From: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
To: Dmitry Vyukov <dvyukov@google.com>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>,
Petr Mladek <pmladek@suse.com>,
Sergey Senozhatsky <sergey.senozhatsky@gmail.com>,
Arnd Bergmann <arnd@arndb.de>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Jiri Slaby <jslaby@suse.com>,
Steven Rostedt <rostedt@goodmis.org>,
Linus Torvalds <torvalds@linux-foundation.org>,
LKML <linux-kernel@vger.kernel.org>
Subject: Re: [PATCH] kconfig: Add kernel config option for fuzz testing.
Date: Tue, 17 Dec 2019 21:54:02 +0900 [thread overview]
Message-ID: <a62a6576-940b-31a8-1d37-8b4c0828d86b@i-love.sakura.ne.jp> (raw)
In-Reply-To: <CACT4Y+b6ZMfLCSe_x8_ME4hyKB9hz9B84LiNV8-u1SVDzqLCHA@mail.gmail.com>
On 2019/12/17 17:41, Dmitry Vyukov wrote:
>> diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c
>> index 90655910b0c7..367b92ad598b 100644
>> --- a/drivers/tty/serial/8250/8250_port.c
>> +++ b/drivers/tty/serial/8250/8250_port.c
>> @@ -519,11 +519,14 @@ serial_port_out_sync(struct uart_port *p, int offset, int value)
>> case UPIO_MEM32:
>> case UPIO_MEM32BE:
>> case UPIO_AU:
>> - p->serial_out(p, offset, value);
>> + /* Writing to random kernel address causes crash. */
>> + if (!IS_ENABLED(CONFIG_KERNEL_BUILT_FOR_FUZZ_TESTING))
>> + p->serial_out(p, offset, value);
>
> Does this do the same as LOCKDOWN_TIOCSSERIAL? How is it different?
I don't know. If there were an oversight in condition of lines 852-858,
uart_startup() might be called due to "goto check_and_exit;" without
hitting security_locked_down(LOCKDOWN_TIOCSSERIAL) check.
846: old_flags = uport->flags;
847: new_flags = (__force upf_t)new_info->flags;
848: old_custom_divisor = uport->custom_divisor;
849:
850: if (!capable(CAP_SYS_ADMIN)) {
851: retval = -EPERM;
852: if (change_irq || change_port ||
853: (new_info->baud_base != uport->uartclk / 16) ||
854: (close_delay != port->close_delay) ||
855: (closing_wait != port->closing_wait) ||
856: (new_info->xmit_fifo_size &&
857: new_info->xmit_fifo_size != uport->fifosize) ||
858: (((new_flags ^ old_flags) & ~UPF_USR_MASK) != 0))
859: goto exit;
860: uport->flags = ((uport->flags & ~UPF_USR_MASK) |
861: (new_flags & UPF_USR_MASK));
862: uport->custom_divisor = new_info->custom_divisor;
863: goto check_and_exit;
864: }
865:
866: retval = security_locked_down(LOCKDOWN_TIOCSSERIAL);
867: if (retval && (change_irq || change_port))
868: goto exit;
>
>> p->serial_in(p, UART_LCR); /* safe, no side-effects */
>> break;
>> default:
>> - p->serial_out(p, offset, value);
>> + if (!IS_ENABLED(CONFIG_KERNEL_BUILT_FOR_FUZZ_TESTING))
>> + p->serial_out(p, offset, value);
>> }
>> }
But I came think that "BUG: unable to handle kernel NULL pointer dereference in
mem_serial_out" is a real kernel bug which should be fixed. It seems that crash
occurs only when "struct serial_struct"->iomem_base == NULL, and EBUSY is
returned otherwise. That is, some sanity check is wrong.
prev parent reply other threads:[~2019-12-17 12:55 UTC|newest]
Thread overview: 26+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-12-16 9:59 [PATCH] kconfig: Add kernel config option for fuzz testing Tetsuo Handa
2019-12-16 11:46 ` Greg Kroah-Hartman
2019-12-16 15:35 ` Tetsuo Handa
2019-12-16 16:31 ` Greg Kroah-Hartman
2019-12-16 20:18 ` Theodore Y. Ts'o
2019-12-16 21:06 ` Tetsuo Handa
2019-12-17 8:36 ` Dmitry Vyukov
2019-12-17 8:53 ` Dmitry Vyukov
2020-01-02 19:57 ` Matthew Garrett
2020-02-18 10:54 ` Tetsuo Handa
2020-02-27 22:10 ` Tetsuo Handa
2020-02-27 22:15 ` Matthew Garrett
2019-12-17 15:52 ` Theodore Y. Ts'o
2019-12-19 17:43 ` Dmitry Vyukov
2019-12-19 21:18 ` Theodore Y. Ts'o
2019-12-18 10:29 ` Tetsuo Handa
2019-12-19 17:21 ` Dmitry Vyukov
2019-12-16 18:34 ` Andi Kleen
2019-12-16 18:47 ` Greg Kroah-Hartman
2019-12-17 5:12 ` Sergey Senozhatsky
2019-12-17 7:54 ` Dmitry Vyukov
2019-12-17 8:24 ` Sergey Senozhatsky
2019-12-17 8:38 ` Dmitry Vyukov
2019-12-17 5:42 ` Masahiro Yamada
2019-12-17 8:41 ` Dmitry Vyukov
2019-12-17 12:54 ` Tetsuo Handa [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=a62a6576-940b-31a8-1d37-8b4c0828d86b@i-love.sakura.ne.jp \
--to=penguin-kernel@i-love.sakura.ne.jp \
--cc=arnd@arndb.de \
--cc=dvyukov@google.com \
--cc=gregkh@linuxfoundation.org \
--cc=jslaby@suse.com \
--cc=linux-kernel@vger.kernel.org \
--cc=pmladek@suse.com \
--cc=rostedt@goodmis.org \
--cc=sergey.senozhatsky@gmail.com \
--cc=torvalds@linux-foundation.org \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).