On Mon, Apr 30, 2018 at 5:14 PM, Eric Sandeen <sandeen@xxxxxxxxxxx> wrote: > On 4/30/18 9:02 AM, Dmitry Vyukov wrote: >> On Mon, Apr 30, 2018 at 3:49 PM, Eric Sandeen <sandeen@xxxxxxxxxxx> wrote: > > ... > >>>> It just extracted kernel source file name that looked relevant >>>> to this crash and run get_maintainers.pl on it. >>>> Also the image can contain dynamically generated data, which makes it >>>> impossible to have as a file at all. >>> >>> I guess I'm not sure what this means, can you explain? >> >> Say, a value that we generally pass to close system call is not static >> and can't be dumped to a static file. It's whatever a previous open >> system call has returned. Inside of the program we memorize the return >> value of open in a variable and then pass it to close. This generally >> stands for all system calls. Say, an image can contain an uid, and >> that uid can be obtained from a system call too. > > Ok, but that's the syscall side. You are operating on a static xfs image, > correct? We're only asking for the actual filesystem you're operating > against. Not necessary. Image can be dynamically generate too, all inputs to kernel are generally dynamically generated. > (When I say "image" I am talking only about the filesystem itself, not any > other syzkaller state) OK, let's do it this way. For the first 10 bugs, ask me, and I will do it manually. I am all for automation. And syzbot is already more automated than most kernel testing systems. But, as I said, this is really not-trivial, large amount of work, and is specific to one out of dozens of kernel subsystems. > Ok, backing up more: When you are testing against an xfs filesystem image, where > does that image come from? How is it generated? A quick look at the syzkaller > tree didn't make that clear to me. > > the xfs.repro file you provided at > https://drive.google.com/file/d/1jzhGGe5SBJcqfsjxCLHoh4Kazke1oTfC/view > > is strange, it doesn't even contain AGF blocks; they aren't fuzzed or corrupted, > they are completely zeroed out. I don't know if that's part of the fuzzing, > or what - what steps led to that image? > > Or put another way, how did you arrive at the fs image values in the reproducer, > i.e.: Currently they are completely random, nobody taught syzkaller about AGFs, etc. > oid loop() > { > memcpy((void*)0x20000000, "xfs", 4); > memcpy((void*)0x20000100, "./file0", 8); > *(uint64_t*)0x20000200 = 0x20010000; > memcpy((void*)0x20010000, > "\x58\x46\x53\x42\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x10\x00\x00" > "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x9f\x98" > "\x99\xff\xcb\xa1\x4e\xe6\xad\x52\x08\x20\x67\x09\xed\x75\x00\x00\x00" > "\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x35\xe0\x00\x00\x00\x00" > "\x00\x00\x35\xe1\x00\x00\x00\x00\x00\x00\x35\xe2\x00\x00\x00\x01\x00" > "\x00\x10\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x03\x55\xb4\xa4" > "\x02\x00\x01\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" > "\x00\x0c\x09\x08\x04\x0c\x00\x00\x19\x00\x00\x00\x00\x00\x00\x00\x40" > "\x00\x00\x00\x00\x00\x00\x00\x3d\x00\x00\x00\x00\x00\x00\x0c\xa3\x00" > "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" > "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00" > "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x02\x02", > 204); > > ... > > The in-memory xfs filesystem it constructs is damaged, is that an intentional > part of the fuzzing during the test? Yes, invalid inputs is part of testing. -- To unsubscribe from this list: send the line "unsubscribe linux-xfs" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
