mbox series

[0/2] net, mac80211: enable KCOV remote coverage collection for 802.11 frame handling

Message ID 20201007101726.3149375-1-a.nogikh@gmail.com
Headers show
Series net, mac80211: enable KCOV remote coverage collection for 802.11 frame handling | expand

Message

Aleksandr Nogikh Oct. 7, 2020, 10:17 a.m. UTC
From: Aleksandr Nogikh <nogikh@google.com>

This patch series enables remote KCOV coverage collection for the
mac80211 code that processes incoming 802.11 frames. These changes
make it possible to perform coverage-guided fuzzing in search of
remotely triggerable bugs.


The series consists of two commits.
1. Remember kcov_handle for each sk_buff. This can later be used to
enable remote coverage for other network subsystems.
2. Annotate the code that processes incoming 802.11 frames.

Aleksandr Nogikh (2):
  net: store KCOV remote handle in sk_buff
  mac80211: add KCOV remote annotations to incoming frame processing

 include/linux/skbuff.h | 21 +++++++++++++++++++++
 net/core/skbuff.c      |  1 +
 net/mac80211/iface.c   |  2 ++
 net/mac80211/main.c    |  2 ++
 4 files changed, 26 insertions(+)


base-commit: a804ab086e9de200e2e70600996db7fc14c91959

Comments

Johannes Berg Oct. 7, 2020, 11:48 a.m. UTC | #1
On Wed, 2020-10-07 at 10:17 +0000, Aleksandr Nogikh wrote:
> From: Aleksandr Nogikh <nogikh@google.com>
> 
> This patch series enables remote KCOV coverage collection for the
> mac80211 code that processes incoming 802.11 frames. These changes
> make it possible to perform coverage-guided fuzzing in search of
> remotely triggerable bugs.
> 
> 
> The series consists of two commits.
> 1. Remember kcov_handle for each sk_buff. This can later be used to
> enable remote coverage for other network subsystems.
> 2. Annotate the code that processes incoming 802.11 frames.
> 
> Aleksandr Nogikh (2):
>   net: store KCOV remote handle in sk_buff

Can you explain that a bit better? What is a "remote handle"? What does
it do in the SKB?

I guess I'd have to know more about "kcov_common_handle()" to understand
this bit.

>   mac80211: add KCOV remote annotations to incoming frame processing

This seems fine, but a bit too limited? You tagged
only ieee80211_tasklet_handler() which calls ieee80211_rx()
or ieee80211_tx_status(), but

1) I'm not even sure ieee80211_tx_status() counts (it's processing
locally generated frames after they round-tripped into the driver
(although in mesh it could be remote originated but retransmitted
frames, so I guess it makes some sense?); and

2) there are many other ways that ieee80211_rx() could get called.

It seems to me it'd make more sense to (also) annotate ieee80211_rx()
itself?

johannes