proxmox-mirrors/mirror_lxc
1
0
Fork 0
mirror of https://git.proxmox.com/git/mirror_lxc synced 2025-08-15 03:55:55 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
11,006 Commits 6 Branches 17 Tags 29 MiB
cdb4f412ff
Commit Graph

11006 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Christian Brauner
8d508eaa9b
confile: clear netdev on network type change 
Link: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32584
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
 2021-03-29 12:26:11 +02:00
Christian Brauner
12babd78e3
confile: vet keys more aggressively 
Enforce an exact match for all keys where we now the subkeys must match
exactly.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
 2021-03-29 10:19:30 +02:00
Christian Brauner
d21e950059
confile: safely clean previous value in set_config_net_ipv4_gateway() 
Link: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32586
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
 2021-03-29 10:07:39 +02:00
Christian Brauner
e0f420d5ae
confile: safely clean previous value in set_config_net_ipv6_gateway() 
Link: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32610
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
 2021-03-29 10:07:39 +02:00
Christian Brauner
cc19bc5406
Merge pull request #3745 from evverx/ubsan-msan-support 
oss-fuzz/cifuzz: a couple of follow-up commits
 2021-03-28 23:16:45 +02:00
Christian Brauner
94d05c50c9
Merge pull request #3744 from evverx/oss-fuzz-32596 
confile_utils: fix a signed integer overflow
 2021-03-28 19:20:49 +02:00
Stéphane Graber
db62570f0f
Merge pull request #3743 from brauner/2021-03-27/fixes_3 
oss-fuzz: fixes
 2021-03-28 12:35:16 -04:00
Evgeny Vereshchagin
f6727edbf7 string_utils: work around an MSan false positive 
MSan doesn't instrument stpncpy (https://github.com/google/sanitizers/issues/926),
which causes the fuzzer to fail with:
```
$ cat ../minimized-from-740f56329efc60eab59b8194132b712a873e88a3
lxc.console.size=123

$ ./out/fuzz-lxc-config-read ../minimized-from-740f56329efc60eab59b8194132b712a873e88a3
INFO: Seed: 3561494591
INFO: Loaded 1 modules   (18795 inline 8-bit counters): 18795 [0x866b98, 0x86b503),
INFO: Loaded 1 PC tables (18795 PCs): 18795 [0x86b508,0x8b4bb8),
./out/fuzz-lxc-config-read: Running 1 inputs 1 time(s) each.
Running: ../minimized-from-740f56329efc60eab59b8194132b712a873e88a3
==850885==WARNING: MemorySanitizer: use-of-uninitialized-value
    #0 0x6b3e7f in parse_byte_size_string /home/vagrant/lxc/src/lxc/string_utils.c:912:6
    #1 0x550991 in set_config_console_size /home/vagrant/lxc/src/lxc/confile.c:2483:8
    #2 0x5346e2 in parse_line /home/vagrant/lxc/src/lxc/confile.c:2962:9
    #3 0x64b3cd in lxc_file_for_each_line_mmap /home/vagrant/lxc/src/lxc/parse.c:125:9
    #4 0x53340c in lxc_config_read /home/vagrant/lxc/src/lxc/confile.c:3039:9
    #5 0x4e7ec2 in LLVMFuzzerTestOneInput /home/vagrant/lxc/src/tests/fuzz-lxc-config-read.c:23:2
    #6 0x44ad2c in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/home/vagrant/lxc/out/fuzz-lxc-config-read+0x44ad2c)
    #7 0x42ca4d in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) (/home/vagrant/lxc/out/fuzz-lxc-config-read+0x42ca4d)
    #8 0x433af0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/home/vagrant/lxc/out/fuzz-lxc-config-read+0x433af0)
    #9 0x423ff6 in main (/home/vagrant/lxc/out/fuzz-lxc-config-read+0x423ff6)
    #10 0x7f79bdc89081 in __libc_start_main (/lib64/libc.so.6+0x27081)
    #11 0x42402d in _start (/home/vagrant/lxc/out/fuzz-lxc-config-read+0x42402d)

  Uninitialized value was created by an allocation of 'dup' in the stack frame of function 'parse_byte_size_string'
    #0 0x6b3330 in parse_byte_size_string /home/vagrant/lxc/src/lxc/string_utils.c:901

SUMMARY: MemorySanitizer: use-of-uninitialized-value /home/vagrant/lxc/src/lxc/string_utils.c:912:6 in parse_byte_size_string
Exiting
```

