From patchwork Wed Oct 7 10:17:25 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Aleksandr Nogikh X-Patchwork-Id: 287952 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.6 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 86605C4363C for ; Wed, 7 Oct 2020 10:18:19 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 35E8220782 for ; Wed, 7 Oct 2020 10:18:19 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="UPwpJB6X" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728020AbgJGKSE (ORCPT ); Wed, 7 Oct 2020 06:18:04 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49242 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727973AbgJGKR7 (ORCPT ); Wed, 7 Oct 2020 06:17:59 -0400 Received: from mail-wr1-x443.google.com (mail-wr1-x443.google.com [IPv6:2a00:1450:4864:20::443]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5B714C061755; Wed, 7 Oct 2020 03:17:58 -0700 (PDT) Received: by mail-wr1-x443.google.com with SMTP id n6so1198256wrm.13; Wed, 07 Oct 2020 03:17:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=ZnoEU+XnxcTdbsZWvSC6xxdTYFozxJsTcCIM0ht4gOc=; b=UPwpJB6Xrb/lRL+4XumO6Cd7zTUZucpNOQtXKr+bnDtg/+zEJSaHM0P4SZXzDzlpnd RKaTKZOYBbG/H19MHorGTcThuduVyL+yoSS6Oo1jTfLKZ5J0HYfopqraOFK/Aex50Z1D RQvQ52JUshOwtGzM16Iy+6I9JaUpHvyO9zmXN+CKKQ73Mq92GXfVvXjH1+Z7Yxq6DLr9 Mkj4z4XZ5SBuT1FVpZWJik2WrEdSTA4/RNdw361J7vJ2IVrocDH806zHcVFuLvxc3QCD J1cJEuHUkgBkgOx1Dpym4Vp2cUpdRfinuU3672sI8fTm1J21cdnlZ0t4cbEYvN7Syw+n MBmQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=ZnoEU+XnxcTdbsZWvSC6xxdTYFozxJsTcCIM0ht4gOc=; b=a7RirAZBh5+AJRsicTa8kDYDpeFdei838hd2B8uYPhDtu1DDV1wvD6UALdM8bE6fT5 ayPT7M+pD5QZ/EhzLplOkjovn4xas1J6F32QUOIcGoEn+XH0k9VloD259WnxRGLxMB9/ fEqg7KKtG6OCPE6J8Yx312igKzP4KoUFPy+3ZK3YCNB6LfR2l+XG+zgfi5R/osU8590H YoZ4rRRLoA8/b45xgTiMj3hwe3LhmzgrGF0nHdlyctiLuahsZy6/kGYXMlFSO8lw+6+J sXPJzrLxfSPiPLshpD6IEsZtBFSlMZ0nx5EULuwNIOwn1wI0WpS1S8RC+DcVfpUlp+fA GArQ== X-Gm-Message-State: AOAM532Y7Hejo2CYpUHXQb4mgqDmiBKBt14cD4N1nfwIEAPGxp2zQ7Cx HJhTS2xB8K1DJcG6moB/LZg= X-Google-Smtp-Source: ABdhPJyYx+CDMq3a+Cdff8hs5IPV3mVv8/gKgVjSK1WkVzZ8olHrdSua4z7Ho5CPdpsmZamqzP2Dxw== X-Received: by 2002:a05:6000:1633:: with SMTP id v19mr812389wrb.147.1602065877045; Wed, 07 Oct 2020 03:17:57 -0700 (PDT) Received: from nogikh.c.googlers.com.com (88.140.78.34.bc.googleusercontent.com. [34.78.140.88]) by smtp.gmail.com with ESMTPSA id u12sm2249168wrt.81.2020.10.07.03.17.56 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 07 Oct 2020 03:17:56 -0700 (PDT) From: Aleksandr Nogikh To: davem@davemloft.net, kuba@kernel.org, johannes@sipsolutions.net Cc: edumazet@google.com, andreyknvl@google.com, dvyukov@google.com, elver@google.com, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, linux-wireless@vger.kernel.org, nogikh@google.com Subject: [PATCH 1/2] net: store KCOV remote handle in sk_buff Date: Wed, 7 Oct 2020 10:17:25 +0000 Message-Id: <20201007101726.3149375-2-a.nogikh@gmail.com> X-Mailer: git-send-email 2.28.0.806.g8561365e88-goog In-Reply-To: <20201007101726.3149375-1-a.nogikh@gmail.com> References: <20201007101726.3149375-1-a.nogikh@gmail.