From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S1751465AbdJ1DWj (ORCPT <rfc822;w@1wt.eu>);
        Fri, 27 Oct 2017 23:22:39 -0400
Received: from szxga04-in.huawei.com ([45.249.212.190]:9461 "EHLO
        szxga04-in.huawei.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
        with ESMTP id S1750851AbdJ1DWh (ORCPT
        <rfc822;linux-kernel@vger.kernel.org>);
        Fri, 27 Oct 2017 23:22:37 -0400
Subject: Re: [PATCH RFC] random: fix syzkaller fuzzer test int overflow
To: "Theodore Ts'o" <tytso@mit.edu>, Greg KH <gregkh@linuxfoundation.org>,
        <zhaoyukun@huawei.com>, <arnd@arndb.de>,
        <linux-kernel@vger.kernel.org>, <suzhuangluan@hisilicon.com>,
        <dan.zhao@hisilicon.com>
References: <1508831057-64195-1-git-send-email-puck.chen@hisilicon.com>
 <20171024090927.GA20625@kroah.com>
 <20171024102528.7oywdwjriesoh3mk@thunk.org> <59F02FA0.7090605@hisilicon.com>
 <20171025065646.GA13386@kroah.com> <59F03887.7020700@hisilicon.com>
 <20171025084926.mpdec34mog3xcocz@thunk.org> <59F19BEB.7090100@hisilicon.com>
 <20171026150445.s3rxcy4btlisdu5q@thunk.org>
From: Chen Feng <puck.chen@hisilicon.com>
Message-ID: <59F3F7D8.1080807@hisilicon.com>
Date: Sat, 28 Oct 2017 11:22:00 +0800
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101
 Thunderbird/38.5.1
MIME-Version: 1.0
In-Reply-To: <20171026150445.s3rxcy4btlisdu5q@thunk.org>
Content-Type: text/plain; charset="windows-1252"
Content-Transfer-Encoding: 7bit
X-Originating-IP: [10.142.193.64]
X-CFilter-Loop: Reflected
X-Mirapoint-Virus-RAPID-Raw: score=unknown(0),
        refid=str=0001.0A090202.59F3F7F4.0024,ss=1,re=0.000,recu=0.000,reip=0.000,cl=1,cld=1,fgs=0,
        ip=0.0.0.0,
        so=2014-11-16 11:51:01,
        dmn=2013-03-21 17:37:32
X-Mirapoint-Loop-Id: 8940fd29eb12ee3fc8309df65ab20541
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Hi ted,

On 2017/10/26 23:04, Theodore Ts'o wrote:
> On Thu, Oct 26, 2017 at 04:25:15PM +0800, Chen Feng wrote:
>>
>>
>> On 2017/10/25 16:49, Theodore Ts'o wrote:
>>> Other people who have sent me fuzzer test reproducers are able to
>>> reproduce syzkaller logs into a simple C program.  Can you explain to
>>> me what the heck:
>>>
>>>> r3 = syz_open_dev$urandom(&(0x7f000000a000)="2f6465762f7572616e646f6d00", 0x0, 0x0)
>>>
>>> means?
>>
>> Take a look at this:
>>
>> https://github.com/google/syzkaller/blob/master/sys/linux/random.txt
> 
> Sorry, this *still* looks like gobbledygook.
> 
> What ioctls are you executing, and with what arguments?
> 
> *Please*, give me a C program I can compile.

I checked the ioctl. What's the purpose of RNDADDTOENTCNT ioctl to userspace?

We need to checked the user-input at credit_entropy_bits_safe.

+	if (INT_MAX - nbits < r->entropy_total)
+		return -EINVAL;
+


The test-code below:

void *random_ioctl_test(void *args)
{
	int fd = -1;
	int ret = -1;
	int test_arg = 0x7fffffff;

	fd = open("dev/urandom", 0x0, 0x0);
	if (fd < 0) {
		printf("open dev/urandom failed!\n");
		return NULL;
	}

	ret = ioctl(fd, 0x40045201, &test_arg);

	printf("random_ioctl ret=%d\n", ret);
	close(fd);
	return NULL;
}

int main(int argc, char *argv[])
{
	int ret, i;
	pthread_t thread[100];

	for (i = 0; i < 100; i++) {
		ret = pthread_create(&thread[i], NULL, random_ioctl_test, &i);
		if (ret) {
			printf("create thread %d fail with ret=%d\n", i, ret);
			return -1;
		}
	}

	for (i = 0; i < 100; i++) {
		pthread_join(thread[i], NULL);
	}
	return 0;
}


> 
> 					 -Ted
> 
> .
>