search

ucsb-seclab / difuze

Fuzzer for Linux Kernel Drivers
BSD 2-Clause "Simplified" License
365 stars 83 forks source link

Interface recovery is failing #8

Open srikanth007m opened 5 years ago

srikanth007m commented 5 years ago

<Distributor ID: Ubuntu Description: Ubuntu 14.04.5 LTS Release: 14.04 Codename: trusty>

run_all is failing for me at unnable to find v4l2 base bitcode file:/local/mnt2/workspace/kdev_4.14/kernel/kernel_out/llvm_bitcode_out/drivers/media/v4l2-core/v4l2-ioctl.llvm.bc

python run_all.py -l /local/mnt2/workspace/kdev_4.14/kernel/kernel_out/llvm_bitcode_out -a 2 -m /local/mnt2/workspace/kdev_4.14/makeout.txt -g aarch64-linux-android-gcc -n 2 -o /local/mnt2/workspace/kdev_4.14/kernel/kernel_out/ -k /local/mnt2/workspace/kdev_4.14/kernel -f /local/mnt2/workspace/kdev_4.14/kernel/kernel_out/ioctl_finder_out [*] Trying to Run Component: BuildLLVM [+] Setup for component: BuildLLVM complete [*] Running LLVM Commands in multiprocessing mode. [*] Finished Building LLVM Bitcode files [+] [+] Script containing all LLVM Build Commands:/local/mnt2/workspace/kdev_4.14/kernel/kernel_out/llvm_bitcode_out/llvm_build.sh [+] Component: BuildLLVM ran successfully. [+] Component: BuildLLVM passed successfully. [*] Trying to Run Component: DrLinker [+] Setup for component: DrLinker complete [*] Running dr_linker. This might take time. Please wait. [+] Found:0 Interesting bitcode files [*] Processing bitcode files [+] Processed all bitcode files. [*] Trying to find dependency bc files [*] dr_linker finished execution. [*] Running llvm-link to generate the final linked bitcode file. [+] Component: DrLinker ran successfully. [+] Component: DrLinker passed successfully. [*] Trying to Run Component: GenerateIncludes [+] Setup for component: GenerateIncludes complete [+] Component: GenerateIncludes ran successfully. [+] Component: GenerateIncludes passed successfully. [*] Trying to Run Component: GeneratePreprocessed [+] Setup for component: GeneratePreprocessed complete [*] Running LLVM Commands in multiprocessing mode. [*] Finished Building LLVM Preprocessed files [+] [+] Script containing all LLVM Preprocess Commands:/local/mnt2/workspace/kdev_4.14/kernel/kernel_out/llvm_bitcode_out/llvm_generate_preprocessed.sh [+] Component: GeneratePreprocessed ran successfully. [+] Component: GeneratePreprocessed passed successfully. [*] Trying to Run Component: ParseHeaders [+] Setup for component: ParseHeaders complete [*] Running grep to find ops and operations structure. [+] Grep ran successfully to find ops and operations structures. [*] Running c2xml to find entry point configurations. [+] Component: ParseHeaders ran successfully. [+] Component: ParseHeaders passed successfully. [*] Trying to Run Component: ParseV4L2Headers [+] Setup for component: ParseV4L2Headers complete [+] Grep ran successfully to find ops and operations structures. [*] Running c2xml to find entry point configurations. [!] Unable to find v4l2 base bitcode file:/local/mnt2/workspace/kdev_4.14/kernel/kernel_out/llvm_bitcode_out/drivers/media/v4l2-core/v4l2-ioctl.llvm.bc [?] Component: ParseV4L2Headers failed. [+] Component: ParseV4L2Headers passed successfully. [*] Trying to Run Component: EntryPointIdentifier [+] Setup for component: EntryPointIdentifier complete [*] Running EntryPointIdentifier.. [+] Entry point file present:/local/mnt2/workspace/kdev_4.14/kernel/kernel_out/llvm_bitcode_out/hdr_file_config.txt [+] Successfully generated all the possible entry points into file: /local/mnt2/workspace/kdev_4.14/kernel/kernel_out/llvm_bitcode_out/entry_point_out.txt [+] Component: EntryPointIdentifier ran successfully. [+] Component: EntryPointIdentifier passed successfully. [*] Trying to Run Component: DevNameFinder [+] Setup for component: DevNameFinder complete [*] Invoking Dev Name finder [*] Found: 0 ioctl functions to process. [*] Processing in multiprocessing mode [*] Finished processing: 0 ioctl functions. [*] Dev name finder failed for: 0 out of: 0 Ioctl functions. [+] Component: DevNameFinder ran successfully. [+] Component: DevNameFinder passed successfully. [*] Trying to Run Component: IoctlCmdFinder [+] Setup for component: IoctlCmdFinder complete [*] Invoking Ioctl cmd finder [*] Found: 0 ioctl functions to process. [*] Processing in multiprocessing mode [*] Finished processing: 0 ioctl functions. [*] Ioctl Cmd finder failed for: 0 out of: 0 Ioctl functions. [+] Component: IoctlCmdFinder ran successfully. [+] Component: IoctlCmdFinder passed successfully. [*] Trying to Run Component: V4L2CmdFinder [!] Setup failed for component: V4L2CmdFinder , with Error: No file specified for v4l2 id -> cmdid list. [!] Component: V4L2CmdFinder failed. Exiting. [*] Component Runtime information: [*] GeneratePreprocessed:0.0103278160095 seconds. [*] EntryPointIdentifier:8.10623168945e-05 seconds. [*] IoctlCmdFinder:0.00345802307129 seconds. [*] ParseV4L2Headers:3.81469726562e-05 seconds. [*] BuildLLVM:0.0165839195251 seconds. [*] DevNameFinder:0.00437998771667 seconds. [*] ParseHeaders:29.3280119896 seconds. [*] GenerateIncludes:0.00590395927429 seconds. [*] DrLinker:0.00212693214417 seconds.

