SYZFAIL: failed to recv rpc while trying to run syzkaller

[youkyeong]

Hi, I'm trying to run syzkaller on my ubuntu desktop to do some fuzzing. 

I got an error as below.

2024/11/28 23:17:31 parsing of machine info failed: failed to get _etext symbol 

2024/11/28 23:17:31 machine check failed: failed to get _etext symbol 

SYZFAIL: failed to recv rpc  

I followed this. https://github.com/google/syzkaller/blob/master/docs/linux/setup_linux-host_qemu-vm_arm64-kernel.md 

and my running environment is here:

- host: ubuntu 22.04 (x86_64)

- vm: qemu 6.4.0 (aarch64)

- buildroot: buildroot-2024.02.8

- toolchain: Linaro GCC 6.4-2018.05

- kernel: linux 5.10.198

I run this command ./bin/syz-manager -config=config.cfg -debug

and the log output with -debug is below

2024/11/28 23:17:06 seed sys/linux/test/cet_user_shstk is broken: unknown syscall arch_prctl$ARCH_SHSTK_DISABLE
2024/11/28 23:17:06 seed sys/linux/test/pkey is broken: unknown syscall pipe
2024/11/28 23:17:06 serving rpc on tcp://45235
2024/11/28 23:17:06 running command: /usr/bin/qemu-system-aarch64 []string{"-m", "2048", "-smp", "2", "-chardev", "socket,id=SOCKSYZ,server=on,wait=off,host=localhost,port=62677", "-mon", "chardev=SOCKSYZ,mode=control", "-display", "none", "-serial", "stdio", "-no-reboot", "-name", "VM-0", "-device", "virtio-rng-pci", "-machine", "virt,virtualization=on,gic-version=max", "-cpu", "max,sve128=on,pauth=off", "-device", "virtio-net-pci,netdev=net0", "-netdev", "user,id=net0,restrict=on,hostfwd=tcp:127.0.0.1:39911-:22", "-hda", "/home/user/aarch64_syzkaller/rootfs.ext2", "-snapshot", "-kernel", "/home/user/koldemort/linux-5.10.198/arch/arm64/boot/Image", "-append", "root=/dev/vda console=ttyAMA0 console=ttyAMA0 root=/dev/vda"}
2024/11/28 23:17:06 serving http on http://:56700
2024/11/28 23:17:07 broken programs in the corpus: 0, broken seeds: 2

----- booting log -----

Seeding 256 bits and crediting
Saving 256 bits of creditable seed for next boot
Starting syslogd: OK
Starting klogd: OK
Running sysctl: OK
Starting haveged: haveged: command socket is listening at fd 3
OK
Starting network: OK
Starting dhcpcd...
dhcpcd-10.0.8 starting
DUID 00:01:00:01:2e:d9:b0:29:52:54:00:12:34:56
no interfaces have a carrier
sending commands to dhcpcd process
Starting sshd: OK

