Re: [PATCH v2] twist: allow converting pr_devel()/pr_debug() into snprintf()

2020-06-08 Thread Geert Uytterhoeven
Hi Tetsuo, On Thu, May 28, 2020 at 8:57 AM Tetsuo Handa wrote: > syzbot found a NULL pointer dereference bug inside mptcp_recvmsg() due to > ssock == NULL, but this bug manifested inside selinux_socket_recvmsg() > because pr_debug() was no-op [1]. > > pr_debug("fallback-read subflow=%p", >

Re: [PATCH v2] twist: allow converting pr_devel()/pr_debug() into snprintf()

2020-06-08 Thread Andrey Konovalov
On Mon, Jun 8, 2020 at 9:48 AM 'Dmitry Vyukov' via syzkaller wrote: > > On Fri, May 29, 2020 at 3:27 PM Tetsuo Handa > wrote: > > > > Hello, Dmitry. > > > > Linus is asking me to avoid build-time switching based on kernel config > > options, > > and is suggesting me to use boot-time switching ba

Re: [PATCH v2] twist: allow converting pr_devel()/pr_debug() into snprintf()

2020-06-08 Thread Tetsuo Handa
On 2020/06/08 16:48, Dmitry Vyukov wrote: >> (5) Anything else? > > Reading: > https://www.kernel.org/doc/html/latest/admin-guide/bootconfig.html#boot-kernel-with-a-boot-config > It seems that boot config is just a more complex way to provide > command line arguments. syzbot already supports comma

Re: [PATCH v2] twist: allow converting pr_devel()/pr_debug() into snprintf()

2020-06-08 Thread Dmitry Vyukov
On Fri, May 29, 2020 at 3:27 PM Tetsuo Handa wrote: > > Hello, Dmitry. > > Linus is asking me to avoid build-time switching based on kernel config > options, > and is suggesting me to use boot-time switching based on boot-config file > feature > (which is available since 5.6). I have several con

Re: [PATCH v2] twist: allow converting pr_devel()/pr_debug() into snprintf()

2020-05-29 Thread Tetsuo Handa
Hello, Dmitry. Linus is asking me to avoid build-time switching based on kernel config options, and is suggesting me to use boot-time switching based on boot-config file feature (which is available since 5.6). I have several concerns about use of boot-config file feature in syzkaller. (1) To us

Re: [PATCH v2] twist: allow converting pr_devel()/pr_debug() into snprintf()

2020-05-29 Thread Petr Mladek
On Thu 2020-05-28 12:50:35, Linus Torvalds wrote: > On Thu, May 28, 2020 at 8:17 AM Tetsuo Handa > wrote: > > > > CONFIG_TWIST_FOR_SYZKALLER_TESTING is meant for linux-next only. > > But CONFIG_TWIST_KERNEL_BEHAVIOR is meant for Linus's tree. > > I really absolutely still detest this all. I don't

Re: [PATCH v2] twist: allow converting pr_devel()/pr_debug() into snprintf()

2020-05-28 Thread Tetsuo Handa
On 2020/05/29 11:24, Linus Torvalds wrote: > Some flags do end up having to be practically system-wide, because > they end up being used in contexts other than the test environment (ie > anything that ends up doing workqueues or networking or VM or whatever > - it's a "global context"). Right. And

Re: [PATCH v2] twist: allow converting pr_devel()/pr_debug() into snprintf()

2020-05-28 Thread Linus Torvalds
On Thu, May 28, 2020 at 7:14 PM Tetsuo Handa wrote: > > You said > > Some kind of "not even root" flag, which might be per-process and not > possible to clear once set (so that your _normal_ system binaries > could still do the root-only stuff, but then you could start a fuzzing > process

Re: [PATCH v2] twist: allow converting pr_devel()/pr_debug() into snprintf()

2020-05-28 Thread Tetsuo Handa
On 2020/05/29 9:28, Linus Torvalds wrote: >> Current kernel is not well segmented enough to allow switching based on >> per process flags. We can't distinguish whether some kernel message was >> caused by a process with such flags. > > Who said anything at all about per process? > You said So

