From 8857fb9beb9dcb95a6ce1be14dc94c4dc4cd3ea3 Mon Sep 17 00:00:00 2001 From: Evgeny Vereshchagin Date: Thu, 15 Nov 2018 17:52:57 +0100 Subject: [PATCH 1/5] tests: add a fuzzer for dev_kmsg_record --- src/fuzz/fuzz-journald-kmsg.c | 29 +++++++++++++++++++ src/fuzz/meson.build | 5 ++++ src/journal/journald-kmsg.c | 2 +- src/journal/journald-kmsg.h | 2 ++ test/fuzz/fuzz-journald-kmsg/basic | 1 + test/fuzz/fuzz-journald-kmsg/dev-null | 2 ++ test/fuzz/fuzz-journald-kmsg/loopback | 2 ++ .../fuzz-journald-kmsg/subsystem-loopback | 2 ++ 8 files changed, 44 insertions(+), 1 deletion(-) create mode 100644 src/fuzz/fuzz-journald-kmsg.c create mode 100644 test/fuzz/fuzz-journald-kmsg/basic create mode 100644 test/fuzz/fuzz-journald-kmsg/dev-null create mode 100644 test/fuzz/fuzz-journald-kmsg/loopback create mode 100644 test/fuzz/fuzz-journald-kmsg/subsystem-loopback diff --git a/src/fuzz/fuzz-journald-kmsg.c b/src/fuzz/fuzz-journald-kmsg.c new file mode 100644 index 0000000000..5d99d244b5 --- /dev/null +++ b/src/fuzz/fuzz-journald-kmsg.c @@ -0,0 +1,29 @@ +/* SPDX-License-Identifier: LGPL-2.1+ */ + +#include "fuzz.h" +#include "journald-kmsg.h" + +int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { + Server s = {}; + _cleanup_free_ char *buffer = NULL; + + if (size == 0) + return 0; + + s = (Server) { + .native_fd = -1, + .stdout_fd = -1, + .dev_kmsg_fd = -1, + .audit_fd = -1, + .hostname_fd = -1, + .notify_fd = -1, + .storage = STORAGE_NONE, + }; + assert_se(sd_event_default(&s.event) >= 0); + buffer = memdup(data, size); + assert_se(buffer); + dev_kmsg_record(&s, buffer, size); + server_done(&s); + + return 0; +} diff --git a/src/fuzz/meson.build b/src/fuzz/meson.build index f1f1db2181..5fd3093f07 100644 --- a/src/fuzz/meson.build +++ b/src/fuzz/meson.build @@ -51,6 +51,11 @@ fuzzers += [ libshared], [libmount]], + [['src/fuzz/fuzz-journald-kmsg.c'], + [libjournal_core, + libshared], + [libselinux]], + [['src/fuzz/fuzz-journald-native.c', 'src/fuzz/fuzz-journald.c'], [libjournal_core, diff --git a/src/journal/journald-kmsg.c b/src/journal/journald-kmsg.c index 9fe9231d80..e343c3f192 100644 --- a/src/journal/journald-kmsg.c +++ b/src/journal/journald-kmsg.c @@ -94,7 +94,7 @@ static bool is_us(const char *identifier, const char *pid) { streq(identifier, program_invocation_short_name); } -static void dev_kmsg_record(Server *s, char *p, size_t l) { +void dev_kmsg_record(Server *s, char *p, size_t l) { _cleanup_free_ char *message = NULL, *syslog_priority = NULL, *syslog_pid = NULL, *syslog_facility = NULL, *syslog_identifier = NULL, *source_time = NULL, *identifier = NULL, *pid = NULL; struct iovec iovec[N_IOVEC_META_FIELDS + 7 + N_IOVEC_KERNEL_FIELDS + 2 + N_IOVEC_UDEV_FIELDS]; diff --git a/src/journal/journald-kmsg.h b/src/journal/journald-kmsg.h index bff24ac310..2326bc8c93 100644 --- a/src/journal/journald-kmsg.h +++ b/src/journal/journald-kmsg.h @@ -9,3 +9,5 @@ int server_flush_dev_kmsg(Server *s); void server_forward_kmsg(Server *s, int priority, const char *identifier, const char *message, const struct ucred *ucred); int server_open_kernel_seqnum(Server *s); + +void dev_kmsg_record(Server *s, char *p, size_t l); diff --git a/test/fuzz/fuzz-journald-kmsg/basic b/test/fuzz/fuzz-journald-kmsg/basic new file mode 100644 index 0000000000..1299cd0869 --- /dev/null +++ b/test/fuzz/fuzz-journald-kmsg/basic @@ -0,0 +1 @@ +29,456,292891883,-;systemd[1]: Reexecuting. diff --git a/test/fuzz/fuzz-journald-kmsg/dev-null b/test/fuzz/fuzz-journald-kmsg/dev-null new file mode 100644 index 0000000000..de039588b5 --- /dev/null +++ b/test/fuzz/fuzz-journald-kmsg/dev-null @@ -0,0 +1,2 @@ +12,460,1322026586,-;hey + DEVICE=c1:3 diff --git a/test/fuzz/fuzz-journald-kmsg/loopback b/test/fuzz/fuzz-journald-kmsg/loopback new file mode 100644 index 0000000000..ca320177b7 --- /dev/null +++ b/test/fuzz/fuzz-journald-kmsg/loopback @@ -0,0 +1,2 @@ +12,460,1322026586,-;hey + DEVICE=n1 diff --git a/test/fuzz/fuzz-journald-kmsg/subsystem-loopback b/test/fuzz/fuzz-journald-kmsg/subsystem-loopback new file mode 100644 index 0000000000..af9c0d91e5 --- /dev/null +++ b/test/fuzz/fuzz-journald-kmsg/subsystem-loopback @@ -0,0 +1,2 @@ +12,460,1322026586,-;hey + DEVICE=+net:lo From 8dc4de966ce6d32470aaff30ed054f6a2688d6d7 Mon Sep 17 00:00:00 2001 From: Evgeny Vereshchagin Date: Fri, 16 Nov 2018 07:05:29 +0100 Subject: [PATCH 2/5] basic: remove an assertion from cunescape_one The function takes a pointer to a random block of memory and the length of that block. It shouldn't crash every time it sees a zero byte at the beginning there. This should help the dev-kmsg fuzzer to keep going. --- src/basic/escape.c | 1 - 1 file changed, 1 deletion(-) diff --git a/src/basic/escape.c b/src/basic/escape.c index 5004763d97..5f715156fb 100644 --- a/src/basic/escape.c +++ b/src/basic/escape.c @@ -106,7 +106,6 @@ int cunescape_one(const char *p, size_t length, char32_t *ret, bool *eight_bit) int r = 1; assert(p); - assert(*p); assert(ret); /* Unescapes C style. Returns the unescaped character in ret. From 080d112caa0dc948555a69a008c1caf4d5d41ed6 Mon Sep 17 00:00:00 2001 From: Evgeny Vereshchagin Date: Fri, 16 Nov 2018 07:11:06 +0100 Subject: [PATCH 3/5] journal: fix an off-by-one error in dev_kmsg_record --- src/journal/journald-kmsg.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/journal/journald-kmsg.c b/src/journal/journald-kmsg.c index e343c3f192..ce82102eed 100644 --- a/src/journal/journald-kmsg.c +++ b/src/journal/journald-kmsg.c @@ -235,7 +235,7 @@ void dev_kmsg_record(Server *s, char *p, size_t l) { j = 0; FOREACH_DEVICE_DEVLINK(d, g) { - if (j > N_IOVEC_UDEV_FIELDS) + if (j >= N_IOVEC_UDEV_FIELDS) break; b = strappend("_UDEV_DEVLINK=", g); From 1dd485b700fe9ad94d7a780f14fcf18a4738ace4 Mon Sep 17 00:00:00 2001 From: Evgeny Vereshchagin Date: Fri, 16 Nov 2018 07:20:44 +0100 Subject: [PATCH 4/5] tests: add a reproducer for a memory leak fixed in 30eddcd51b8a472e05d3b8d1 in August --- ...leak-ab161e601e82f1ec31d11e2cbae2747834ce9e43 | Bin 0 -> 1847 bytes 1 file changed, 0 insertions(+), 0 deletions(-) create mode 100644 test/fuzz/fuzz-journald-kmsg/leak-ab161e601e82f1ec31d11e2cbae2747834ce9e43 diff --git a/test/fuzz/fuzz-journald-kmsg/leak-ab161e601e82f1ec31d11e2cbae2747834ce9e43 b/test/fuzz/fuzz-journald-kmsg/leak-ab161e601e82f1ec31d11e2cbae2747834ce9e43 new file mode 100644 index 0000000000000000000000000000000000000000..424ae5cb010aa519758e6af90cc981795b68d3fd GIT binary patch literal 1847 zcmXps(lIeJ&@nVNGBPkSGqo_&(Y4MjX0aSiiycD2<{NiEaQE6vG)izFLb8I! Date: Fri, 16 Nov 2018 07:33:02 +0100 Subject: [PATCH 5/5] tests: add a reproducer for a heap-buffer-overflow fixed in 937b1171378bc1000a --- ...crash-c6c04d83e73f3d1417bc0afce8fa81b99f955963 | Bin 0 -> 112 bytes 1 file changed, 0 insertions(+), 0 deletions(-) create mode 100644 test/fuzz/fuzz-journald-kmsg/crash-c6c04d83e73f3d1417bc0afce8fa81b99f955963 diff --git a/test/fuzz/fuzz-journald-kmsg/crash-c6c04d83e73f3d1417bc0afce8fa81b99f955963 b/test/fuzz/fuzz-journald-kmsg/crash-c6c04d83e73f3d1417bc0afce8fa81b99f955963 new file mode 100644 index 0000000000000000000000000000000000000000..19887a1fec9fc29b1f7da8a2d1c5ea5054f2bc02 GIT binary patch literal 112 zcmXpq)Zrxx80r}680lCOP-~&{)k?wIfGehgOM!tQroxI#0Z63Aa4DF?03ibx03hxS A82|tP literal 0 HcmV?d00001