19086794632

Committed 04 Nov 2025 08:16PM UTC coverage: 72.165% (-0.1%) from 72.279%

Build # 19086794632

Build Type

push

github

Committed by

yuwata

Commit Message

TEST-64-UDEV-STORAGE: generate debugging logs

Let's see if it provides something useful for debugging issue #39544.

Run Details

305891 of 423878 relevant lines covered (72.16%)

1224411.04 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

0.0

/src/core/fuzz-execute-serialize.c

/* SPDX-License-Identifier: LGPL-2.1-or-later */
/* Notes on how to run the fuzzer manually:
 *  1) Build the fuzzers with LLVM's libFuzzer and ASan+UBSan:
 *    $ CC=clang CXX=clang++ meson build-libfuzz -Db_sanitize=address,undefined -Dllvm-fuzz=true -Db_lundef=false
 *
 *  2) Collect some valid inputs:
 *
 * OUT=test/fuzz/fuzz-execute-serialize/initial
 * for section in context command parameters runtime cgroup; do
 *     awk "match(\$0, /startswith\\(.+, \"(exec-${section}-[^\"]+=)\"/, m) { print m[1]; }" \
 *         src/core/execute-serialize.c >>"$OUT"
 *     # Each "section" is delimited by an empty line
 *     echo >>"$OUT"
 * done
 *
 *  3) Run the fuzzer:
 *    $ build-libfuzz/fuzz-execute-serialize test/fuzz/fuzz-execute-serialize
 */

#include <stdio.h>
#include <stdlib.h>

#include "cgroup.h"
#include "dynamic-user.h"
#include "execute-serialize.h"
#include "execute.h"
#include "fd-util.h"
#include "fdset.h"
#include "fuzz.h"

static void exec_fuzz_one(FILE *f, FDSet *fdset) {
        _cleanup_(exec_params_deep_clear) ExecParameters params = EXEC_PARAMETERS_INIT(/* flags= */ 0);
        _cleanup_(exec_context_done) ExecContext exec_context = {};
        _cleanup_(cgroup_context_done) CGroupContext cgroup_context = {};
        DynamicCreds dynamic_creds = {};
        ExecCommand command = {};
        ExecSharedRuntime shared = {
                .userns_storage_socket = EBADF_PAIR,
                .netns_storage_socket = EBADF_PAIR,
                .ipcns_storage_socket = EBADF_PAIR,
        };
        ExecRuntime runtime = {
                .ephemeral_storage_socket = EBADF_PAIR,
                .shared = &shared,
                .dynamic_creds = &dynamic_creds,
        };

        exec_context_init(&exec_context);
        cgroup_context_init(&cgroup_context);

        (void) exec_deserialize_invocation(f, fdset, &exec_context, &command, &params, &runtime, &cgroup_context);
        exec_context.private_var_tmp = PRIVATE_TMP_DISCONNECTED; /* The deserialization in the above may set an invalid value. */
        (void) exec_serialize_invocation(f, fdset, &exec_context, &command, &params, &runtime, &cgroup_context);
        (void) exec_deserialize_invocation(f, fdset, &exec_context, &command, &params, &runtime, &cgroup_context);

        /* We definitely didn't provide valid FDs during deserialization, so
         * wipe the FDs before exec_params_serialized_clear() kicks in, otherwise
         * we'll hit the assert in safe_close() */
        params.stdin_fd = -EBADF;
        params.stdout_fd = -EBADF;
        params.stderr_fd = -EBADF;
        params.root_directory_fd = -EBADF;
        params.exec_fd = -EBADF;
        params.user_lookup_fd = -EBADF;
        params.bpf_restrict_fs_map_fd = -EBADF;
        if (!params.fds)
                params.n_socket_fds = params.n_stashed_fds = 0;
        for (size_t i = 0; params.fds && i < params.n_socket_fds + params.n_stashed_fds; i++)
                params.fds[i] = -EBADF;

        exec_command_done_array(&command, /* n= */ 1);
        exec_shared_runtime_done(&shared);
        if (dynamic_creds.group != dynamic_creds.user)
                dynamic_user_free(dynamic_creds.group);
        dynamic_user_free(dynamic_creds.user);
        free(runtime.ephemeral_copy);
        safe_close_pair(runtime.ephemeral_storage_socket);
}

int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
        _cleanup_fclose_ FILE *f = NULL;
        _cleanup_fdset_free_ FDSet *fdset = NULL;

        if (outside_size_range(size, 0, 128 * 1024))
                return 0;

        fuzz_setup_logging();

        assert_se(fdset = fdset_new());
        assert_se(f = data_to_file(data, size));

        exec_fuzz_one(f, fdset);