Machiry commented 5 years ago

Can you share your kernel?

srikanth007m commented 5 years ago

Here it is https://source.codeaurora.org/quic/la/kernel/msm-4.14/

srikanth007m commented 5 years ago

Entire log uploaded to https://gist.github.com/srikanth007m/6aa9eab8ad4177ae3f111ecefe8e5316

srikanth007m commented 5 years ago

@Machiry Did you got chance to look into it?

Machiry commented 5 years ago

@srikanth007m Looking into it now.

Machiry commented 5 years ago

As the error suggests, clang doesn't support that ABI. This commit ignores the flag: https://github.com/ucsb-seclab/difuze/commit/91a6cb3e9b7e19d145789af860831b08eebcd9a4\

But for the sake for interface recovery, I suggest you to pull the latest commit and use the following workaround:

Before running run_all.py, do following changed to the include/linux/compiler-gcc.h file in the kernel sources (line 305):

+ //#define asm_volatile_goto(x...)       do { asm goto(x); asm (""); } while (0)
+ #define asm_volatile_goto(x...)       do { } while (0)

NOTE: DONT MAKE THESE CHANGES WHILE BUILDING THE KERNEL.

srikanth007m commented 5 years ago

Thank you for your response .. i will try as you suggested.

srikanth007m commented 5 years ago

@Machiry i tried which you suggestion. I see still it is unable to fine the ParseV4L2Headers