Closes https://oss-fuzz.com/testcase-detail/5829890470445056

Signed-off-by: Evgeny Vereshchagin <evvers@ya.ru>
 2021-03-28 16:05:29 +00:00
Evgeny Vereshchagin
cf0f7aba41 cifuzz: turn on MSan 
Signed-off-by: Evgeny Vereshchagin <evvers@ya.ru>
 2021-03-28 16:05:13 +00:00
Christian Brauner
4c5479d21e
string_utils: handle overflow correct in parse_byte_size_string() 
This takes the overflow handling code from the kernel.

Link: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32549
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
 2021-03-28 11:55:13 +02:00
Evgeny Vereshchagin
a6fa6772e1 cifuzz: turn on UBsan 
Signed-off-by: Evgeny Vereshchagin <evvers@ya.ru>
 2021-03-28 06:53:44 +00:00
Evgeny Vereshchagin
745d60487b oss-fuzz.sh: take SANITIZER into account 
to make it possible to build the fuzzer with UBSan and MSan locally

```
$ SANITIZER=undefined ./src/tests/oss-fuzz.sh
$ printf 'lxc.signal.stop=sigrtmax-020000000020' >oss-fuzz-32596
$ UBSAN_OPTIONS=print_stacktrace=1:print_summary=1:halt_on_error=1 ./out/fuzz-lxc-config-read oss-fuzz-32596
INFO: Seed: 595864277
INFO: Loaded 1 modules   (61553 inline 8-bit counters): 61553 [0x80a1b0, 0x819221),
INFO: Loaded 1 PC tables (61553 PCs): 61553 [0x819228,0x909938),
./out/fuzz-lxc-config-read: Running 1 inputs 1 time(s) each.
Running: oss-fuzz-32596
confile_utils.c:1051:20: runtime error: signed integer overflow: 64 - -2147483632 cannot be represented in type 'int'
    #0 0x51799a in rt_sig_num /home/vagrant/lxc/src/lxc/confile_utils.c:1051:20
    #1 0x517268 in sig_parse /home/vagrant/lxc/src/lxc/confile_utils.c:1069:11
    #2 0x500ca4 in set_config_signal_stop /home/vagrant/lxc/src/lxc/confile.c:1738:10
    #3 0x4b8c7c in parse_line /home/vagrant/lxc/src/lxc/confile.c:2962:9
    #4 0x5a5eb0 in lxc_file_for_each_line_mmap /home/vagrant/lxc/src/lxc/parse.c:125:9

```

Signed-off-by: Evgeny Vereshchagin <evvers@ya.ru>
 2021-03-28 06:52:01 +00:00
Evgeny Vereshchagin
e6b35fbfb6 confile_utils: fix a signed integer overflow 
This was triggered by the following chain of conversions:

lxc_safe_uint("020000000020") -> 2147483664 (uint)
sig_num(2147483664 (uint)) -> -2147483632 (int)

64 - -2147483632 cannot be represented in type 'int'

