| Message ID | 20200609113421.10936-1-rpalethorpe@suse.com |
|---|---|
| State | Superseded |
| Headers | show |
| Series | [v3] Wrapper for Syzkaller reproducers | expand |
Hi Richard, > So this has now being floating in limbo for some time. My preference is to > merge it to make it easy for users to try out with plenty of time before the > next LTP release. It shouldn't break anything because it is hidden behind a > configure switch. +1 Reviewed-by: Petr Vorel <pvorel@suse.cz> I plan to test it a bit and appreciate if somebody else also test it, but I see no problem to include this patchset. > V3: > + Updated linux-arts commit (thanks Dmitry and Shuah for updating those!) > + Fixed AC macro ... > +ifeq ($(WITH_SYZKALLER_REPROS),yes) > + > +# This is mainly due to the -m32 flag, but there could be other problems. > +ifneq ($(HOST_CPU), x86_64)) nit: I guess, there should not be space, it should be ifneq ($(HOST_CPU),x86_64)) include/mk/config.mk HOST_CPU := x86_64 => I thought that the trailing space is omitted. But working with it => not important. > +$(error "We currently only support building the Syzkaller reproducers on x86_64") > +endif > + > +# The number of reproducers in each runtest file > +SYZKALLER_RUNFILES_SIZE ?= 100 > + > +# Extra arguments to pass to syzwrap. Uncomment the below to add some > +# sandboxing. > +# SYZWRAP_ARGS ?= -s > + > +# Location where reproducers are installed > +SYZKALLER_INSTALL_DIR ?= $(abspath $(DESTDIR)/$(prefix)/testcases/bin) > + > +# If the reproducers directory is missing then we automatically clone the repo. > +# We then have to call make recursively to revaluate the targets > +SYZKALLER_REPROS_DIR ?= $(abs_top_srcdir)/testcases/linux-arts/syzkaller-repros/linux > +$(SYZKALLER_REPROS_DIR): > + git submodule update --init $(abs_top_srcdir)/testcases/linux-arts > + $(MAKE) syzkaller_runfiles > + > +SYZKALLER_REPROS_SRCS = $(wildcard $(SYZKALLER_REPROS_DIR)/*.c) > + > +# Some useful compiler flags for the LTP will cause problems with the > +# syzkaller repros so the repros have seperate flags > +SYZKALLER_CFLAGS ?= -pthread > +SYZKALLER_REPROS = $(subst $(abs_top_srcdir),$(abs_top_builddir),$(SYZKALLER_REPROS_SRCS:.c=)) > +$(SYZKALLER_REPROS): %: %.c > + -@if grep -q "__NR_mmap2" $^; then \ > + M32="-m32"; \ > + fi; \ > + $(CC) $(SYZKALLER_CFLAGS) $$M32 $(SYZKALLER_LDFLAGS) $^ -o $@; \ > + echo $(CC) $(SYZKALLER_CFLAGS) $$M32 $(SYZKALLER_LDFLAGS) $^ -o $@; nit: it'd be worth to mention 32bit compilation environment. And I like this Makefile :) I experimentally enabled it on all intel native builds in my LTP fork travis [1] and it runs well. Failed only in minimal variant [2] (no surprise). Fedora required to add glibc-devel.i686, other have support by default. It failed on ubuntu eon on timeout. I'd suggest to chose one target where this would be running. Whole job was prolonged from 2 hrs to 2,75 hrs, but running a single job wouldn't be that bad. [1] https://travis-ci.org/github/pevik/ltp/builds/696513565 [2] https://travis-ci.org/github/pevik/ltp/jobs/696513571 > + > +# Generate the names of the runtest files. This uses Shell arithmetic to > +# calculate how many runtest files there will be. > +define SYZKALLER_RUNFILES != > + n=$(words $(SYZKALLER_REPROS)); > + m=$(SYZKALLER_RUNFILES_SIZE); > + i=$$(( $$n / $$m + ($$n % $$m > 0) )); > + while test $$i -gt 0; > + do > + echo $(top_srcdir)/runtest/syzkaller$$i; > + i=$$(($$i - 1)); > + done > +endef > + > +++ b/testcases/kernel/syzkaller-repros/README.md ... > +## Instructions > + > +1. Run `ltp/configure` with `--with-syzkaller-repros`. nit: I'd omit ltp/ (=> ./configure). > +2. Build and install the LTP as normal. > +3. Run one or more of syzkallerN runtest files where N is a number. Kind regards, Petr
