| Commit message (Collapse) | Author | Age | Files | Lines |
|---|
| | |
|
| |
|
|
| |
Add another anchor frame.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
| |
We started detecting all kernel reboots as corrupted,
because we considered that after any "Allocated" line
a stack trace should follow.
Kernel boot output now contains:
ima: Allocated hash algorithm: sha256
and there is no stack trace after that.
1. Refine stack trace regexps (we actually want to look for
"Allocated by task PID:" lines).
2. Don't check stacks if report format says that it
does not contain stacks.
|
| |
|
|
|
|
|
| |
Amusing that's another kernel failure mode that we are discovering after 3 years.
One can't even reliably understand when kernel has crashed.
I wonder if syzkaller never hit these, or just never recognized and reported them. We will see.
Don't even want to think about arm kernel output parsing.
|
| |
|
|
|
|
|
| |
This is called from kfree in the added test.
We already ignore everything related to kmalloc/free
and e.g. arch/.*/mm/fault.c, so it looks reasonable
to ignore this one too.
|
| | |
|
| |
|
|
| |
Skip few more common allocation functions.
|
| |
|
|
|
| |
Account for the case that some file names can appear _before_ crash report starts.
Start extracting guilty file starting from StartPos.
|
| | |
|
| |
|
|
|
|
| |
Extract guilty frame from stack.
Add few more ignored functions.
Add more tests.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
During rcu stalls and cpu lockups kernel loops in some part of code,
usually across several functions. When the stall is detected, traceback
points to a random stack within the looping code. We generally take
the top function in the stack (with few exceptions) as the bug identity.
As the result stalls with the same root would produce multiple reports
in different functions, which is bad.
Instead we identify a representative function deeper in the stack.
For most syscalls it can be the syscall entry function (e.g. SyS_timer_create).
However, for highly discriminated functions syscalls like ioctl/read/write/connect
we take the previous function (e.g. for connect the one that points to exact
protocol, or for ioctl the one that is related to the device).
Fixes #710
|
| | |
|
| | |
|
| | |
|
| |
|
|
|
|
| |
Currently this report is named:
"general protection fault in perf_trace_lock"
which is bad.
|
| | |
|
| |
|
|
| |
kernels
|
| |
|
|
| |
This report does not have stack trace, so we always detected it as corrupted.
|
| | |
|
| |
|
|
| |
Kernel keeps inventing new formats...
|
| | |
|
| | |
|
| | |
|
| |
|
|
|
| |
We fixed only 1, but new format affects all lockdep reports.
Fix all of them.
|
| | |
|
| |
|
|
|
|
|
|
| |
Strip non-printable characters from titles.
Trim whitespaces on both ends.
Replace tabs with spaces.
Remove duplicate spaces.
Reduce max title length.
|
| | |
|
| | |
|
| |
|
|
|
|
| |
This leads to unbounded number of bug reports as syzkaller
can generate new device names dynamically.
Exclude actual device name from title.
|
| | |
|
| |
|
|
|
|
| |
Add special report format for hangs in unregister_netdevice.
And support new format of lockdep reports (otherwise they all
are marked as corrupted).
|
| |
|
|
|
|
|
|
|
|
|
| |
1. If we see should_failslab frames during report parsing,
that's a corrupted report with intermixed frames from
fault injection stack.
2. If we matched report title and this report should contains
a guilty stack frame, but we failed to extract any frame,
consider it as corrupted.
New tests added. Also one of the old tests is fixed.
|
| |
|
|
|
| |
KMSAN reports can be short, but still include full stack.
The added test is only 28 lines, so reduce the threshold from 40 to 25 lines.
|
| |
|
|
| |
kcov frame can be present in rcu stalls, ignore it.
|
| |
|
|
|
| |
List functions are very generic and we see lots of different
bug merged into "bug-type in list_function".
|
| | |
|
| | |
|
| | |
|
| |
|
|
|
|
| |
The test case causes rep.StartPos == secondReportPos,
which then makes extraction of description fail,
because report is empty.
|
| | |
|
| |
|
|
|
|
| |
The problem is with "BUG: KASAN: (.*)" match which matches
just anything however much it is corrupted.
Mark this match as corrupted.
|
| | |
|
| | |
|
| | |
|
| |
|
|
|
|
|
| |
Detect informational kernel reports that are not bugs in itself,
but contain stack traces. If we see them in the middle of another
report, we know stacks are intermixed and the report is potentially
corrupted.
|
| | |
|
| | |
|
| | |
|
| |
|
|
|
|
|
|
|
|
| |
1. Make extractStackFrame more picky about stray frames.
This fixes some TODO's in tests where we matched completley
unrelated frames printed by another task.
2. Extract KASAN guilty frame from report header
if the frame should not be skipped (e.g. not __lock_acquire).
This makes parsing more tolerant to corrupted reports.
|
| |
|
|
|
|
|
| |
If there are more than one report, detect where the second
report starts and extract description only from the first report.
There are too many cases where several reports gets intermixed
and as the result we extract bogus description.
|
