From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 36A1FC19F2A for ; Thu, 11 Aug 2022 15:47:58 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235857AbiHKPrz (ORCPT ); Thu, 11 Aug 2022 11:47:55 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51394 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236825AbiHKPqW (ORCPT ); Thu, 11 Aug 2022 11:46:22 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A444075FF4; Thu, 11 Aug 2022 08:40:53 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 4E7BCB82144; Thu, 11 Aug 2022 15:40:52 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7DED5C433D6; Thu, 11 Aug 2022 15:40:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1660232451; bh=1rkGZBOMlsFEI12HyG6x8dhtnlxUENUiRXBgvXTb3vg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=VkIkRhUxuph3MMW2nsr+z1zrs/30Wi+pywBonWyp2BXe3+a/taWGV6BWfAqqR4sYF A/J7VqBxfFZzfr7hie2JNLhAUz1sVyahU7NEgwjPEetd4e+faCJsD7mEI6v3kS4f1N PyYNYrHgoCNK3HBSA5jR8RaH0GAZV6NE/V/jbpv3IxX9S/Eb2XErLd7Ima1ADvDTGj YuSMc7lkSynziJet1F4WpqwlZg5uCdKZDOw6E8sHc/WleSE1yL+qIvBHXRX6sZb+eo SPZ981UCw873Jh/3OERxgSzxaMiC/uLNUFQ0eNgzIUi6ZJVmx7y1LxFAc8IcVkhh4U tQ+DHl0Oce2ug== From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Tamas Koczka , Aleksandr Nogikh , Dmitry Vyukov , Luiz Augusto von Dentz , Sasha Levin , marcel@holtmann.org, johan.hedberg@gmail.com, luiz.dentz@gmail.com, davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com, linux-bluetooth@vger.kernel.org, netdev@vger.kernel.org Subject: [PATCH AUTOSEL 5.19 083/105] Bluetooth: Collect kcov coverage from hci_rx_work Date: Thu, 11 Aug 2022 11:28:07 -0400 Message-Id: <20220811152851.1520029-83-sashal@kernel.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220811152851.1520029-1-sashal@kernel.org> References: <20220811152851.1520029-1-sashal@kernel.org> MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Tamas Koczka [ Upstream commit 9f30de9e0343da05ac621b5817e9b1ce303c6310 ] Annotate hci_rx_work() with kcov_remote_start() and kcov_remote_stop() calls, so remote KCOV coverage is collected while processing the rx_q queue which is the main incoming Bluetooth packet queue. Coverage is associated with the thread which created the packet skb. The collected extra coverage helps kernel fuzzing efforts in finding vulnerabilities. This change only has effect if the kernel is compiled with CONFIG_KCOV, otherwise kcov_ functions don't do anything. Signed-off-by: Tamas Koczka Tested-by: Aleksandr Nogikh Reviewed-by: Dmitry Vyukov Signed-off-by: Luiz Augusto von Dentz Signed-off-by: Sasha Levin --- net/bluetooth/hci_core.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c index a0f99baafd35..00d42ef705f4 100644 --- a/net/bluetooth/hci_core.c +++ b/net/bluetooth/hci_core.c @@ -29,6 +29,7 @@ #include #include #include +#include #include #include #include @@ -3781,7 +3782,14 @@ static void hci_rx_work(struct work_struct *work) BT_DBG("%s", hdev->name); - while ((skb = skb_dequeue(&hdev->rx_q))) { + /* The kcov_remote functions used for collecting packet parsing + * coverage information from this background thread and associate + * the coverage with the syscall's thread which originally injected + * the packet. This helps fuzzing the kernel. + */ + for (; (skb = skb_dequeue(&hdev->rx_q)); kcov_remote_stop()) { + kcov_remote_start_common(skb_get_kcov_handle(skb)); + /* Send copy to monitor */ hci_send_to_monitor(hdev, skb); -- 2.35.1