Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

WIP: better logging #83

Draft
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

mrc0mmand
Copy link
Member

@mrc0mmand mrc0mmand commented May 9, 2022

Very WIP, more like PoC in its current form to discuss the file format and other needs as discussed in #75.

Right now this patch generates a "reproducer" file (separate one for each fail):

$ build/dfuzzer --log-dir logs/ -n org.freedesktop.dfuzzerServer -o /org/freedesktop/dfuzzerObject -i org.freedesktop.dfuzzerInterface -t df_crash_on_leeroy -v -f test.txt 
Loading suppressions from file './dfuzzer.conf'
Found suppressions for bus: 'org.freedesktop.dfuzzerServer'
Loaded suppression for method: *:*:df_hang (Intentionally hangs the server to test timeout handling)
[SESSION BUS]
Error while activating 'org.freedesktop.dfuzzerServer': The name is not activatable.
Error while calling method 'GetConnectionUnixProcessID': The connection does not exist.
Couldn't get the PID of the tested process
[SYSTEM BUS]
[PROCESS: /usr/bin/dfuzzer-test-server]
[CONNECTED TO PID: 1997897]
Object: /org/freedesktop/dfuzzerObject
 Interface: org.freedesktop.dfuzzerInterface
  df_crash_on_leeroy...   -- Signature: (s)
   -- Value: ('a',)
   -- Signature: (s)
   -- Value: ('a',)
   -- Signature: (s)
   -- Value: ('a',)
   -- Signature: (s)
   -- Value: ('a',)
  FAIL df_crash_on_leeroy - process 1997897 exited
   on input:
   -- Signature: (s)
   -- Value: ('Leeroy Jenkins',)
   Wrote the reproducer into file 'logs//org.freedesktop.dfuzzerServer-df_crash_on_leeroy-1652111159881833-fail.json'
   reproducer: dfuzzer -v -n org.freedesktop.dfuzzerServer -o /org/freedesktop/dfuzzerObject -i org.freedesktop.dfuzzerInterface -t df_crash_on_leeroy
Exit status: 2

logs//org.freedesktop.dfuzzerServer-df_crash_on_leeroy-1652111159881833-fail.json

{
  "bus" : "org.freedesktop.dfuzzerServer",
  "object" : "/org/freedesktop/dfuzzerObject",
  "interface" : "org.freedesktop.dfuzzerInterface",
  "method" : "df_crash_on_leeroy",
  "payload" : {
    "signature" : "(s)",
    "data" : [
      "Leeroy Jenkins"
    ]
  }
}

Similarly for df_complex_sig_2 (when tweaked to crash) - logs/org.freedesktop.dfuzzerServer-df_complex_sig_2-1652111623694577-fail.json:

{
  "bus" : "org.freedesktop.dfuzzerServer",
  "object" : "/org/freedesktop/dfuzzerObject",
  "interface" : "org.freedesktop.dfuzzerInterface",
  "method" : "df_complex_sig_2",
  "payload" : {
    "signature" : "(isaaai(y(b(n(q(iua{ov})v)o))x(dh))a{t(bov)})",
    "data" : [
      -2147483648,
      "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
      [
        [
          [
            -2147483648
          ]
        ]
      ],
      [
        0,
        [
          false,
          [
            -32768,
            [
              0,
              [
                -2147483648,
                0,
                {
                  "/" : "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
                }
              ],
              "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
            ],
            "/"
          ]
        ],
        -9223372036854775808,
        [
          1.7976931348623157e+308,
          0
        ]
      ],
      {
        "0" : [
          false,
          "/",
          "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
        ]
      }
    ]
  }
}

@lgtm-com
Copy link

lgtm-com bot commented May 9, 2022

This pull request introduces 1 alert when merging a153751 into 4930c31 - view on LGTM.com

new alerts:

  • 1 for FIXME comment

@evverx
Copy link
Member

evverx commented May 10, 2022

Right now this patch generates a "reproducer" file (separate one for each fail):

I think it would cover bugs like avahi/avahi#375 and systemd/systemd#22555 that can be triggered reliably by calling certain DBus methods but almost all the bugs dfuzzer has helped to find in systemd were caught by ASan when systemd was reloaded or reexecuted so I think it would be better to put everything in one file and add a way to "replay" it

@lgtm-com
Copy link

lgtm-com bot commented May 10, 2022

This pull request introduces 1 alert when merging 77f3b5a into 3a59dbc - view on LGTM.com

new alerts:

  • 1 for FIXME comment

@evverx
Copy link
Member

evverx commented May 10, 2022

FWIW I'm still trying to figure out what the log should look like. I think

@mrc0mmand
Copy link
Member Author

mrc0mmand commented May 10, 2022

FWIW I'm still trying to figure out what the log should look like. I think

* It should be possible to "replay" it

* it should be compatible with dictionaries mentioned in [Dictionaries as a way to guide dfuzzer? #81](https://github.com/matusmarhefka/dfuzzer/issues/81) in the sense that it should be easy to add methods from the log to those dictionaries

* it should be possible to look for timeouts

* it should be possible to look for methods triggering bugs like [machined: AddressSanitizer: stack-buffer-overflow on address 0x7fffd8fd26d0 at pc 0x7f3f70d7aa5f bp 0x7fffd8fd1900 sp 0x7fffd8fd18f8 systemd/systemd#22555](https://github.com/systemd/systemd/issues/22555) (that's what `reprogen.py` did)

No worries, I was just curious how easy it would be to generate a JSON file with random data & json-glib... turns out it's really easy, so it's something we could use once we have the details outlined.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants