Commits · 52c57882a0774b2984aa12b0566690d50f6b7be3 · Chen Yisong / lxc

02 Apr, 2021 9 commits
- build-system: make it compatible with ASan/UBsan/MSan · 52c57882
  Evgeny Vereshchagin authored Mar 30, 2021
```
Closes: https://github.com/lxc/lxc/issues/3727Signed-off-by: Evgeny Vereshchagin <evvers@ya.ru>
```
  52c57882
- ci: enable PAM · 85ec1b47
  Evgeny Vereshchagin authored Mar 30, 2021
```
to make sure pam_cgfs is buildable with ASan/UBsan too
Signed-off-by: Evgeny Vereshchagin <evvers@ya.ru>
```
  85ec1b47
- ci: also build with ASan/UBsan · 766b5f05
  Evgeny Vereshchagin authored Mar 30, 2021
```
Signed-off-by: Evgeny Vereshchagin <evvers@ya.ru>
```
  766b5f05
- oss-fuzz.sh: get rid of the sed "no-undefined" kludge · fe069142
  Evgeny Vereshchagin authored Mar 30, 2021
```
Signed-off-by: Evgeny Vereshchagin <evvers@ya.ru>
```
  fe069142
- ci: stop passing --enable-ubsan · b2378a56
  Evgeny Vereshchagin authored Mar 30, 2021
```
It's just a follow-up to 5f404236 (where --enable-ubsan
was removed).
Signed-off-by: Evgeny Vereshchagin <evvers@ya.ru>
```
  b2378a56
- doc: Documented that net type field must come before other options on the net device · df9bfcf0
  Thomas Parrott authored Mar 29, 2021
```
Signed-off-by: Thomas Parrott <thomas.parrott@canonical.com>
```
  df9bfcf0
- README: remove Travis and add Github actions badge · 38743a89
  Christian Brauner authored Mar 29, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  38743a89
- autotools: remove --enable-{asan,ubsan} in favor of --enable-sanitizers · 96c61d3a
  Christian Brauner authored Mar 29, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
  96c61d3a
- oss-fuzz.sh: put the "lxc.net" keys in the seed corpus as well · 95e142f5
  Evgeny Vereshchagin authored Mar 29, 2021
```
It's just a follow-up to 0abcc213 (where the "lxc.net" keys
were moved from config_jump_table to config_jump_table_net)
Signed-off-by: Evgeny Vereshchagin <evvers@ya.ru>
```
  95e142f5
29 Mar, 2021 31 commits

compiler: fix thread_local detection · 03fd6796
Christian Brauner authored Mar 29, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
03fd6796
lxccontainer: ensure second parameter to bsearch is never NULL · 3d764767
Christian Brauner authored Mar 29, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
3d764767

conf: fix thread_local support detection · 63340988

authored Mar 29, 2021

Our detection for TLS wasn't working. Fix it.

Fixes: https://github.com/lxc/lxd/issues/8327Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

63340988

tests: add another test for garbage config key · 90accff3

authored Mar 29, 2021

where a valid key has trailing garbage at the end before the "=".
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

90accff3

tests: fix two false negatives in parse_config_file() · f44eb244
Christian Brauner authored Mar 29, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
f44eb244
confile: cleanup set_config_net_script_down() · 01e3ca9b
Christian Brauner authored Mar 29, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
01e3ca9b
confile: cleanup set_config_net_script_up() · ab34ded6
Christian Brauner authored Mar 29, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
ab34ded6
confile: cleanup set_config_net_mtu() · d47e3831
Christian Brauner authored Mar 29, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
d47e3831
confile: cleanup set_config_net_hwaddr() · c72590da
Christian Brauner authored Mar 29, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
c72590da

confile: clear netdev on network type change · 942b2d31

authored Mar 29, 2021

Link: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32584Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

942b2d31

confile: vet keys more aggressively · 24ca9420

authored Mar 29, 2021

Enforce an exact match for all keys where we now the subkeys must match
exactly.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

24ca9420

confile: safely clean previous value in set_config_net_ipv4_gateway() · 9d5a073d

authored Mar 28, 2021

Link: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32586Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

9d5a073d

confile: safely clean previous value in set_config_net_ipv6_gateway() · ed3a03cb

authored Mar 28, 2021

Link: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32610Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