Closes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32596

Signed-off-by: Evgeny Vereshchagin <evvers@ya.ru>
 2021-03-28 05:41:34 +00:00
Christian Brauner
405b28a4de
confile: don't leak memory in case multiple shmounts are set 
Link: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32503
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
 2021-03-27 20:59:15 +01:00
Christian Brauner
79d2f54fd5
confile: add missing prefix validation 
Link: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32488
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
 2021-03-27 20:49:19 +01:00
Stéphane Graber
d734e61169
Merge pull request #3741 from brauner/2021-03-27/fixes_2 
confile_utils: free list during lxc_remove_nic_by_idx()
 2021-03-27 14:32:51 -04:00
Christian Brauner
9a096e987e
confile_utils: free list during lxc_remove_nic_by_idx() 
Reported-by: Evgeny Vereshchagin <evvers@ya.ru>
Link: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32484
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
 2021-03-27 18:42:24 +01:00
Stéphane Graber
cc98c47021
Merge pull request #3739 from brauner/2021-03-27/fixes 
oss-fuzz: fixes
 2021-03-27 11:48:18 -04:00
Evgeny Vereshchagin
b2606302de
ci: turn on ASan on CIFuzz 
Signed-off-by: Evgeny Vereshchagin <evvers@ya.ru>
 2021-03-27 14:35:48 +01:00
Christian Brauner
1504790389
confile: prevent recursion when parsing networks 
Link: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32558
Link: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32484
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
 2021-03-27 14:31:50 +01:00
Evgeny Vereshchagin
f6848c5fbc
confile: fix a memory leak in set_config_net_hwaddr 
It was found by ClusterFuzz in https://oss-fuzz.com/testcase-detail/4747480244813824
but hasn't been reported on Monorail
(https://bugs.chromium.org/p/oss-fuzz/) yet

```
$ cat minimized-from-1a18983c13ce64e8a3bd0f699a97d25beb21481e
lxc.net.0.hwaddr=0
lxc.net.0.hwaddr=4

./out/fuzz-lxc-config-read minimized-from-1a18983c13ce64e8a3bd0f699a97d25beb21481e
INFO: Seed: 1473396311
INFO: Loaded 1 modules   (18821 inline 8-bit counters): 18821 [0x885fa0, 0x88a925),
INFO: Loaded 1 PC tables (18821 PCs): 18821 [0x88a928,0x8d4178),
./out/fuzz-lxc-config-read: Running 1 inputs 1 time(s) each.
Running: minimized-from-1a18983c13ce64e8a3bd0f699a97d25beb21481e

=================================================================
==226185==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 2 byte(s) in 1 object(s) allocated from:
    #0 0x4d25d7 in strdup (/home/vagrant/lxc/out/fuzz-lxc-config-read+0x4d25d7)
    #1 0x58e48f in set_config_net_hwaddr /home/vagrant/lxc/src/lxc/confile.c:654:14
    #2 0x59af3b in set_config_net_nic /home/vagrant/lxc/src/lxc/confile.c:5276:9
    #3 0x571c29 in parse_line /home/vagrant/lxc/src/lxc/confile.c:2958:9
    #4 0x61b0b2 in lxc_file_for_each_line_mmap /home/vagrant/lxc/src/lxc/parse.c:125:9
    #5 0x5710ed in lxc_config_read /home/vagrant/lxc/src/lxc/confile.c:3035:9
    #6 0x542cd6 in LLVMFuzzerTestOneInput /home/vagrant/lxc/src/tests/fuzz-lxc-config-read.c:23:2
    #7 0x449e8c in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/home/vagrant/lxc/out/fuzz-lxc-config-read+0x449e8c)
    #8 0x42bbad in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) (/home/vagrant/lxc/out/fuzz-lxc-config-read+0x42bbad)
    #9 0x432c50 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/home/vagrant/lxc/out/fuzz-lxc-config-read+0x432c50)
    #10 0x423136 in main (/home/vagrant/lxc/out/fuzz-lxc-config-read+0x423136)
    #11 0x7f2cbb992081 in __libc_start_main (/lib64/libc.so.6+0x27081)

SUMMARY: AddressSanitizer: 2 byte(s) leaked in 1 allocation(s).
```

Signed-off-by: Evgeny Vereshchagin <evvers@ya.ru>
 2021-03-27 14:31:37 +01:00
Christian Brauner
299ddd1663
confile: improve network vetting 
Move all input sanity checks up and add two missing checks for the
correct network type when using veth-vlan and vlan network types.