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org From: Aleksandr Nogikh Remote KCOV coverage collection enables coverage-guided fuzzing of the code that is not reachable during normal system call execution. It is especially helpful for fuzzing networking subsystems, where it is common to perform packet handling in separate work queues even for the packets that originated directly from the user space. Enable coverage-guided frame injection by adding a kcov_handle parameter to sk_buff structure. Initialization in __alloc_skb ensures that no socket buffer that was generated during a system call will be missed. Code that is of interest and that performs packet processing should be annotated with kcov_remote_start()/kcov_remote_stop(). An alternative approach is to determine kcov_handle solely on the basis of the device/interface that received the specific socket buffer. However, in this case it would be impossible to distinguish between packets that originated from normal background network processes and those that were intentionally injected from the user space. Signed-off-by: Aleksandr Nogikh --- include/linux/skbuff.h | 21 +++++++++++++++++++++ net/core/skbuff.c | 1 + 2 files changed, 22 insertions(+) diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h index a828cf99c521..5639f27e05ef 100644 --- a/include/linux/skbuff.h +++ b/include/linux/skbuff.h @@ -701,6 +701,7 @@ typedef unsigned char *sk_buff_data_t; * @transport_header: Transport layer header * @network_header: Network layer header * @mac_header: Link layer header + * @kcov_handle: KCOV remote handle for remote coverage collection * @tail: Tail pointer * @end: End pointer * @head: Head of buffer @@ -904,6 +905,10 @@ struct sk_buff { __u16 network_header; __u16 mac_header; +#ifdef CONFIG_KCOV + u64 kcov_handle; +#endif + /* private: */ __u32 headers_end[0]; /* public: */ @@ -4605,5 +4610,21 @@ static inline void skb_reset_redirect(struct sk_buff *skb) #endif } +static inline void skb_set_kcov_handle(struct sk_buff *skb, const u64 kcov_handle) +{ +#ifdef CONFIG_KCOV + skb->kcov_handle = kcov_handle; +#endif +} + +static inline u64 skb_get_kcov_handle(struct sk_buff *skb) +{ +#ifdef CONFIG_KCOV + return skb->kcov_handle; +#else + return 0; +#endif +} + #endif /* __KERNEL__ */ #endif /* _LINUX_SKBUFF_H */ diff --git a/net/core/skbuff.c b/net/core/skbuff.c index f67631faa9aa..e7acd7d45b03 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -233,6 +233,7 @@ struct sk_buff *__alloc_skb(unsigned int size, gfp_t gfp_mask, skb->end = skb->tail + size; skb->mac_header = (typeof(skb->mac_header))~0U; skb->transport_header = (typeof(skb->transport_header))~0U; + skb_set_kcov_handle(skb, kcov_common_handle()); /* make sure we initialize shinfo sequentially */ shinfo = skb_shinfo(skb); From patchwork Wed Oct 7 10:17:26 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Aleksandr Nogikh X-Patchwork-Id: 268437 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.6 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 832B7C4363C for ; Wed, 7 Oct 2020 10:18:06 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 27C4620870 for ; Wed, 7 Oct 2020 10:18:06 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="YAyNSKmr" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728038AbgJGKSF (ORCPT ); Wed, 7 Oct 2020 06:18:05 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49250 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728013AbgJGKSA (ORCPT ); Wed, 7 Oct 2020 06:18:00 -0400 Received: from mail-wr1-x441.google.com (mail-wr1-x441.google.com [IPv6:2a00:1450:4864:20::441]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id F194FC0613D2; Wed, 7 Oct 2020 03:17:59 -0700 (PDT) Received: by mail-wr1-x441.google.com with SMTP id k10so1494313wru.6; Wed, 07 Oct 2020 03:17:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=PrZHgoHwx+8u1/cy9dkjn6c9rWW6kI8dskt+mlUcuL4=; b=YAyNSKmrlZECEsQsYfztmczdbHiXVB5bsPiFmxOFIAET6TjdLpos+HyIAD4Kv2cRe8 IWVu0sRjgw1Js4O0XN/Vq0FUIEkmWomBagBwjpNtm2UU/sCNyGdsQfVv4H5+Gq+/ZnsL