linux-kernel - Re: [syzbot] unexpected kernel reboot (5)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Mon, 31 May 2021 10:50:18 +0200
From:   Dmitry Vyukov <dvyukov@...gle.com>
To:     Tetsuo Handa <penguin-kernel@...ove.sakura.ne.jp>
Cc:     "joey.jiaojg" <joey.jiaojg@...il.com>,
        syzbot <syzbot+6fb8ff5211d3e821398f@...kaller.appspotmail.com>,
        LKML <linux-kernel@...r.kernel.org>,
        syzkaller-bugs <syzkaller-bugs@...glegroups.com>
Subject: Re: [syzbot] unexpected kernel reboot (5)

On Thu, May 27, 2021 at 3:17 PM Tetsuo Handa
<penguin-kernel@...ove.sakura.ne.jp> wrote:
>
> On 2021/05/27 21:15, joey.jiaojg wrote:
> > I tested on qemu and Android device, not found the reboot.
> > Any kernel version different?
>
> Kernel version needs to be v5.11-rc5+ because this reproducer
> depends on commit f2d6c2708bd8 ("kernfs: wire up ->splice_read
> and ->splice_write"). Also, this reproducer depends on contents
> of /sys/power/state file.
>
> ----------
> #include <sys/types.h>
> #include <sys/stat.h>
> #include <fcntl.h>
> #include <sys/sendfile.h>
>
> int main(int argc, char *argv[])
> {
>         const int fd = open("/sys/power/state", O_RDWR);
>         off_t offset = 7;
>
>         /* Assumes that 3 bytes from offset 7 in /sys/power/state are "mem". */
>         sendfile(fd, fd, &offset, 3);
>         return 0;
> }
> ----------
>
> On 2021/05/27 21:19, joey.jiaojg wrote:
> > Or we can add glob code like
> > /sys/**/*:-/sys/power/state to exclude.
>
> Well, since /sys/ includes mount points for other filesystems such as
> securityfs ( /sys/kernel/security/ ), debugfs ( /sys/kernel/debug/ )
> and cgroup ( /sys/fs/cgroup/ ), just excluding this specific file is not
> sufficient. I think we have to start from removing glob["/sys/**/*"] .

FTR, Joey is working on support for excluding specific patterns from globs:
https://github.com/google/syzkaller/pull/2602

I agree /sys/**/* may be too broad. On my machine /sys contains 82501
files. But it's also hard for me to tell what exactly should be
included/excluded. Do we know any definitely bad files/dirs?
Or alternatively, we can just wait for more reports from syzbot when
it opens something we don't want it to open. The benefit of working on
testing :)