On 6/9/20 10:59 AM, Petr Vorel wrote: > Hi Richard, > >> So this has now being floating in limbo for some time. My preference is to >> merge it to make it easy for users to try out with plenty of time before the >> next LTP release. It shouldn't break anything because it is hidden behind a >> configure switch. > +1 > > Reviewed-by: Petr Vorel <pvorel@suse.cz> > > I plan to test it a bit and appreciate if somebody else also test it, > but I see no problem to include this patchset. > >> V3: >> + Updated linux-arts commit (thanks Dmitry and Shuah for updating those!) >> + Fixed AC macro > You can send patch to me against linux-arts for this and I will pull it in. Dmitry, is that okay with you. This could make it easier for you and reduce your work. thanks, -- Shuah
On Tue, Jun 9, 2020 at 7:10 PM Shuah Khan <skhan@linuxfoundation.org> wrote: > > On 6/9/20 10:59 AM, Petr Vorel wrote: > > Hi Richard, > > > >> So this has now being floating in limbo for some time. My preference is to > >> merge it to make it easy for users to try out with plenty of time before the > >> next LTP release. It shouldn't break anything because it is hidden behind a > >> configure switch. > > +1 > > > > Reviewed-by: Petr Vorel <pvorel@suse.cz> > > > > I plan to test it a bit and appreciate if somebody else also test it, > > but I see no problem to include this patchset. > > >> V3: > >> + Updated linux-arts commit (thanks Dmitry and Shuah for updating those!) > >> + Fixed AC macro > > > > You can send patch to me against linux-arts for this and I will pull > it in. > > Dmitry, is that okay with you. This could make it easier for you and > reduce your work. Hi, I don't have any particular comments. I assume Richard tested it and it works. if so, it's fine with me :) I don't have any concrete plans to use this at the moment. We have a corpus of reproducers in syzkaller format and we can run these. This should be more useful for kernel continuous integration systems and distro testing.
On 6/9/20 11:15 AM, Dmitry Vyukov wrote: > On Tue, Jun 9, 2020 at 7:10 PM Shuah Khan <skhan@linuxfoundation.org> wrote: >> >> On 6/9/20 10:59 AM, Petr Vorel wrote: >>> Hi Richard, >>> >>>> So this has now being floating in limbo for some time. My preference is to >>>> merge it to make it easy for users to try out with plenty of time before the >>>> next LTP release. It shouldn't break anything because it is hidden behind a >>>> configure switch. >>> +1 >>> >>> Reviewed-by: Petr Vorel <pvorel@suse.cz> >>> >>> I plan to test it a bit and appreciate if somebody else also test it, >>> but I see no problem to include this patchset. >>>>> V3: >>>> + Updated linux-arts commit (thanks Dmitry and Shuah for updating those!) >>>> + Fixed AC macro >>> >> >> You can send patch to me against linux-arts for this and I will pull >> it in. >> >> Dmitry, is that okay with you. This could make it easier for you and >> reduce your work. > > Hi, > > I don't have any particular comments. > I assume Richard tested it and it works. if so, it's fine with me :) > I don't have any concrete plans to use this at the moment. We have a > corpus of reproducers in syzkaller format and we can run these. This > should be more useful for kernel continuous integration systems and > distro testing. > Right. That is what I was thinking that this is more relevant for kernel developers, CI and distros. Richard, Please send the patch for linux-arts to me once Petr gives it a try and I will apply it. thanks, -- Shuah thanks, -- Shuah
Hi Shuah, ... > > I don't have any particular comments. > > I assume Richard tested it and it works. if so, it's fine with me :) > > I don't have any concrete plans to use this at the moment. We have a > > corpus of reproducers in syzkaller format and we can run these. This > > should be more useful for kernel continuous integration systems and > > distro testing. > Right. That is what I was thinking that this is more relevant for kernel > developers, CI and distros. > Richard, Please send the patch for linux-arts to me once Petr gives it a > try and I will apply it. NOTE: this patch is for LTP. But maybe I miss something (some other patch for linux-arts I overlooked). Kind regards, Petr
