[PATCH] kcov: add AFL-style tracing

* [PATCH] kcov: add AFL-style tracing
@ 2016-05-21 16:07 Vegard Nossum
  2016-05-29 16:51 ` Dmitry Vyukov
  0 siblings, 1 reply; 8+ messages in thread
From: Vegard Nossum @ 2016-05-21 16:07 UTC (permalink / raw)
  To: Dmitry Vyukov
  Cc: syzkaller, linux-kernel, Quentin Casasnovas, Michal Zalewski,
	Kees Cook, Vegard Nossum

From: Quentin Casasnovas <quentin.casasnovas@oracle.com>

AFL uses a fixed-size buffer (typically 64 KiB) where each byte is
a counter representing how many times an A -> B branch was taken.
Of course, since the buffer is fixed size, it's a little imprecise
in that e.g. two different branches could map to the same counter,
but in practice it works well.

See afl:docs/technical_details.txt for more information.

Here is a small test program that demonstrates the new capability:

	#include <sys/ioctl.h>
	#include <sys/mman.h>
	#include <sys/types.h>

	#include <errno.h>
	#include <error.h>
	#include <fcntl.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <unistd.h>

	#include <linux/types.h>

	#define KCOV_INIT_TRACE                 _IOR('c', 1, unsigned long)
	#define KCOV_INIT_AFL                   _IOR('c', 2, unsigned long)
	#define KCOV_ENABLE                     _IO('c', 100)
	#define KCOV_DISABLE                    _IO('c', 101)

	int main(int argc, char *argv[])
	{
		int fd = open("/sys/kernel/debug/kcov", O_RDWR);
		if (fd == -1)
			error(1, errno, "open()");

		unsigned long size = 1 << 10;
		if (ioctl(fd, KCOV_INIT_AFL, size) != 0)
			error(1, errno, "ioctl(KCOV_INIT_AFL)");

		void *mem = mmap(NULL, size * sizeof(long), PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0);
		if (mem == MAP_FAILED)
			error(1, errno, "mmap()");

		/* Start kernel instrumentation */
		if (ioctl(fd, KCOV_ENABLE, 0) != 0)
			error(1, errno, "ioctl(KCOV_ENABLE)");

		printf("Hello world!\n");

		/* End kernel instrumentation*/
		if (ioctl(fd, KCOV_DISABLE, 0) != 0)
			error(1, errno, "ioctl(KCOV_DISABLE)");

		/* Hex dump of memory area */
		unsigned char *mem2 = mem;
		for (unsigned int i = 0; i < size; ++i) {
			printf("%02x ", mem2[i]);
			if (i % 32 == 31)
				printf("\n");
		}

		close(fd);
		return 0;
	}

This patch is a collaboration between Quentin Casasnovas and Vegard Nossum.

Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Michal Zalewski <lcamtuf@gmail.com>
Cc: Kees Cook <keescook@chromium.org>
Signed-off-by: Quentin Casasnovas <quentin.casasnovas@oracle.com>
Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com>
---
 include/linux/kcov.h      |  6 ++++++
 include/uapi/linux/kcov.h |  1 +
 kernel/kcov.c             | 44 ++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 51 insertions(+)

diff --git a/include/linux/kcov.h b/include/linux/kcov.h
index 2883ac9..cb8eb3e 100644
--- a/include/linux/kcov.h
+++ b/include/linux/kcov.h
@@ -18,6 +18,12 @@ enum kcov_mode {
 	 * Covered PCs are collected in a per-task buffer.
 	 */
 	KCOV_MODE_TRACE = 1,
+	/*
+	 * AFL-style collection.
+	 * Covered branches are hashed and collected in a fixed size buffer
+	 * (see AFL documentation for more information).
+	 */
+	KCOV_MODE_AFL = 2,
 };
 
 #else
diff --git a/include/uapi/linux/kcov.h b/include/uapi/linux/kcov.h
index 574e22e..0dc1cf9 100644
--- a/include/uapi/linux/kcov.h
+++ b/include/uapi/linux/kcov.h
@@ -4,6 +4,7 @@
 #include <linux/types.h>
 
 #define KCOV_INIT_TRACE			_IOR('c', 1, unsigned long)
+#define KCOV_INIT_AFL			_IOR('c', 2, unsigned long)
 #define KCOV_ENABLE			_IO('c', 100)
 #define KCOV_DISABLE			_IO('c', 101)
 
diff --git a/kernel/kcov.c b/kernel/kcov.c
index a02f2dd..e6eb785 100644
--- a/kernel/kcov.c
+++ b/kernel/kcov.c
@@ -5,6 +5,7 @@
 #include <linux/types.h>
 #include <linux/file.h>
 #include <linux/fs.h>
+#include <linux/hash.h>
 #include <linux/mm.h>
 #include <linux/printk.h>
 #include <linux/slab.h>
@@ -34,6 +35,19 @@ struct kcov {
 	enum kcov_mode		mode;
 	/* Size of arena (in long's for KCOV_MODE_TRACE). */
 	unsigned		size;
+
+	union {
+		/* For KCOV_MODE_AFL */
+		struct {
+			/* (number of bytes) - 1, where number of
+			 * bytes must be a power of 2. */
+			unsigned int		mask;
+
+			/* Previous PC (for KCOV_MODE_AFL). */
+			unsigned int		prev_location;
+		};
+	};
+
 	/* Coverage buffer shared with user space. */
 	void			*area;
 	/* Task for which we collect coverage, or NULL. */
@@ -76,6 +90,19 @@ void notrace __sanitizer_cov_trace_pc(void)
 			area[pos] = _RET_IP_;
 			WRITE_ONCE(area[0], pos);
 		}
+	} else if (mode == KCOV_MODE_AFL) {
+		struct kcov *kcov;
+		unsigned char *area;
+		unsigned long location = _RET_IP_;
+
+		/* See above */
+		barrier();
+
+		kcov = t->kcov;
+		area = kcov->area;
+
+		++area[(kcov->prev_location ^ location) & kcov->mask];
+		kcov->prev_location = hash_long(location, BITS_PER_LONG);
 	}
 }
 EXPORT_SYMBOL(__sanitizer_cov_trace_pc);
@@ -200,6 +227,23 @@ static int kcov_ioctl_locked(struct kcov *kcov, unsigned int cmd,
 		kcov->size = size;
 		kcov->mode = KCOV_MODE_TRACE;
 		return 0;
+	case KCOV_INIT_AFL:
+		if (kcov->mode != KCOV_MODE_DISABLED)
+			return -EBUSY;
+
+		/*
+		 * AFL mode needs a fixed-size area that is a power of 2.
+		 */
+		size = arg;
+		if (size < 2 || size > INT_MAX / sizeof(unsigned long))
+			return -EINVAL;
+		if (!is_power_of_2(size))
+			return -EINVAL;
+		kcov->size = size;
+		kcov->mask = (size * sizeof(unsigned long)) - 1;
+		kcov->prev_location = hash_long(0, BITS_PER_LONG);
+		kcov->mode = KCOV_MODE_AFL;
+		return 0;
 	case KCOV_ENABLE:
 		/*
 		 * Enable coverage for the current task.
-- 
1.9.1

^ permalink raw reply related	[flat|nested] 8+ messages in thread