        return 0;
}

1	/* SPDX-License-Identifier: LGPL-2.1-or-later */
2	/* Notes on how to run the fuzzer manually:
3	* 1) Build the fuzzers with LLVM's libFuzzer and ASan+UBSan:
4	* $ CC=clang CXX=clang++ meson build-libfuzz -Db_sanitize=address,undefined -Dllvm-fuzz=true -Db_lundef=false
5	*
6	* 2) Collect some valid inputs:
7	*
8	* OUT=test/fuzz/fuzz-execute-serialize/initial
9	* for section in context command parameters runtime cgroup; do
10	* awk "match(\$0, /startswith\\(.+, \"(exec-${section}-[^\"]+=)\"/, m) { print m[1]; }" \
11	* src/core/execute-serialize.c >>"$OUT"
12	* # Each "section" is delimited by an empty line
13	* echo >>"$OUT"
14	* done
15	*
16	* 3) Run the fuzzer:
17	* $ build-libfuzz/fuzz-execute-serialize test/fuzz/fuzz-execute-serialize
18	*/
19
20	#include <stdio.h>
21	#include <stdlib.h>
22
23	#include "cgroup.h"
24	#include "dynamic-user.h"
25	#include "execute-serialize.h"
26	#include "execute.h"
27	#include "fd-util.h"
28	#include "fdset.h"
29	#include "fuzz.h"
30
31	static void exec_fuzz_one(FILE f, FDSet fdset) {	×
32	_cleanup_(exec_params_deep_clear) ExecParameters params = EXEC_PARAMETERS_INIT(/* flags= */ 0);	×
33	_cleanup_(exec_context_done) ExecContext exec_context = {};	×
34	_cleanup_(cgroup_context_done) CGroupContext cgroup_context = {};	×
35	DynamicCreds dynamic_creds = {};	×
36	ExecCommand command = {};	×
37	ExecSharedRuntime shared = {	×
38	.userns_storage_socket = EBADF_PAIR,
39	.netns_storage_socket = EBADF_PAIR,
40	.ipcns_storage_socket = EBADF_PAIR,
41	};
42	ExecRuntime runtime = {	×
43	.ephemeral_storage_socket = EBADF_PAIR,
44	.shared = &shared,
45	.dynamic_creds = &dynamic_creds,
46	};
47
48	exec_context_init(&exec_context);	×
49	cgroup_context_init(&cgroup_context);	×
50
51	(void) exec_deserialize_invocation(f, fdset, &exec_context, &command, &params, &runtime, &cgroup_context);	×
52	exec_context.private_var_tmp = PRIVATE_TMP_DISCONNECTED; /* The deserialization in the above may set an invalid value. */	×
53	(void) exec_serialize_invocation(f, fdset, &exec_context, &command, &params, &runtime, &cgroup_context);	×
54	(void) exec_deserialize_invocation(f, fdset, &exec_context, &command, &params, &runtime, &cgroup_context);	×
55
56	/* We definitely didn't provide valid FDs during deserialization, so
57	* wipe the FDs before exec_params_serialized_clear() kicks in, otherwise
58	* we'll hit the assert in safe_close() */
59	params.stdin_fd = -EBADF;	×
60	params.stdout_fd = -EBADF;	×
61	params.stderr_fd = -EBADF;	×
62	params.root_directory_fd = -EBADF;	×
63	params.exec_fd = -EBADF;	×
64	params.user_lookup_fd = -EBADF;	×
65	params.bpf_restrict_fs_map_fd = -EBADF;	×
66	if (!params.fds)	×
67	params.n_socket_fds = params.n_stashed_fds = 0;	×
68	for (size_t i = 0; params.fds && i < params.n_socket_fds + params.n_stashed_fds; i++)	×
69	params.fds[i] = -EBADF;	×
70
71	exec_command_done_array(&command, /* n= */ 1);	×
72	exec_shared_runtime_done(&shared);	×
73	if (dynamic_creds.group != dynamic_creds.user)	×
74	dynamic_user_free(dynamic_creds.group);	×
75	dynamic_user_free(dynamic_creds.user);	×
76	free(runtime.ephemeral_copy);	×
77	safe_close_pair(runtime.ephemeral_storage_socket);	×
78	}	×
79
80	int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {	×
81	_cleanup_fclose_ FILE *f = NULL;	×
82	_cleanup_fdset_free_ FDSet *fdset = NULL;	×
83
84	if (outside_size_range(size, 0, 128 * 1024))	×
85	return 0;
86
87	fuzz_setup_logging();	×
88
89	assert_se(fdset = fdset_new());	×
90	assert_se(f = data_to_file(data, size));	×
91
92	exec_fuzz_one(f, fdset);	×
93
94	return 0;	×
95	}

systemd / systemd / 19086794632

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous