On Fri, May 20, 2022 at 01:57:07PM +0200, Dmitry Vyukov wrote: > > Hi Ted, > > Reviving this old thread re syzkaller using SCHED_FIFO. > > It's a bit hard to restrict what the fuzzer can do if we give it > sched_setattr() and friends syscalls. We could remove them from the > fuzzer entirely, but it's probably suboptimal as well. > > I see that setting up SCHED_FIFO is guarded by CAP_SYS_NICE: > https://elixir.bootlin.com/linux/v5.18-rc7/source/kernel/sched/core.c#L7264 > > And I see we drop CAP_SYS_NICE from the fuzzer process since 2019 > (after a similar discussion): > https://github.com/google/syzkaller/commit/f3ad68446455a > > The latest C reproducer contains: .... For this particular report, there *was* no C reproducer. There was only a syz reproducer: > syzbot found the following issue on: > > HEAD commit: 5472f14a3742 Merge tag 'for_linus' of git://git.kernel.org.. > git tree: upstream > console output: https://syzkaller.appspot.com/x/log.txt?x=11132113b00000 > kernel config: https://syzkaller.appspot.com/x/.config?x=e3bdfd29b408d1b6 > dashboard link: https://syzkaller.appspot.com/bug?extid=9c3fb12e9128b6e1d7eb > compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14559113b00000 So let me ask a counter question. I thought syzbot tries to create a minimal reproducer? So if the sched_setattr is a no-op, and is returning EPERM, why wasn't the sched_setattr line removed from the syz repro? As a side note, since in many cases running a reproducer can be painful, would it be possible for the syzkiller dashboard to provide the output of running "strace -f" while the reproducer is running? That would also especially help since even when there is a C reproducer, trying to understand what it is doing from reading the syzbot-generated C source code is often non-trivial, and strace does a much better job decoding what the !@#?@ the reproducer. Another advantage of using strace is that it will also show us the return code from the system call, which would very quickly confirm whether the sched_setattr() was actually returning EPERM or not --- and it will decode the system call arguments in a way that I often wished would be included as comments in the syzbot-generated reproducer. Providing the strace output could significantly reduce the amount of upstream developer toil, and might therefore improve upstream developer engagement with syzkaller. Cheers, - Ted
