From patchwork Fri May 4 13:55:33 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mark Rutland X-Patchwork-Id: 134978 Delivered-To: patch@linaro.org Received: by 10.46.151.6 with SMTP id r6csp81800lji; Fri, 4 May 2018 06:55:50 -0700 (PDT) X-Google-Smtp-Source: AB8JxZpsQ2rLNFszLeVwysqMJdo8VUcuxVj+pfAmBu/I49/lIKsOUUnEvvyQFGzVqWUqm8NG2XgG X-Received: by 2002:a65:44cc:: with SMTP id g12-v6mr22367748pgs.110.1525442150720; Fri, 04 May 2018 06:55:50 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1525442150; cv=none; d=google.com; s=arc-20160816; b=xi2g1ydoL9fKpvM5gxSjcZxZC8pT9nXnGjwVjIIbVhsTJ+Q0iBq/TeAn3Sb0aE4VRH jYRRlCqaRJpb2dEthKOmBs+T0wjUjoaT8a7CEfgFa4vK99KS1LvAFP1Oxukbr7u0MFil 1438I6OSaTwZE/HiwapDTBK4MCb4QghjXu8u8wAnbSORBeiGjSDmCfHOwqCaB2bzdKGH ZeHmDUiAyWxRCtRvmYHRgt8FtNKiwcZnuBFJSTiTPiLzXPex2JM4akxHbHyFvH/LFrJI tOQ6sZw334V+nn22YC6AcDzE07QcPooqWYYTMZQtLeOYanKH2GIOjLII+Zr9ZMjMcONd l7CA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:references:in-reply-to:message-id:date :subject:cc:to:from:arc-authentication-results; bh=vJCkCLeozTTSpN1PdLfGExEdxJfOA2HLJfltzQIBJ1o=; b=Ydf70vgdQc41x2lNT7CvkI3kNjqQcmLMLAW0ExhFc6SXH5XInZfEeXdd/QQf45RIZA 9644OoFlaJIOI4r8KsE22NYCr2D1DHtU3w64ga5CWu2ZWBcjuqRCL06poSE79RVWAYiH OgFzkk5vuHCDurn/w0YMzSAPpi19bevYaeD1h1vfiCy0cl+X7dWMj3Q2S3j2n3NsIJjn sp+p6mArYI6O17HDEEZkFOqgTGyqDSql+pY8YFk8Ce+rrhYWY7wGy9JBmcN6fGIvgti/ 3b1WAB7id8WtwGgXeU9NXH5eu1H1ZqxhhMaDd1ehIiC0V2asfGsGo03No5+zqfpIgugk 0U1Q== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id c2si16578325pfh.215.2018.05.04.06.55.50; Fri, 04 May 2018 06:55:50 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752034AbeEDNzq (ORCPT + 29 others); Fri, 4 May 2018 09:55:46 -0400 Received: from usa-sjc-mx-foss1.foss.arm.com ([217.140.101.70]:53656 "EHLO foss.arm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751573AbeEDNzn (ORCPT ); Fri, 4 May 2018 09:55:43 -0400 Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.72.51.249]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 5F2111596; Fri, 4 May 2018 06:55:43 -0700 (PDT) Received: from lakrids.cambridge.arm.com (usa-sjc-imap-foss1.foss.arm.com [10.72.51.249]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPA id 0A67A3F487; Fri, 4 May 2018 06:55:41 -0700 (PDT) From: Mark Rutland To: linux-kernel@vger.kernel.org Cc: akpm@linux-foundation.org, aryabinin@virtuozzo.com, dvyukov@google.com, mark.rutland@arm.com, mingo@redhat.com, peterz@infradead.org Subject: [PATCH 1/3] kcov: ensure irq code sees a valid area Date: Fri, 4 May 2018 14:55:33 +0100 Message-Id: <20180504135535.53744-2-mark.rutland@arm.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20180504135535.53744-1-mark.rutland@arm.com> References: <20180504135535.53744-1-mark.rutland@arm.com> Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org For kernels built with CONFIG_PREEMPT, some C code may execute before or after the interrupt handler, while the hardirq count is zero. In these cases, in_task() can return true. A task can be interrupted in the middle of a KCOV_DISABLE ioctl while it resets the task's kcov data via kcov_task_init(). Instrumented code executed during this period will call __sanitizer_cov_trace_pc(), and as in_task() returns true, will inspect t->kcov_mode before trying to write to t->kcov_area. In kcov_init_task() Since we update t->kcov_{mode,area,size} with plain stores, which may be re-ordered, torn, etc. Thus __sanitizer_cov_trace_pc() may see bogus values for any of these fields, and may attempt to write to memory which is not mapped. Let's avoid this by using WRITE_ONCE() to set t->kcov_mode, with a barrier() to ensure this is ordered before we clear t->kov_{area,size}. This ensures that any code execute while kcov_init_task() is preempted will either see valid values for t->kcov_{area,size}, or will see that t->kcov_mode is KCOV_MODE_DISABLED, and bail out without touching t->kcov_area. Signed-off-by: Mark Rutland Cc: Andrew Morton Cc: Andrey Ryabinin Cc: Dmitry Vyukov --- kernel/kcov.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) -- 2.11.0 diff --git a/kernel/kcov.c b/kernel/kcov.c index 2c16f1ab5e10..5be9a60a959f 100644 --- a/kernel/kcov.c +++ b/kernel/kcov.c @@ -241,7 +241,8 @@ static void kcov_put(struct kcov *kcov) void kcov_task_init(struct task_struct *t) { - t->kcov_mode = KCOV_MODE_DISABLED; + WRITE_ONCE(t->kcov_mode, KCOV_MODE_DISABLED); + barrier(); t->kcov_size = 0; t->kcov_area = NULL; t->kcov = NULL;