Messages in this thread | | | From | Geert Uytterhoeven <> | Date | Mon, 8 Jun 2020 18:39:53 +0200 | Subject | Re: [PATCH v2] twist: allow converting pr_devel()/pr_debug() into snprintf() |
| |
Hi Tetsuo,
On Thu, May 28, 2020 at 8:57 AM Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp> wrote: > syzbot found a NULL pointer dereference bug inside mptcp_recvmsg() due to > ssock == NULL, but this bug manifested inside selinux_socket_recvmsg() > because pr_debug() was no-op [1]. > > pr_debug("fallback-read subflow=%p", > mptcp_subflow_ctx(ssock->sk)); > copied = sock_recvmsg(ssock, msg, flags); > > Thus, let's allow fuzzers to always evaluate pr_devel()/pr_debug() > messages, by redirecting no-op pr_devel()/pr_debug() calls to snprintf(). > > [1] https://syzkaller.appspot.com/bug?id=12be9aa373be9d8727cdd172f190de39528a413a > > Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Thanks for your patch!
> --- a/lib/Kconfig.twist > +++ b/lib/Kconfig.twist > @@ -12,10 +12,22 @@ if TWIST_KERNEL_BEHAVIOR > > config TWIST_FOR_SYZKALLER_TESTING > bool "Select all twist options suitable for syzkaller testing" > + select TWIST_ALWAYS_EVALUATE_PRINTK_ARGUMENTS > select TWIST_DISABLE_KBD_K_SPEC_HANDLER > help > Say N unless you are building kernels for syzkaller's testing. > > +config TWIST_ALWAYS_EVALUATE_PRINTK_ARGUMENTS > + bool "Always evaluate printk() arguments" > + help > + Currently, only format string of printk() arguments is checked > + by compiler if pr_devel()/pr_debug() are disabled. Therefore, > + fuzz testing cannot catch runtime bugs (e.g. NULL pointer > + dereference, use-after-free/out-of-bounds/uninitialized read) > + in disabled printk() calls. This option redirects disabled > + printk(...) to snprintf(NULL, 0, ...) in order to evaluate > + arguments without printing. > + > config TWIST_DISABLE_KBD_K_SPEC_HANDLER > bool "Disable k_spec() function in drivers/tty/vt/keyboard.c" > help
Can't you just enable CONFIG_DYNAMIC_DEBUG in your fuzzer config instead?
Gr{oetje,eeting}s,
Geert
-- Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@linux-m68k.org
In personal conversations with technical people, I call myself a hacker. But when I'm talking to journalists I just say "programmer" or something like that. -- Linus Torvalds
| |