oyS6P20zqcuK8B0XUgB4rv9/1BLgV18WC8KbzUSd4gdomsM4SGJ2JyC31B9N8Ye4Gbvd 0tqf5FwqTYqVeGQchpY/FdITDu4FZxEeIgxGRqLc/9qPMpIUi4Yng7mv4Zjb73cQrFGD 3b0Bcd/SGDCuDII31KeENjDHLHwxHp1rlULWnhzJvbVRJfifaX0iv0By9uTg+aNF1jMo YNyQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=PrZHgoHwx+8u1/cy9dkjn6c9rWW6kI8dskt+mlUcuL4=; b=QwmOuf9GdD3g5aHKalneWnAvmH8xEylGJldrwNaD9vCWpyrqSQD59HmRUZjKfPAigq 1UNXxAVKZdHUFINNBoEUFEgYjMNnVHSZAFGY7DiN4+ZDzgDCAMCVC0wStyZ5Rep5UD+P v1074mhpryK95uVOeHYivjYhk5iLRxQYeh8J1IG1scYmZwVsRtFawybVBbYFakGFBtbr OTEaAgp6CLRC+CQsO+8oe7UjJWb7t0njPLIxzgaseT2QabBkcXZg9kuI3QhFxWg/WRAT 0+YWz2rbx58fpU3trF9uXBCQVdJmWlUkCnNZHnSUeZEcHzL6xmomdKrcWMPnj60c5Uy4 eokA== X-Gm-Message-State: AOAM532O1ugc06wKUMHpMt2cmPEQ5D48VcMD5DiR+l5J0EAVjC4lJgxR 0CdeVSGlOF+1loW1YDVFDaPFTTByrcU4Rdpj X-Google-Smtp-Source: ABdhPJxQJLHjvhwq4UaVCUsIgyqBcpYW8JqyymbOZ+t6Ge87O3Ej71NY2tzRxuf6sYSJePvKpM4cjg== X-Received: by 2002:adf:f508:: with SMTP id q8mr2546894wro.233.1602065878650; Wed, 07 Oct 2020 03:17:58 -0700 (PDT) Received: from nogikh.c.googlers.com.com (88.140.78.34.bc.googleusercontent.com. [34.78.140.88]) by smtp.gmail.com with ESMTPSA id u12sm2249168wrt.81.2020.10.07.03.17.57 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 07 Oct 2020 03:17:58 -0700 (PDT) From: Aleksandr Nogikh To: davem@davemloft.net, kuba@kernel.org, johannes@sipsolutions.net Cc: edumazet@google.com, andreyknvl@google.com, dvyukov@google.com, elver@google.com, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, linux-wireless@vger.kernel.org, nogikh@google.com Subject: [PATCH 2/2] mac80211: add KCOV remote annotations to incoming frame processing Date: Wed, 7 Oct 2020 10:17:26 +0000 Message-Id: <20201007101726.3149375-3-a.nogikh@gmail.com> X-Mailer: git-send-email 2.28.0.806.g8561365e88-goog In-Reply-To: <20201007101726.3149375-1-a.nogikh@gmail.com> References: <20201007101726.3149375-1-a.nogikh@gmail.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org From: Aleksandr Nogikh Add KCOV remote annotations to ieee80211_iface_work and ieee80211_tasklet_handler. This will enable coverage-guided fuzzing of mac80211 code that processes incoming 802.11 frames. Signed-off-by: Aleksandr Nogikh --- net/mac80211/iface.c | 2 ++ net/mac80211/main.c | 2 ++ 2 files changed, 4 insertions(+) diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c index 240862a74a0f..482d2ae46e71 100644 --- a/net/mac80211/iface.c +++ b/net/mac80211/iface.c @@ -1377,6 +1377,7 @@ static void ieee80211_iface_work(struct work_struct *work) while ((skb = skb_dequeue(&sdata->skb_queue))) { struct ieee80211_mgmt *mgmt = (void *)skb->data; + kcov_remote_start_common(skb_get_kcov_handle(skb)); if (ieee80211_is_action(mgmt->frame_control) && mgmt->u.action.category == WLAN_CATEGORY_BACK) { int len = skb->len; @@ -1486,6 +1487,7 @@ static void ieee80211_iface_work(struct work_struct *work) } kfree_skb(skb); + kcov_remote_stop(); } /* then other type-dependent work */ diff --git a/net/mac80211/main.c b/net/mac80211/main.c index 523380aed92e..d7eebafc14e0 100644 --- a/net/mac80211/main.c +++ b/net/mac80211/main.c @@ -227,6 +227,7 @@ static void ieee80211_tasklet_handler(unsigned long data) while ((skb = skb_dequeue(&local->skb_queue)) || (skb = skb_dequeue(&local->skb_queue_unreliable))) { + kcov_remote_start_common(skb_get_kcov_handle(skb)); switch (skb->pkt_type) { case IEEE80211_RX_MSG: /* Clear skb->pkt_type in order to not confuse kernel @@ -244,6 +245,7 @@ static void ieee80211_tasklet_handler(unsigned long data) dev_kfree_skb(skb); break; } + kcov_remote_stop(); } }