You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
130 lines
4.7 KiB
130 lines
4.7 KiB
From e7e70f575840cd021f6429f264911ae0cbff9741 Mon Sep 17 00:00:00 2001
|
|
From: Evgeny Vereshchagin <evvers@ya.ru>
|
|
Date: Thu, 15 Nov 2018 17:52:57 +0100
|
|
Subject: [PATCH] tests: add a fuzzer for dev_kmsg_record
|
|
|
|
(cherry picked from commit 8857fb9beb9dcb95a6ce1be14dc94c4dc4cd3ea3)
|
|
|
|
Resolves: #1764560
|
|
---
|
|
src/fuzz/fuzz-journald-kmsg.c | 29 +++++++++++++++++++
|
|
src/fuzz/meson.build | 5 ++++
|
|
src/journal/journald-kmsg.c | 2 +-
|
|
src/journal/journald-kmsg.h | 2 ++
|
|
test/fuzz/fuzz-journald-kmsg/basic | 1 +
|
|
test/fuzz/fuzz-journald-kmsg/dev-null | 2 ++
|
|
test/fuzz/fuzz-journald-kmsg/loopback | 2 ++
|
|
.../fuzz-journald-kmsg/subsystem-loopback | 2 ++
|
|
8 files changed, 44 insertions(+), 1 deletion(-)
|
|
create mode 100644 src/fuzz/fuzz-journald-kmsg.c
|
|
create mode 100644 test/fuzz/fuzz-journald-kmsg/basic
|
|
create mode 100644 test/fuzz/fuzz-journald-kmsg/dev-null
|
|
create mode 100644 test/fuzz/fuzz-journald-kmsg/loopback
|
|
create mode 100644 test/fuzz/fuzz-journald-kmsg/subsystem-loopback
|
|
|
|
diff --git a/src/fuzz/fuzz-journald-kmsg.c b/src/fuzz/fuzz-journald-kmsg.c
|
|
new file mode 100644
|
|
index 0000000000..5d99d244b5
|
|
--- /dev/null
|
|
+++ b/src/fuzz/fuzz-journald-kmsg.c
|
|
@@ -0,0 +1,29 @@
|
|
+/* SPDX-License-Identifier: LGPL-2.1+ */
|
|
+
|
|
+#include "fuzz.h"
|
|
+#include "journald-kmsg.h"
|
|
+
|
|
+int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
|
|
+ Server s = {};
|
|
+ _cleanup_free_ char *buffer = NULL;
|
|
+
|
|
+ if (size == 0)
|
|
+ return 0;
|
|
+
|
|
+ s = (Server) {
|
|
+ .native_fd = -1,
|
|
+ .stdout_fd = -1,
|
|
+ .dev_kmsg_fd = -1,
|
|
+ .audit_fd = -1,
|
|
+ .hostname_fd = -1,
|
|
+ .notify_fd = -1,
|
|
+ .storage = STORAGE_NONE,
|
|
+ };
|
|
+ assert_se(sd_event_default(&s.event) >= 0);
|
|
+ buffer = memdup(data, size);
|
|
+ assert_se(buffer);
|
|
+ dev_kmsg_record(&s, buffer, size);
|
|
+ server_done(&s);
|
|
+
|
|
+ return 0;
|
|
+}
|
|
diff --git a/src/fuzz/meson.build b/src/fuzz/meson.build
|
|
index 1f8631bcc0..0520e448a9 100644
|
|
--- a/src/fuzz/meson.build
|
|
+++ b/src/fuzz/meson.build
|
|
@@ -33,6 +33,11 @@ fuzzers += [
|
|
libshared],
|
|
[libmount]],
|
|
|
|
+ [['src/fuzz/fuzz-journald-kmsg.c'],
|
|
+ [libjournal_core,
|
|
+ libshared],
|
|
+ [libselinux]],
|
|
+
|
|
[['src/fuzz/fuzz-journald-native.c',
|
|
'src/fuzz/fuzz-journald.c'],
|
|
[libjournal_core,
|
|
diff --git a/src/journal/journald-kmsg.c b/src/journal/journald-kmsg.c
|
|
index 7644bebfc8..0cdf1c4794 100644
|
|
--- a/src/journal/journald-kmsg.c
|
|
+++ b/src/journal/journald-kmsg.c
|
|
@@ -93,7 +93,7 @@ static bool is_us(const char *identifier, const char *pid) {
|
|
streq(identifier, program_invocation_short_name);
|
|
}
|
|
|
|
-static void dev_kmsg_record(Server *s, char *p, size_t l) {
|
|
+void dev_kmsg_record(Server *s, char *p, size_t l) {
|
|
|
|
_cleanup_free_ char *message = NULL, *syslog_priority = NULL, *syslog_pid = NULL, *syslog_facility = NULL, *syslog_identifier = NULL, *source_time = NULL, *identifier = NULL, *pid = NULL;
|
|
struct iovec iovec[N_IOVEC_META_FIELDS + 7 + N_IOVEC_KERNEL_FIELDS + 2 + N_IOVEC_UDEV_FIELDS];
|
|
diff --git a/src/journal/journald-kmsg.h b/src/journal/journald-kmsg.h
|
|
index bff24ac310..2326bc8c93 100644
|
|
--- a/src/journal/journald-kmsg.h
|
|
+++ b/src/journal/journald-kmsg.h
|
|
@@ -9,3 +9,5 @@ int server_flush_dev_kmsg(Server *s);
|
|
void server_forward_kmsg(Server *s, int priority, const char *identifier, const char *message, const struct ucred *ucred);
|
|
|
|
int server_open_kernel_seqnum(Server *s);
|
|
+
|
|
+void dev_kmsg_record(Server *s, char *p, size_t l);
|
|
diff --git a/test/fuzz/fuzz-journald-kmsg/basic b/test/fuzz/fuzz-journald-kmsg/basic
|
|
new file mode 100644
|
|
index 0000000000..1299cd0869
|
|
--- /dev/null
|
|
+++ b/test/fuzz/fuzz-journald-kmsg/basic
|
|
@@ -0,0 +1 @@
|
|
+29,456,292891883,-;systemd[1]: Reexecuting.
|
|
diff --git a/test/fuzz/fuzz-journald-kmsg/dev-null b/test/fuzz/fuzz-journald-kmsg/dev-null
|
|
new file mode 100644
|
|
index 0000000000..de039588b5
|
|
--- /dev/null
|
|
+++ b/test/fuzz/fuzz-journald-kmsg/dev-null
|
|
@@ -0,0 +1,2 @@
|
|
+12,460,1322026586,-;hey
|
|
+ DEVICE=c1:3
|
|
diff --git a/test/fuzz/fuzz-journald-kmsg/loopback b/test/fuzz/fuzz-journald-kmsg/loopback
|
|
new file mode 100644
|
|
index 0000000000..ca320177b7
|
|
--- /dev/null
|
|
+++ b/test/fuzz/fuzz-journald-kmsg/loopback
|
|
@@ -0,0 +1,2 @@
|
|
+12,460,1322026586,-;hey
|
|
+ DEVICE=n1
|
|
diff --git a/test/fuzz/fuzz-journald-kmsg/subsystem-loopback b/test/fuzz/fuzz-journald-kmsg/subsystem-loopback
|
|
new file mode 100644
|
|
index 0000000000..af9c0d91e5
|
|
--- /dev/null
|
|
+++ b/test/fuzz/fuzz-journald-kmsg/subsystem-loopback
|
|
@@ -0,0 +1,2 @@
|
|
+12,460,1322026586,-;hey
|
|
+ DEVICE=+net:lo
|