From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
To: Andrew Morton <akpm@linux-foundation.org>
Cc: linux-kernel@vger.kernel.org,
Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>,
Dmitry Vyukov <dvyukov@google.com>,
Ondrej Mosnacek <omosnace@redhat.com>,
Petr Mladek <pmladek@suse.com>,
Sergey Senozhatsky <sergey.senozhatsky@gmail.com>,
Steven Rostedt <rostedt@goodmis.org>
Subject: [PATCH] twist: allow converting pr_devel()/pr_debug() into printk(KERN_DEBUG)
Date: Sun, 24 May 2020 23:50:34 +0900 [thread overview]
Message-ID: <20200524145034.10697-1-penguin-kernel@I-love.SAKURA.ne.jp> (raw)
syzbot found a NULL pointer dereference bug inside mptcp_recvmsg() due to
ssock == NULL, but this bug manifested inside selinux_socket_recvmsg()
because pr_debug() was no-op [1].
pr_debug("fallback-read subflow=%p",
mptcp_subflow_ctx(ssock->sk));
copied = sock_recvmsg(ssock, msg, flags);
Since console loglevel used by syzkaller will not print KERN_DEBUG
messages to consoles, always evaluating pr_devel()/pr_debug() messages
will not cause too much console output. Thus, let's allow fuzzers to
always evaluate pr_devel()/pr_debug() messages.
[1] https://syzkaller.appspot.com/bug?id=12be9aa373be9d8727cdd172f190de39528a413a
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Cc: Petr Mladek <pmladek@suse.com>
Cc: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Ondrej Mosnacek <omosnace@redhat.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
---
include/linux/printk.h | 25 ++++++++++++++++++-------
lib/Kconfig.twist | 10 ++++++++++
2 files changed, 28 insertions(+), 7 deletions(-)
diff --git a/include/linux/printk.h b/include/linux/printk.h
index 38beb97e7018..2562ffb438ed 100644
--- a/include/linux/printk.h
+++ b/include/linux/printk.h
@@ -389,7 +389,7 @@ extern int kptr_restrict;
*
* It uses pr_fmt() to generate the format string.
*/
-#ifdef DEBUG
+#if defined(DEBUG) || defined(CONFIG_TWIST_ALWAYS_EVALUATE_DEBUG_PRINTK)
#define pr_devel(fmt, ...) \
printk(KERN_DEBUG pr_fmt(fmt), ##__VA_ARGS__)
#else
@@ -399,7 +399,10 @@ extern int kptr_restrict;
/* If you are writing a driver, please use dev_dbg instead */
-#if defined(CONFIG_DYNAMIC_DEBUG) || \
+#if defined(CONFIG_TWIST_ALWAYS_EVALUATE_DEBUG_PRINTK)
+#define pr_debug(fmt, ...) \
+ printk(KERN_DEBUG pr_fmt(fmt), ##__VA_ARGS__)
+#elif defined(CONFIG_DYNAMIC_DEBUG) || \
(defined(CONFIG_DYNAMIC_DEBUG_CORE) && defined(DYNAMIC_DEBUG_MODULE))
#include <linux/dynamic_debug.h>
@@ -476,7 +479,7 @@ extern int kptr_restrict;
#define pr_cont_once(fmt, ...) \
printk_once(KERN_CONT pr_fmt(fmt), ##__VA_ARGS__)
-#if defined(DEBUG)
+#if defined(DEBUG) || defined(CONFIG_TWIST_ALWAYS_EVALUATE_DEBUG_PRINTK)
#define pr_devel_once(fmt, ...) \
printk_once(KERN_DEBUG pr_fmt(fmt), ##__VA_ARGS__)
#else
@@ -485,7 +488,7 @@ extern int kptr_restrict;
#endif
/* If you are writing a driver, please use dev_dbg instead */
-#if defined(DEBUG)
+#if defined(DEBUG) || defined(CONFIG_TWIST_ALWAYS_EVALUATE_DEBUG_PRINTK)
#define pr_debug_once(fmt, ...) \
printk_once(KERN_DEBUG pr_fmt(fmt), ##__VA_ARGS__)
#else
@@ -528,7 +531,7 @@ extern int kptr_restrict;
printk_ratelimited(KERN_INFO pr_fmt(fmt), ##__VA_ARGS__)
/* no pr_cont_ratelimited, don't do that... */
-#if defined(DEBUG)
+#if defined(DEBUG) || defined(CONFIG_TWIST_ALWAYS_EVALUATE_DEBUG_PRINTK)
#define pr_devel_ratelimited(fmt, ...) \
printk_ratelimited(KERN_DEBUG pr_fmt(fmt), ##__VA_ARGS__)
#else
@@ -537,7 +540,10 @@ extern int kptr_restrict;
#endif
/* If you are writing a driver, please use dev_dbg instead */
-#if defined(CONFIG_DYNAMIC_DEBUG) || \
+#if defined(CONFIG_TWIST_ALWAYS_EVALUATE_DEBUG_PRINTK)
+#define pr_debug_ratelimited(fmt, ...) \
+ printk_ratelimited(KERN_DEBUG pr_fmt(fmt), ##__VA_ARGS__)
+#elif defined(CONFIG_DYNAMIC_DEBUG) || \
(defined(CONFIG_DYNAMIC_DEBUG_CORE) && defined(DYNAMIC_DEBUG_MODULE))
/* descriptor check is first to prevent flooding with "callbacks suppressed" */
#define pr_debug_ratelimited(fmt, ...) \
@@ -585,7 +591,12 @@ static inline void print_hex_dump_bytes(const char *prefix_str, int prefix_type,
#endif
-#if defined(CONFIG_DYNAMIC_DEBUG) || \
+#if defined(CONFIG_TWIST_ALWAYS_EVALUATE_DEBUG_PRINTK)
+#define print_hex_dump_debug(prefix_str, prefix_type, rowsize, \
+ groupsize, buf, len, ascii) \
+ print_hex_dump(KERN_DEBUG, prefix_str, prefix_type, rowsize, \
+ groupsize, buf, len, ascii)
+#elif defined(CONFIG_DYNAMIC_DEBUG) || \
(defined(CONFIG_DYNAMIC_DEBUG_CORE) && defined(DYNAMIC_DEBUG_MODULE))
#define print_hex_dump_debug(prefix_str, prefix_type, rowsize, \
groupsize, buf, len, ascii) \
diff --git a/lib/Kconfig.twist b/lib/Kconfig.twist
index f20e0d003581..710202f4b15d 100644
--- a/lib/Kconfig.twist
+++ b/lib/Kconfig.twist
@@ -12,10 +12,20 @@ if TWIST_KERNEL_BEHAVIOR
config TWIST_FOR_SYZKALLER_TESTING
bool "Select all twist options suitable for syzkaller testing"
+ select TWIST_ALWAYS_EVALUATE_DEBUG_PRINTK
select TWIST_DISABLE_KBD_K_SPEC_HANDLER
help
Say N unless you are building kernels for syzkaller's testing.
