diff options
| author | Aleksandr Nogikh <nogikh@google.com> | 2020-10-29 17:36:20 +0000 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2020-11-02 18:01:45 -0800 |
| commit | 261e411bb283d348a6a977cccb5db393594e7695 (patch) | |
| tree | f89aa18a2e0028b93f8fe790997df75e15938236 /net/mac80211 | |
| parent | 6370cc3bbd8a0f9bf975b013781243ab147876c6 (diff) | |
mac80211: add KCOV remote annotations to incoming frame processing
Add KCOV remote annotations to ieee80211_iface_work() and
ieee80211_rx_list(). This will enable coverage-guided fuzzing of
mac80211 code that processes incoming 802.11 frames.
Signed-off-by: Aleksandr Nogikh <nogikh@google.com>
Reviewed-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'net/mac80211')
| -rw-r--r-- | net/mac80211/iface.c | 2 | ||||
| -rw-r--r-- | net/mac80211/rx.c | 16 |
2 files changed, 11 insertions, 7 deletions
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c index 1be775979132..56a1bcea2c1c 100644 --- a/net/mac80211/iface.c +++ b/net/mac80211/iface.c @@ -1356,6 +1356,7 @@ static void ieee80211_iface_work(struct work_struct *work) while ((skb = skb_dequeue(&sdata->skb_queue))) { struct ieee80211_mgmt *mgmt = (void *)skb->data; + kcov_remote_start_common(skb_get_kcov_handle(skb)); if (ieee80211_is_action(mgmt->frame_control) && mgmt->u.action.category == WLAN_CATEGORY_BACK) { int len = skb->len; @@ -1465,6 +1466,7 @@ static void ieee80211_iface_work(struct work_struct *work) } kfree_skb(skb); + kcov_remote_stop(); } /* then other type-dependent work */ diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c index 1e2e5a406d58..09d1c9fb8872 100644 --- a/net/mac80211/rx.c +++ b/net/mac80211/rx.c @@ -4742,6 +4742,8 @@ void ieee80211_rx_list(struct ieee80211_hw *hw, struct ieee80211_sta *pubsta, status->rx_flags = 0; + kcov_remote_start_common(skb_get_kcov_handle(skb)); + /* * Frames with failed FCS/PLCP checksum are not returned, * all other frames are returned without radiotap header @@ -4749,15 +4751,15 @@ void ieee80211_rx_list(struct ieee80211_hw *hw, struct ieee80211_sta *pubsta, * Also, frames with less than 16 bytes are dropped. */ skb = ieee80211_rx_monitor(local, skb, rate); - if (!skb) - return; - - ieee80211_tpt_led_trig_rx(local, - ((struct ieee80211_hdr *)skb->data)->frame_control, - skb->len); + if (skb) { + ieee80211_tpt_led_trig_rx(local, + ((struct ieee80211_hdr *)skb->data)->frame_control, + skb->len); - __ieee80211_rx_handle_packet(hw, pubsta, skb, list); + __ieee80211_rx_handle_packet(hw, pubsta, skb, list); + } + kcov_remote_stop(); return; drop: kfree_skb(skb); |