Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
MIME-Version: 1.0
References: <CACT4Y+ZE1XhYpTsjP1J1PyUsEHYKvchww71aHb7UnSk5=4xUrw@mail.gmail.com>
 <04E78431-7B62-4FA1-8B1D-51DF7648D9C5@lca.pw>
In-Reply-To: <04E78431-7B62-4FA1-8B1D-51DF7648D9C5@lca.pw>
From:   Dmitry Vyukov <dvyukov@google.com>
Date:   Tue, 14 Apr 2020 14:05:21 +0200
Message-ID: <CACT4Y+YE6N8MUL-hVps6+BxVoQ0Xi_4AS26j8e+tv=_L2vKuYA@mail.gmail.com>
Subject: Re: [PATCH 0/2] mm: Two small fixes for recent syzbot reports
To:     Qian Cai <cai@lca.pw>
Cc:     Linus Torvalds <torvalds@linux-foundation.org>,
        Stephen Rothwell <sfr@canb.auug.org.au>,
        Andrew Morton <akpm@linux-foundation.org>,
        Peter Xu <peterx@redhat.com>,
        LKML <linux-kernel@vger.kernel.org>,
        Linux-MM <linux-mm@kvack.org>, Jens Axboe <axboe@kernel.dk>,
        Christoph Lameter <cl@linux.com>,
        Johannes Weiner <hannes@cmpxchg.org>,
        syzkaller <syzkaller@googlegroups.com>,
        Dan Rue <dan.rue@linaro.org>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On Tue, Apr 14, 2020 at 1:59 PM Qian Cai <cai@lca.pw> wrote:
> > On Apr 14, 2020, at 7:13 AM, Dmitry Vyukov <dvyukov@google.com> wrote:
> >
> > How do these use-after-free's and locking bugs get past the
> > unit-testing systems (which syzbot is not) and remain unnoticed for so
> > long?...
> > syzbot uses the dumbest VMs (GCE), so everything it triggers during
> > boot should be triggerable pretty much everywhere.
>
> There are many reasons that any early testing would not be able to catch =
ALL the syzbot blockers.
>
> The Kconfigs are different. For example, I don=E2=80=99t have openvswitch=
 enabled, so would miss that ovs rcu-list lockdep warning. Same for that us=
e-after-free in net/bluetooth and a warning in sound subsystem.
>
> But, notifying Linux-next ML is a good start, so at least we could ask Pa=
ul or Steve to pull out the commit which enabling rcu-list debugging by def=
ault with PROVE_RCU.
>
> I learned through that restricted kconfig to some degree of minimal could=
 save a lot of troubles late on especially those options that I have no way=
 to exercise like net/bluetooth and sound currently. It is going to be extr=
a works though because those default options in Linux-next or even defconfi=
gs are not always pleasant and would want to enable something I don=E2=80=
=99t need if not given human intervention.

We only try to enable what we can reach. There is significant reach
for sound and net/bluetooth even without any hardware. So I would
assume generic testing systems like KernelCI, LKFT, CKI should enable
these as well. Hopefully we don't have all of the sound and
net/bluetooth completely untested in linux-next.