Welcome to Buildroot
2024/11/28 23:17:16 running ssh: []string{"-p", "39911", "-F", "/dev/null", "-o", "UserKnownHostsFile=/dev/null", "-o", "IdentitiesOnly=yes", "-o", "BatchMode=yes", "-o", "StrictHostKeyChecking=no", "-o", "ConnectTimeout=10", "-i", "/home/user/.ssh/id_ed25519", "-v", "root@localhost", "pwd"}
2024/11/28 23:17:22 running command: scp []string{"-P", "39911", "-F", "/dev/null", "-o", "UserKnownHostsFile=/dev/null", "-o", "IdentitiesOnly=yes", "-o", "BatchMode=yes", "-o", "StrictHostKeyChecking=no", "-o", "ConnectTimeout=10", "-i", "/home/user/.ssh/id_ed25519", "-v", "/home/user/syzkaller/bin/linux_arm64/syz-executor", "root@localhost:/syz-executor"}
2024/11/28 23:17:26 running command: []string{"ssh", "-p", "39911", "-F", "/dev/null", "-o", "UserKnownHostsFile=/dev/null", "-o", "IdentitiesOnly=yes", "-o", "BatchMode=yes", "-o", "StrictHostKeyChecking=no", "-o", "ConnectTimeout=10", "-i", "/home/user/.ssh/id_ed25519", "-R", "45235:127.0.0.1:45235", "-v", "root@localhost", "cd / && /syz-executor runner 0 localhost 45235"}
OpenSSH_8.9p1 Ubuntu-3ubuntu0.10, OpenSSL 3.0.2 15 Mar 2022
debug1: Reading configuration data /dev/null
debug1: Connecting to localhost [127.0.0.1] port 39911.
debug1: fd 3 clearing O_NONBLOCK
debug1: Connection established.
debug1: identity file /home/user/.ssh/id_ed25519 type 3
debug1: identity file /home/user/.ssh/id_ed25519-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.10
debug1: Remote protocol version 2.0, remote software version OpenSSH_9.7
debug1: compat_banner: match: OpenSSH_9.7 pat OpenSSH* compat 0x04000000
debug1: Authenticating to localhost:39911 as 'root'
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts2: No such file or directory
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: curve25519-sha256
debug1: kex: host key algorithm: ssh-ed25519
debug1: kex: server->client cipher: chacha20...@openssh.com MAC: <implicit> compression: none
debug1: kex: client->server cipher: chacha20...@openssh.com MAC: <implicit> compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: SSH2_MSG_KEX_ECDH_REPLY received
debug1: Server host key: ssh-ed25519 SHA256:dM1QbT1sOFlP79xONHPx6n/1gAoPaj/VumbnL2qWIaQ
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts2: No such file or directory
debug1: checking without port identifier
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts2: No such file or directory
Warning: Permanently added '[localhost]:39911' (ED25519) to the list of known hosts.
debug1: ssh_packet_send2_wrapped: resetting send seqnr 3
debug1: rekey out after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: ssh_packet_read_poll2: resetting read seqnr 3
debug1: SSH2_MSG_NEWKEYS received
debug1: rekey in after 134217728 blocks
debug1: Will attempt key: /home/user/.ssh/id_ed25519 ED25519 SHA256:H5dxSKlBAKFsBzCmuNdQ+0ImzmTVk3n2SoY50ZFEdLA explicit
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,sk-ssh-...@openssh.com,sk-ecdsa-sh...@openssh.com,rsa-sha2-512,rsa-sha2-256>
debug1: kex_input_ext_info: publickey...@openssh.com=<0>
debug1: kex_input_ext_info: pi...@openssh.com (unrecognised)
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,password,keyboard-interactive
debug1: Next authentication method: publickey
debug1: Offering public key: /home/user/.ssh/id_ed25519 ED25519 SHA256:H5dxSKlBAKFsBzCmuNdQ+0ImzmTVk3n2SoY50ZFEdLA explicit
debug1: Server accepts key: /home/user/.ssh/id_ed25519 ED25519 SHA256:H5dxSKlBAKFsBzCmuNdQ+0ImzmTVk3n2SoY50ZFEdLA explicit
Authenticated to localhost ([127.0.0.1]:39911) using "publickey".
debug1: Remote connections from LOCALHOST:45235 forwarded to local address 127.0.0.1:45235
debug1: channel 0: new [client-session]
debug1: Requesting no-more-...@openssh.com
debug1: Entering interactive session.
debug1: pledge: network
debug1: client_input_global_request: rtype hostk...@openssh.com want_reply 0
debug1: Remote: /root/.ssh/authorized_keys:1: key options: agent-forwarding port-forwarding pty user-rc x11-forwarding
