Skip to content

WIP: better logging#83

Draft
mrc0mmand wants to merge 1 commit intodbus-fuzzer:masterfrom
mrc0mmand:better-logging
Draft

WIP: better logging#83
mrc0mmand wants to merge 1 commit intodbus-fuzzer:masterfrom
mrc0mmand:better-logging

Conversation

@mrc0mmand
Copy link
Member

@mrc0mmand mrc0mmand commented May 9, 2022

Very WIP, more like PoC in its current form to discuss the file format and other needs as discussed in #75.

Right now this patch generates a "reproducer" file (separate one for each fail):

$ build/dfuzzer --log-dir logs/ -n org.freedesktop.dfuzzerServer -o /org/freedesktop/dfuzzerObject -i org.freedesktop.dfuzzerInterface -t df_crash_on_leeroy -v -f test.txt 
Loading suppressions from file './dfuzzer.conf'
Found suppressions for bus: 'org.freedesktop.dfuzzerServer'
Loaded suppression for method: *:*:df_hang (Intentionally hangs the server to test timeout handling)
[SESSION BUS]
Error while activating 'org.freedesktop.dfuzzerServer': The name is not activatable.
Error while calling method 'GetConnectionUnixProcessID': The connection does not exist.
Couldn't get the PID of the tested process
[SYSTEM BUS]
[PROCESS: /usr/bin/dfuzzer-test-server]
[CONNECTED TO PID: 1997897]
Object: /org/freedesktop/dfuzzerObject
 Interface: org.freedesktop.dfuzzerInterface
  df_crash_on_leeroy...   -- Signature: (s)
   -- Value: ('a',)
   -- Signature: (s)
   -- Value: ('a',)
   -- Signature: (s)
   -- Value: ('a',)
   -- Signature: (s)
   -- Value: ('a',)
  FAIL df_crash_on_leeroy - process 1997897 exited
   on input:
   -- Signature: (s)
   -- Value: ('Leeroy Jenkins',)
   Wrote the reproducer into file 'logs//org.freedesktop.dfuzzerServer-df_crash_on_leeroy-1652111159881833-fail.json'
   reproducer: dfuzzer -v -n org.freedesktop.dfuzzerServer -o /org/freedesktop/dfuzzerObject -i org.freedesktop.dfuzzerInterface -t df_crash_on_leeroy
Exit status: 2

logs//org.freedesktop.dfuzzerServer-df_crash_on_leeroy-1652111159881833-fail.json

{
  "bus" : "org.freedesktop.dfuzzerServer",
  "object" : "/org/freedesktop/dfuzzerObject",
  "interface" : "org.freedesktop.dfuzzerInterface",
  "method" : "df_crash_on_leeroy",
  "payload" : {
    "signature" : "(s)",
    "data" : [
      "Leeroy Jenkins"
    ]
  }
}

Similarly for df_complex_sig_2 (when tweaked to crash) - logs/org.freedesktop.dfuzzerServer-df_complex_sig_2-1652111623694577-fail.json:

{
  "bus" : "org.freedesktop.dfuzzerServer",
  "object" : "/org/freedesktop/dfuzzerObject",
  "interface" : "org.freedesktop.dfuzzerInterface",
  "method" : "df_complex_sig_2",
  "payload" : {
    "signature" : "(isaaai(y(b(n(q(iua{ov})v)o))x(dh))a{t(bov)})",
    "data" : [
      -2147483648,
      "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
      [
        [
          [
            -2147483648
          ]
        ]
      ],
      [
        0,
        [
          false,
          [
            -32768,
            [
              0,
              [
                -2147483648,
                0,
                {
                  "/" : "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
                }
              ],
              "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
            ],
            "/"
          ]
        ],
        -9223372036854775808,
        [
          1.7976931348623157e+308,
          0
        ]
      ],
      {
        "0" : [
          false,
          "/",
          "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
        ]
      }
    ]
  }
}

@lgtm-com
Copy link

lgtm-com bot commented May 9, 2022

This pull request introduces 1 alert when merging a153751 into 4930c31 - view on LGTM.com

new alerts:

  • 1 for FIXME comment

@evverx
Copy link
Collaborator

evverx commented May 10, 2022

Right now this patch generates a "reproducer" file (separate one for each fail):

I think it would cover bugs like avahi/avahi#375 and systemd/systemd#22555 that can be triggered reliably by calling certain DBus methods but almost all the bugs dfuzzer has helped to find in systemd were caught by ASan when systemd was reloaded or reexecuted so I think it would be better to put everything in one file and add a way to "replay" it

@lgtm-com
Copy link

lgtm-com bot commented May 10, 2022

This pull request introduces 1 alert when merging 77f3b5a into 3a59dbc - view on LGTM.com

new alerts:

  • 1 for FIXME comment

@evverx
Copy link
Collaborator

evverx commented May 10, 2022

FWIW I'm still trying to figure out what the log should look like. I think

@mrc0mmand
Copy link
Member Author

mrc0mmand commented May 10, 2022

FWIW I'm still trying to figure out what the log should look like. I think

* It should be possible to "replay" it

* it should be compatible with dictionaries mentioned in [Dictionaries as a way to guide dfuzzer? #81](https://github.com/matusmarhefka/dfuzzer/issues/81) in the sense that it should be easy to add methods from the log to those dictionaries

* it should be possible to look for timeouts

* it should be possible to look for methods triggering bugs like [machined: AddressSanitizer: stack-buffer-overflow on address 0x7fffd8fd26d0 at pc 0x7f3f70d7aa5f bp 0x7fffd8fd1900 sp 0x7fffd8fd18f8 systemd/systemd#22555](https://github.com/systemd/systemd/issues/22555) (that's what `reprogen.py` did)

No worries, I was just curious how easy it would be to generate a JSON file with random data & json-glib... turns out it's really easy, so it's something we could use once we have the details outlined.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants