linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH] twist: allow converting pr_devel()/pr_debug() into printk(KERN_DEBUG)
@ 2020-05-24 14:50 Tetsuo Handa
  2020-05-24 17:38 ` Joe Perches
                   ` (3 more replies)
  0 siblings, 4 replies; 44+ messages in thread
From: Tetsuo Handa @ 2020-05-24 14:50 UTC (permalink / raw)
  To: Andrew Morton
  Cc: linux-kernel, Tetsuo Handa, Dmitry Vyukov, Ondrej Mosnacek,
	Petr Mladek, Sergey Senozhatsky, Steven Rostedt

syzbot found a NULL pointer dereference bug inside mptcp_recvmsg() due to
ssock == NULL, but this bug manifested inside selinux_socket_recvmsg()
because pr_debug() was no-op [1].

  pr_debug("fallback-read subflow=%p",
           mptcp_subflow_ctx(ssock->sk));
  copied = sock_recvmsg(ssock, msg, flags);

Since console loglevel used by syzkaller will not print KERN_DEBUG
messages to consoles, always evaluating pr_devel()/pr_debug() messages
will not cause too much console output. Thus, let's allow fuzzers to
always evaluate pr_devel()/pr_debug() messages.

[1] https://syzkaller.appspot.com/bug?id=12be9aa373be9d8727cdd172f190de39528a413a

Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Cc: Petr Mladek <pmladek@suse.com>
Cc: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Ondrej Mosnacek <omosnace@redhat.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
---
 include/linux/printk.h | 25 ++++++++++++++++++-------
 lib/Kconfig.twist      | 10 ++++++++++
 2 files changed, 28 insertions(+), 7 deletions(-)

diff --git a/include/linux/printk.h b/include/linux/printk.h
index 38beb97e7018..2562ffb438ed 100644
--- a/include/linux/printk.h
+++ b/include/linux/printk.h
@@ -389,7 +389,7 @@ extern int kptr_restrict;
  *
  * It uses pr_fmt() to generate the format string.
  */
-#ifdef DEBUG
+#if defined(DEBUG) || defined(CONFIG_TWIST_ALWAYS_EVALUATE_DEBUG_PRINTK)
 #define pr_devel(fmt, ...) \
 	printk(KERN_DEBUG pr_fmt(fmt), ##__VA_ARGS__)
 #else
@@ -399,7 +399,10 @@ extern int kptr_restrict;
 
 
 /* If you are writing a driver, please use dev_dbg instead */
-#if defined(CONFIG_DYNAMIC_DEBUG) || \
+#if defined(CONFIG_TWIST_ALWAYS_EVALUATE_DEBUG_PRINTK)
+#define pr_debug(fmt, ...) \
+	printk(KERN_DEBUG pr_fmt(fmt), ##__VA_ARGS__)
+#elif defined(CONFIG_DYNAMIC_DEBUG) || \
 	(defined(CONFIG_DYNAMIC_DEBUG_CORE) && defined(DYNAMIC_DEBUG_MODULE))
 #include <linux/dynamic_debug.h>
 
@@ -476,7 +479,7 @@ extern int kptr_restrict;
 #define pr_cont_once(fmt, ...)					\
 	printk_once(KERN_CONT pr_fmt(fmt), ##__VA_ARGS__)
 
-#if defined(DEBUG)
+#if defined(DEBUG) || defined(CONFIG_TWIST_ALWAYS_EVALUATE_DEBUG_PRINTK)
 #define pr_devel_once(fmt, ...)					\
 	printk_once(KERN_DEBUG pr_fmt(fmt), ##__VA_ARGS__)
 #else
@@ -485,7 +488,7 @@ extern int kptr_restrict;
 #endif
 
 /* If you are writing a driver, please use dev_dbg instead */
-#if defined(DEBUG)
+#if defined(DEBUG) || defined(CONFIG_TWIST_ALWAYS_EVALUATE_DEBUG_PRINTK)
 #define pr_debug_once(fmt, ...)					\
 	printk_once(KERN_DEBUG pr_fmt(fmt), ##__VA_ARGS__)
 #else
@@ -528,7 +531,7 @@ extern int kptr_restrict;
 	printk_ratelimited(KERN_INFO pr_fmt(fmt), ##__VA_ARGS__)
 /* no pr_cont_ratelimited, don't do that... */
 
-#if defined(DEBUG)
+#if defined(DEBUG) || defined(CONFIG_TWIST_ALWAYS_EVALUATE_DEBUG_PRINTK)
 #define pr_devel_ratelimited(fmt, ...)					\
 	printk_ratelimited(KERN_DEBUG pr_fmt(fmt), ##__VA_ARGS__)
 #else
@@ -537,7 +540,10 @@ extern int kptr_restrict;
 #endif
 
 /* If you are writing a driver, please use dev_dbg instead */
-#if defined(CONFIG_DYNAMIC_DEBUG) || \
+#if defined(CONFIG_TWIST_ALWAYS_EVALUATE_DEBUG_PRINTK)
+#define pr_debug_ratelimited(fmt, ...)					\
+	printk_ratelimited(KERN_DEBUG pr_fmt(fmt), ##__VA_ARGS__)
+#elif defined(CONFIG_DYNAMIC_DEBUG) || \
 	(defined(CONFIG_DYNAMIC_DEBUG_CORE) && defined(DYNAMIC_DEBUG_MODULE))
 /* descriptor check is first to prevent flooding with "callbacks suppressed" */
 #define pr_debug_ratelimited(fmt, ...)					\
@@ -585,7 +591,12 @@ static inline void print_hex_dump_bytes(const char *prefix_str, int prefix_type,
 