Re: [PATCH v2] twist: allow converting pr_devel()/pr_debug() into snprintf()

2020-05-28 Thread Linus Torvalds
On Thu, May 28, 2020 at 5:08 PM Tetsuo Handa wrote: > > You mean "export these behavior as kernel command line options"? That will > involve run-time costs (while build-time branching based on #ifdef can > completely eliminate run-time costs). Are _any_ of these things meaningful? > Also, as num

Re: [PATCH v2] twist: allow converting pr_devel()/pr_debug() into snprintf()

2020-05-28 Thread Tetsuo Handa
On 2020/05/29 4:50, Linus Torvalds wrote: > On Thu, May 28, 2020 at 8:17 AM Tetsuo Handa > wrote: >> >> CONFIG_TWIST_FOR_SYZKALLER_TESTING is meant for linux-next only. >> But CONFIG_TWIST_KERNEL_BEHAVIOR is meant for Linus's tree. > > I really absolutely still detest this all. I don't see the po

Re: [PATCH v2] twist: allow converting pr_devel()/pr_debug() into snprintf()

2020-05-28 Thread Linus Torvalds
On Thu, May 28, 2020 at 12:50 PM Linus Torvalds wrote: > > I still don't understand why this small set of random options couldn't > just be kernel options that get set on the command line, and that have > independent and sane and explainable behavior? Why this odd mentality > of "syzkaller is spec

Re: [PATCH v2] twist: allow converting pr_devel()/pr_debug() into snprintf()

2020-05-28 Thread Linus Torvalds
On Thu, May 28, 2020 at 8:17 AM Tetsuo Handa wrote: > > CONFIG_TWIST_FOR_SYZKALLER_TESTING is meant for linux-next only. > But CONFIG_TWIST_KERNEL_BEHAVIOR is meant for Linus's tree. I really absolutely still detest this all. I don't see the point. The naming is completely random (both "twist" an

Re: [PATCH v2] twist: allow converting pr_devel()/pr_debug() into snprintf()

2020-05-28 Thread Andrew Morton
On Fri, 29 May 2020 00:16:22 +0900 Tetsuo Handa wrote: > On 2020/05/28 20:06, Petr Mladek wrote: > > Now, it requires lib/Kconfig.twist that is added by a patch in > > Andrew's tree. One approach is to push this into linux-next > > via Andrew's -mm tree. > > > > Another possibility would be to

Re: [PATCH v2] twist: allow converting pr_devel()/pr_debug() into snprintf()

2020-05-28 Thread Tetsuo Handa
On 2020/05/28 20:06, Petr Mladek wrote: > Now, it requires lib/Kconfig.twist that is added by a patch in > Andrew's tree. One approach is to push this into linux-next > via Andrew's -mm tree. > > Another possibility would be to remove lib/Kconfig.twist > changes from this patch and replace > CONFI

Re: [PATCH v2] twist: allow converting pr_devel()/pr_debug() into snprintf()

2020-05-28 Thread Petr Mladek
On Thu 2020-05-28 15:56:03, Tetsuo Handa wrote: > syzbot found a NULL pointer dereference bug inside mptcp_recvmsg() due to > ssock == NULL, but this bug manifested inside selinux_socket_recvmsg() > because pr_debug() was no-op [1]. > > pr_debug("fallback-read subflow=%p", >mptcp_sub

[PATCH v2] twist: allow converting pr_devel()/pr_debug() into snprintf()

2020-05-27 Thread Tetsuo Handa
syzbot found a NULL pointer dereference bug inside mptcp_recvmsg() due to ssock == NULL, but this bug manifested inside selinux_socket_recvmsg() because pr_debug() was no-op [1]. pr_debug("fallback-read subflow=%p", mptcp_subflow_ctx(ssock->sk)); copied = sock_recvmsg(ssock, msg, fl