linux-kernel - Re: [RESEND PATCH 0/5] perf core: Support overwrite ring buffer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Wed, 9 Mar 2016 12:19:55 +0100
From:	Dmitry Vyukov <dvyukov@...gle.com>
To:	Borislav Petkov <bp@...en8.de>
Cc:	Ingo Molnar <mingo@...nel.org>,
	Peter Zijlstra <peterz@...radead.org>,
	Wang Nan <wangnan0@...wei.com>, Ingo Molnar <mingo@...hat.com>,
	LKML <linux-kernel@...r.kernel.org>,
	He Kuang <hekuang@...wei.com>,
	Alexei Starovoitov <ast@...nel.org>,
	Arnaldo Carvalho de Melo <acme@...hat.com>,
	Brendan Gregg <brendan.d.gregg@...il.com>,
	Jiri Olsa <jolsa@...nel.org>,
	Masami Hiramatsu <masami.hiramatsu.pt@...achi.com>,
	Namhyung Kim <namhyung@...nel.org>,
	Zefan Li <lizefan@...wei.com>, pi3orama@....com
Subject: Re: [RESEND PATCH 0/5] perf core: Support overwrite ring buffer

On Wed, Mar 9, 2016 at 11:53 AM, Borislav Petkov <bp@...en8.de> wrote:
> On Tue, Mar 08, 2016 at 04:54:23PM +0100, Ingo Molnar wrote:
>> triton:~/go/src/github.com/google/syzkaller> cat perf.cfg
>> {
>>         "http": "localhost:50000",
>>         "workdir": "/home/mingo/go/src/github.com/google/syzkaller/workdir",
>>         "syzkaller": "/home/mingo/go/src/github.com/google/syzkaller",
>>         "vmlinux": "-",
>>         "type": "local",
>>         "count": 1,
>>         "procs": 16,
>>         "nocover": true,
>>         "nodropprivs": true,
>>         "enable_syscalls": [
>>                 "getpid",
>>                 "perf_event_open",
>
> Btw, is there a way to specify range of arguments to feed into
> perf_event_open? Like, limit @attr_uptr to single or multiple event IDs
> or so, for example?

No, there is no _that_ level of granularity in the config.

If you really-really want that, then you can alter description of the
perf_event_open syscall in sys/perf.txt file:

https://github.com/google/syzkaller/blob/master/sys/perf.txt

to be more restrictive. For example, you can limit set of values
passed in a particular argument, or even set some args/fields to const
values.
Then you will need to do:

$ make generate LINUX=/path/to/fresh/linux/checkout
$ make

But I would suggest to not do that. That perf config already limits
set of syscalls to a very small set. The fuzzer should be able to
examine all interesting combinations of arguments for these syscalls
in a reasonable time (provided that you use CONFIG_KCOV). And in the
end you don't know where the bugs. They are usually where you don't
expect them. So I would suggest the opposite: describe and more
perf-related syscalls, describe arguments in greater detail, enable
other syscalls that can have effect on perf subsystem. And then just
run it for longer using more machines.