On 6/9/20 1:58 PM, Petr Vorel wrote: > Hi Shuah, > > ... >>> I don't have any particular comments. >>> I assume Richard tested it and it works. if so, it's fine with me :) >>> I don't have any concrete plans to use this at the moment. We have a >>> corpus of reproducers in syzkaller format and we can run these. This >>> should be more useful for kernel continuous integration systems and >>> distro testing. > >> Right. That is what I was thinking that this is more relevant for kernel >> developers, CI and distros. > >> Richard, Please send the patch for linux-arts to me once Petr gives it a >> try and I will apply it. > NOTE: this patch is for LTP. But maybe I miss something (some other patch for > linux-arts I overlooked). > Possibly I misread the V3: + Updated linux-arts commit (thanks Dmitry and Shuah for updating those!) + Fixed AC macro If this patch doesn't intend to update syzkaller-repo, there is nothing to do for linux-arts. I thought that this patch is for Dmitry's syzkaller repo I update from and looking get this into linux-arts directly. Since this is LTP patch, ignore my comments. Sorry for the noise. thanks, -- Shuah
Hello, Shuah Khan <skhan@linuxfoundation.org> writes: > On 6/9/20 1:58 PM, Petr Vorel wrote: >> Hi Shuah, >> >> ... >>>> I don't have any particular comments. >>>> I assume Richard tested it and it works. if so, it's fine with me :) >>>> I don't have any concrete plans to use this at the moment. We have a >>>> corpus of reproducers in syzkaller format and we can run these. This >>>> should be more useful for kernel continuous integration systems and >>>> distro testing. >> >>> Right. That is what I was thinking that this is more relevant for kernel >>> developers, CI and distros. >> >>> Richard, Please send the patch for linux-arts to me once Petr gives it a >>> try and I will apply it. >> NOTE: this patch is for LTP. But maybe I miss something (some other patch for >> linux-arts I overlooked). >> > > Possibly I misread the > > V3: > + Updated linux-arts commit (thanks Dmitry and Shuah for updating those!) > + Fixed AC macro > > If this patch doesn't intend to update syzkaller-repo, there is > nothing to do for linux-arts. I thought that this patch is for > Dmitry's syzkaller repo I update from and looking get this into > linux-arts directly. > > Since this is LTP patch, ignore my comments. Sorry for the noise. > > thanks, > -- Shuah No problem at all, I should have made that more clear. Infact I will send a seperate patch to linux-arts mentioning the LTP wrapper.
Hi Shuah, Richard, > > If this patch doesn't intend to update syzkaller-repo, there is > > nothing to do for linux-arts. I thought that this patch is for > > Dmitry's syzkaller repo I update from and looking get this into > > linux-arts directly. > > Since this is LTP patch, ignore my comments. Sorry for the noise. > > thanks, > > -- Shuah > No problem at all, I should have made that more clear. > Infact I will send a seperate patch to linux-arts mentioning the LTP > wrapper. Thanks you both for clarifying. @Jan, @Cyril, @Yang, @Li: any ack/objection to this patch? Kind regards, Petr
On Wed, Jun 10, 2020 at 3:27 PM Petr Vorel <pvorel@suse.cz> wrote: > Hi Shuah, Richard, > > > > If this patch doesn't intend to update syzkaller-repo, there is > > > nothing to do for linux-arts. I thought that this patch is for > > > Dmitry's syzkaller repo I update from and looking get this into > > > linux-arts directly. > > > > Since this is LTP patch, ignore my comments. Sorry for the noise. > > > > thanks, > > > -- Shuah > > > No problem at all, I should have made that more clear. > > > Infact I will send a seperate patch to linux-arts mentioning the LTP > > wrapper. > Thanks you both for clarifying. > > @Jan, @Cyril, @Yang, @Li: any ack/objection to this patch? > I have no objection to merging the syzkaller patch. Build and run some of the testcase locally(Fedora32) by manual, it works well.
