SYZFAIL: FAULT_IOC_GETINFO failed

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 59ee1e30 make(1): replace global preserveUndefined with VA..
git tree: netbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=10a022cad00000
kernel config: https://syzkaller.appspot.com/x/.config?x=fab579639ba4bf0a
dashboard link: https://syzkaller.appspot.com/bug?extid=9b488239796a69cbc1d7
compiler: g++ (Ubuntu 5.4.0-6ubuntu1~16.04.12) 5.4.0 20160609

Unfortunately, I don't have any reproducer for this issue yet.

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+9b4882...@syzkaller.appspotmail.com

SYZFAIL: FAULT_IOC_GETINFO failed
(errno 0: Undefined error: 0)
SYZFAIL: child failed


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[Chuck Silvers]

this appears to be due to an uninitialized-variable bug in syz-executor.
here's a patch that should fix it.

-Chuck



commit 9bd64179f13110614228dcf3e56a46dd1866cf5f
Author: Chuck Silvers <ch...@chuq.com>
Date: Mon Jun 28 10:46:35 2021 -0700

executor: initialize scope in fault_ioc_info

the "scope" field of struct fault_ioc_info is an input to the ioctl,
so initialize it to FAULT_SCOPE_LWP to match other fault_ioc_* usage.

diff --git a/executor/common_bsd.h b/executor/common_bsd.h
index 398d402fb..131ab0764 100644
--- a/executor/common_bsd.h
+++ b/executor/common_bsd.h
@@ -73,6 +73,7 @@ static int fault_injected(int fd)
struct fault_ioc_disable dis;
int res;

+ info.scope = FAULT_SCOPE_LWP;
if (ioctl(fd, FAULT_IOC_GETINFO, &info) != 0)
fail("FAULT_IOC_GETINFO failed");
res = (info.nfaults > 0);

> --
> You received this message because you are subscribed to the Google Groups "syzkaller-netbsd-bugs" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-netbsd...@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-netbsd-bugs/0000000000006f6e2305bbdc5ca5%40google.com.

[Dmitry Vyukov]

On Tue, Jun 29, 2021 at 12:36 AM Chuck Silvers <ch...@chuq.com> wrote:
>
> this appears to be due to an uninitialized-variable bug in syz-executor.
> here's a patch that should fix it.
>
> -Chuck

So this SYZFAIL found a real bug. Nice.

Unfortunately we cannot accept patches from the mailing list. Do you
want to send a github PR? You would need to run 'make generate' as
well I think to update source for C reproducers as well.
Or I can rewrite this and merge?

> To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-netbsd-bugs/YNpO9a7TMSa2tM0u%40spathi.chuq.com.

[Chuck Silvers]

On Tue, Jun 29, 2021 at 10:48:22AM +0200, 'Dmitry Vyukov' via syzkaller-netbsd-bugs wrote:
> On Tue, Jun 29, 2021 at 12:36 AM Chuck Silvers <ch...@chuq.com> wrote:
> >
> > this appears to be due to an uninitialized-variable bug in syz-executor.
> > here's a patch that should fix it.
> >
> > -Chuck
>
> So this SYZFAIL found a real bug. Nice.
>
> Unfortunately we cannot accept patches from the mailing list. Do you
> want to send a github PR? You would need to run 'make generate' as
> well I think to update source for C reproducers as well.
> Or I can rewrite this and merge?

I set up everything for github and sent a pull request there.
I forgot to do the "make generate" the first time so I force-pushed
a second try to include that change as well.

https://github.com/google/syzkaller/pull/2641

-Chuck

[Dmitry Vyukov]

Thanks for sending the PR. Merged!

Rebasing is fine, we generally rebase and force push.

[Chuck Silvers]

thanks for merging the fix!

how do I mark the syzbot bug report as being fixed by a syzkaller commit rather than
a netbsd commit? should I have just added the usual "Reported-by" line to the
syzkaller commit message? or is the only way to close it at this point to tag it as invalid?

-Chuck

[Dmitry Vyukov]

Marking bugs as fixed with syzkaller commits was never implemented.
Though, it comes up periodically. This is
https://github.com/google/syzkaller/issues/1878
For now we are just marking these as invalid:

#syz invalid