debug1: Remote: /root/.ssh/authorized_keys:1: key options: agent-forwarding port-forwarding pty user-rc x11-forwarding
debug1: remote forward success for: listen 45235, connect 127.0.0.1:45235
debug1: Sending command: cd / && /syz-executor runner 0 localhost 45235
debug1: client_input_channel_open: ctype forwarded-tcpip rchan 2 win 2097152 max 32768
debug1: client_request_forwarded_tcpip: listen localhost port 45235, originator 127.0.0.1 port 59830
debug1: connect_next: host 127.0.0.1 ([127.0.0.1]:45235) in progress, fd=4
debug1: channel 1: new [127.0.0.1]
debug1: confirm forwarded-tcpip
debug1: channel 1: connected to 127.0.0.1 port 45235
connected to manager: procs=1 cover_edges=1 kernel_64_bit=1 slowdown=10 syscall_timeout=500 program_timeout=15000 features=0xffffffffffffffff
reading file /proc/cpuinfo: size=852 exists=1 error=
reading file /proc/modules: size=0 exists=1 error=
reading file /proc/kallsyms: size=6421184 exists=1 error=
glob /sys/module/*/sections/.text resolved to 0 files
glob /sys/module/kvm*/parameters/* resolved to 4 files
reading file /sys/module/kvm/parameters/halt_poll_ns_shrink: size=2 exists=1 error=
reading file /sys/module/kvm/parameters/halt_poll_ns: size=7 exists=1 error=
reading file /sys/module/kvm/parameters/halt_poll_ns_grow_start: size=6 exists=1 error=
reading file /sys/module/kvm/parameters/halt_poll_ns_grow: size=2 exists=1 error=
reading file /proc/version: size=270 exists=1 error=
reading file /proc/filesystems: size=334 exists=1 error=
reading file /sys/kernel/security/lsm: size=0 exists=0 error=No such file or directory
glob /sys/**/* resolved to 24 files
write to /proc/sys/kernel/hung_task_check_interval_secs failed: No such file or directory
write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory
buildroot login: [   22.852462] cgroup: Unknown subsys name 'net'
[   22.853253] cgroup: Unknown subsys name 'net_prio'
mount(/syzcgroup/net, net) failed: 22
mount(/syzcgroup/net, net_prio) failed: 22
[   22.863816] cgroup: Unknown subsys name 'freezer'
mount(/syzcgroup/net, freezer) failed: 22
[   22.910780] cgroup: Unknown subsys name 'rlimit'
mount(/syzcgroup/cpu, rlimit) failed: 22
setting up feature DelayKcovMmap
setting up feature Fault
failed: CONFIG_FAULT_INJECTION is not enabled
setting up feature Leak
failed: failed to write(kmemleak, "scan=off")
setting up feature KCSAN
failed: write(/sys/kernel/debug/kcsan, on) failed
setting up feature USBEmulation
failed: failed to chmod /dev/raw-gadget
setting up feature LRWPANEmulation
netlink: failed to get family id for nl802154: No such file or directory
failed: netlink_query_family_id failed
setting up feature BinFmtMisc
mount(binfmt_misc) failed: 2
setting up feature Swap
mkswap ./swap-file
mkswap: image is too small
FAIL: mkswap ./swap-file
failed: mkswap failed
setting up feature NicVF
failed: PCI device 0000:00:11.0 is not available
setting up feature DevlinkPCI
failed: PCI device 0000:00:10.0 is not available
2024/11/28 23:17:31 parsing of machine info failed: failed to get _etext symbol
2024/11/28 23:17:31 machine check failed: failed to get _etext symbol
SYZFAIL: failed to recv rpc
2024/11/28 23:17:31 qemu: running hmp command: info registers
fd=3 want=4 recv=0 n=0 (errno 2: No such file or directory)
2024/11/28 23:17:31 qemu: reply: <nil>
 PC=ffffcf091bcd4dbc X00=ffffcf091ca73400 X01=ffffcf091bd00000
X02=0000000000000000 X03=0000000000030e5a X04=ffffcf091ac00000
X05=0000000000000000 X06=0000000000000000 X07=000000000000002e
X08=ffffcf091ca73e90 X09=ffffcf091ca63e10 X10=0000000000000a30
X11=0000000000000000 X12=0000000000000002 X13=0000000000000000
X14=0000000000000000 X15=00000000000000b2 X16=0000000000000000
X17=0000000000000000 X18=0000000000000000 X19=ffffcf091ca6a260
X20=0000000000000001 X21=ffffcf091ca6a000 X22=ffffcf091c5f08b8
X23=ffffcf091c3c4000 X24=ffffcf091ca6a35c X25=0000000000000000
X26=0000000000000000 X27=ffffcf091ca73400 X28=00000000412e9348
X29=ffffcf091ca63e90 X30=ffffcf091bcd4db4  SP=ffffcf091ca63e90
