Re: general protection fault in syscall_return_slowpath

[Dmitry Vyukov]

On Sun, Mar 8, 2020 at 7:26 PM Thomas Gleixner <tglx@xxxxxxxxxxxxx> wrote:
>
> Andy Lutomirski <luto@xxxxxxxxxx> writes:
> > On Sat, Mar 7, 2020 at 11:45 PM syzbot
> > <syzbot+cd66e43794b178bb5cd6@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote:
> > $ make -j4
> > tools/syz-env/env.go:14:2: cannot find package
> > "github.com/google/syzkaller/pkg/osutil" in any of:
> >
> > I'm sure that if I actually understood Go's delightful packaging
> > system, I could reverse engineer your build system and figure out how
> > to make it work.  But perhaps you could document the build process?
> > Or maybe make 'make' just work?
> >
> > For kicks, I tried this:
> >
> > $ mkdir -p src/github.com/google
> > $ ln -sr . src/github.com/google/syzkaller
> > $ GOPATH=`/bin/pwd` make
> > GOOS=linux GOARCH=amd64 go install ./syz-manager
> > go install: no install location for directory
> > /home/luto/apps/syzkaller/syz-manager outside GOPATH
> >
> > Are there instructions for just building syzkaller?  I don't want to
> > install it, I don't want to fuzz my kernel -- I just want to run your
> > reproducer.
>
> https://github.com/google/syzkaller/blob/master/docs/executing_syzkaller_programs.md
>
> That's how I build the binaries:
>
>   mkdir foo
>   export GOPATH=$HOME/foo
>
>   cd foo
>   go get -u -d github.com/google/syzkaller/...
>   cd src/github.com/google/syzkaller
>   make
>   cp bin/linux_amd64/syz-execprog bin/linux_amd64/syz-executor $GOPATH
>
> Of course you can build it somewhere and scp the executables to a test box.
>
> And then to run it
>
>   cd $GOPATH
>   wget -O repro.syz https://syzkaller.appspot.com/x/repro.syz?x=12a42329e00000
>   ./syz-execprog -procs 6 -repeat 0 -collide -disable none repro.syz
>
> The command line options are a bit tedious as you have to look them up
> in the comment in repro.syz.
>
> A scripts which converts that comment into command line options or
> syz-execprog simply taking it from repro.syz would indeed be handy.
>
> A kernel with the config provided in the report and running that
> reproducer is still not reproducing with a runtime of 8hrs+ :(

There is https://github.com/google/syzkaller/issues/563 for a self
contained repro script.

But I am not sure how configurable it should be; how much should it
download; and if it should assume reproducing on host, or some other
remote machine/VM. Some users want only flags for syz-repro and have
the rest installed; some want the script to take care of Go toolchain
installation and/or syzkaller checkout; some also want
qemu/image/kernel/gcc. Some there is whole spectrum of what it can do
with lots of variations. If it does everything end-to-end downloading
tens of gigs and building own kernel, some users won't be happy. If we
add a gazillion of flags, one will need to be a certified expert in
configuring this script, which may be not simpler than doing all steps
manually, and obviously less transparent when it fails...