| Message ID | cover.1571844200.git.andreyknvl@google.com |
|---|---|
| Headers | show |
| Series | kcov: collect coverage from usb and vhost | expand |
On Wed, 23 Oct 2019 17:24:28 +0200 Andrey Konovalov <andreyknvl@google.com> wrote: > This patchset extends kcov to allow collecting coverage from the USB > subsystem and vhost workers. See the first patch description for details > about the kcov extension. The other two patches apply this kcov extension > to USB and vhost. > > These patches have been used to enable coverage-guided USB fuzzing with > syzkaller for the last few years I find it surprising that this material is so focused on USB. Is there something unique about USB that gave rise to this situation, or is it expected that the new kcov feature will be used elsewhere in the kernel? If the latter, which are the expected subsystems?
On Thu, Oct 24, 2019 at 12:04 AM Andrew Morton <akpm@linux-foundation.org> wrote: > > On Wed, 23 Oct 2019 17:24:28 +0200 Andrey Konovalov <andreyknvl@google.com> wrote: > > > This patchset extends kcov to allow collecting coverage from the USB > > subsystem and vhost workers. See the first patch description for details > > about the kcov extension. The other two patches apply this kcov extension > > to USB and vhost. > > > > These patches have been used to enable coverage-guided USB fuzzing with > > syzkaller for the last few years > > I find it surprising that this material is so focused on USB. Is > there something unique about USB that gave rise to this situation, or USB fuzzing is the thing that I've been working on that requires this functionality. But the idea is to make the interface generic enough to make it useful for other subsystems as well as long as the annotations are added. > is it expected that the new kcov feature will be used elsewhere in the > kernel? > > If the latter, which are the expected subsystems? Currently we encountered two cases where this is useful: USB and vhost workers. Most probably there are more subsystems that will benefit from this kcov extension to get better fuzzing coverage. I don't have a list of them, but the provided interface should be easy to use when more of such cases are encountered.
On Thu, 24 Oct 2019 14:47:31 +0200 Andrey Konovalov <andreyknvl@google.com> wrote: > > is it expected that the new kcov feature will be used elsewhere in the > > kernel? > > > > If the latter, which are the expected subsystems? > > Currently we encountered two cases where this is useful: USB and vhost > workers. Most probably there are more subsystems that will benefit > from this kcov extension to get better fuzzing coverage. I don't have > a list of them, but the provided interface should be easy to use when > more of such cases are encountered. It would be helpful to add such a list to the changelog. Best-effort and approximate is OK - just to help people understand the eventual usefulness of the proposal.
On Fri, Oct 25, 2019 at 1:59 AM Andrew Morton <akpm@linux-foundation.org> wrote: > > On Thu, 24 Oct 2019 14:47:31 +0200 Andrey Konovalov <andreyknvl@google.com> wrote: > > > > is it expected that the new kcov feature will be used elsewhere in the > > > kernel? > > > > > > If the latter, which are the expected subsystems? > > > > Currently we encountered two cases where this is useful: USB and vhost > > workers. Most probably there are more subsystems that will benefit > > from this kcov extension to get better fuzzing coverage. I don't have > > a list of them, but the provided interface should be easy to use when > > more of such cases are encountered. > > It would be helpful to add such a list to the changelog. Best-effort > and approximate is OK - just to help people understand the eventual > usefulness of the proposal. OK, I'll add it to the cover letter in v3, thanks!
This patchset extends kcov to allow collecting coverage from the USB subsystem and vhost workers. See the first patch description for details about the kcov extension. The other two patches apply this kcov extension to USB and vhost. These patches have been used to enable coverage-guided USB fuzzing with syzkaller for the last few years, see the details here: https://github.com/google/syzkaller/blob/master/docs/linux/external_fuzzing_usb.md This patchset has been pushed to the public Linux kernel Gerrit instance: https://linux-review.googlesource.com/c/linux/kernel/git/torvalds/linux/+/1524 Changes v1 -> v2: - Changed common_handle type back to u64 (to allow extending it in the future). - Reworked kcov_remote_handle() helpers. - Fixed vhost annotations when CONFIG_KCOV is not enabled. - Use kcov_disable() instead of kcov_remote_reset() when KCOV_REMOTE_ENABLE fails. Changes RFC v1 -> v1: - Remove unnecessary #ifdef's from drivers/vhost/vhost.c. - Reset t->kcov when area allocation fails in kcov_remote_start(). - Use struct_size to calculate array size in kcov_ioctl(). - Add a limit on area_size in kcov_remote_arg. - Added kcov_disable() helper. - Changed encoding of kcov remote handle ids, see the documentation. - Added a comment reference for kcov_sequence task_struct field. - Change common_handle type to u32. - Add checks for handle validity into kcov_ioctl_locked() and kcov_remote_start(). - Updated documentation to reflect the changes. Andrey Konovalov (3): kcov: remote coverage support usb, kcov: collect coverage from hub_event vhost, kcov: collect coverage from vhost_worker Documentation/dev-tools/kcov.rst | 128 +++++++++ drivers/usb/core/hub.c | 5 + drivers/vhost/vhost.c | 6 + drivers/vhost/vhost.h | 1 + include/linux/kcov.h | 23 ++ include/linux/sched.h | 6 + include/uapi/linux/kcov.h | 25 ++ kernel/kcov.c | 480 ++++++++++++++++++++++++++++--- 8 files changed, 639 insertions(+), 35 deletions(-)