| Commit message (Collapse) | Author | Age | Files | Lines |
| |
|
|
|
|
|
|
| |
This ability was never used but we maintain a bunch of code for it.
syzkaller also recently learned to spoof this error code
with some ptrace magic (probably intercepted control flow again
and exploited executor binary).
Drop all of it.
|
| |
|
|
| |
Skip various *_trylock functions as we do for *_lock functions.
|
| |
|
|
| |
Update #933
|
| |
|
|
| |
Update #933
|
| |
|
|
|
|
| |
Oops messages frequently induce possible deadlock reports
because oops reporting introduces unexpected locking chains.
So if we have enough of the actual oops, strip the deadlock message.
|
| |
|
|
|
| |
If we have contexts, we don't need to strip the first report
at the beginning of the second report.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
CONFIG_PRINTK_CALLER has reached linux-next:
https://groups.google.com/d/msg/syzkaller/xEDUgkgFvL8/d5bBS3BJBwAJ
Enable CONFIG_PRINTK_CALLER and support parsing of its output format.
This gives us several advantages:
- output from different contexts don't intermix
- intermixed output doesn't cause corrupted reports
- we can keep larger prefix since we know it comes from the same task
Credit for the kernel part goes to Tetsuo Handa.
Also Sergey Senozhatsky and Petr Mladek for reviews of the kernel part.
Fixes #596
Fixes #600
|
| | |
|
| | |
|
| |
|
|
|
|
|
|
|
|
| |
Ignore double faults as start of a second report.
Double fault can happen during handling of paging faults
if memory is badly corrupted. Also it usually happens
synchronously, which means that maybe the report is not corrupted.
But of course it can come from another CPU as well.
Add more interesting test cases.
|
| | |
|
| | |
|
| |
|
|
| |
Add another anchor frame.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
| |
We started detecting all kernel reboots as corrupted,
because we considered that after any "Allocated" line
a stack trace should follow.
Kernel boot output now contains:
ima: Allocated hash algorithm: sha256
and there is no stack trace after that.
1. Refine stack trace regexps (we actually want to look for
"Allocated by task PID:" lines).
2. Don't check stacks if report format says that it
does not contain stacks.
|
| |
|
|
|
|
|
| |
Amusing that's another kernel failure mode that we are discovering after 3 years.
One can't even reliably understand when kernel has crashed.
I wonder if syzkaller never hit these, or just never recognized and reported them. We will see.
Don't even want to think about arm kernel output parsing.
|
| |
|
|
|
|
|
| |
This is called from kfree in the added test.
We already ignore everything related to kmalloc/free
and e.g. arch/.*/mm/fault.c, so it looks reasonable
to ignore this one too.
|
| | |
|
| |
|
|
| |
Skip few more common allocation functions.
|
| |
|
|
|
| |
Account for the case that some file names can appear _before_ crash report starts.
Start extracting guilty file starting from StartPos.
|
| | |
|
| |
|
|
|
|
| |
Extract guilty frame from stack.
Add few more ignored functions.
Add more tests.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
During rcu stalls and cpu lockups kernel loops in some part of code,
usually across several functions. When the stall is detected, traceback
points to a random stack within the looping code. We generally take
the top function in the stack (with few exceptions) as the bug identity.
As the result stalls with the same root would produce multiple reports
in different functions, which is bad.
Instead we identify a representative function deeper in the stack.
For most syscalls it can be the syscall entry function (e.g. SyS_timer_create).
However, for highly discriminated functions syscalls like ioctl/read/write/connect
we take the previous function (e.g. for connect the one that points to exact
protocol, or for ioctl the one that is related to the device).
Fixes #710
|
| | |
|
| | |
|
| | |
|
| |
|
|
|
|
| |
Currently this report is named:
"general protection fault in perf_trace_lock"
which is bad.
|
| | |
|
| |
|
|
| |
kernels
|
| |
|
|
| |
This report does not have stack trace, so we always detected it as corrupted.
|
| | |
|
| |
|
|
| |
Kernel keeps inventing new formats...
|
| | |
|
| | |
|
| | |
|
| |
|
|
|
| |
We fixed only 1, but new format affects all lockdep reports.
Fix all of them.
|
| | |
|
| |
|
|
|
|
|
|
| |
Strip non-printable characters from titles.
Trim whitespaces on both ends.
Replace tabs with spaces.
Remove duplicate spaces.
Reduce max title length.
|
| | |
|
| | |
|
| |
|
|
|
|
| |
This leads to unbounded number of bug reports as syzkaller
can generate new device names dynamically.
Exclude actual device name from title.
|
| | |
|
| |
|
|
|
|
| |
Add special report format for hangs in unregister_netdevice.
And support new format of lockdep reports (otherwise they all
are marked as corrupted).
|
| |
|
|
|
|
|
|
|
|
|
| |
1. If we see should_failslab frames during report parsing,
that's a corrupted report with intermixed frames from
fault injection stack.
2. If we matched report title and this report should contains
a guilty stack frame, but we failed to extract any frame,
consider it as corrupted.
New tests added. Also one of the old tests is fixed.
|
| |
|
|
|
| |
KMSAN reports can be short, but still include full stack.
The added test is only 28 lines, so reduce the threshold from 40 to 25 lines.
|
| |
|
|
| |
kcov frame can be present in rcu stalls, ignore it.
|
| |
|
|
|
| |
List functions are very generic and we see lots of different
bug merged into "bug-type in list_function".
|
| | |
|
| | |
|
| | |
|
| |
|
|
|
|
| |
The test case causes rep.StartPos == secondReportPos,
which then makes extraction of description fail,
because report is empty.
|