Link: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32513
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
 2021-03-27 14:31:37 +01:00
Christian Brauner
bbc9892535
confile: use correct check for too large network lists 
Link: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32558
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
 2021-03-27 08:09:56 +01:00
Christian Brauner
6a52a513f9
confile: make string calculations in get_network_config_ops() more obvious 
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
 2021-03-27 08:09:09 +01:00
Christian Brauner
ced5587c03
conf: coding style cleanups 
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
 2021-03-27 07:56:22 +01:00
Christian Brauner
25ed0305b1
confile_utils: free network list items 
Link: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32484
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
 2021-03-27 07:52:33 +01:00
Christian Brauner
cc36133d43
conf: reinitialize lists 
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
 2021-03-27 07:52:10 +01:00
Christian Brauner
c45833e39c
string_utils: always memset buf in lxc_safe_int64_residual() 
Link: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32482
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
 2021-03-27 07:14:56 +01:00
Stéphane Graber
6a374b65e7
Merge pull request #3738 from brauner/2021-03-26/fixes_3 
oss-fuzz: fixes
 2021-03-26 18:22:30 -04:00
Christian Brauner
5837aa8448
confile: fix returns in set_config_net_veth_vlan_tagged_id() 
Link: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32494
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
 2021-03-26 23:02:59 +01:00
Christian Brauner
631d271533
confile: fix setting prlimits 
Fixes: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32532
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
 2021-03-26 22:58:01 +01:00
Christian Brauner
59bc24cd0d
conf: don't leak list 
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
 2021-03-26 22:57:58 +01:00
Stéphane Graber
8c70a4080b
Merge pull request #3736 from brauner/2021-03-26/fixes_3 
oss-fuzz: fixes
 2021-03-26 17:52:57 -04:00
Christian Brauner
06fdc710a8
log: avoid regressions for relative log paths 
We need to allow relative log paths.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
 2021-03-26 22:32:18 +01:00
Christian Brauner
b2480b2950
string_utils: fix parse_byte_size_string() 
Link: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32475
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
 2021-03-26 22:28:36 +01:00
Christian Brauner
0b73eb0590
confile_utils: improve network parser 
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
 2021-03-26 22:28:36 +01:00
Christian Brauner
6583a65090
Merge pull request #3737 from evverx/oss-fuzz-fixes 
oss-fuzz: a few follow-up commits
 2021-03-26 20:45:39 +01:00
Christian Brauner
647d0e011a
Merge pull request #3731 from samboyles1/master 
network: handle name collisions when returning interfaces to host
 2021-03-26 17:18:08 +01:00
Stéphane Graber
627c766cba
Merge pull request #3735 from brauner/2021-03-26/fixes_2 
oss-fuzz: fixes
 2021-03-26 12:00:04 -04:00
Christian Brauner
786467cbdd
conf: prevent UAF in lxc_clear_limits() 
Link: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32532
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
 2021-03-26 16:42:57 +01:00
Christian Brauner
b8e539f448
confile_utils: fix real-time signal parsing 
Link: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32521
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
 2021-03-26 16:38:49 +01:00
Christian Brauner
c04f422182
confile: don't leak memory when overwriting lxc.rootfs.options 
Link: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32473
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
 2021-03-26 16:02:04 +01:00
Christian Brauner
e50319aaaf
Merge pull request #3733 from evverx/move-from-oss-fuzz 
oss-fuzz: make it possible to build the fuzzer without docker
 2021-03-26 15:35:37 +01:00
Stéphane Graber
6a3b579505
Merge pull request #3734 from brauner/2021-03-26/fixes_2 
confile: be stricter in config helpers
 2021-03-26 10:30:47 -04:00
Christian Brauner
d60ba56821
confile: be stricter in config helpers 
We never call these helper without an initialized config afaict but
since we're now exposing these two functions to oss-fuzz directly in a
way we never do to users so let's be stricter about it.

Inspired-by: #3733
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
 2021-03-26 15:11:08 +01:00
Stéphane Graber
0912bf6b77
Merge pull request #3732 from brauner/2021-03-26/fixes 
log: dont create log file for fuzz builds
 2021-03-26 08:26:41 -04:00
Christian Brauner
2f6d309983
log: handle empty log name 
Fixes: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32491
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
 2021-03-26 12:21:48 +01:00
Christian Brauner
e459cf6831
log: don't create directories for fuzz builds 
Fixes: #3730
Fixes: https://github.com/google/oss-fuzz/issues/5509
Suggested-by: Evgeny Vereshchagin <evvers@ya.ru>
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
 2021-03-26 11:52:54 +01:00
Christian Brauner
a30a4efae5
log: dont create log file for fuzz builds 
Fixes: #3730
Fixes: https://github.com/google/oss-fuzz/issues/5509
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
 2021-03-26 09:20:56 +01:00
Evgeny Vereshchagin
98f9e64d33 fuzz: generate all the config keys and add them to the seed corpus 
It should help to cover more code faster

Signed-off-by: Evgeny Vereshchagin <evvers@ya.ru>
 2021-03-26 05:49:19 +00:00