PSTATE=80c00089 N--- EL2h  BTYPE=0     FPCR=00000000 FPSR=00000000
P00=1111 P01=0000 P02=0000 P03=0000 P04=0000 P05=0000 P06=0000 P07=0000
P08=0000 P09=0000 P10=0000 P11=0000 P12=0000 P13=0000 P14=0000 P15=0000
FFR=0000
Z00=0000000000000000:0000000000000000 Z01=9c0d07f6186f36b6:368c9ec317dbc98e
Z02=dc362d87f0381824:195e2f559de0d67b Z03=8012dd3ea71cb278:69221ad7e990d0c4
Z04=50024b15675e9382:e1a92f92c955bc18 Z05=5bd682783821adb6:46ce77af471b5a89
Z06=e05ad195e0f55e9c:2238177b1857e5dd Z07=359d8be83e47d9c4:6260d198a4fcde68
Z08=0000000000000000:0000000000000000 Z09=0000000000000000:0000000000000000
Z10=0000000000000000:0000000000000000 Z11=0000000000000000:0000000000000000
Z12=0000000000000000:0000000000000000 Z13=0000000000000000:0000000000000000
Z14=0000000000000000:0000000000000000 Z15=0000000000000000:0000000000000000
Z16=0000002700000026:0000002500000024 Z17=6d6b286574697277:206f742064656c69
Z18=666f3d6e61637322:202c6b61656c6d65 Z19=000a00080007000c:0018000a00292266
Z20=0000000001000000:0010010000000000 Z21=4749464e4f430000:0025000000000000
Z22=4e4f495443454a4e:495f544c5541465f Z23=0064656c62616e65:20746f6e20736920
Z24=0000000000080007:0008001000080000 Z25=6170786561707865:6170786561707865
Z26=3320646e3320646e:3320646e3320646e Z27=79622d3279622d32:79622d3279622d32
Z28=6b2065746b206574:6b2065746b206574 Z29=70c381bc70c381bc:70c381bc70c381bc
Z30=9ad88ddb9ad88ddb:9ad88ddb9ad88ddb Z31=ef000000ef000000:ef000000ef000000
2024/11/28 23:17:31 qemu: running hmp command: info registers
2024/11/28 23:17:31 qemu: reply: <nil>
 PC=ffffcf091ae2285c X00=ffff318543a3f000 X01=ffffcf091bd00000
X02=0000000000000000 X03=0000000000000135 X04=ffffcf091ac00000
X05=ffff318542429000 X06=0000000000000020 X07=0000000000000012
X08=ffffffffffffffff X09=000000000000000d X10=ffff318542408c00
X11=0000000000000090 X12=000000000000019d X13=000000000000038f
X14=0000000000000000 X15=0000000000000001 X16=0000000000000000
X17=0000000000000000 X18=0000000000000000 X19=fffffec614ef32c0
X20=ffff318543b4a2a0 X21=fffffec614ef32c0 X22=0020000043ccbfc3
X23=0000ffffafc54000 X24=ffff80001031bb58 X25=0000000000000000
X26=ffff80001031bc78 X27=0000000000000000 X28=0000ffffafd29000
X29=ffff80001031ba30 X30=ffffcf091ae10b0c  SP=ffff80001031ba30
PSTATE=80400009 N--- EL2h  BTYPE=0     FPCR=00000000 FPSR=00000000
P00=1111 P01=0000 P02=0000 P03=0000 P04=0000 P05=0000 P06=0000 P07=0000
P08=0000 P09=0000 P10=0000 P11=0000 P12=0000 P13=0000 P14=0000 P15=0000
FFR=0000
Z00=2525252525252525:2525252525252525 Z01=206e776f6e6b6e75:0000000000000000
Z02=f00ff00ff00ff00f:f00ff00ff00ff00f Z03=0000000000000000:f00ff00ff00ff00f
Z04=f00ff00ff00ff00f:f00ff00ff00ff00f Z05=00000000ffffffff:00000000ffffffff
Z06=cccccccc00000000:cccccccc00000000 Z07=0000000000000000:0000000000000000
Z08=0000000000000000:0000000000000000 Z09=0000000000000000:0000000000000000
Z10=0000000000000000:0000000000000000 Z11=0000000000000000:0000000000000000
Z12=0000000000000000:0000000000000000 Z13=0000000000000000:0000000000000000
Z14=0000000000000000:0000000000000000 Z15=0000000000000000:0000000000000000
Z16=0000000000000000:0000000000000000 Z17=0000000000000000:0000000000000000
Z18=0000000000000000:0000000000000000 Z19=0000000000000000:0000000000000000
Z20=0000000000000000:0000000000000000 Z21=0000000000000000:0000000000000000
Z22=0000000000000000:0000000000000000 Z23=0000000000000000:0000000000000000
Z24=0000000000000000:0000000000000000 Z25=0000000000000000:0000000000000000
Z26=0000000000000000:0000000000000000 Z27=0000000000000000:0000000000000000
Z28=0000000000000000:0000000000000000 Z29=0000000000000000:0000000000000000
Z30=0000000000000000:0000000000000000 Z31=0000000000000000:0000000000000000
debug1: client_input_channel_req: channel 0 rtype exit-status reply 0
debug1: channel 1: free: 127.0.0.1, nchannels 2
debug1: channel 0: free: client-session, nchannels 1
Transferred: sent 3800, received 6435036 bytes, in 4.6 seconds
Bytes per second: sent 831.0, received 1407191.4
debug1: Exit status 67

