Message-ID: <e51f5885-5508-7574-e5b9-e931a1164d3f@i-love.sakura.ne.jp>
Date:   Mon, 8 Jun 2020 19:30:26 +0900
From:   Tetsuo Handa <penguin-kernel@...ove.sakura.ne.jp>
To:     Dmitry Vyukov <dvyukov@...gle.com>
Cc:     syzkaller <syzkaller@...glegroups.com>,
        Linus Torvalds <torvalds@...ux-foundation.org>,
        Petr Mladek <pmladek@...e.com>,
        Andrew Morton <akpm@...ux-foundation.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        Ondrej Mosnacek <omosnace@...hat.com>,
        Sergey Senozhatsky <sergey.senozhatsky@...il.com>,
        Steven Rostedt <rostedt@...dmis.org>
Subject: Re: [PATCH v2] twist: allow converting pr_devel()/pr_debug() into
 snprintf()

On 2020/06/08 16:48, Dmitry Vyukov wrote:
>> (5) Anything else?
> 
> Reading:
> https://www.kernel.org/doc/html/latest/admin-guide/bootconfig.html#boot-kernel-with-a-boot-config
> It seems that boot config is just a more complex way to provide
> command line arguments. syzbot already supports command line
> arguments, and it looks much simpler and no additional work required.
> Why do we want to use boot config?

Since the max length a bootloader can accept for kernel command line arguments is finite (e.g.
https://bugzilla.redhat.com/show_bug.cgi?id=1239170 ), we can't specify as many arguments as
we want. Since Linus is expecting to specify independently upon boot, length for the kernel
command line arguments might exceed that limit. The boot config is a method for allowing longer
kernel command line arguments, at the cost of mandating use of the initramfs file.

>> (2) The boot-config file is embedded into initramfs file. Since syzkaller builds
>>     kernels with almost-allyesconfig, booting syzkaller kernels do not require
>>     initramfs for loading kernel modules needed for mounting the root partition.
>>     In fact, according to "unexpected kernel reboot" report which contains boot messages,
>>     I can't find "Unpacking initramfs..." message. It seems that syzkaller kernels do not
>>     use initramfs file.
>>
>>     Is it possible for syzkaller to enforce performing steps for creating an initramfs,
>>     embedding the boot-config file
>>     ( https://www.kernel.org/doc/html/latest/admin-guide/bootconfig.html#boot-kernel-with-a-boot-config),
>>     and loading that initramfs whenever booting the syzkaller kernels?
>>     By the way, I do worry that people forget to perform these steps when they do
>>     their tests without asking syzbot...
> 
> I think we have some confusion between syzkaller and syzbot here.
> syzkaller itself does not enforce/require any kernel configuration,
> hardware nor use or not use of initramfs. In fact, qemu VM type
> supports initramfs today. Or syzkaller can work with bare machines
> where all setup is up to the user.
> syzbot is just one deployment of syzkaller with a particular
> configuration/hardware.

OK.

> 
> If this feature is useful for any linux kernel fuzzing, then we need
> to have a plan for all users and setups.

Build-time switching can support all users and setups, for the kernel is built for intended
environment/purpose only. Assuming that this feature is useful for any linux kernel fuzzing,
we need to care about whether we can specify longer kernel command line arguments on every
environment in order to support boot-time switching.

> 
> And, yes, an additional context is kernel developers reproducing bugs.
> Not all of them may be happy about any additional steps, nor will
> follow them.

But there will be bugs which could not be found unless we twist kernel behavior.
Not mandate specifying appropriate twist options to the kernel command line
arguments can prevent automated/manual testings from finding/reproducing bugs.

> 
> Answering your question, syzkaller can do some sanity checking of the
> provided machine/kernel and reject working with it. If you tell me
> what exactly needs to be checked, I can think where this code should
> go.
> However, again, I am not sure if one is using, say, Android phones and
> they don't envision use of initramfs, then what?

If use of initramfs cannot be mandated, we might fail to specify necessary
twist options to the kernel command line (due to length limitation).

> 
> For syzbot, the build happens here:
> https://github.com/google/syzkaller/blob/7751efd04aebb07bc82b5c0e8eeaca07be1ae112/pkg/build/linux.go#L72
> I don't know if initramfs is supported with GCE machines and what
> exactly is required.

Neither do I. I'm not familiar with bootloaders.

> 
>> (4) Of course, "your-config" file would not change so frequently, but "#syz test" command
>>     relies on external file in "syzkaller tree" makes it impossible to try different
>>     configuration when I have to ask syzbot to test. (Since I don't have hardware which
>>     syzbot is reporting problems, I have to ask syzbot when I can't reproduce the problem
>>     in my environment.)
>>
>>     https://syzkaller.appspot.com/text?tag=Patch&x=135f254a100000 is an example of
>>     need to enforce CONFIG_DEBUG_INFO_BTF=n in order to workaround build failure during
>>     "#syz test" command. If we bring "which twist options should be enabled" to an external
>>     boot-config file, I can't ask syzbot to try different twist options (except directly
>>     patching the kernel source which handles "which twist options should be enabled").
>>     Can syzbot solve this concern?
> 
> The CONFIG_DEBUG_INFO_BTF relates to build config. This can't be
> solved during boot, right? So what is the relation?

This is an approach for embedding twist options into build-time conditions in order to
compensate for lack of ability to temporarily change the kernel command line arguments
(when it is difficult to temporarily change the kernel command line arguments).

Powered by blists - more mailing lists