Study and Implementation of Fault Injection Method for Device Drivers

doi:10.3969/j.issn.1671-1122.2019.06.003

Abstract

Abstract:

In this paper, a flexible and controllable model of fault injection is put forward based on location and replacement of function invocation instructions at the time of module installation and based on automatic recovery and interactive re-triggering at run-time. The corresponding prototype is designed and implemented where notifier chain is used for monitoring the installation of target modules, command line arguments of Shell programs and module parameters are used comprehensively for the configuration of target functions of fault injection, and debugfs is exploited for triggering fault again. Compared with other fault injection tools, our prototype has more flexible and more controllable features in routines of triggering faults of multiple kernel functions so that robustness and dependability of kernel modules such as device drivers can be verified more effectively.

Key words: security of kernel, device drivers, fault injection, notifier chain, pseudo file system for kernel debugging

CLC Number:

TP309

Gaoshou ZHAI, Ruixia ZHAI, Feng LIU, Honghui LI. Study and Implementation of Fault Injection Method for Device Drivers[J]. Netinfo Security, 2019, 19(6): 19-27.

Figures/Tables 9

References 22

[1]	JABEEN S H, ZHAI Gaoshou, ZHAI Ruixia.Fault Simulation and Memory Leak Detection over Custom Kernel Module by Using KEDR[C]//SCIEIA. The 7th International Workshop on Computer Science and Engineering, June 25-27, 2017, Beijing, China. California: SCIEI, 2017: 244-248.
[2]	LUTZ R R.Analyzing Software Requirements Errors in Safety-critical, Embedded Systems[C]//IEEE. IEEE International Symposium on Requirements Engineering, January 4-6, 1993, San Diego, California, USA. New Jersey: IEEE, 1993: 126-133.
[3]	SCHMID M, GHOSH A, HILL F.Techniques for Evaluating the Robustness of Windows NT Software[C]//IEEE. DARPA Information Survivability Conference and Exposition: Discex’00, January 25-27, 2000, Hilton Head, South Carolina, USA. New Jersey: IEEE, 2000, 347-360.
[4]	HSUEH M C, TSAI T K., IYER R K.Fault Injection Techniques and Tools[J]. Computer, 1997, 30(4): 75-82.
[5]	CONG Kai, LEI Li, YANG Zhenkun, et al.Automatic Fault Injection for Driver Robustness Testing[C]//ACM. 2015 International Symposium on Software Testing and Analysis, July 14-17, 2015, Baltimore, Maryland, USA. New York: ACM, 2015: 361-372.
[6]	MA Pei, ZHAI Gaoshou.Automatic Analysis and Detection of Sensitive Codes Relating to Transient Hardware-faults for Linux Drivers[J]. Computer Engineering & Software, 2015, 36(12): 9-15.
	马培,翟高寿. 面向硬件瞬时故障的Linux设备驱动敏感代码的自动分析与检测[J]. 软件,2015,36(12):9-15.
[7]	ZHAI Gaoshou, LIU Chen, XIANG Yong.Study and Implementation of Systematic Protection by Monitoring Abnormal Invocation of Linux Kernel Functions[J]. Netinfo Security, 2018, 18(3): 26-38.
	翟高寿,刘晨,向勇. 基于内核函数监控的Linux系统防护方法的研究与实现[J]. 信息网络安全,2018,18(3):26-38
[8]	TAN Zhuo, ZHAI Gaoshou.Study and Implementation of Communication Mechanism for Non-kernel Device Drivers[J]. Netinfo Security, 2016, 16(11): 57-65.
	谭茁,翟高寿. 设备驱动非内核化通信架构的研究与实现[J]. 信息网络安全,2016,16(11):57-65.
[9]	REN Yanyan, ZHAI Gaoshou, ZHANG Junhong.Automatic Updating and Auxiliary Tools of Linux Device Drivers[J]. Computer Systems & Applications, 2018, 27(7): 211-218
	任艳艳,翟高寿,张俊红. Linux设备驱动程序自动更新及辅助工具[J]. 计算机系统应用,2018,27(7):211-218.
[10]	SUN Junzhao, WANG Jianying, YANG Xiaozong.The Present Situation for Research of Fault Injection Methodology and Tools[J]. Journal of Astronautics, 2001, 22(1): 99-104.
	孙峻朝,王建莹,杨孝宗. 故障注入方法与工具的研究现状[J]. 宇航学报,2001,22(1):99-104.
[11]	MARINESCU P D, CANDEA G.LFI: A Practical and General Library-level Fault Injector[C]//IEEE. 2009 IEEE/IFIP International Conference on Dependable Systems and Networks, June 29-July 2, 2009, Lisbon, Portugal. New Jersey: IEEE, 2009: 379-388.
[12]	NAUGHTON T, BLAND W, VALLÉE G, et al. Fault Injection Framework for System Resilience Evaluation: Fake Faults for Finding Future Failures[C]//ACM. 2009 Workshop on Resiliency in High Performance, June 9, 2009, Munich, Germany. New York: ACM, 2009: 23-28.
[13]	WANG Bo.Design and Implementation of Fault Injectors for High-end Fault-tolerant Computer[D]. Harbin: Harbin Institute of Technology, 2011.
	王波. 高端容错计算机故障注入工具的设计与实现[D]. 哈尔滨:哈尔滨工业大学,2011.
[14]	MENG Xuemei.Research of Software Fault Injection and Software Vulnerabilities Identifying[J]. Public Communication of Science & Technology, 2013, 5(24): 216-217.
	孟雪梅. 软件故障注入及软件脆弱点检测方法研究[J]. 科技传播,2013,5(24):216-217.
[15]	LV Wenjuan.Research of Software Fault Injection and Software Vulnerabilities Identifying[D]. Harbin: Harbin Institute of Technology, 2009.
	吕文娟. 软件故障注入及软件脆弱点检测方法研究[D]. 哈尔滨:哈尔滨工业大学,2009.
[16]	NIE Hongjie, DING Cheng. Linux Kernel Memory Checker: Kmemcheck[EB/OL]. , 2009-11-19.
	聂洪杰,丁成. Linux内核内存检测工具——Kmemcheck[EB/OL]. , 2009-11-19.
[17]	The Kernel Development Community. Kernel Memory Leak Detector[EB/OL]. , 2019-1-26.
[18]	SystemTap. SystemTap[EB/OL]. , 2019-1-26.
[19]	TANAKA K, HAMAGUCHI M, SATO T, et al.SCSI Fault Injection Test[C]//Linux Symposium. 2008 Linux Symposium, July 23-26, 2008, Ottawa, Ontario, Canada. Ottawa: Linux Symposium, 2008: 205-214.
[20]	RUBANOV V V, SHATOKHIN E A.Runtime Verification of Linux Kernel Modules Based on Call Interception[C]//IEEE. IEEE Fourth International Conference on Software Testing, Verification and Validation, March 21-25, 2011, Berlin, Germany. New Jersey: IEEE, 2011: 180-189.
[21]	CORBET Jonathan. Debugfs[EB/OL]. , 20192019-1-26.
[22]	XIA An, YAN Jiangyu, HUANG Jingchang.Understanding Linux Network Internals[M]. Beijing: China Electric Power Press, 2009.
	夏安,闫江毓,黄景昌,译. 深入理解LINUX网络技术内幕[M]. 北京:中国电力出版社,2009.

