| Commit message (Collapse) | Author | Age | Files | Lines |
| ... | |
| |
|
|
| |
These are just informative messages.
|
| |
|
|
|
| |
Like many other str* functions, strstr() is not interesting and should
be ignored.
|
| |
|
|
|
|
|
|
|
| |
Bug title in https://syzkaller.appspot.com/bug?extid=17a061f6132066e9fb95 is
"KMSAN: kernel-infoleak in copy_page_to_iter (4)", which is too generic
and may potentially correspond to multiple bugs. Ignore
copy_page_to_iter() and copy_folio_to_iter() to make it more meaningful.
In addition, speculatively ignore copy_page_from_iter().
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
It was initially proposed in
https://github.com/google/syzkaller/issues/1575 that KMSAN reports with
the same origin should be clustered together using an alt title.
This however turns out to be too aggressive: certain KMSAN reports have
their uninitialized values originating from common functions - this
leads to too many KMSAN reports being glued together. Because KMSAN
reports can be also clustered with KASAN reports or other kernel panics,
ultimately seemingly unrelated crashes are considered similar just
because they share their top frames with two KMSAN reports that, in
turn, share the same origin.
The resulting issues on the dashboard look confusing to the users, they
are hard to find and require manual untangling, which probably outweighs
the benefits of having KMSAN issues with exactly the same origin
clustered together.
For other types of KMSAN reports (infoleaks and use-after-frees) the alt
titles are preserved. First, there are fewer of those on the dashboard.
Second, they are rarely grouped together with non-KASAN reports and
are less likely to cause a lot of mess.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
When a "fatal error:" bug is reported, this usually means that syzkaller
itself had a memory corruption (except in the gVisor fuzzing case where
this could be an actual bug in gVisor)
Most likely, this is due to a kernel that went wild and corrupted the
syzkaller address space, but in that case the exact details of what part
of the runtime failed are rarely relevant.
This gathers all these go runtime errors under one umbrella so they are
easier to track. Except for gVisor on which the logic is kept the same
as existing.
Add three test cases to the linux reporting:
- 705 (equivalent to the current all/report/7) to make sure Go OOO are
suppressed (they have a different title now but still get suppressed)
- 706 (equivalent to the current all/report/8) to make sure that ALSA
"fatal errors" are not handled as Go fatal errors
- 707 (new) to make sure that reports like
https://syzkaller.appspot.com/bug?extid=3f00d7083c52713ba3b0 are
re-named to "go runtime error"
|
| |
|
|
| |
Newer arm compiler versions produce somewhat different output.
|
| |
|
|
| |
It refers to SYZFAIL and SYZFATAL errors.
|
| |
|
|
| |
Amend oops and oopsFormat to contain report type.
|
| |
|
|
| |
Reference: https://syzkaller.appspot.com/bug?extid=c370a63abf53498ae3e2
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Ignore the following functions:
- folio_alloc
- filemap_alloc_folio
- __filemap_get_folio
- find_or_create_page
- do_read_cache_folio
- read_cache_page
- pagecache_get_page
- grab_cache_page_write_begin
that perform allocations within mm/filemap.c
This is to defeat an overly eager report clusterization in
https://syzkaller.appspot.com/bug?extid=828dfc12440b4f6f305d
|
| |
|
|
| |
See https://syzkaller.appspot.com/bug?extid=d8fc21bfa138a5ae916d
|
| |
|
|
| |
Sample bug: https://syzkaller.appspot.com/bug?extid=fae676d3cf469331fc89
|
| |
|
|
|
|
| |
They are misleading guilty file detection.
See https://groups.google.com/g/syzkaller-bugs/c/T6Z_5Gh1Qio
|
| |
|
|
| |
Based on https://syzkaller.appspot.com/bug?extid=64b645917ce07d89bde5
|
| |
|
|
| |
See https://syzkaller.appspot.com/bug?id=88b03615bcf53f3cdc9b987ad26207a9b8d47d8f
|
| |
|
|
| |
Also, skip more workqueue functions.
|
| | |
|
| | |
|
| |
|
|
|
| |
Ignore arch/arm64/kernel/process.c and some of page cache sources, as
the real problem will much more likely lie in the caller.
|
| |
|
|
| |
Its caller is much more informative.
|
| |
|
|
|
| |
For context see:
https://lore.kernel.org/all/CACT4Y+ZMXN=smH-0FN4Ui0zm6P-c=eEwG6fNJ9deTnc0M099UQ@mail.gmail.com/T/#t
|
| | |
|
| |
|
|
|
| |
Of course something in the kernel prints "fatal error"
and it's not a kernel bug.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
This several small improvements:
1. Move these patterns into the common part.
We run Go code on (almost) all OSes and error messages
are the same for all of them.
2. Detect "fatal error:" as a bug as well.
This is what I currently see from Go 1.20 runtime,
but we don't recognize it, so these reports probably
go into "lost connection" bucket now (bad).
3. Add a pattern for panic(ENOMEM) message.
pkg/image/compression_optimized.go can produce it
on mmap failure.
4. Add tests.
|
| |
|
|
|
| |
Currently we return ".", which is not really expected by all the
surrounding logic.
|
| | |
|
| |
|
|
|
|
| |
The existing code is broken - the console output does not contain a
whitespace before the apic_timer_interrupt frame. Also, add the
apic_timer source files to the excluded ones.
|
| | |
|
| |
|
|
| |
This frame also ditributes work to other functions.
|
| |
|
|
|
|
|
| |
Refactor the existing guilty path testing code to allow for simpler
extension.
Reuse the resulting code to invoke guilty_raw tests.
|
| |
|
|
|
| |
The family of such functions is big and keeps on growing. Add them to
the generic skipPatterns code.
|
| |
|
|
| |
Fixes #3621
|
| |
|
|
|
|
|
| |
Two KMSAN reports belonging to different subsystems ended up being merged
together because they both had netlink_ack in their origin. Let's skip
this frame as well as netlink_rcv_skb, which is common among several
network protocols.
|
| | |
|
| | |
|
| | |
|
| | |
|
| |
|
|
|
|
|
| |
We have lots of report "in queue_work".
They are usually due to the caller bugs.
Currently this leads to glueing of unrelated bugs together.
Skip queue_work to prevent this glueing.
|
| | |
|
| |
|
|
|
|
| |
Turns out a lot of KMSAN bugs get merged together because their origin
is "allocate_slab". Make sure we skip that frame when parsing stacks, so
that a different origin frame is used.
|
| |
|
|
|
|
|
|
| |
We took the exact top frame for these reports.
As the result the frame filtering logic wasn't working
and some bugs were attributed to very common functions
like _atomic_dec_and_lock/kmem_cache_alloc_node.
Parse the full stack instead.
|
| | |
|
| | |
|
| |
|
|
|
|
|
| |
Extract guilty frame from arm64 stack overflow reports.
Add AltTitle for stack overflow reports, since we now
have 3 different formats (arm64 and x86 produce different reports).
Improve stall frame extraction for arm64.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
We used to use "kernel BUG at source:line" for BUGs.
Later we switch to "kernel BUG in function" as a better title,
but kept the old title as alt title so that the new titles are
merged with existing bugs.
Now it's causing issues: the following 2 reports got merged together:
kernel BUG at lib/string_helpers.c:983
Call Trace:
__fortify_strlen include/linux/fortify-string.h:144 [inline]
strlcpy include/linux/fortify-string.h:159 [inline]
init_names fs/gfs2/ops_fstype.c:385 [inline]
gfs2_fill_super+0x1226/0x27f0 fs/gfs2/ops_fstype.c:1187
kernel BUG at lib/string_helpers.c:980!
Call Trace:
__fortify_strlen include/linux/fortify-string.h:128 [inline]
strlcpy include/linux/fortify-string.h:143 [inline]
__set_page_owner_handle+0x2b1/0x3e0 mm/page_owner.c:171
__set_page_owner+0x3e/0x50 mm/page_owner.c:190
prep_new_page mm/page_alloc.c:2441 [inline]
while they are unrelated.
A BUG in a common ignored helper will glue all reports together.
We added the alt title in Jan 2021 (de4e4f4d8b582).
All existing bugs should have been merged already,
so we can safely remove the alt title now.
|
| |
|
|
| |
Crashes are much more likely to be caused by their callers.
|
| | |
|
| | |
|
| |
|
|
|
|
|
|
| |
Currently "./syzkaller-testdir264563108" is replaced with "./syzkaller-testdir2ADDR".
That's due to a bug in the ADDR replacement rule. Fix it.
Also improve NUM replement b/c currently "testdir264563108" is considered
as it can be a function name.
|
| |
|
|
|
|
| |
We ignore some of the kobject frames, but there is also kobject_cleanup
that we were missing (or maybe was added recently).
Make refcount/kobject patterns more robust.
|