diff options
| author | Aleksandr Nogikh <nogikh@google.com> | 2023-04-05 17:45:15 +0200 |
|---|---|---|
| committer | Aleksandr Nogikh <wp32pw@gmail.com> | 2023-04-06 10:14:04 +0200 |
| commit | e962f59f57afaccd1d28bfdbb2b91d0110acd285 (patch) | |
| tree | 186eb96b279ff42db0426ae64517529a5c9d4002 /pkg | |
| parent | 8b8349653b892d7d34714888496b75f9bf158880 (diff) | |
pkg/subsystem: prioritize repro subsystems correctly
We currently prioritize a subsystem if it's present in all reproducers
and that is supported by at least one guilty path among the considered
crashes.
Due to a small bug in the code we only considered it to be supported if
the guilty path belonged to one of parent subsystems of the one
mentioned in the reproducer. It's fair to also consider full overlap
between them.
Diffstat (limited to 'pkg')
| -rw-r--r-- | pkg/subsystem/extractor.go | 2 | ||||
| -rw-r--r-- | pkg/subsystem/lists/linux_test.go | 34 |
2 files changed, 35 insertions, 1 deletions
diff --git a/pkg/subsystem/extractor.go b/pkg/subsystem/extractor.go index 996560a31..9794642d3 100644 --- a/pkg/subsystem/extractor.go +++ b/pkg/subsystem/extractor.go @@ -52,7 +52,6 @@ func (e *Extractor) Extract(crashes []*Crash) []*Subsystem { } } } - // It can be the case that guilty paths point to several subsystems, but the reproducer // can clearly point to one of them. if len(fromRepro) > 0 { @@ -62,6 +61,7 @@ func (e *Extractor) Extract(crashes []*Crash) []*Subsystem { newSubsystems := []*Subsystem{} for _, reproSubsystem := range fromRepro { parents := reproSubsystem.ReachableParents() + parents[reproSubsystem] = struct{}{} // also include the subsystem itself for _, subsystem := range withoutParents { if _, ok := parents[subsystem]; ok { newSubsystems = append(newSubsystems, reproSubsystem) diff --git a/pkg/subsystem/lists/linux_test.go b/pkg/subsystem/lists/linux_test.go index 6107ff68f..075a3d26d 100644 --- a/pkg/subsystem/lists/linux_test.go +++ b/pkg/subsystem/lists/linux_test.go @@ -97,6 +97,40 @@ syz_usb_connect(0x0, 0x24, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000abbe6740e917 }, expect: []string{"dri"}, }, + { + name: "ntfs bug with one ntfs guilty path", + crashes: []*subsystem.Crash{ + { + GuiltyPath: `mm/folio-compat.c`, + }, + { + GuiltyPath: `mm/folio-compat.c`, + }, + { + GuiltyPath: `mm/folio-compat.c`, + }, + { + // By chance just one was correct. + GuiltyPath: `fs/ntfs3/frecord.c`, + SyzRepro: []byte(` +# https://syzkaller.appspot.com/bug?id=9a239048a7fff1d8d9b276b240522a2293468dba +# See https://goo.gl/kgGztJ for information about syzkaller reproducers. +#{"procs":1,"slowdown":1,"sandbox":"","sandbox_arg":0,"close_fds":false} +syz_mount_image$ntfs3(&(0x7f000001f740), &(0x7f000001f780)='./file0\x00', 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="64697363==") +`), + }, + { + GuiltyPath: `mm/folio-compat.c`, + SyzRepro: []byte(` +# https://syzkaller.appspot.com/bug?id=56e9aec9bc3b5378c9b231a3f4b3329cf9f80990 +# See https://goo.gl/kgGztJ for information about syzkaller reproducers. +#{"procs":1,"slowdown":1,"sandbox":"none","sandbox_arg":0,"tun":true,"netdev":true,"close_fds":true} +syz_mount_image$ntfs3(&(0x7f000001f740), &(0x7f000001f780)='./file0\x00', 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="64697363==") +`), + }, + }, + expect: []string{"ntfs3"}, + }, } for _, test := range tests { t.Run(test.name, func(t *testing.T) { |