On (03/16/19 19:18), Tetsuo Handa wrote:
> On 2019/03/16 18:11, Dmitry Vyukov wrote:
> > Such reports showed up always with low frequency. For all that I
> > looked at we also always had a normal non-truncated version, so I was
> > never too worried.
> >
> > If something would write from userspace, that would show up in the
> > output, or not?
> >
> > Perhaps syzkaller somehow manages to lower console output level?
>
> panic() calls console_verbose() before calling
>
> pr_emerg("Kernel panic - not syncing: %s\n", buf);
>
> line. Then, someone might have changed console_loglevel enough to
> suppress printk() output.
Hmm... sysctl, may be?
> > I figured out that we should restrict it from doing
> > syslog(SYSLOG_ACTION_CONSOLE_OFF). And I also restricted its access o
> > /dev/console. But maybe there is something else? It _should_ not be
> > able to write to random sysctl's.
>
> Maybe try running with "ignore_loglevel" kernel command line option added?
Right, that's something I would expect 0-day and syzkaller to do.
-ss