相关设备驱动	内核函数
字符设备驱动	__kmalloc, _copy_to_user, _copy_from_user
pcnet32网卡驱动	dma_alloc_coherent, dma_unmap_single_attrs, dma_mapping_error, dma_sync_single_for_cpu, dma_sync_single_for_device, netdev_priv, __netdev_alloc_skb, skb_put, skb_copy_to_linear_data, skb_reserve, spin_unlock_irqrestore, kmalloc_array, __napi_complete, netif_running, netif_receive_skb, netif_wake_queue, netif_tx_disable, pci_enable_device, generic_mii_ioctl
ens1371/ens1370 声卡驱动	spin_lock, frames_to_bytes, snd_pcm_trigger_done, spin_lock_irq, snd_pcm_format_width, snd_info_set_text_ops, gameport_allocate_port, __gameport_register_port, snd_pcm_new, snd_pcm_set_ops, snd_card_free, snd_pcm_add_chmap_ctls, snd_card_register, snd_device_new, snd_pcm_lib_malloc_pages, snd_ctl_add,snd_pcm_period_elapsed, snd_ac97_bus, snd_ac97_mixer
其他	krealloc, __krealloc, kmem_cache_alloc, kmem_cache_alloc_trace, kmalloc_order_trace, __get_free_pages, get_zeroed_page, __alloc_pages_nodemask, alloc_pages_exact, strndup_user, memdup_user, capable, kstrdup, kstrndup, kmemdup, posix_acl_alloc, posix_acl_from_mode, posix_acl_from_xattr, match_strdup, __posix_acl_create, __posix_acl_chmod, vmalloc, __vmalloc, vmalloc_user, vmalloc_node, vmalloc_32, vmalloc_32_user, vzalloc, vzalloc_node