[PATCH v4 2/3] twist: Allow disabling k_spec() function in drivers/tty/vt/keyboard.c

[Tetsuo Handa]

syzbot is reporting unexpected kernel reboots [1]. This seems to be
caused by triggering Ctrl-Alt-Del event via k_spec() function in
drivers/tty/vt/keyboard.c file, for the console output includes normal
restart sequence.

[ 97.727327][ T1] systemd-shutdown[1]: Unmounting file systems.
[ 97.734278][ T1] systemd-shutdown[1]: Remounting '/' read-only with options ''.
[ 97.747758][ T21] usb 2-1: device descriptor read/8, error -71
[ 97.747850][ T3116] usb 1-1: device descriptor read/8, error -71
[ 97.764818][ T1] EXT4-fs (sda1): re-mounted. Opts:
[ 97.777551][ T1] systemd-shutdown[1]: Remounting '/' read-only with options ''.
[ 97.785448][ T1] EXT4-fs (sda1): re-mounted. Opts:
[ 97.790920][ T1] systemd-shutdown[1]: All filesystems unmounted.
[ 97.797352][ T1] systemd-shutdown[1]: Deactivating swaps.
[ 97.803451][ T1] systemd-shutdown[1]: All swaps deactivated.
[ 97.809626][ T1] systemd-shutdown[1]: Detaching loop devices.
[ 97.890294][ T1] systemd-shutdown[1]: All loop devices detached.
[ 98.967832][ T3116] usb 1-1: device descriptor read/8, error -71
[ 100.108406][ T1] sd 0:0:1:0: [sda] Synchronizing SCSI cache
[ 100.116036][ T1] reboot: Restarting system
[ 100.120636][ T1] reboot: machine restart
SeaBIOS (version 1.8.2-20200402_173431-google)
Total RAM Size = 0x00000001e0000000 = 7680 MiB
CPUs found: 2 Max CPUs supported: 2
Comparing RSDP and RSDP

Therefore, allow disabling only k_spec() function in order to allow
fuzzers to examine the remaining part in that file.

[1] https://syzkaller.appspot.com/bug?id=321861b1588b44d064b779b92293c5d55cfe8430

Signed-off-by: Tetsuo Handa <penguin...@I-love.SAKURA.ne.jp>
---
drivers/tty/vt/keyboard.c | 2 ++
lib/Kconfig.twist | 7 +++++++
2 files changed, 9 insertions(+)

diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c
index 15d33fa0c925..f08855c4c5ba 100644
--- a/drivers/tty/vt/keyboard.c
+++ b/drivers/tty/vt/keyboard.c
@@ -633,6 +633,8 @@ static void k_spec(struct vc_data *vc, unsigned char value, char up_flag)
kbd->kbdmode == VC_OFF) &&
value != KVAL(K_SAK))
return; /* SAK is allowed even in raw mode */
+ if (IS_ENABLED(CONFIG_TWIST_DISABLE_KBD_K_SPEC_HANDLER))
+ return;
fn_handler[value](vc);
}

diff --git a/lib/Kconfig.twist b/lib/Kconfig.twist
index a5ce0db67f28..a1d038bcc2a5 100644
--- a/lib/Kconfig.twist
+++ b/lib/Kconfig.twist
@@ -10,4 +10,11 @@ menuconfig TWIST_KERNEL_BEHAVIOR

if TWIST_KERNEL_BEHAVIOR

+config TWIST_DISABLE_KBD_K_SPEC_HANDLER
+ bool "Disable k_spec() function in drivers/tty/vt/keyboard.c"
+ help
+ k_spec() function allows triggering e.g. Ctrl-Alt-Del event.
+ Such event is annoying for fuzz testing which wants to test
+ kernel code without rebooting the system.
+
endif # TWIST_KERNEL_BEHAVIOR
--
2.18.2

[Tetsuo Handa]

Existing kernel config options are defined based on "whether you want to
enable this module/feature or not". And such granularity is sometimes
too rough-grained for fuzzing tools which try to find bugs inside each
module/feature.

While syzkaller (one of fuzzing tools) is finding many bugs, sometimes
syzkaller examines stupid operations. Some examples of such operations
are: changing console loglevel which in turn makes it impossible to get
kernel messages when a crash happens, freezing filesystems which in turn
causes khungtaskd to needlessly complain, programmatically sending
Ctrl-Alt-Del which in turn causes the system to needlessly reboot.
Currently we prevent syzkaller from examining stupid operations by
blacklisting syscall arguments and/or disabling whole functionality
using existing kernel config options. But such approach is difficult to
maintain and needlessly prevents fuzzers from testing kernel code. [1]

We want fuzzers to test as much coverage as possible while we want
fuzzers not to try stupid operations. To achieve this goal, we want
cooperation from kernel side, and build-time branching (i.e. kernel
config options) will be the simplest and the most reliable.

Therefore, this patch introduces a kernel config option which allows
selecting fine-grained kernel config options for twisting kernel's
behavior. Each fine-grained kernel config option will be added by future
patches. For ease of management, grouping kernel config options for
allowing e.g. syzkaller to select all fine-grained kernel config options
which e.g. syzkaller wants would be added by future patches.

[1] https://lkml.kernel.org/r/CACT4Y+a6KExbggs4mg8pvoD554PcDqQNW4sM15X-tc=YON...@mail.gmail.com

Signed-off-by: Tetsuo Handa <penguin...@I-love.SAKURA.ne.jp>
---

lib/Kconfig.debug | 2 ++
lib/Kconfig.twist | 13 +++++++++++++
2 files changed, 15 insertions(+)
create mode 100644 lib/Kconfig.twist

Changes since v3 ( https://lkml.kernel.org/r/20200413063317.716...@I-love.SAKURA.ne.jp ):
Use "twist" instead of "tweak".
Add an instance of fine-grained kernel config option as patch 2 of 3.
Add a grouping kernel config option for syzkaller as patch 3 of 3.

Changes since v2 ( https://lkml.kernel.org/r/20200307135822.389...@I-love.SAKURA.ne.jp ):
Reduce the role of this kernel config option from "enable everything
which would be useful for fuzz testing" to "simply serve as a gate for
hiding individual kernel config option", for we should use individual
kernel config option for tweaking individual kernel behavior.

Changes since v1 ( https://lkml.kernel.org/r/20191216095955.988...@I-love.SAKURA.ne.jp ):
Drop users of this kernel config option.
Update patch description.

diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index 21d9c5f6e7ec..e6162595ef9d 100644
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -2225,4 +2225,6 @@ config HYPERV_TESTING

endmenu # "Kernel Testing and Coverage"

+source "lib/Kconfig.twist"
+
endmenu # Kernel hacking
diff --git a/lib/Kconfig.twist b/lib/Kconfig.twist
new file mode 100644
index 000000000000..a5ce0db67f28
--- /dev/null
+++ b/lib/Kconfig.twist
@@ -0,0 +1,13 @@
+menuconfig TWIST_KERNEL_BEHAVIOR
+ bool "Twist kernel behavior"
+ help
+ Saying Y here allows modifying kernel behavior via kernel
+ config options which will become visible by selecting this
+ config option. Since these kernel config options are intended
+ for helping e.g. fuzz testing, behavior twisted by this kernel
+ option might be unstable. Userspace applications should not
+ count on this option being selected.
+
+if TWIST_KERNEL_BEHAVIOR
+
+endif # TWIST_KERNEL_BEHAVIOR
--
2.18.2