diff mbox series

[v2] Bluetooth: Collect kcov coverage from hci_rx_work

Message ID 20220714104814.1296858-1-poprdi@google.com (mailing list archive)
State Accepted
Commit b28a31ebc74fc72acbc9cb9d865c14000d420773
Headers show
Series [v2] Bluetooth: Collect kcov coverage from hci_rx_work | expand

Checks

Context Check Description
tedd_an/pre-ci_am success Success
tedd_an/checkpatch success Checkpatch PASS
tedd_an/gitlint fail [v2] Bluetooth: Collect kcov coverage from hci_rx_work 24: B1 Line exceeds max length (132>80): "Note: this is a resubmission of https://lore.kernel.org/netdev/CAPUC6bJbVMPn1FMLYnXg2GUX4ikesMSRjj=oPOOrS5H2DOx_bA@mail.gmail.com/T/"
tedd_an/subjectprefix success PASS
tedd_an/buildkernel success Build Kernel PASS
tedd_an/buildkernel32 success Build Kernel32 PASS
tedd_an/incremental_build success Pass
tedd_an/testrunnersetup success Test Runner Setup PASS
tedd_an/testrunnerl2cap-tester success Total: 40, Passed: 40 (100.0%), Failed: 0, Not Run: 0
tedd_an/testrunnerbnep-tester success Total: 1, Passed: 1 (100.0%), Failed: 0, Not Run: 0
tedd_an/testrunnermgmt-tester success Total: 494, Passed: 494 (100.0%), Failed: 0, Not Run: 0
tedd_an/testrunnerrfcomm-tester success Total: 10, Passed: 10 (100.0%), Failed: 0, Not Run: 0
tedd_an/testrunnersco-tester success Total: 12, Passed: 12 (100.0%), Failed: 0, Not Run: 0
tedd_an/testrunnersmp-tester success Total: 8, Passed: 8 (100.0%), Failed: 0, Not Run: 0
tedd_an/testrunneruserchan-tester success Total: 4, Passed: 4 (100.0%), Failed: 0, Not Run: 0

Commit Message

Tamas Koczka July 14, 2022, 10:48 a.m. UTC 
Annotate hci_rx_work() with kcov_remote_start() and kcov_remote_stop()
calls, so remote KCOV coverage is collected while processing the rx_q
queue which is the main incoming Bluetooth packet queue.

Coverage is associated with the thread which created the packet skb.

The collected extra coverage helps kernel fuzzing efforts in finding
vulnerabilities.

This change only has effect if the kernel is compiled with CONFIG_KCOV,
otherwise kcov_ functions don't do anything.

Signed-off-by: Tamas Koczka <poprdi@google.com>
Tested-by: Aleksandr Nogikh <nogikh@google.com>
Reviewed-by: Dmitry Vyukov <dvyukov@google.com>
---
Changelog since v1:
 - add comment about why kcov_remote functions are called

v1: https://lore.kernel.org/all/20220517094532.2729049-1-poprdi@google.com/

Note: this is a resubmission of https://lore.kernel.org/netdev/CAPUC6bJbVMPn1FMLYnXg2GUX4ikesMSRjj=oPOOrS5H2DOx_bA@mail.gmail.com/T/

 net/bluetooth/hci_core.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

Comments

bluez.test.bot@gmail.com July 14, 2022, 11:55 a.m. UTC | #1 
This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=659660

---Test result---

Test Summary:
CheckPatch                    PASS      1.26 seconds
GitLint                       FAIL      0.56 seconds
SubjectPrefix                 PASS      0.39 seconds
BuildKernel                   PASS      31.70 seconds
BuildKernel32                 PASS      27.34 seconds
Incremental Build with patchesPASS      37.80 seconds
TestRunner: Setup             PASS      468.97 seconds
TestRunner: l2cap-tester      PASS      16.30 seconds
TestRunner: bnep-tester       PASS      5.46 seconds
TestRunner: mgmt-tester       PASS      95.42 seconds
TestRunner: rfcomm-tester     PASS      8.90 seconds
TestRunner: sco-tester        PASS      8.60 seconds
TestRunner: smp-tester        PASS      8.65 seconds
TestRunner: userchan-tester   PASS      5.65 seconds

Details
##############################
Test: GitLint - FAIL - 0.56 seconds
Run gitlint with rule in .gitlint
[v2] Bluetooth: Collect kcov coverage from hci_rx_work
24: B1 Line exceeds max length (132>80): "Note: this is a resubmission of https://lore.kernel.org/netdev/CAPUC6bJbVMPn1FMLYnXg2GUX4ikesMSRjj=oPOOrS5H2DOx_bA@mail.gmail.com/T/"




---
Regards,
Linux Bluetooth
patchwork-bot+bluetooth@kernel.org July 14, 2022, 8 p.m. UTC | #2 
Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Thu, 14 Jul 2022 10:48:14 +0000 you wrote:
> Annotate hci_rx_work() with kcov_remote_start() and kcov_remote_stop()
> calls, so remote KCOV coverage is collected while processing the rx_q
> queue which is the main incoming Bluetooth packet queue.
> 
> Coverage is associated with the thread which created the packet skb.
> 
> The collected extra coverage helps kernel fuzzing efforts in finding
> vulnerabilities.
> 
> [...]

Here is the summary with links:
  - [v2] Bluetooth: Collect kcov coverage from hci_rx_work
    https://git.kernel.org/bluetooth/bluetooth-next/c/b28a31ebc74f

You are awesome, thank you!
diff mbox series

Patch

diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 45c2dd2e1590..0af43844c55a 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -29,6 +29,7 @@ 
 #include <linux/rfkill.h>
 #include <linux/debugfs.h>
 #include <linux/crypto.h>
+#include <linux/kcov.h>
 #include <linux/property.h>
 #include <linux/suspend.h>
 #include <linux/wait.h>
@@ -3780,7 +3781,14 @@  static void hci_rx_work(struct work_struct *work)
 
 	BT_DBG("%s", hdev->name);
 
-	while ((skb = skb_dequeue(&hdev->rx_q))) {
+	/* The kcov_remote functions used for collecting packet parsing
+	 * coverage information from this background thread and associate
+	 * the coverage with the syscall's thread which originally injected
+	 * the packet. This helps fuzzing the kernel.
+	 */
+	for (; (skb = skb_dequeue(&hdev->rx_q)); kcov_remote_stop()) {
+		kcov_remote_start_common(skb_get_kcov_handle(skb));
+
 		/* Send copy to monitor */
 		hci_send_to_monitor(hdev, skb);