[*] Trying to Run Component: BuildLLVM [+] Setup for component: BuildLLVM complete [*] Running LLVM Commands in multiprocessing mode. [*] Finished Building LLVM Bitcode files [+] [+] Script containing all LLVM Build Commands:/local/mnt2/workspace/kdev_4.14/kernel/kernel_out/llvm_bitcode_out/llvm_build.sh [+] Component: BuildLLVM ran successfully. [+] Component: BuildLLVM passed successfully. [*] Trying to Run Component: DrLinker [+] Setup for component: DrLinker complete [*] Running dr_linker. This might take time. Please wait. [+] Found:0 Interesting bitcode files [*] Processing bitcode files [+] Processed all bitcode files. [*] Trying to find dependency bc files [*] dr_linker finished execution. [*] Running llvm-link to generate the final linked bitcode file. [+] Component: DrLinker ran successfully. [+] Component: DrLinker passed successfully. [*] Trying to Run Component: GenerateIncludes [+] Setup for component: GenerateIncludes complete [+] Component: GenerateIncludes ran successfully. [+] Component: GenerateIncludes passed successfully. [*] Trying to Run Component: GeneratePreprocessed [+] Setup for component: GeneratePreprocessed complete [*] Running LLVM Commands in multiprocessing mode. [*] Finished Building LLVM Preprocessed files [+] [+] Script containing all LLVM Preprocess Commands:/local/mnt2/workspace/kdev_4.14/kernel/kernel_out/llvm_bitcode_out/llvm_generate_preprocessed.sh [+] Component: GeneratePreprocessed ran successfully. [+] Component: GeneratePreprocessed passed successfully. [*] Trying to Run Component: ParseHeaders [+] Setup for component: ParseHeaders complete [*] Running grep to find ops and operations structure. [+] Grep ran successfully to find ops and operations structures. [*] Running c2xml to find entry point configurations. [+] Component: ParseHeaders ran successfully. [+] Component: ParseHeaders passed successfully. [*] Trying to Run Component: ParseV4L2Headers [+] Setup for component: ParseV4L2Headers complete [+] Grep ran successfully to find ops and operations structures. [*] Running c2xml to find entry point configurations. [!] Unable to find v4l2 base bitcode file:/local/mnt2/workspace/kdev_4.14/kernel/kernel_out/llvm_bitcode_out/drivers/media/v4l2-core/v4l2-ioctl.llvm.bc [?] Component: ParseV4L2Headers failed. [+] Component: ParseV4L2Headers passed successfully. [*] Trying to Run Component: EntryPointIdentifier [+] Setup for component: EntryPointIdentifier complete [*] Running EntryPointIdentifier.. [+] Entry point file present:/local/mnt2/workspace/kdev_4.14/kernel/kernel_out/llvm_bitcode_out/hdr_file_config.txt [+] Successfully generated all the possible entry points into file: /local/mnt2/workspace/kdev_4.14/kernel/kernel_out/llvm_bitcode_out/entry_point_out.txt [+] Component: EntryPointIdentifier ran successfully. [+] Component: EntryPointIdentifier passed successfully. [*] Trying to Run Component: DevNameFinder [+] Setup for component: DevNameFinder complete [*] Invoking Dev Name finder [*] Found: 0 ioctl functions to process. [*] Processing in multiprocessing mode [*] Finished processing: 0 ioctl functions. [*] Dev name finder failed for: 0 out of: 0 Ioctl functions. [+] Component: DevNameFinder ran successfully. [+] Component: DevNameFinder passed successfully. [*] Trying to Run Component: IoctlCmdFinder [+] Setup for component: IoctlCmdFinder complete [*] Invoking Ioctl cmd finder [*] Found: 0 ioctl functions to process. [*] Processing in multiprocessing mode [*] Finished processing: 0 ioctl functions. [*] Ioctl Cmd finder failed for: 0 out of: 0 Ioctl functions. [+] Component: IoctlCmdFinder ran successfully. [+] Component: IoctlCmdFinder passed successfully. [*] Trying to Run Component: V4L2CmdFinder [!] Setup failed for component: V4L2CmdFinder , with Error: No file specified for v4l2 id -> cmdid list. [!] Component: V4L2CmdFinder failed. Exiting. [*] Component Runtime information: [*] GeneratePreprocessed:0.044095993042 seconds. [*] EntryPointIdentifier:8.79764556885e-05 seconds. [*] IoctlCmdFinder:0.0045919418335 seconds. [*] ParseV4L2Headers:4.81605529785e-05 seconds. [*] BuildLLVM:0.0548439025879 seconds. [*] DevNameFinder:0.00578618049622 seconds. [*] ParseHeaders:0.36589884758 seconds. [*] GenerateIncludes:0.037024974823 seconds. [*] DrLinker:0.00234293937683 seconds.

srikanth007m commented 5 years ago

@Machiry - I have 2 issues here.

1 Has said above. This is one one version of kernel snapshot. Interface recovery is immediately failing.

2 Showing different errors on one kernel snapshot , where https://gist.github.com/srikanth007m/c67db0bba5fc3223e95b475ba3fc9f37 full log uploaded.

Machiry commented 5 years ago

@srikanth007m Looks like you missed the changes to the file: include/linux/compiler-gcc.h. What I meant was, do not make the changes while building i.e., while generating makeout.txt.

Once it is generated, then make the changes to include/linux/compiler-gcc.h, as suggested in https://github.com/ucsb-seclab/difuze/issues#issuecomment-449777064, then run run_all.py

Machiry commented 5 years ago

btw, I tested with the difuze docker container.

srikanth007m commented 5 years ago

@Machiry I did the same. I made the changes to file: include/linux/compiler-gcc.h only after compilation. Does normal and docker makes any difference?

Securee commented 2 years ago

@Machiry I did the same. I made the changes to file: include/linux/compiler-gcc.h only after compilation. Does normal and docker makes any difference?

hi, has your problem resolved ? I met the same issue.