From: Geert Uytterhoeven <geert@linux-m68k.org>
To: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
Cc: Andrew Morton <akpm@linux-foundation.org>,
Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
Dmitry Vyukov <dvyukov@google.com>,
Ondrej Mosnacek <omosnace@redhat.com>,
Petr Mladek <pmladek@suse.com>,
Sergey Senozhatsky <sergey.senozhatsky@gmail.com>,
Steven Rostedt <rostedt@goodmis.org>
Subject: Re: [PATCH v2] twist: allow converting pr_devel()/pr_debug() into snprintf()
Date: Mon, 8 Jun 2020 18:39:53 +0200 [thread overview]
Message-ID: <CAMuHMdWOjCtV9W7GtHrhKCJwJ6wNSpd_RQTBaoG7sVrb4oYSDA@mail.gmail.com> (raw)
In-Reply-To: <20200528065603.3596-1-penguin-kernel@I-love.SAKURA.ne.jp>
Hi Tetsuo,
On Thu, May 28, 2020 at 8:57 AM Tetsuo Handa
<penguin-kernel@i-love.sakura.ne.jp> wrote:
> syzbot found a NULL pointer dereference bug inside mptcp_recvmsg() due to
> ssock == NULL, but this bug manifested inside selinux_socket_recvmsg()
> because pr_debug() was no-op [1].
>
> pr_debug("fallback-read subflow=%p",
> mptcp_subflow_ctx(ssock->sk));
> copied = sock_recvmsg(ssock, msg, flags);
>
> Thus, let's allow fuzzers to always evaluate pr_devel()/pr_debug()
> messages, by redirecting no-op pr_devel()/pr_debug() calls to snprintf().
>
> [1] https://syzkaller.appspot.com/bug?id=12be9aa373be9d8727cdd172f190de39528a413a
>
> Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Thanks for your patch!
> --- a/lib/Kconfig.twist
> +++ b/lib/Kconfig.twist
> @@ -12,10 +12,22 @@ if TWIST_KERNEL_BEHAVIOR
>
> config TWIST_FOR_SYZKALLER_TESTING
> bool "Select all twist options suitable for syzkaller testing"
> + select TWIST_ALWAYS_EVALUATE_PRINTK_ARGUMENTS
> select TWIST_DISABLE_KBD_K_SPEC_HANDLER
> help
> Say N unless you are building kernels for syzkaller's testing.
>
> +config TWIST_ALWAYS_EVALUATE_PRINTK_ARGUMENTS
> + bool "Always evaluate printk() arguments"
> + help
> + Currently, only format string of printk() arguments is checked
> + by compiler if pr_devel()/pr_debug() are disabled. Therefore,
> + fuzz testing cannot catch runtime bugs (e.g. NULL pointer
> + dereference, use-after-free/out-of-bounds/uninitialized read)
> + in disabled printk() calls. This option redirects disabled
> + printk(...) to snprintf(NULL, 0, ...) in order to evaluate
> + arguments without printing.
> +
> config TWIST_DISABLE_KBD_K_SPEC_HANDLER
> bool "Disable k_spec() function in drivers/tty/vt/keyboard.c"
> help
Can't you just enable CONFIG_DYNAMIC_DEBUG in your fuzzer
config instead?
Gr{oetje,eeting}s,
Geert
--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@linux-m68k.org
In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
-- Linus Torvalds
next prev parent reply other threads:[~2020-06-08 16:40 UTC|newest]
Thread overview: 44+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-05-24 14:50 [PATCH] twist: allow converting pr_devel()/pr_debug() into printk(KERN_DEBUG) Tetsuo Handa
2020-05-24 17:38 ` Joe Perches
2020-05-24 19:18 ` Ondrej Mosnacek
2020-05-25 5:03 ` Tetsuo Handa
2020-05-25 6:07 ` Joe Perches
2020-05-25 7:38 ` Dmitry Vyukov
2020-05-25 8:42 ` Petr Mladek
2020-05-25 9:11 ` Sergey Senozhatsky
2020-05-25 10:43 ` Tetsuo Handa
2020-05-27 8:37 ` Petr Mladek
2020-05-27 10:13 ` Tetsuo Handa
2020-05-27 15:55 ` Petr Mladek
2020-05-27 23:33 ` Tetsuo Handa
2020-05-28 6:56 ` [PATCH v2] twist: allow converting pr_devel()/pr_debug() into snprintf() Tetsuo Handa
2020-05-28 11:06 ` Petr Mladek
2020-05-28 15:16 ` Tetsuo Handa
2020-05-28 19:10 ` Andrew Morton
2020-05-28 19:50 ` Linus Torvalds
2020-05-28 20:01 ` Linus Torvalds
2020-05-29 0:07 ` Tetsuo Handa
2020-05-29 0:28 ` Linus Torvalds
2020-05-29 2:13 ` Tetsuo Handa
2020-05-29 2:24 ` Linus Torvalds
2020-05-29 4:47 ` Tetsuo Handa
2020-05-29 13:26 ` Tetsuo Handa
2020-06-03 11:03 ` twist: allow disabling reboot request Tetsuo Handa
2020-06-03 12:44 ` Petr Mladek
2020-06-03 13:35 ` Tetsuo Handa
2020-06-04 10:21 ` Petr Mladek
2020-06-08 7:48 ` [PATCH v2] twist: allow converting pr_devel()/pr_debug() into snprintf() Dmitry Vyukov
2020-06-08 10:30 ` Tetsuo Handa
2020-06-08 11:31 ` Andrey Konovalov
2020-05-29 8:17 ` Petr Mladek
2020-06-08 16:39 ` Geert Uytterhoeven [this message]
2020-05-28 10:59 ` [PATCH] twist: allow converting pr_devel()/pr_debug() into printk(KERN_DEBUG) Petr Mladek
2020-05-28 11:33 ` Tetsuo Handa
2020-05-28 12:14 ` Petr Mladek
2020-05-28 14:13 ` Tetsuo Handa
2020-05-28 17:08 ` Joe Perches
2020-05-29 2:04 ` Sergey Senozhatsky
2020-05-29 5:06 ` Tetsuo Handa
2020-05-27 9:59 ` kbuild test robot
2020-05-27 13:41 ` Tetsuo Handa
2020-05-27 12:37 ` kbuild test robot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAMuHMdWOjCtV9W7GtHrhKCJwJ6wNSpd_RQTBaoG7sVrb4oYSDA@mail.gmail.com \
--to=geert@linux-m68k.org \
--cc=akpm@linux-foundation.org \
--cc=dvyukov@google.com \
--cc=linux-kernel@vger.kernel.org \
--cc=omosnace@redhat.com \
--cc=penguin-kernel@i-love.sakura.ne.jp \
--cc=pmladek@suse.com \
--cc=rostedt@goodmis.org \
--cc=sergey.senozhatsky@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).