any suggestions what is going wrong here?

thanks in advance.

youkyeong.

[youkyeong ko]

[Dmitry Vyukov]

Hi,

syzkaller parses /proc/kallsyms file on start to figure out something,
and it expects to find _etext symbol there.
For your test machine it fails to find _etext in /proc/kallsyms.
Maybe you have CONFIG_KALLSYMS* kernel configs disabled.

[youkyeong]

thank you for your reply. 

but CONFIG_KALLSYMS* kernel configs are already enabled. 

In QEMU, I can find /proc/kallsyms file. 

Is there any other possible problem?

2024년 12월 2일 월요일 오후 6시 30분 29초 UTC+9에 dvy...@google.com님이 작성:

[Dmitry Vyukov]

On Wed, 4 Dec 2024 at 01:42, youkyeong <kokoy...@gmail.com> wrote:
>
> thank you for your reply.
> but CONFIG_KALLSYMS* kernel configs are already enabled.
> In QEMU, I can find /proc/kallsyms file.
> Is there any other possible problem?

Does kallsyms contain _etext symbol?
This is the root cause:

> --
> You received this message because you are subscribed to the Google Groups "syzkaller" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller+...@googlegroups.com.
> To view this discussion visit https://groups.google.com/d/msgid/syzkaller/e8da413e-665f-4389-87f2-33d4dc225ffcn%40googlegroups.com.

[youkyeong]

yes, kallsyms contains _etext symbol. 

# cat kallsyms | grep "_etext" 

ffffd8c9c8300000 R _etext  

here is the output. 

Thank you. 

[Dmitry Vyukov]

Can you please test if this fixes the problem?

https://github.com/google/syzkaller/pull/5573

To view this discussion visit https://groups.google.com/d/msgid/syzkaller/139acab8-fe13-4f28-a3a0-36bd68d2ca3cn%40googlegroups.com.

[youkyeong]

It's working well now. 

Thank you so much!