From da9149293b7e915541a9a98b6d8650351b3334e9 Mon Sep 17 00:00:00 2001 From: Alessandro Carminati Date: Fri, 3 May 2024 23:22:50 +0200 Subject: [PATCH] syz-fuzzer: add NULL check in supported features Kernel supported features are detected using debugfs. However, if the filesystem is not mounted, `syz-fuzzer` panics without providing any clues as to why. ``` 2024/05/04 10:12:49 connecting to manager... 2024/05/04 10:12:49 fuzzer vm-1 connected 2024/05/04 10:12:49 checking machine... panic: runtime error: invalid memory address or nil pointer dereference [signal SIGSEGV: segmentation violation code=0x1 addr=0x0 pc=0x6019a8] goroutine 1 [running]: main.main() /home/alessandro/go/src/syzkaller/syz-fuzzer/fuzzer.go:169 +0x958 debug1: client_input_channel_req: channel 0 rtype exit-status reply 0 debug1: channel 0: free: client-session, nchannels 2 debug1: channel 1: free: 127.0.0.1, nchannels 1 Transferred: sent 5180, received 6532 bytes, in 2.5 seconds Bytes per second: sent 2097.7, received 2645.2 debug1: Exit status 2 ``` This simple patch prevents `syz-fuzzer` from crashing and allows it to terminate cleanly, while provides a possible cause why this issue is occurring. ``` 2024/05/04 10:15:14 connecting to manager... 2024/05/04 10:15:14 fuzzer vm-1 connected 2024/05/04 10:15:14 checking machine... 2024/05/04 10:15:14 SYZFATAL: The currently running kernel image seems not to support any required feature, have you forgotten to mount debugfs? debug1: client_input_channel_req: channel 0 rtype exit-status reply 0 debug1: channel 0: free: client-session, nchannels 2 debug1: channel 1: free: 127.0.0.1, nchannels 1 Transferred: sent 5160, received 5016 bytes, in 2.4 seconds Bytes per second: sent 2106.7, received 2047.9 debug1: Exit status 1 ``` Signed-off-by: Alessandro Carminati --- CONTRIBUTORS | 1 + syz-fuzzer/fuzzer.go | 8 +++++++- 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/CONTRIBUTORS b/CONTRIBUTORS index 3eb1319e8326..352e6c0b160b 100644 --- a/CONTRIBUTORS +++ b/CONTRIBUTORS @@ -130,3 +130,4 @@ Krzysztof Pawlaczyk Simone Weiß Amazon Bjoern Doebel +Alessandro Carminati diff --git a/syz-fuzzer/fuzzer.go b/syz-fuzzer/fuzzer.go index bdccf9d82006..15b27bb86f76 100644 --- a/syz-fuzzer/fuzzer.go +++ b/syz-fuzzer/fuzzer.go @@ -163,7 +163,13 @@ func main() { checkReq = new(rpctype.CheckArgs) } - for _, feat := range r.Features.Supported() { + suppFeatures := r.Features.Supported() + + if suppFeatures == nil { + log.SyzFatalf("The currently running kernel image seems not to support any required feature, have you forgotten to mount debugfs?") + } + + for _, feat := range suppFeatures { log.Logf(0, "%v: %v", feat.Name, feat.Reason) }