From e962f59f57afaccd1d28bfdbb2b91d0110acd285 Mon Sep 17 00:00:00 2001
From: Aleksandr Nogikh <nogikh@google.com>
Date: Wed, 5 Apr 2023 17:45:15 +0200
Subject: pkg/subsystem: prioritize repro subsystems correctly

We currently prioritize a subsystem if it's present in all reproducers
and that is supported by at least one guilty path among the considered
crashes.

Due to a small bug in the code we only considered it to be supported if
the guilty path belonged to one of parent subsystems of the one
mentioned in the reproducer. It's fair to also consider full overlap
between them.
---
 pkg/subsystem/extractor.go        |  2 +-
 pkg/subsystem/lists/linux_test.go | 34 ++++++++++++++++++++++++++++++++++
 2 files changed, 35 insertions(+), 1 deletion(-)

diff --git a/pkg/subsystem/extractor.go b/pkg/subsystem/extractor.go
index 996560a31..9794642d3 100644
--- a/pkg/subsystem/extractor.go
+++ b/pkg/subsystem/extractor.go
@@ -52,7 +52,6 @@ func (e *Extractor) Extract(crashes []*Crash) []*Subsystem {
 			}
 		}
 	}
-
 	// It can be the case that guilty paths point to several subsystems, but the reproducer
 	// can clearly point to one of them.
 	if len(fromRepro) > 0 {
@@ -62,6 +61,7 @@ func (e *Extractor) Extract(crashes []*Crash) []*Subsystem {
 		newSubsystems := []*Subsystem{}
 		for _, reproSubsystem := range fromRepro {
 			parents := reproSubsystem.ReachableParents()
+			parents[reproSubsystem] = struct{}{} // also include the subsystem itself
 			for _, subsystem := range withoutParents {
 				if _, ok := parents[subsystem]; ok {
 					newSubsystems = append(newSubsystems, reproSubsystem)
diff --git a/pkg/subsystem/lists/linux_test.go b/pkg/subsystem/lists/linux_test.go
index 6107ff68f..075a3d26d 100644
--- a/pkg/subsystem/lists/linux_test.go
+++ b/pkg/subsystem/lists/linux_test.go
@@ -97,6 +97,40 @@ syz_usb_connect(0x0, 0x24, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000abbe6740e917
 			},
 			expect: []string{"dri"},
 		},
+		{
+			name: "ntfs bug with one ntfs guilty path",
+			crashes: []*subsystem.Crash{
+				{
+					GuiltyPath: `mm/folio-compat.c`,
+				},
+				{
+					GuiltyPath: `mm/folio-compat.c`,
+				},
+				{
+					GuiltyPath: `mm/folio-compat.c`,
+				},
+				{
+					// By chance just one was correct.
+					GuiltyPath: `fs/ntfs3/frecord.c`,
+					SyzRepro: []byte(`
+# https://syzkaller.appspot.com/bug?id=9a239048a7fff1d8d9b276b240522a2293468dba
+# See https://goo.gl/kgGztJ for information about syzkaller reproducers.
+#{"procs":1,"slowdown":1,"sandbox":"","sandbox_arg":0,"close_fds":false}
+syz_mount_image$ntfs3(&(0x7f000001f740), &(0x7f000001f780)='./file0\x00', 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="64697363==")
+`),
+				},
+				{
+					GuiltyPath: `mm/folio-compat.c`,
+					SyzRepro: []byte(`
+# https://syzkaller.appspot.com/bug?id=56e9aec9bc3b5378c9b231a3f4b3329cf9f80990
+# See https://goo.gl/kgGztJ for information about syzkaller reproducers.
+#{"procs":1,"slowdown":1,"sandbox":"none","sandbox_arg":0,"tun":true,"netdev":true,"close_fds":true}
+syz_mount_image$ntfs3(&(0x7f000001f740), &(0x7f000001f780)='./file0\x00', 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="64697363==")
+`),
+				},
+			},
+			expect: []string{"ntfs3"},
+		},
 	}
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-- 
cgit mrf-deployment