R13: ffff880066068a30 R14: ffff8800660691e0 R15: ffffffff902fe397
> [ 23.899597] FS: 000000000275c940(0000) GS:ffff88006d600000(0000) knlGS:0000000000000000
> [ 23.902104] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 23.903808] CR2: 00000000006dbb18 CR3: 0000000067c7c000 CR4: 00000000000006e0
> [ 23.905954] Call Trace:
> [ 23.906721] percpu_up_write+0x4c/0x60
> [ 23.907868] thaw_super+0x1c4/0x250
> [ 23.908943] thaw_bdev+0x14a/0x170
> [ 23.909996] ext4_ioctl+0x1fd8/0x39a0
> [ 23.911114] ? alloc_set_pte+0x66d/0xe50
> [ 23.912318] ? ext4_ioctl_setflags+0x600/0x600
> [ 23.913672] ? drop_futex_key_refs.isra.3+0x65/0xb0
> [ 23.915106] ? futex_wake+0x14a/0x400
> [ 23.916242] ? futex_wait_restart+0x1e0/0x1e0
> [ 23.917589] ? lock_contended+0xd30/0xd30
> [ 23.918805] ? alloc_set_pte+0x330/0xe50
> [ 23.920025] ? kvm_sched_clock_read+0x21/0x30
> [ 23.921369] ? sched_clock+0x5/0x10
> [ 23.922442] ? sched_clock_cpu+0x18/0x180
> [ 23.923691] ? do_futex+0x3ab/0xa90
> [ 23.924783] ? exit_robust_list+0x240/0x240
> [ 23.926076] ? do_raw_spin_unlock+0x54/0x220
> [ 23.927388] ? ext4_ioctl_setflags+0x600/0x600
> [ 23.928758] do_vfs_ioctl+0x18b/0xfb0
> [ 23.929893] ? ioctl_preallocate+0x1a0/0x1a0
> [ 23.931204] ? SyS_futex+0x1c9/0x270
> [ 23.932304] ? SyS_futex+0x1d2/0x270
> [ 23.933412] ? do_futex+0xa90/0xa90
> [ 23.934502] ? up_read+0x1c/0x110
> [ 23.935532] ksys_ioctl+0x42/0x80
> [ 23.936564] SyS_ioctl+0x23/0x30
> [ 23.937567] ? ksys_ioctl+0x80/0x80
> [ 23.938649] do_syscall_64+0x1a0/0x640
> [ 23.939813] entry_SYSCALL_64_after_hwframe+0x42/0xb7
> [ 23.941360] RIP: 0033:0x455289
> [ 23.942298] RSP: 002b:00007ffea24780d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
> [ 23.944588] RAX: ffffffffffffffda RBX: 000000000070bea0 RCX: 0000000000455289
> [ 23.946762] RDX: 0000000020000100 RSI: 000000008004587d RDI: 0000000000000003
> [ 23.948924] RBP: 000000000275c914 R08: 0000000000000000 R09: 0000000000000000
> [ 23.951102] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
> [ 23.953287] R13: 00000000000001c5 R14: 00000000006dbb18 R15: 00000000006d90a0
> [ 23.955435] Code: 83 e0 07 83 c0 03 38 d0 7c 04 84 d2 75 48 8b 05 14 d0 c2 03 85 c0 75 86 48 c7 c6 60 2c c6 91 48 c7 c7 20 2c c6 91 e8 ad da f1 ff <0f> 0b e9 6c ff ff ff e8 01 a1 2d 00 e9 2a ff ff ff 48 89 ef e8
> [ 23.960064] ---[ end trace f542ead798faa3a9 ]---
> ....
Powered by blists - more mailing lists