linux-kernel - Re: [PATCH v2] kernel: add kcov code coverage

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 22 Jan 2016 13:15:27 +0100
From:	Dmitry Vyukov <dvyukov@...gle.com>
To:	Mark Rutland <mark.rutland@....com>
Cc:	syzkaller <syzkaller@...glegroups.com>,
	Vegard Nossum <vegard.nossum@...cle.com>,
	Catalin Marinas <catalin.marinas@....com>,
	Tavis Ormandy <taviso@...gle.com>,
	Will Deacon <will.deacon@....com>,
	LKML <linux-kernel@...r.kernel.org>,
	Quentin Casasnovas <quentin.casasnovas@...cle.com>,
	Kostya Serebryany <kcc@...gle.com>,
	Eric Dumazet <edumazet@...gle.com>,
	Alexander Potapenko <glider@...gle.com>,
	Kees Cook <keescook@...gle.com>,
	Bjorn Helgaas <bhelgaas@...gle.com>,
	Sasha Levin <sasha.levin@...cle.com>,
	Andrew Morton <akpm@...ux-foundation.org>,
	David Drysdale <drysdale@...gle.com>,
	linux-arm-kernel@...ts.infradead.org,
	Ard Biesheuvel <ard.biesheuvel@...aro.org>
Subject: Re: [PATCH v2] kernel: add kcov code coverage

On Fri, Jan 22, 2016 at 12:55 PM, Mark Rutland <mark.rutland@....com> wrote:
> On Mon, Jan 18, 2016 at 09:09:43PM +0100, Dmitry Vyukov wrote:
>> On Mon, Jan 18, 2016 at 8:44 PM, Dmitry Vyukov <dvyukov@...gle.com> wrote:
>> > I've got several comments regarding the 4-byte compressed PCs. We've
>> > also discussed this internally.
>> > As the result in v4 I made it possible to export both compressed
>> > 4-byte PCs and full 8-byte PCs.
>> > Now init ioctl accepts the following struct and kernel can say whether
>> > it will export 4- or 8-byte PCs:
>> >
>> > struct kcov_init_trace {
>> >         unsigned long        flags; /* In: reserved, must be 0. */
>> >         unsigned long        size; /* In: trace buffer size. */
>> >         unsigned long        version;  /* Out: trace format, currently 1. */
>> >         /*
>> >          * Output.
>> >          * pc_size can be 4 or 8. If pc_size = 4 on a 64-bit arch,
>> >          * returned PCs are compressed by subtracting pc_base and then
>> >          * truncating to 4 bytes.
>> >          */
>> >         unsigned long        pc_size;
>> >         unsigned long        pc_base;
>> > };
>> >
>> > So for KASLR or other archs we can just export full 8-byte PCs.
>> >
>> > Regarding KASLR and dynamically loaded modules. I've looked at my
>> > use-case and concluded
>> > that most of the time I can work with "non-stable" PCs within a single
>> > VM. Whenever I need to
>> > store PCs persistently or send to another machine, I think I can
>> > "canonicalize" PCs using
>> > /proc/modules and /proc/kallsyms to something like (module hash,
>> > module offset). So kernel does
>> > not need to do this during coverage collection.
>>
>> On second though, maybe it's better to just always export unsigned long PCs...
>> Need to measure how much memory coverage information consumes,
>> and how much slower it is with uint64 PCs. Maybe I can live with large PCs,
>> or maybe I can make syzkaller require !KASLR and compress PCs in user-space...
>> Need to think about this more.
>
> I can imagine we might keep the expanded module range even in the
> absence of full KASLR, though I don't know how realistic that thought
> is.


The last version of the patch just exposes PCs as unsigned longs
without any compression. So it should not be a problem (at least for
kernel, now it's user responsibility to make sense out of the PCs).