From: Aleksandr Nogikh <[email protected]>
This patch series enables remote KCOV coverage collection during 802.11
frames processing. These changes make it possible to perform
coverage-guided fuzzing in search of remotely triggerable bugs.
Normally, KCOV collects coverage information for the code that is
executed inside the system call context. It is easy to identify where
that coverage should go and whether it should be collected at all by
looking at the current process. If KCOV was enabled on that process,
coverage will be stored in a buffer specific to that process.
Howerever, it is not always enough as handling can happen elsewhere
(e.g. in separate kernel threads).
When it is impossible to infer KCOV-related info just by looking at the
currently running process, one needs to manually pass some information
to the code that should be instrumented. The information takes the form
of 64 bit integers (KCOV remote handles). Zero is the special value that
corresponds to an empty handle. More details on KCOV and remote coverage
collection can be found in Documentation/dev-tools/kcov.rst.
The series consists of three patches:
1. Apply a minor fix to kcov_common_handle() so that it returns a valid
handle (zero) when called in an interrupt context.
2. Take the remote handle from KCOV and attach it to newly allocated
SKBs. If the allocation happens inside a system call context, the SKB
will be tied to the process that issued the syscall (if that process
is interested in remote coverage collection).
3. Annotate the code that processes incoming 802.11 frames with
kcov_remote_start()/kcov_remote_stop().
v6:
* Revert usage of skb extensions due to potential memory leak. Patch 2/3 is now
idential to that in v2.
* Patches 1/3 and 3/3 are otherwise identical to v5.
v5: https://lore.kernel.org/linux-wireless/[email protected]/
* Collecting remote coverate at ieee80211_rx_list() instead of
ieee80211_rx()
v4: https://lkml.kernel.org/r/[email protected]
* CONFIG_SKB_EXTENSIONS is now automatically selected by CONFIG_KCOV.
* Elaborated on a minor optimization in skb_set_kcov_handle().
v3: https://lkml.kernel.org/r/[email protected]
* kcov_handle is now stored in skb extensions instead of sk_buff
itself.
* Updated the cover letter.
v2: https://lkml.kernel.org/r/[email protected]
* Moved KCOV annotations from ieee80211_tasklet_handler to
ieee80211_rx.
* Updated kcov_common_handle() to return 0 if it is called in
interrupt context.
v1: https://lkml.kernel.org/r/[email protected]
Aleksandr Nogikh (3):
kernel: make kcov_common_handle consider the current context
net: store KCOV remote handle in sk_buff
mac80211: add KCOV remote annotations to incoming frame processing
include/linux/skbuff.h | 21 +++++++++++++++++++++
kernel/kcov.c | 2 ++
net/core/skbuff.c | 1 +
net/mac80211/iface.c | 2 ++
net/mac80211/rx.c | 16 +++++++++-------
5 files changed, 35 insertions(+), 7 deletions(-)
--
2.29.2.454.gaff20da3a2-goog
From: Aleksandr Nogikh <[email protected]>
Remote KCOV coverage collection enables coverage-guided fuzzing of the
code that is not reachable during normal system call execution. It is
especially helpful for fuzzing networking subsystems, where it is
common to perform packet handling in separate work queues even for the
packets that originated directly from the user space. More details can
be found in Documentation/dev-tools/kcov.rst.
Enable coverage-guided frame injection by adding a kcov_handle
parameter to sk_buff structure. Initializate this field in __alloc_skb
to kcov_common_handle() so that no socket buffer that was generated
during a system call is missed. For sk_buffs that were allocated in an
interrupt context, kcov_handle will be initialized to 0.
Code that is of interest and that performs packet processing should be
annotated with kcov_remote_start()/kcov_remote_stop().
An alternative approach is to determine kcov_handle solely on the
basis of the device/interface that received the specific socket
buffer. However, in this case it would be impossible to distinguish
between packets that originated from normal background network
processes and those that were intentionally injected from the user
space.
Signed-off-by: Aleksandr Nogikh <[email protected]>
Signed-off-by: Marco Elver <[email protected]>
---
v6:
* Revert usage of skb extensions in favour of directly storing the
kcov_handle in in sk_buff. skb extensions were leading to a memory
leak as reported by Ido Schimmel:
https://lore.kernel.org/linux-wireless/[email protected]/
---
include/linux/skbuff.h | 21 +++++++++++++++++++++
net/core/skbuff.c | 1 +
2 files changed, 22 insertions(+)
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index a828cf99c521..5639f27e05ef 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -701,6 +701,7 @@ typedef unsigned char *sk_buff_data_t;
* @transport_header: Transport layer header
* @network_header: Network layer header
* @mac_header: Link layer header
+ * @kcov_handle: KCOV remote handle for remote coverage collection
* @tail: Tail pointer
* @end: End pointer
* @head: Head of buffer
@@ -904,6 +905,10 @@ struct sk_buff {
__u16 network_header;
__u16 mac_header;
+#ifdef CONFIG_KCOV
+ u64 kcov_handle;
+#endif
+
/* private: */
__u32 headers_end[0];
/* public: */
@@ -4605,5 +4610,21 @@ static inline void skb_reset_redirect(struct sk_buff *skb)
#endif
}
+static inline void skb_set_kcov_handle(struct sk_buff *skb, const u64 kcov_handle)
+{
+#ifdef CONFIG_KCOV
+ skb->kcov_handle = kcov_handle;
+#endif
+}
+
+static inline u64 skb_get_kcov_handle(struct sk_buff *skb)
+{
+#ifdef CONFIG_KCOV
+ return skb->kcov_handle;
+#else
+ return 0;
+#endif
+}
+
#endif /* __KERNEL__ */
#endif /* _LINUX_SKBUFF_H */
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 1ba8f0163744..2f27635c3e97 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -233,6 +233,7 @@ struct sk_buff *__alloc_skb(unsigned int size, gfp_t gfp_mask,
skb->end = skb->tail + size;
skb->mac_header = (typeof(skb->mac_header))~0U;
skb->transport_header = (typeof(skb->transport_header))~0U;
+ skb_set_kcov_handle(skb, kcov_common_handle());
/* make sure we initialize shinfo sequentially */
shinfo = skb_shinfo(skb);
--
2.29.2.454.gaff20da3a2-goog