diff --git a/.gitmodules b/.gitmodules index 1c9e9c38a..2b9e836e6 100644 --- a/.gitmodules +++ b/.gitmodules @@ -1,3 +1,7 @@ [submodule "testcases/kernel/mce-test"] path = testcases/kernel/mce-test url = git://git.kernel.org/pub/scm/linux/kernel/git/gong.chen/mce-test.git +[submodule "testcases/linux-arts"] + path = testcases/linux-arts + url = https://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-arts.git + shallow = true diff --git a/configure.ac b/configure.ac index 1d3ea58d0..20293040b 100644 --- a/configure.ac +++ b/configure.ac @@ -271,6 +271,18 @@ else AC_SUBST([WITH_OPEN_POSIX_TESTSUITE],["no"]) fi +AC_ARG_WITH([syzkaller-repros], + [AC_HELP_STRING([--with-syzkaller-repros], + [compile and install Syzkaller reproducers (default=no)])], + [with_syzkaller_repros=$withval], + [with_syzkaller_repros=no] +) +if test "x$with_syzkaller_repros" = xyes; then + AC_SUBST([WITH_SYZKALLER_REPROS],["yes"]) +else + AC_SUBST([WITH_SYZKALLER_REPROS],["no"]) +fi + # TODO: testcases/realtime requires bash and python. AC_ARG_WITH([realtime-testsuite], [AC_HELP_STRING([--with-realtime-testsuite], diff --git a/include/mk/features.mk.in b/include/mk/features.mk.in index 8e561b738..3ab7f4721 100644 --- a/include/mk/features.mk.in +++ b/include/mk/features.mk.in @@ -47,3 +47,5 @@ WITH_REALTIME_TESTSUITE := no else WITH_REALTIME_TESTSUITE := @WITH_REALTIME_TESTSUITE@ endif + +WITH_SYZKALLER_REPROS := @WITH_SYZKALLER_REPROS@ diff --git a/runtest/.gitignore b/runtest/.gitignore new file mode 100644 index 000000000..2ae05bfac --- /dev/null +++ b/runtest/.gitignore @@ -0,0 +1 @@ +syzkaller* diff --git a/testcases/kernel/Makefile b/testcases/kernel/Makefile index 3319b3163..0150cfb4f 100644 --- a/testcases/kernel/Makefile +++ b/testcases/kernel/Makefile @@ -53,6 +53,7 @@ SUBDIRS += connectors \ sched \ security \ sound \ + syzkaller-repros \ tracing \ uevents \ diff --git a/testcases/kernel/syzkaller-repros/.gitignore b/testcases/kernel/syzkaller-repros/.gitignore new file mode 100644 index 000000000..dbda1c71f --- /dev/null +++ b/testcases/kernel/syzkaller-repros/.gitignore @@ -0,0 +1 @@ +syzwrap diff --git a/testcases/kernel/syzkaller-repros/Makefile b/testcases/kernel/syzkaller-repros/Makefile new file mode 100644 index 000000000..a3acf9647 --- /dev/null +++ b/testcases/kernel/syzkaller-repros/Makefile @@ -0,0 +1,105 @@ +# SPDX-License-Identifier: GPL-2.0-or-later +# Copyright (c) 2019 Linux Test Project + +top_srcdir ?= ../../.. + +include $(top_srcdir)/include/mk/testcases.mk + +CFLAGS += -D_GNU_SOURCE + +ifeq ($(WITH_SYZKALLER_REPROS),yes) + +# This is mainly due to the -m32 flag, but there could be other problems. +ifneq ($(HOST_CPU), x86_64)) +$(error "We currently only support building the Syzkaller reproducers on x86_64") +endif + +# The number of reproducers in each runtest file +SYZKALLER_RUNFILES_SIZE ?= 100 + +# Extra arguments to pass to syzwrap. Uncomment the below to add some +# sandboxing. +# SYZWRAP_ARGS ?= -s + +# Location where reproducers are installed +SYZKALLER_INSTALL_DIR ?= $(abspath $(DESTDIR)/$(prefix)/testcases/bin) + +# If the reproducers directory is missing then we automatically clone the repo. +# We then have to call make recursively to revaluate the targets +SYZKALLER_REPROS_DIR ?