+config TWIST_ALWAYS_EVALUATE_DEBUG_PRINTK
+ bool "Always evaluate pr_devel() and pr_debug()"
+ help
+ When pr_devel()/pr_debug() are no-op, only format string is checked
+ by compiler, and runtime bugs (such as NULL pointer dereference)
+ cannot be reported by fuzz testing.
+ This option will unconditionally convert pr_devel() and pr_debug()
+ into printk(KERN_DEBUG) in order to evaluate printk() arguments.
+
config TWIST_DISABLE_KBD_K_SPEC_HANDLER
bool "Disable k_spec() function in drivers/tty/vt/keyboard.c"
help
--
2.18.2
next reply other threads:[~2020-05-24 14:50 UTC|newest]
Thread overview: 44+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-05-24 14:50 Tetsuo Handa [this message]
2020-05-24 17:38 ` [PATCH] twist: allow converting pr_devel()/pr_debug() into printk(KERN_DEBUG) Joe Perches
2020-05-24 19:18 ` Ondrej Mosnacek
2020-05-25 5:03 ` Tetsuo Handa
2020-05-25 6:07 ` Joe Perches
2020-05-25 7:38 ` Dmitry Vyukov
2020-05-25 8:42 ` Petr Mladek
2020-05-25 9:11 ` Sergey Senozhatsky
2020-05-25 10:43 ` Tetsuo Handa
2020-05-27 8:37 ` Petr Mladek
2020-05-27 10:13 ` Tetsuo Handa
2020-05-27 15:55 ` Petr Mladek
2020-05-27 23:33 ` Tetsuo Handa
2020-05-28 6:56 ` [PATCH v2] twist: allow converting pr_devel()/pr_debug() into snprintf() Tetsuo Handa
2020-05-28 11:06 ` Petr Mladek
2020-05-28 15:16 ` Tetsuo Handa
2020-05-28 19:10 ` Andrew Morton
2020-05-28 19:50 ` Linus Torvalds
2020-05-28 20:01 ` Linus Torvalds
2020-05-29 0:07 ` Tetsuo Handa
2020-05-29 0:28 ` Linus Torvalds
2020-05-29 2:13 ` Tetsuo Handa
2020-05-29 2:24 ` Linus Torvalds
2020-05-29 4:47 ` Tetsuo Handa
2020-05-29 13:26 ` Tetsuo Handa
2020-06-03 11:03 ` twist: allow disabling reboot request Tetsuo Handa
2020-06-03 12:44 ` Petr Mladek
2020-06-03 13:35 ` Tetsuo Handa
2020-06-04 10:21 ` Petr Mladek
2020-06-08 7:48 ` [PATCH v2] twist: allow converting pr_devel()/pr_debug() into snprintf() Dmitry Vyukov
2020-06-08 10:30 ` Tetsuo Handa
2020-06-08 11:31 ` Andrey Konovalov
2020-05-29 8:17 ` Petr Mladek
2020-06-08 16:39 ` Geert Uytterhoeven
2020-05-28 10:59 ` [PATCH] twist: allow converting pr_devel()/pr_debug() into printk(KERN_DEBUG) Petr Mladek
2020-05-28 11:33 ` Tetsuo Handa
2020-05-28 12:14 ` Petr Mladek
2020-05-28 14:13 ` Tetsuo Handa
2020-05-28 17:08 ` Joe Perches
2020-05-29 2:04 ` Sergey Senozhatsky
2020-05-29 5:06 ` Tetsuo Handa
2020-05-27 9:59 ` kbuild test robot
2020-05-27 13:41 ` Tetsuo Handa
2020-05-27 12:37 ` kbuild test robot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200524145034.10697-1-penguin-kernel@I-love.SAKURA.ne.jp \
--to=penguin-kernel@i-love.sakura.ne.jp \
--cc=akpm@linux-foundation.org \
--cc=dvyukov@google.com \
--cc=linux-kernel@vger.kernel.org \
--cc=omosnace@redhat.com \
--cc=pmladek@suse.com \
--cc=rostedt@goodmis.org \
--cc=sergey.senozhatsky@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).