ed3a03cb

string_utils: work around an MSan false positive · a348e8f4

authored Mar 28, 2021

MSan doesn't instrument stpncpy (https://github.com/google/sanitizers/issues/926),
which causes the fuzzer to fail with:
```
$ cat ../minimized-from-740f56329efc60eab59b8194132b712a873e88a3
lxc.console.size=123

$ ./out/fuzz-lxc-config-read ../minimized-from-740f56329efc60eab59b8194132b712a873e88a3
INFO: Seed: 3561494591
INFO: Loaded 1 modules   (18795 inline 8-bit counters): 18795 [0x866b98, 0x86b503),
INFO: Loaded 1 PC tables (18795 PCs): 18795 [0x86b508,0x8b4bb8),
./out/fuzz-lxc-config-read: Running 1 inputs 1 time(s) each.
Running: ../minimized-from-740f56329efc60eab59b8194132b712a873e88a3
==850885==WARNING: MemorySanitizer: use-of-uninitialized-value
    #0 0x6b3e7f in parse_byte_size_string /home/vagrant/lxc/src/lxc/string_utils.c:912:6
    #1 0x550991 in set_config_console_size /home/vagrant/lxc/src/lxc/confile.c:2483:8
    #2 0x5346e2 in parse_line /home/vagrant/lxc/src/lxc/confile.c:2962:9
    #3 0x64b3cd in lxc_file_for_each_line_mmap /home/vagrant/lxc/src/lxc/parse.c:125:9
    #4 0x53340c in lxc_config_read /home/vagrant/lxc/src/lxc/confile.c:3039:9
    #5 0x4e7ec2 in LLVMFuzzerTestOneInput /home/vagrant/lxc/src/tests/fuzz-lxc-config-read.c:23:2
    #6 0x44ad2c in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/home/vagrant/lxc/out/fuzz-lxc-config-read+0x44ad2c)
    #7 0x42ca4d in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) (/home/vagrant/lxc/out/fuzz-lxc-config-read+0x42ca4d)
    #8 0x433af0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/home/vagrant/lxc/out/fuzz-lxc-config-read+0x433af0)
    #9 0x423ff6 in main (/home/vagrant/lxc/out/fuzz-lxc-config-read+0x423ff6)
    #10 0x7f79bdc89081 in __libc_start_main (/lib64/libc.so.6+0x27081)
    #11 0x42402d in _start (/home/vagrant/lxc/out/fuzz-lxc-config-read+0x42402d)

  Uninitialized value was created by an allocation of 'dup' in the stack frame of function 'parse_byte_size_string'
    #0 0x6b3330 in parse_byte_size_string /home/vagrant/lxc/src/lxc/string_utils.c:901

SUMMARY: MemorySanitizer: use-of-uninitialized-value /home/vagrant/lxc/src/lxc/string_utils.c:912:6 in parse_byte_size_string
Exiting
```

Closes https://oss-fuzz.com/testcase-detail/5829890470445056Signed-off-by: Evgeny Vereshchagin <evvers@ya.ru>

a348e8f4

cifuzz: turn on MSan · 0e24c1b2
Evgeny Vereshchagin authored Mar 28, 2021
```
Signed-off-by: Evgeny Vereshchagin <evvers@ya.ru>
```
0e24c1b2

string_utils: handle overflow correct in parse_byte_size_string() · 8ccd3d76

authored Mar 27, 2021

This takes the overflow handling code from the kernel.

Link: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32549Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

8ccd3d76

cifuzz: turn on UBsan · 51b0e727
Evgeny Vereshchagin authored Mar 28, 2021
```
Signed-off-by: Evgeny Vereshchagin <evvers@ya.ru>
```
51b0e727

oss-fuzz.sh: take SANITIZER into account · affdb4a4

authored Mar 28, 2021

to make it possible to build the fuzzer with UBSan and MSan locally

```
$ SANITIZER=undefined ./src/tests/oss-fuzz.sh
$ printf 'lxc.signal.stop=sigrtmax-020000000020' >oss-fuzz-32596
$ UBSAN_OPTIONS=print_stacktrace=1:print_summary=1:halt_on_error=1 ./out/fuzz-lxc-config-read oss-fuzz-32596
INFO: Seed: 595864277
INFO: Loaded 1 modules   (61553 inline 8-bit counters): 61553 [0x80a1b0, 0x819221),
INFO: Loaded 1 PC tables (61553 PCs): 61553 [0x819228,0x909938),
./out/fuzz-lxc-config-read: Running 1 inputs 1 time(s) each.
Running: oss-fuzz-32596
confile_utils.c:1051:20: runtime error: signed integer overflow: 64 - -2147483632 cannot be represented in type 'int'
    #0 0x51799a in rt_sig_num /home/vagrant/lxc/src/lxc/confile_utils.c:1051:20
    #1 0x517268 in sig_parse /home/vagrant/lxc/src/lxc/confile_utils.c:1069:11
    #2 0x500ca4 in set_config_signal_stop /home/vagrant/lxc/src/lxc/confile.c:1738:10
    #3 0x4b8c7c in parse_line /home/vagrant/lxc/src/lxc/confile.c:2962:9
    #4 0x5a5eb0 in lxc_file_for_each_line_mmap /home/vagrant/lxc/src/lxc/parse.c:125:9