= $(abs_top_srcdir)/testcases/linux-arts/syzkaller-repros/linux +$(SYZKALLER_REPROS_DIR): + git submodule update --init $(abs_top_srcdir)/testcases/linux-arts + $(MAKE) syzkaller_runfiles + +SYZKALLER_REPROS_SRCS = $(wildcard $(SYZKALLER_REPROS_DIR)/*.c) + +# Some useful compiler flags for the LTP will cause problems with the +# syzkaller repros so the repros have seperate flags +SYZKALLER_CFLAGS ?= -pthread +SYZKALLER_REPROS = $(subst $(abs_top_srcdir),$(abs_top_builddir),$(SYZKALLER_REPROS_SRCS:.c=)) +$(SYZKALLER_REPROS): %: %.c + -@if grep -q "__NR_mmap2" $^; then \ + M32="-m32"; \ + fi; \ + $(CC) $(SYZKALLER_CFLAGS) $$M32 $(SYZKALLER_LDFLAGS) $^ -o $@; \ + echo $(CC) $(SYZKALLER_CFLAGS) $$M32 $(SYZKALLER_LDFLAGS) $^ -o $@; + +# Generate the names of the runtest files. This uses Shell arithmetic to +# calculate how many runtest files there will be. +define SYZKALLER_RUNFILES != + n=$(words $(SYZKALLER_REPROS)); + m=$(SYZKALLER_RUNFILES_SIZE); + i=$$(( $$n / $$m + ($$n % $$m > 0) )); + while test $$i -gt 0; + do + echo $(top_srcdir)/runtest/syzkaller$$i; + i=$$(($$i - 1)); + done +endef + +# Get the index part of a runtest files name +syz_n = $(subst $(top_srcdir)/runtest/syzkaller,,$(1)) +syz_m = $(SYZKALLER_RUNFILES_SIZE) +# Gives the index of the first reproducer in a runtest file +syz_i = $(shell echo $$((($(call syz_n,$(1)) - 1) * $(2) + 1))) +# Gives the index of the last reproducer in a runtest file +syz_j = $(shell echo $$(( $(call syz_i,$(1),$(2)) + $(2) - 1 ))) +# Gvien a runtest file name, get the reproducers it should contain +syz_wordlist = $(wordlist $(call syz_i,$(1),$(syz_m)),$(call syz_j,$(1),$(syz_m)),$(SYZKALLER_REPROS)) + +define syz_runfile_line +$(notdir $(exe)) syzwrap $(SYZWRAP_ARGS) -d $(SYZKALLER_INSTALL_DIR) -n $(notdir $(exe)) + +endef + +# Generate the runtest files based on the reproducer names and batch size. +$(SYZKALLER_RUNFILES): $(SYZKALLER_REPROS) + @echo "Writing $@" + $(file >$@) + $(foreach exe,$(call syz_wordlist,$@),$(file >>$@,$(syz_runfile_line))) + +.PHONY: syzkaller_runfiles +syzkaller_runfiles: $(SYZKALLER_RUNFILES) | $(SYZKALLER_REPROS_DIR) + +all: $(SYZKALLER_RUNFILES) | $(SYZKALLER_REPROS_DIR) + +# There are too many reproducers to pass all at once to rm, so we just pass +# one at a time +syzkaller_clean: + $(foreach f, $(SYZKALLER_REPROS), $(RM) $(f)) +CLEAN_DEPS += syzkaller_clean +CLEAN_TARGETS += $(SYZKALLER_RUNFILES) + +INSTALL_MODE ?= 0775 + +# For some reason part of the path is missing if we just try to install these +# by adding them to INSTALL_FILES +SYZKALLER_REPROS_INSTALLED := $(subst $(SYZKALLER_REPROS_DIR),$(SYZKALLER_INSTALL_DIR),$(SYZKALLER_REPROS)) +$(SYZKALLER_REPROS_INSTALLED): $(SYZKALLER_INSTALL_DIR)/%: $(SYZKALLER_REPROS_DIR)/% + install -m $(INSTALL_MODE) -T $< $@ + +install: $(SYZKALLER_REPROS_INSTALLED) + +endif + +include $(top_srcdir)/include/mk/generic_leaf_target.mk diff --git a/testcases/kernel/syzkaller-repros/README.md b/testcases/kernel/syzkaller-repros/README.md new file mode 100644 index 000000000..2c88efd01 --- /dev/null +++ b/testcases/kernel/syzkaller-repros/README.md @@ -0,0 +1,45 @@ +# LTP wrapper for Syzkaller reproducers + +This allows you to run the autogenerated C bug reproducers from the Syzkaller +fuzzer within the LTP framework. Meaning that you may use an existing test +runner compatible with the LTP (with some constraints, see below). + +## Instructions + +1. Run `ltp/configure` with `--with-syzkaller-repros`. +2. Build and install the LTP as normal. +3. Run one or more of syzkallerN runtest files where N is a number. + +Make will automatically download the reproducers into `testcases/linux-arts` +using git-submodule if necessary. + +By default each runtest file contains 100 reproducers. You may change this by +overriding `SYZKALLER_RUNFILES_SIZE`. + +Extra parameters can be sent to syzwrap using `SYZWRAP_ARGS`. See `syzwrap +-h`. + +## Kernel Requirements + +It is strongly recommended that you use KASAN and other debugging kernel +features. See the Syzkaller documentation for the configuration you should +use. + +## Test Runner Requirements + +Unlike most LTP tests these reproducers can leave your system in a broken +state even if no bug is triggered. + +You will need to: + +A) Reboot the SUT +B) Reset at least the root filesystem to a known good state + +Every time syzwrap fails. + +If syzwrap fails with TBROK or fails to run at all, then you probably need to +reset the system and rerun that test. If a test fails with TFAIL, you may also +want to run it once again with a clean state. + +It might be the case that some reproducers write to random devices or do other +things which can effect the outside world. diff --git a/testcases/kernel/syzkaller-repros/syzwrap.c b/testcases/kernel/syzkaller-repros/syzwrap.c new file mode 100644 index 000000000..c8c95e750 --- /dev/null +++ b/testcases/kernel/syzkaller-repros/syzwrap.c @@ -0,0 +1,134 @@ +// SPDX-License-Identifier: GPL-2.0-or-later +/* + * Copyright (c) 2019 Richard Palethorpe <rpalethorpe@suse.com> + * + * Run a single reproducer generated by the Syzkaller fuzzer. + */ + +#include <sys/types.h> +#include <sys/wait.h> +#include <sys/prctl.h> +#include <sched.h> +#include <signal.h> +#include <stdio.h> +#include <pwd.h> + +#include "tst_test.h" +#include "tst_taint.h" +#include "tst_safe_stdio.h" + +#define SANDBOX_HELP "\n"\ + "-s\t Add some sandboxing around the reproducer. This will prevent some\n"\ + "\t reproducers from creating network devices and thus prevent them from\n"\ + "\t working. However it will also prevent some reproducers from trashing\n"\ + "\t the system using root privileges. Note that you may generate the\n"\ + "\t reproducers with various types of sandboxing built in using\n"\ + "\t syz-reprolist" + +static char *dir; +static char *name; +static char *path; + +static char *sandbox; + +static struct tst_option options[] = { + {"d:", &dir, "\n-d PATH\t Mandatory directory containing reproducers"}, + {"n:", &name, "-n NAME\t Mandatory executable name of reproducer"}, + {"s", &sandbox, SANDBOX_HELP}, + {NULL, NULL, NULL} +}; + +static void become_nobody(void) +{ + struct passwd *pw; + int gid, uid; + + setgroups(0, NULL); + + pw = getpwnam("nobody"); + if (pw) { + gid = pw->pw_gid; + uid = pw->pw_uid; + } else { + gid = 65534; + uid = 65534; + } + + SAFE_SETREGID(gid, gid); + SAFE_SETREUID(uid, uid); +} + +static void setup(void) +{ + tst_taint_init(TST_TAINT_W | TST_TAINT_D | TST_TAINT_L); + + if (!dir) + tst_brk(TBROK, "No reproducer directory specified"); + + if (!name) + tst_brk(TBROK, "No reproducer name specified"); + + tst_res(TINFO, "https://syzkaller.appspot.com/bug?id=%s", name); + + SAFE_ASPRINTF(&path, "%s/%s", dir, name); + tst_res(TINFO, "%s", path); +} + +static void run(void) +{ + unsigned int backoff = 100; + int rem, status, sent_kill = 0; + float exec_time_start = (float)tst_timeout_remaining(); + int pid; + + if (sandbox) + SAFE_UNSHARE(CLONE_NEWPID); + + pid = SAFE_FORK(); + if (!pid) { + if (sandbox) { + SAFE_UNSHARE(CLONE_NEWNET); + become_nobody(); + } + + if (prctl(PR_SET_DUMPABLE, 1, 0, 0, 0)) { + tst_res(TWARN | TERRNO, + "Failed to set dumpable; won't be able to open /proc/self/*"); + } + + execl(path, name, NULL); + tst_brk(TBROK | TERRNO, "Failed to exec reproducer"); + } + + while (!waitpid(pid, &status, WNOHANG)) { + rem = tst_timeout_remaining(); + + if (!sent_kill && rem / exec_time_start < 0.5) { + tst_res(TINFO, "Timeout; killing reproducer"); + + TEST(kill(pid, SIGKILL)); + if (TST_RET == -1) + tst_res(TWARN | TTERRNO, "kill() failed"); + else + sent_kill = 1; + } + + usleep(backoff); + backoff = MIN(2 * backoff, 1000000); + } + + if (tst_taint_check()) { + tst_res(TFAIL, "Kernel is tainted"); + } else { + tst_res(TPASS, "Kernel is not tainted"); + } +} + +static struct tst_test test = { + .setup = setup, + .test_all = run, + .options = options, + .needs_tmpdir = 1, + .forks_child = 1, + .timeout = 20 +}; diff --git a/testcases/linux-arts b/testcases/linux-arts new file mode 160000 index 000000000..e39dd3846 --- /dev/null +++ b/testcases/linux-arts @@ -0,0 +1 @@ +Subproject commit e39dd38466d956a7a9b6c061163cba783cf09b2e
Allows one to run the Syzkaller reproducers as part of the LTP. Signed-off-by: Richard Palethorpe <rpalethorpe@suse.com> Cc: Dmitry Vyukov <dvyukov@google.com> Cc: Shuah Khan <skhan@linuxfoundation.org> --- So this has now being floating in limbo for some time. My preference is to merge it to make it easy for users to try out with plenty of time before the next LTP release. It shouldn't break anything because it is hidden behind a configure switch. V3: + Updated linux-arts commit (thanks Dmitry and Shuah for updating those!) + Fixed AC macro .gitmodules | 4 + configure.ac | 12 ++ include/mk/features.mk.in | 2 + runtest/.gitignore | 1 + testcases/kernel/Makefile | 1 + testcases/kernel/syzkaller-repros/.gitignore | 1 + testcases/kernel/syzkaller-repros/Makefile | 105 +++++++++++++++ testcases/kernel/syzkaller-repros/README.md | 45 +++++++ testcases/kernel/syzkaller-repros/syzwrap.c | 134 +++++++++++++++++++ testcases/linux-arts | 1 + 10 files changed, 306 insertions(+) create mode 100644 runtest/.gitignore create mode 100644 testcases/kernel/syzkaller-repros/.gitignore create mode 100644 testcases/kernel/syzkaller-repros/Makefile create mode 100644 testcases/kernel/syzkaller-repros/README.md create mode 100644 testcases/kernel/syzkaller-repros/syzwrap.c create mode 160000 testcases/linux-arts