 #endif
 
-#if defined(CONFIG_DYNAMIC_DEBUG) || \
+#if defined(CONFIG_TWIST_ALWAYS_EVALUATE_DEBUG_PRINTK)
+#define print_hex_dump_debug(prefix_str, prefix_type, rowsize,		\
+			     groupsize, buf, len, ascii)		\
+	print_hex_dump(KERN_DEBUG, prefix_str, prefix_type, rowsize,	\
+		       groupsize, buf, len, ascii)
+#elif defined(CONFIG_DYNAMIC_DEBUG) || \
 	(defined(CONFIG_DYNAMIC_DEBUG_CORE) && defined(DYNAMIC_DEBUG_MODULE))
 #define print_hex_dump_debug(prefix_str, prefix_type, rowsize,	\
 			     groupsize, buf, len, ascii)	\
diff --git a/lib/Kconfig.twist b/lib/Kconfig.twist
index f20e0d003581..710202f4b15d 100644
--- a/lib/Kconfig.twist
+++ b/lib/Kconfig.twist
@@ -12,10 +12,20 @@ if TWIST_KERNEL_BEHAVIOR
 
 config TWIST_FOR_SYZKALLER_TESTING
        bool "Select all twist options suitable for syzkaller testing"
+       select TWIST_ALWAYS_EVALUATE_DEBUG_PRINTK
        select TWIST_DISABLE_KBD_K_SPEC_HANDLER
        help
 	 Say N unless you are building kernels for syzkaller's testing.
 
+config TWIST_ALWAYS_EVALUATE_DEBUG_PRINTK
+       bool "Always evaluate pr_devel() and pr_debug()"
+       help
+	 When pr_devel()/pr_debug() are no-op, only format string is checked
+	 by compiler, and runtime bugs (such as NULL pointer dereference)
+	 cannot be reported by fuzz testing.
+	 This option will unconditionally convert pr_devel() and pr_debug()
+	 into printk(KERN_DEBUG) in order to evaluate printk() arguments.
+
 config TWIST_DISABLE_KBD_K_SPEC_HANDLER
        bool "Disable k_spec() function in drivers/tty/vt/keyboard.c"
        help
-- 
2.18.2


^ permalink raw reply related	[flat|nested] 44+ messages in thread

end of thread, other threads:[~2020-06-08 16:40 UTC | newest]

Thread overview: 44+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-05-24 14:50 [PATCH] twist: allow converting pr_devel()/pr_debug() into printk(KERN_DEBUG) Tetsuo Handa
2020-05-24 17:38 ` Joe Perches
2020-05-24 19:18   ` Ondrej Mosnacek
2020-05-25  5:03     ` Tetsuo Handa
2020-05-25  6:07       ` Joe Perches
2020-05-25  7:38         ` Dmitry Vyukov
2020-05-25  8:42 ` Petr Mladek
2020-05-25  9:11   ` Sergey Senozhatsky
2020-05-25 10:43     ` Tetsuo Handa
2020-05-27  8:37       ` Petr Mladek
2020-05-27 10:13         ` Tetsuo Handa
2020-05-27 15:55           ` Petr Mladek
2020-05-27 23:33             ` Tetsuo Handa
2020-05-28  6:56               ` [PATCH v2] twist: allow converting pr_devel()/pr_debug() into snprintf() Tetsuo Handa
2020-05-28 11:06                 ` Petr Mladek
2020-05-28 15:16                   ` Tetsuo Handa
2020-05-28 19:10                     ` Andrew Morton
2020-05-28 19:50                     ` Linus Torvalds
2020-05-28 20:01                       ` Linus Torvalds
2020-05-29  0:07                         ` Tetsuo Handa
2020-05-29  0:28                           ` Linus Torvalds
2020-05-29  2:13                             ` Tetsuo Handa
2020-05-29  2:24                               ` Linus Torvalds
2020-05-29  4:47                                 ` Tetsuo Handa
2020-05-29 13:26                                   ` Tetsuo Handa
2020-06-03 11:03                                     ` twist: allow disabling reboot request Tetsuo Handa
2020-06-03 12:44                                       ` Petr Mladek
2020-06-03 13:35                                         ` Tetsuo Handa
2020-06-04 10:21                                           ` Petr Mladek
2020-06-08  7:48                                     ` [PATCH v2] twist: allow converting pr_devel()/pr_debug() into snprintf() Dmitry Vyukov
2020-06-08 10:30                                       ` Tetsuo Handa
2020-06-08 11:31                                       ` Andrey Konovalov
2020-05-29  8:17                       ` Petr Mladek
2020-06-08 16:39                 ` Geert Uytterhoeven
2020-05-28 10:59               ` [PATCH] twist: allow converting pr_devel()/pr_debug() into printk(KERN_DEBUG) Petr Mladek
2020-05-28 11:33                 ` Tetsuo Handa
2020-05-28 12:14                   ` Petr Mladek
2020-05-28 14:13                     ` Tetsuo Handa
2020-05-28 17:08                     ` Joe Perches
2020-05-29  2:04       ` Sergey Senozhatsky
2020-05-29  5:06         ` Tetsuo Handa
2020-05-27  9:59 ` kbuild test robot
2020-05-27 13:41   ` Tetsuo Handa
2020-05-27 12:37 ` kbuild test robot

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).