On 12/01/2015 10:38 AM, Dmitry Vyukov wrote:
On Mon, Nov 30, 2015 at 7:29 PM, Alexei Starovoitov
<alexei.starovoi...@gmail.com> wrote:
...
Dmitry, thanks a lot for applying syzkaller to bpf. The issues
got cought much sooner than they would have been discovered otherwise.
Looks like the fuzzing has limited dependency chains described
in sys/sys.txt. Can they be improved into doing something like:
single call to map_create followed by many calls to update to
stress oom ? I did it manually so far without kasan.
Hi Alexei,
Please elaborate.
sys.txt describes signatures of syscalls. Based on that syzkaller
generates programs that can contain a map_create call followed by
multiple map update calls. Though, it won't generate millions of
update calls on a single map, because it directly conflicts with the
idea of coverage guided fuzzing. For OOMs I guess you want to try
kmalloc fault injection.
Wrt dependency chains, I believe what is meant is that there are some
options that could only be covered by the fuzzer after having succeeded
a couple of dependencies first.
Perhaps not directly related to BPF, but f.e. some things can only be
reached after having a session established, like the transfer of fds via
SCM_RIGHTS, options that are being fuzzed while having a tcp/udp/sctp/
netlink/etc session established and such.
Perhaps in BPF case, f.e. updating of a program array, which itself would
require some semi-autogenerated program to get loaded first. (The latter
is already a different beast by itself wrt testing the verifier, though.)
Cheers,
Daniel
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
