Skip to content

Conversation

@f0rm2l1n
Copy link
Contributor

@f0rm2l1n f0rm2l1n commented Apr 5, 2025

Definitions for attribute NBD_ATTR_SOCKETS, NL80211_ATTR_BSS_SELECT, and NL80211_ATTR_PEER_MEASUREMENTS are wrong.

For example, the current attribute NL80211_ATTR_BSS_SELECT is defined as

    nlnest[NL80211_ATTR_BSS_SELECT, array[nl80211_bss_select_policy]]

However, the actual parsing code is like

parse_bss_select(info->attrs[NL80211_ATTR_BSS_SELECT], wiphy, &connect.bss_select);
...
nest = nla_data(nla);
if (!nla_ok(nest, nla_len(nest)))
return -EINVAL;

err = nla_parse_nested_deprecated(attr, NL80211_BSS_SELECT_ATTR_MAX,
					nest, nl80211_bss_select_policy,
					NULL);

In short, before the nl80211_bss_select_policy, there is another nested nla_data there.

This commit fixes them carefully. Check related parse functions: nbd_genl_reconfigure, parse_bss_select, nl80211_pmsr_start for details.

a-nogikh and others added 30 commits June 8, 2023 11:24
Ignore arch/arm64/kernel/process.c and some of page cache sources, as
the real problem will much more likely lie in the caller.
Recommend CONFIG_DEBUG_INFO_DWARF4 (syzkaller doesn't work with DWARF5)
and bump the kernel version.
This will make FullBugInfo's contents much more useful.
There are some minor subsystems (e.g. PAGE CACHE in Linux) that are
parts of several big subsystems. At the same time, a reproducer can
clearly disambiguate such case.

If subsystems from reproducers and subsystems from guilty files
intersect, only proceed with the results of the intersection.
Earlier we only took maintainers if there was just one MAINTAINERS
record, but that was a very severe limitation.

Let's try a more elaborate approach. It's also not perfect, but allows
us to extract many more maintainers, while keeping false positives at
zero.

Group raw MAINTAINER records by their T: entries. If there's just one
set of T: values per group mailing list, take the intersection of M:
entries from there.
New versions of clang-format start complaining about the dup attribute.
Remove it.
Currently it repeats that this is a list of subsystems 3 times:
1. "Subsystems" tab
2. "The list of subsystems" caption
3. "Subsystems list" table caption

Leave only one of them.
Manager name does not tell much to end users.
They are also long and all prefixed with ci[2]-upstream-,
this takes lots of space in the table.
Move it to the end of the table.
Make each crash table row take 1 line.
Otherwise it looks unesthetic and vertical space is wasted
no other column has data on the second/third/fourth lines.
Docker now supports rootless mode, which allows you to run your dockerd as
a non-root user. This is helpful for security, as traditional rootful
Docker can trivially be used to obtain root privileges outside of a
container.

Rootless Docker is implemented using RootlessKit (a fancy version of
fakeroot that uses user namespaces) to create a new user namespace that
maps the uid of the user running dockerd to 0. Files in mounted volumes
that are owned by that user will appear in the container as belonging to
root.

Currently, syz-env invokes "docker run" with --user to set the uid inside
the container to match the user's uid outside the container, to ensure
that file ownership and permissions behave as expected. This breaks under
rootless mode, as the files will appear to be owned by root while the user
has a non-root uid.

Only add the --user flag if the Docker daemon is not running in rootless
mode. If running in rootless mode, run without --user so that the user
appears to be root inside the container.

Closes: #3765 ("syz-env: uid/permissions issues when running with rootless Docker")
Signed-off-by: Andrew Donnellan <ajd@linux.ibm.com>
Technologies we want to use and test if available.
The syscall sets PKRU register which is part of protection keys (pkey).
Adjust the rules so that syz_mount_image$nilfs2 begins to point to
nilfs.
Let's consider them a strong indicator that usb subsystem is affected by
a bug.
Also make the call point to the "input" subsystem.
We currently generate incorrect links in the list of similar bugs and in
the list of bugs on a subsystem's page.
a-nogikh and others added 29 commits June 8, 2023 11:25
Split Run() into several functions to facilitate testing.

This commit does not introduce any functional changes.
Interact with a syz-execprog instance via an additional interface. This
will simplify testing.
This is a sanity test for the overall pkg/repro machinery. It does not
focus on minor corner cases.
Only use ctx.bootRequests to indicate that no further VMs are needed.

Do not return from Run() until we have fully stopped the VM creation
loop as there's a risk it might interfere with fuzzing.
Most of those errors seem to be transient, so there's no sense to fail
the whole C repro generation process.

Give it one more chance and only fail after that.
As the process is single-threaded, the positive contribution of each
additional VM allocated for the repro generation process decreases.

For GCE VMs (mostly used by syzbot), the time to set up a VM instance
is usually less than 5 minutes. The time to run a single test that
doesn't crash the VM is ~ 10 minutes and actually most runs will be like
that.

Therefore we have plenty of time to set up a VM while another one is being
tested (on average).

Let's save resources and use 3 VMs instead of 4: one for running the
test, one is prepared in parallel and one speeds up processing in the case
of transient errors and for cases when a reproducer is able to crash a
VM quickly.
This will let us use the information not just on the web dashboard, but
also for external reportings.
If the label is not user-set and the config specifies a message for it,
send a bug notification.

If the label is related to bug origin testing, attach the list of tested
trees.
Split it into multiple functions.
This was already the case before #3420. Using the default compiler so
far back was overly optimistic, as pointed out in #3814.
Full commit ids are not necessary in the notification email.
There are cases when e.g. an LTS kernel does not build if provided with
some downstream kernel config.

Introduce a special AppendConfig option to KernelRepo that can help in
this case.
Query bugs for all related syz-managers, but deduplicate the results
after that.

It should lead to fewer examined bugs and, hopefully, to fewer
CONCURRENT_TRANSACTION errors.
Subsystems are now part of labels. Fix the forgotten piece of code.
We don't always need a consistent view of data when we're inside a
transaction. Moreover, querying less can help us avoid "too much
contention on these datastore entities".

Let's see how it all behaves if pass both a transaction context and
a global context to the tree.go machinery.
The current syz-query-subsystems raise below error:
failed to query subsystems: failed to set names: failed to extract a name from kernel-tls-handshake@lists.linux.dev

This patch adds this email to exception list to fix that.

Signed-off-by: Lin Ma <linma@zju.edu.cn>
Fix various typos within the documentation directory.
This has been supported for a while but apparently was never added.

Signed-off-by: Christian Brauner <brauner@kernel.org>
This is currently in linux-next make sure it gets tested.

Signed-off-by: Christian Brauner <brauner@kernel.org>
Definitions for attribute `NBD_ATTR_SOCKETS`, `NL80211_ATTR_BSS_SELECT`,
and `NL80211_ATTR_PEER_MEASUREMENTS` are wrong.

Fix them carefully, Check related parse functions: nbd_genl_reconfigure,
parse_bss_select, nl80211_pmsr_start for details.

Signed-off-by: Lin Ma <linma@zju.edu.cn>
@f0rm2l1n f0rm2l1n closed this Apr 6, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.