mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2025-01-10 07:00:48 +00:00
Bluetooth: Collect kcov coverage from hci_rx_work
Annotate hci_rx_work() with kcov_remote_start() and kcov_remote_stop() calls, so remote KCOV coverage is collected while processing the rx_q queue which is the main incoming Bluetooth packet queue. Coverage is associated with the thread which created the packet skb. The collected extra coverage helps kernel fuzzing efforts in finding vulnerabilities. This change only has effect if the kernel is compiled with CONFIG_KCOV, otherwise kcov_ functions don't do anything. Signed-off-by: Tamas Koczka <poprdi@google.com> Tested-by: Aleksandr Nogikh <nogikh@google.com> Reviewed-by: Dmitry Vyukov <dvyukov@google.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
This commit is contained in:
parent
68253f3cd7
commit
9f30de9e03
@ -29,6 +29,7 @@
|
||||
#include <linux/rfkill.h>
|
||||
#include <linux/debugfs.h>
|
||||
#include <linux/crypto.h>
|
||||
#include <linux/kcov.h>
|
||||
#include <linux/property.h>
|
||||
#include <linux/suspend.h>
|
||||
#include <linux/wait.h>
|
||||
@ -3804,7 +3805,14 @@ static void hci_rx_work(struct work_struct *work)
|
||||
|
||||
BT_DBG("%s", hdev->name);
|
||||
|
||||
while ((skb = skb_dequeue(&hdev->rx_q))) {
|
||||
/* The kcov_remote functions used for collecting packet parsing
|
||||
* coverage information from this background thread and associate
|
||||
* the coverage with the syscall's thread which originally injected
|
||||
* the packet. This helps fuzzing the kernel.
|
||||
*/
|
||||
for (; (skb = skb_dequeue(&hdev->rx_q)); kcov_remote_stop()) {
|
||||
kcov_remote_start_common(skb_get_kcov_handle(skb));
|
||||
|
||||
/* Send copy to monitor */
|
||||
hci_send_to_monitor(hdev, skb);
|
||||
|
||||
|
Loading…
x
Reference in New Issue
Block a user