netdev.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Aleksandr Nogikh <a.nogikh@gmail.com>
To: davem@davemloft.net, kuba@kernel.org, johannes@sipsolutions.net
Cc: edumazet@google.com, andreyknvl@google.com, dvyukov@google.com,
	elver@google.com, linux-kernel@vger.kernel.org,
	netdev@vger.kernel.org, linux-wireless@vger.kernel.org,
	nogikh@google.com
Subject: [PATCH 1/2] net: store KCOV remote handle in sk_buff
Date: Wed,  7 Oct 2020 10:17:25 +0000	[thread overview]
Message-ID: <20201007101726.3149375-2-a.nogikh@gmail.com> (raw)
In-Reply-To: <20201007101726.3149375-1-a.nogikh@gmail.com>

From: Aleksandr Nogikh <nogikh@google.com>

Remote KCOV coverage collection enables coverage-guided fuzzing of the
code that is not reachable during normal system call execution. It is
especially helpful for fuzzing networking subsystems, where it is
common to perform packet handling in separate work queues even for the
packets that originated directly from the user space.

Enable coverage-guided frame injection by adding a kcov_handle
parameter to sk_buff structure. Initialization in __alloc_skb ensures
that no socket buffer that was generated during a system call will be
missed.

Code that is of interest and that performs packet processing should be
annotated with kcov_remote_start()/kcov_remote_stop().

An alternative approach is to determine kcov_handle solely on the
basis of the device/interface that received the specific socket
buffer. However, in this case it would be impossible to distinguish
between packets that originated from normal background network
processes and those that were intentionally injected from the user
space.

Signed-off-by: Aleksandr Nogikh <nogikh@google.com>
---
 include/linux/skbuff.h | 21 +++++++++++++++++++++
 net/core/skbuff.c      |  1 +
 2 files changed, 22 insertions(+)

diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index a828cf99c521..5639f27e05ef 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -701,6 +701,7 @@ typedef unsigned char *sk_buff_data_t;
  *	@transport_header: Transport layer header
  *	@network_header: Network layer header
  *	@mac_header: Link layer header
+ *	@kcov_handle: KCOV remote handle for remote coverage collection
  *	@tail: Tail pointer
  *	@end: End pointer
  *	@head: Head of buffer
@@ -904,6 +905,10 @@ struct sk_buff {
 	__u16			network_header;
 	__u16			mac_header;
 
+#ifdef CONFIG_KCOV
+	u64			kcov_handle;
+#endif
+
 	/* private: */
 	__u32			headers_end[0];
 	/* public: */
@@ -4605,5 +4610,21 @@ static inline void skb_reset_redirect(struct sk_buff *skb)
 #endif
 }
 
+static inline void skb_set_kcov_handle(struct sk_buff *skb, const u64 kcov_handle)
+{
+#ifdef CONFIG_KCOV
+	skb->kcov_handle = kcov_handle;
+#endif
+}
+
+static inline u64 skb_get_kcov_handle(struct sk_buff *skb)
+{
+#ifdef CONFIG_KCOV
+	return skb->kcov_handle;
+#else
+	return 0;
+#endif
+}
+
 #endif	/* __KERNEL__ */
 #endif	/* _LINUX_SKBUFF_H */
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index f67631faa9aa..e7acd7d45b03 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -233,6 +233,7 @@ struct sk_buff *__alloc_skb(unsigned int size, gfp_t gfp_mask,
 	skb->end = skb->tail + size;
 	skb->mac_header = (typeof(skb->mac_header))~0U;
 	skb->transport_header = (typeof(skb->transport_header))~0U;
+	skb_set_kcov_handle(skb, kcov_common_handle());
 
 	/* make sure we initialize shinfo sequentially */
 	shinfo = skb_shinfo(skb);
-- 
2.28.0.806.g8561365e88-goog


  reply	other threads:[~2020-10-07 10:18 UTC|newest]

Thread overview: 15+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-10-07 10:17 [PATCH 0/2] net, mac80211: enable KCOV remote coverage collection for 802.11 frame handling Aleksandr Nogikh
2020-10-07 10:17 ` Aleksandr Nogikh [this message]
2020-10-09 23:15   ` [PATCH 1/2] net: store KCOV remote handle in sk_buff Jakub Kicinski
2020-10-10  7:54     ` Dmitry Vyukov
2020-10-10 15:14       ` Jakub Kicinski
2020-10-12  6:04         ` Dmitry Vyukov
2020-10-13 15:59           ` Aleksandr Nogikh
2020-10-13 16:50             ` Jakub Kicinski
2020-10-15 19:04               ` Willem de Bruijn
2020-10-16 14:20                 ` Aleksandr Nogikh
2020-10-12  7:12   ` Johannes Berg
2020-10-12 10:10     ` Aleksandr Nogikh
2020-10-07 10:17 ` [PATCH 2/2] mac80211: add KCOV remote annotations to incoming frame processing Aleksandr Nogikh
2020-10-07 11:48 ` [PATCH 0/2] net, mac80211: enable KCOV remote coverage collection for 802.11 frame handling Johannes Berg
2020-10-07 14:40   ` Aleksandr Nogikh

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20201007101726.3149375-2-a.nogikh@gmail.com \
    --to=a.nogikh@gmail.com \
    --cc=andreyknvl@google.com \
    --cc=davem@davemloft.net \
    --cc=dvyukov@google.com \
    --cc=edumazet@google.com \
    --cc=elver@google.com \
    --cc=johannes@sipsolutions.net \
    --cc=kuba@kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-wireless@vger.kernel.org \
    --cc=netdev@vger.kernel.org \
    --cc=nogikh@google.com \
    --subject='Re: [PATCH 1/2] net: store KCOV remote handle in sk_buff' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
on how to clone and mirror all data and code used for this inbox