mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-27 12:57:53 +00:00
637619b02c
commit01c8f9806bupstream. In kcov_remote_start()/kcov_remote_stop(), we swap the previous KCOV metadata of the current task into a per-CPU variable. However, the kcov_mode_enabled(mode) check is not sufficient in the case of remote KCOV coverage: current->kcov_mode always remains KCOV_MODE_DISABLED for remote KCOV objects. If the original task that has invoked the KCOV_REMOTE_ENABLE ioctl happens to get interrupted and kcov_remote_start() is called, it ultimately leads to kcov_remote_stop() NOT restoring the original KCOV reference. So when the task exits, all registered remote KCOV handles remain active forever. The most uncomfortable effect (at least for syzkaller) is that the bug prevents the reuse of the same /sys/kernel/debug/kcov descriptor. If we obtain it in the parent process and then e.g. drop some capabilities and continuously fork to execute individual programs, at some point current->kcov of the forked process is lost, kcov_task_exit() takes no action, and all KCOV_REMOTE_ENABLE ioctls calls from subsequent forks fail. And, yes, the efficiency is also affected if we keep on losing remote kcov objects. a) kcov_remote_map keeps on growing forever. b) (If I'm not mistaken), we're also not freeing the memory referenced by kcov->area. Fix it by introducing a special kcov_mode that is assigned to the task that owns a KCOV remote object. It makes kcov_mode_enabled() return true and yet does not trigger coverage collection in __sanitizer_cov_trace_pc() and write_comp_data(). [nogikh@google.com: replace WRITE_ONCE() with an ordinary assignment] Link: https://lkml.kernel.org/r/20240614171221.2837584-1-nogikh@google.com Link: https://lkml.kernel.org/r/20240611133229.527822-1-nogikh@google.com Fixes:5ff3b30ab5("kcov: collect coverage from interrupts") Signed-off-by: Aleksandr Nogikh <nogikh@google.com> Reviewed-by: Dmitry Vyukov <dvyukov@google.com> Reviewed-by: Andrey Konovalov <andreyknvl@gmail.com> Tested-by: Andrey Konovalov <andreyknvl@gmail.com> Cc: Alexander Potapenko <glider@google.com> Cc: Arnd Bergmann <arnd@arndb.de> Cc: Marco Elver <elver@google.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
112 lines
3.1 KiB
C
112 lines
3.1 KiB
C
/* SPDX-License-Identifier: GPL-2.0 */
|
|
#ifndef _LINUX_KCOV_H
|
|
#define _LINUX_KCOV_H
|
|
|
|
#include <linux/sched.h>
|
|
#include <uapi/linux/kcov.h>
|
|
|
|
struct task_struct;
|
|
|
|
#ifdef CONFIG_KCOV
|
|
|
|
enum kcov_mode {
|
|
/* Coverage collection is not enabled yet. */
|
|
KCOV_MODE_DISABLED = 0,
|
|
/* KCOV was initialized, but tracing mode hasn't been chosen yet. */
|
|
KCOV_MODE_INIT = 1,
|
|
/*
|
|
* Tracing coverage collection mode.
|
|
* Covered PCs are collected in a per-task buffer.
|
|
*/
|
|
KCOV_MODE_TRACE_PC = 2,
|
|
/* Collecting comparison operands mode. */
|
|
KCOV_MODE_TRACE_CMP = 3,
|
|
/* The process owns a KCOV remote reference. */
|
|
KCOV_MODE_REMOTE = 4,
|
|
};
|
|
|
|
#define KCOV_IN_CTXSW (1 << 30)
|
|
|
|
void kcov_task_init(struct task_struct *t);
|
|
void kcov_task_exit(struct task_struct *t);
|
|
|
|
#define kcov_prepare_switch(t) \
|
|
do { \
|
|
(t)->kcov_mode |= KCOV_IN_CTXSW; \
|
|
} while (0)
|
|
|
|
#define kcov_finish_switch(t) \
|
|
do { \
|
|
(t)->kcov_mode &= ~KCOV_IN_CTXSW; \
|
|
} while (0)
|
|
|
|
/* See Documentation/dev-tools/kcov.rst for usage details. */
|
|
void kcov_remote_start(u64 handle);
|
|
void kcov_remote_stop(void);
|
|
u64 kcov_common_handle(void);
|
|
|
|
static inline void kcov_remote_start_common(u64 id)
|
|
{
|
|
kcov_remote_start(kcov_remote_handle(KCOV_SUBSYSTEM_COMMON, id));
|
|
}
|
|
|
|
static inline void kcov_remote_start_usb(u64 id)
|
|
{
|
|
kcov_remote_start(kcov_remote_handle(KCOV_SUBSYSTEM_USB, id));
|
|
}
|
|
|
|
/*
|
|
* The softirq flavor of kcov_remote_*() functions is introduced as a temporary
|
|
* work around for kcov's lack of nested remote coverage sections support in
|
|
* task context. Adding support for nested sections is tracked in:
|
|
* https://bugzilla.kernel.org/show_bug.cgi?id=210337
|
|
*/
|
|
|
|
static inline void kcov_remote_start_usb_softirq(u64 id)
|
|
{
|
|
if (in_serving_softirq())
|
|
kcov_remote_start_usb(id);
|
|
}
|
|
|
|
static inline void kcov_remote_stop_softirq(void)
|
|
{
|
|
if (in_serving_softirq())
|
|
kcov_remote_stop();
|
|
}
|
|
|
|
#ifdef CONFIG_64BIT
|
|
typedef unsigned long kcov_u64;
|
|
#else
|
|
typedef unsigned long long kcov_u64;
|
|
#endif
|
|
|
|
void __sanitizer_cov_trace_pc(void);
|
|
void __sanitizer_cov_trace_cmp1(u8 arg1, u8 arg2);
|
|
void __sanitizer_cov_trace_cmp2(u16 arg1, u16 arg2);
|
|
void __sanitizer_cov_trace_cmp4(u32 arg1, u32 arg2);
|
|
void __sanitizer_cov_trace_cmp8(kcov_u64 arg1, kcov_u64 arg2);
|
|
void __sanitizer_cov_trace_const_cmp1(u8 arg1, u8 arg2);
|
|
void __sanitizer_cov_trace_const_cmp2(u16 arg1, u16 arg2);
|
|
void __sanitizer_cov_trace_const_cmp4(u32 arg1, u32 arg2);
|
|
void __sanitizer_cov_trace_const_cmp8(kcov_u64 arg1, kcov_u64 arg2);
|
|
void __sanitizer_cov_trace_switch(kcov_u64 val, void *cases);
|
|
|
|
#else
|
|
|
|
static inline void kcov_task_init(struct task_struct *t) {}
|
|
static inline void kcov_task_exit(struct task_struct *t) {}
|
|
static inline void kcov_prepare_switch(struct task_struct *t) {}
|
|
static inline void kcov_finish_switch(struct task_struct *t) {}
|
|
static inline void kcov_remote_start(u64 handle) {}
|
|
static inline void kcov_remote_stop(void) {}
|
|
static inline u64 kcov_common_handle(void)
|
|
{
|
|
return 0;
|
|
}
|
|
static inline void kcov_remote_start_common(u64 id) {}
|
|
static inline void kcov_remote_start_usb(u64 id) {}
|
|
static inline void kcov_remote_start_usb_softirq(u64 id) {}
|
|
static inline void kcov_remote_stop_softirq(void) {}
|
|
|
|
#endif /* CONFIG_KCOV */
|
|
#endif /* _LINUX_KCOV_H */
|