From: Jiri Slaby <jslaby@suse.com>
To: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>,
Andrew Morton <akpm@linux-foundation.org>
Cc: Matthew Garrett <mjg59@google.com>,
Andi Kleen <ak@linux.intel.com>,
"Theodore Y . Ts'o" <tytso@mit.edu>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Alexander Viro <viro@zeniv.linux.org.uk>,
Petr Mladek <pmladek@suse.com>,
Sergey Senozhatsky <sergey.senozhatsky@gmail.com>,
Arnd Bergmann <arnd@arndb.de>,
Steven Rostedt <rostedt@goodmis.org>,
Linus Torvalds <torvalds@linux-foundation.org>,
LKML <linux-kernel@vger.kernel.org>,
Dmitry Vyukov <dvyukov@google.com>
Subject: Re: [PATCH v2] Add kernel config option for fuzz testing.
Date: Sat, 7 Mar 2020 17:28:22 +0100 [thread overview]
Message-ID: <6f2e27de-c820-7de3-447d-cd9f7c650add@suse.com> (raw)
In-Reply-To: <20200307135822.3894-1-penguin-kernel@I-love.SAKURA.ne.jp>
On 07. 03. 20, 14:58, Tetsuo Handa wrote:
> While syzkaller is finding many bugs, sometimes syzkaller examines
> stupid operations. Currently we prevent syzkaller from examining
> stupid operations by blacklisting syscall arguments and/or disabling
> whole functionality using existing kernel config options, but it is
> a whack-a-mole approach. We need cooperation from kernel side [1].
>
> This patch introduces a kernel config option which allows disabling
> only specific operations. This kernel config option should be enabled
> only when building kernels for fuzz testing.
>
> We discussed possibility of disabling specific operations at run-time
> using some lockdown mechanism [2], but conclusion seems that build-time
> control (i.e. kernel config option) fits better for this purpose.
> Since patches for users of this kernel config option will want a lot of
> explanation [3], this patch provides only kernel config option for them.
>
> [1] https://github.com/google/syzkaller/issues/1622
> [2] https://lkml.kernel.org/r/CACdnJutc7OQeoor6WLTh8as10da_CN=crs79v3Fp0mJTaO=+yw@mail.gmail.com
> [3] https://lkml.kernel.org/r/20191216163155.GB2258618@kroah.com
>
> Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
> Cc: Dmitry Vyukov <dvyukov@google.com>
> ---
> lib/Kconfig.debug | 10 ++++++++++
> 1 file changed, 10 insertions(+)
>
> Changes since v1:
> Drop users of this kernel config option.
> Update patch description.
>
> diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
> index 53e786e0a604..e360090e24c5 100644
> --- a/lib/Kconfig.debug
> +++ b/lib/Kconfig.debug
> @@ -2208,4 +2208,14 @@ config HYPERV_TESTING
>
> endmenu # "Kernel Testing and Coverage"
>
> +config KERNEL_BUILT_FOR_FUZZ_TESTING
> + bool "Build kernel for fuzz testing"
If we really want to go this way, I wouldn't limit it for fuzz testing
only. Static analyzers, symbolic executors, formal verifiers, etc. --
all of them should avoid the paths.
So what about KERNEL_BUILT_FOR_ANALYZERS?
> + default n
> + help
> + Say N unless you are building kernels for fuzz testing.
> + Saying Y here disables several things that legitimately cause
> + damage under a fuzzer workload (e.g. copying to arbitrary
> + user-specified kernel address, changing console loglevel,
> + freezing filesystems).
> +
> endmenu # Kernel hacking
>
--
js
suse labs
next prev parent reply other threads:[~2020-03-07 16:30 UTC|newest]
Thread overview: 19+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-03-07 13:58 [PATCH v2] Add kernel config option for fuzz testing Tetsuo Handa
2020-03-07 16:28 ` Jiri Slaby [this message]
2020-03-08 6:52 ` Greg Kroah-Hartman
2020-03-08 16:13 ` Linus Torvalds
2020-03-09 11:22 ` Tetsuo Handa
2020-03-09 13:23 ` Steven Rostedt
2020-03-09 15:39 ` Jiri Slaby
2020-03-10 6:30 ` Dmitry Vyukov
2020-03-11 14:11 ` Steven Rostedt
2020-03-12 19:23 ` Dmitry Vyukov
2020-03-12 21:59 ` Tetsuo Handa
2020-03-12 22:29 ` Steven Rostedt
2020-03-13 8:31 ` Peter Zijlstra
2020-03-15 5:54 ` Dmitry Vyukov
2020-03-21 4:49 ` Tetsuo Handa
2020-03-24 10:37 ` Dmitry Vyukov
2020-03-26 11:10 ` Tetsuo Handa
2020-04-10 4:38 ` Tetsuo Handa
2020-03-08 6:52 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=6f2e27de-c820-7de3-447d-cd9f7c650add@suse.com \
--to=jslaby@suse.com \
--cc=ak@linux.intel.com \
--cc=akpm@linux-foundation.org \
--cc=arnd@arndb.de \
--cc=dvyukov@google.com \
--cc=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mjg59@google.com \
--cc=penguin-kernel@I-love.SAKURA.ne.jp \
--cc=pmladek@suse.com \
--cc=rostedt@goodmis.org \
--cc=sergey.senozhatsky@gmail.com \
--cc=torvalds@linux-foundation.org \
--cc=tytso@mit.edu \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).