```
Signed-off-by: Evgeny Vereshchagin <evvers@ya.ru>

affdb4a4

confile_utils: fix a signed integer overflow · 8122eb0f

authored Mar 28, 2021

This was triggered by the following chain of conversions:

lxc_safe_uint("020000000020") -> 2147483664 (uint)
sig_num(2147483664 (uint)) -> -2147483632 (int)

64 - -2147483632 cannot be represented in type 'int'

Closes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32596Signed-off-by: Evgeny Vereshchagin <evvers@ya.ru>

8122eb0f

confile: don't leak memory in case multiple shmounts are set · 285dd691

authored Mar 27, 2021

Link: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32503Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

285dd691

confile: add missing prefix validation · 265542bb

authored Mar 27, 2021

Link: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32488Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

265542bb

confile_utils: free list during lxc_remove_nic_by_idx() · 5335a80f

authored Mar 27, 2021

Reported-by: Evgeny Vereshchagin <evvers@ya.ru>
Link: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32484Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

5335a80f

ci: turn on ASan on CIFuzz · 1998f661
Evgeny Vereshchagin authored Mar 27, 2021
```
Signed-off-by: Evgeny Vereshchagin <evvers@ya.ru>
```
1998f661

confile: prevent recursion when parsing networks · 0274a0ee

authored Mar 27, 2021

Link: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32558
Link: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32484Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

0274a0ee

confile: fix a memory leak in set_config_net_hwaddr · 1f860b31

authored Mar 27, 2021

It was found by ClusterFuzz in https://oss-fuzz.com/testcase-detail/4747480244813824
but hasn't been reported on Monorail
(https://bugs.chromium.org/p/oss-fuzz/) yet

```
$ cat minimized-from-1a18983c13ce64e8a3bd0f699a97d25beb21481e
lxc.net.0.hwaddr=0
lxc.net.0.hwaddr=4

./out/fuzz-lxc-config-read minimized-from-1a18983c13ce64e8a3bd0f699a97d25beb21481e
INFO: Seed: 1473396311
INFO: Loaded 1 modules   (18821 inline 8-bit counters): 18821 [0x885fa0, 0x88a925),
INFO: Loaded 1 PC tables (18821 PCs): 18821 [0x88a928,0x8d4178),
./out/fuzz-lxc-config-read: Running 1 inputs 1 time(s) each.
Running: minimized-from-1a18983c13ce64e8a3bd0f699a97d25beb21481e

=================================================================
==226185==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 2 byte(s) in 1 object(s) allocated from:
    #0 0x4d25d7 in strdup (/home/vagrant/lxc/out/fuzz-lxc-config-read+0x4d25d7)
    #1 0x58e48f in set_config_net_hwaddr /home/vagrant/lxc/src/lxc/confile.c:654:14
    #2 0x59af3b in set_config_net_nic /home/vagrant/lxc/src/lxc/confile.c:5276:9
    #3 0x571c29 in parse_line /home/vagrant/lxc/src/lxc/confile.c:2958:9
    #4 0x61b0b2 in lxc_file_for_each_line_mmap /home/vagrant/lxc/src/lxc/parse.c:125:9
    #5 0x5710ed in lxc_config_read /home/vagrant/lxc/src/lxc/confile.c:3035:9
    #6 0x542cd6 in LLVMFuzzerTestOneInput /home/vagrant/lxc/src/tests/fuzz-lxc-config-read.c:23:2
    #7 0x449e8c in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/home/vagrant/lxc/out/fuzz-lxc-config-read+0x449e8c)
    #8 0x42bbad in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) (/home/vagrant/lxc/out/fuzz-lxc-config-read+0x42bbad)
    #9 0x432c50 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/home/vagrant/lxc/out/fuzz-lxc-config-read+0x432c50)
    #10 0x423136 in main (/home/vagrant/lxc/out/fuzz-lxc-config-read+0x423136)
    #11 0x7f2cbb992081 in __libc_start_main (/lib64/libc.so.6+0x27081)

SUMMARY: AddressSanitizer: 2 byte(s) leaked in 1 allocation(s).
```
Signed-off-by: Evgeny Vereshchagin <evvers@ya.ru>

1f860b31

confile: improve network vetting · 8fa51b7a

authored Mar 27, 2021

Move all input sanity checks up and add two missing checks for the
correct network type when using veth-vlan and vlan network types.

Link: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32513Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

8fa51b7a

confile: use correct check for too large network lists · 0977c023

authored Mar 27, 2021

Link: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32558Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

0977c023

confile: make string calculations in get_network_config_ops() more obvious · 6712de30
Christian Brauner authored Mar 27, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
6712de30
conf: coding style cleanups · 6219606b
Christian Brauner authored Mar 27, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
6219606b

confile_utils: free network list items · 5c1a9b8a

authored Mar 27, 2021

Link: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32484Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

5c1a9b8a

conf: reinitialize lists · c98770b9
Christian Brauner authored Mar 27, 2021
```
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
```
c98770b9