From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
To: Andrew Morton <akpm@linux-foundation.org>
Cc: Matthew Garrett <mjg59@google.com>,
Andi Kleen <ak@linux.intel.com>,
"Theodore Y . Ts'o" <tytso@mit.edu>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Alexander Viro <viro@zeniv.linux.org.uk>,
Petr Mladek <pmladek@suse.com>,
Sergey Senozhatsky <sergey.senozhatsky@gmail.com>,
Arnd Bergmann <arnd@arndb.de>, Jiri Slaby <jslaby@suse.com>,
Steven Rostedt <rostedt@goodmis.org>,
Linus Torvalds <torvalds@linux-foundation.org>,
LKML <linux-kernel@vger.kernel.org>,
Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>,
Dmitry Vyukov <dvyukov@google.com>
Subject: [PATCH v2] Add kernel config option for fuzz testing.
Date: Sat, 7 Mar 2020 22:58:22 +0900 [thread overview]
Message-ID: <20200307135822.3894-1-penguin-kernel@I-love.SAKURA.ne.jp> (raw)
While syzkaller is finding many bugs, sometimes syzkaller examines
stupid operations. Currently we prevent syzkaller from examining
stupid operations by blacklisting syscall arguments and/or disabling
whole functionality using existing kernel config options, but it is
a whack-a-mole approach. We need cooperation from kernel side [1].
This patch introduces a kernel config option which allows disabling
only specific operations. This kernel config option should be enabled
only when building kernels for fuzz testing.
We discussed possibility of disabling specific operations at run-time
using some lockdown mechanism [2], but conclusion seems that build-time
control (i.e. kernel config option) fits better for this purpose.
Since patches for users of this kernel config option will want a lot of
explanation [3], this patch provides only kernel config option for them.
[1] https://github.com/google/syzkaller/issues/1622
[2] https://lkml.kernel.org/r/CACdnJutc7OQeoor6WLTh8as10da_CN=crs79v3Fp0mJTaO=+yw@mail.gmail.com
[3] https://lkml.kernel.org/r/20191216163155.GB2258618@kroah.com
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Cc: Dmitry Vyukov <dvyukov@google.com>
---
lib/Kconfig.debug | 10 ++++++++++
1 file changed, 10 insertions(+)
Changes since v1:
Drop users of this kernel config option.
Update patch description.
diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index 53e786e0a604..e360090e24c5 100644
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -2208,4 +2208,14 @@ config HYPERV_TESTING
endmenu # "Kernel Testing and Coverage"
+config KERNEL_BUILT_FOR_FUZZ_TESTING
+ bool "Build kernel for fuzz testing"
+ default n
+ help
+ Say N unless you are building kernels for fuzz testing.
+ Saying Y here disables several things that legitimately cause
+ damage under a fuzzer workload (e.g. copying to arbitrary
+ user-specified kernel address, changing console loglevel,
+ freezing filesystems).
+
endmenu # Kernel hacking
--
2.18.2
next reply other threads:[~2020-03-07 14:00 UTC|newest]
Thread overview: 19+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-03-07 13:58 Tetsuo Handa [this message]
2020-03-07 16:28 ` [PATCH v2] Add kernel config option for fuzz testing Jiri Slaby
2020-03-08 6:52 ` Greg Kroah-Hartman
2020-03-08 16:13 ` Linus Torvalds
2020-03-09 11:22 ` Tetsuo Handa
2020-03-09 13:23 ` Steven Rostedt
2020-03-09 15:39 ` Jiri Slaby
2020-03-10 6:30 ` Dmitry Vyukov
2020-03-11 14:11 ` Steven Rostedt
2020-03-12 19:23 ` Dmitry Vyukov
2020-03-12 21:59 ` Tetsuo Handa
2020-03-12 22:29 ` Steven Rostedt
2020-03-13 8:31 ` Peter Zijlstra
2020-03-15 5:54 ` Dmitry Vyukov
2020-03-21 4:49 ` Tetsuo Handa
2020-03-24 10:37 ` Dmitry Vyukov
2020-03-26 11:10 ` Tetsuo Handa
2020-04-10 4:38 ` Tetsuo Handa
2020-03-08 6:52 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200307135822.3894-1-penguin-kernel@I-love.SAKURA.ne.jp \
--to=penguin-kernel@i-love.sakura.ne.jp \
--cc=ak@linux.intel.com \
--cc=akpm@linux-foundation.org \
--cc=arnd@arndb.de \
--cc=dvyukov@google.com \
--cc=gregkh@linuxfoundation.org \
--cc=jslaby@suse.com \
--cc=linux-kernel@vger.kernel.org \
--cc=mjg59@google.com \
--cc=pmladek@suse.com \
--cc=rostedt@goodmis.org \
--cc=sergey.senozhatsky@gmail.com \
--cc=torvalds@linux-foundation.org \
--cc=tytso@mit.edu \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).