linux-toradex.git/kernel/kcov.c, branch v5.15-rc5

kernel: make kcov_common_handle consider the current context

2020-11-03T02:00:20+00:00

kcov_common_handle is a method that is used to obtain a "default" KCOV
remote handle of the current process. The handle can later be passed
to kcov_remote_start in order to collect coverage for the processing
that is initiated by one process, but done in another. For details see
Documentation/dev-tools/kcov.rst and comments in kernel/kcov.c.

Presently, if kcov_common_handle is called in an IRQ context, it will
return a handle for the interrupted process. This may lead to
unreliable and incorrect coverage collection.

Adjust the behavior of kcov_common_handle in the following way. If it
is called in a task context, return the common handle for the
currently running task. Otherwise, return 0.

Signed-off-by: Aleksandr Nogikh 
Reviewed-by: Andrey Konovalov 
Signed-off-by: Jakub Kicinski

kcov: make some symbols static

2020-08-12T17:58:02+00:00

Fix sparse build warnings:

kernel/kcov.c:99:1: warning:
 symbol '__pcpu_scope_kcov_percpu_data' was not declared. Should it be static?
kernel/kcov.c:778:6: warning:
 symbol 'kcov_remote_softirq_start' was not declared. Should it be static?
kernel/kcov.c:795:6: warning:
 symbol 'kcov_remote_softirq_stop' was not declared. Should it be static?

Reported-by: Hulk Robot 
Signed-off-by: Wei Yongjun 
Signed-off-by: Andrew Morton 
Reviewed-by: Andrey Konovalov 
Link: http://lkml.kernel.org/r/20200702115501.73077-1-weiyongjun1@huawei.com
Signed-off-by: Linus Torvalds

kcov: check kcov_softirq in kcov_remote_stop()

2020-06-11T02:14:17+00:00

kcov_remote_stop() should check that the corresponding kcov_remote_start()
actually found the specified remote handle and started collecting
coverage.  This is done by checking the per thread kcov_softirq flag.

A particular failure scenario where this was observed involved a softirq
with a remote coverage collection section coming between check_kcov_mode()
and the access to t->kcov_area in __sanitizer_cov_trace_pc().  In that
softirq kcov_remote_start() bailed out after kcov_remote_find() check, but
the matching kcov_remote_stop() didn't check if kcov_remote_start()
succeeded, and overwrote per thread kcov parameters with invalid (zero)
values.

Fixes: 5ff3b30ab57d ("kcov: collect coverage from interrupts")
Signed-off-by: Andrey Konovalov 
Signed-off-by: Andrew Morton 
Reviewed-by: Dmitry Vyukov 
Cc: Alexander Potapenko 
Cc: Marco Elver 
Cc: Tetsuo Handa 
Link: http://lkml.kernel.org/r/fcd1cd16eac1d2c01a66befd8ea4afc6f8d09833.1591576806.git.andreyknvl@google.com
Signed-off-by: Linus Torvalds

kcov: collect coverage from interrupts

2020-06-05T02:06:20+00:00

This change extends kcov remote coverage support to allow collecting
coverage from soft interrupts in addition to kernel background threads.

To collect coverage from code that is executed in softirq context, a part
of that code has to be annotated with kcov_remote_start/stop() in a
similar way as how it is done for global kernel background threads.  Then
the handle used for the annotations has to be passed to the
KCOV_REMOTE_ENABLE ioctl.

Internally this patch adjusts the __sanitizer_cov_trace_pc() compiler
inserted callback to not bail out when called from softirq context.
kcov_remote_start/stop() are updated to save/restore the current per task
kcov state in a per-cpu area (in case the softirq came when the kernel was
already collecting coverage in task context).  Coverage from softirqs is
collected into pre-allocated per-cpu areas, whose size is controlled by
the new CONFIG_KCOV_IRQ_AREA_SIZE.

[andreyknvl@google.com: turn current->kcov_softirq into unsigned int to fix objtool warning]
  Link: http://lkml.kernel.org/r/841c778aa3849c5cb8c3761f56b87ce653a88671.1585233617.git.andreyknvl@google.com
Signed-off-by: Andrey Konovalov 
Signed-off-by: Andrew Morton 
Reviewed-by: Dmitry Vyukov 
Cc: Alan Stern 
Cc: Alexander Potapenko 
Cc: Andrey Konovalov 
Cc: Greg Kroah-Hartman 
Cc: Marco Elver 
Link: http://lkml.kernel.org/r/469bd385c431d050bc38a593296eff4baae50666.1584655448.git.andreyknvl@google.com
Signed-off-by: Linus Torvalds

kcov: use t->kcov_mode as enabled indicator

2020-06-05T02:06:20+00:00

Currently kcov_remote_start() and kcov_remote_stop() check t->kcov to find
out whether the coverage is already being collected by the current task.
Use t->kcov_mode for that instead.  This doesn't change the overall
behavior in any way, but serves as a preparation for the following softirq
coverage collection support patch.

Signed-off-by: Andrey Konovalov 
Signed-off-by: Andrew Morton 
Reviewed-by: Dmitry Vyukov 
Cc: Alan Stern 
Cc: Alexander Potapenko 
Cc: Greg Kroah-Hartman 
Cc: Marco Elver 
Cc: Andrey Konovalov 
Link: http://lkml.kernel.org/r/f70377945d1d8e6e4916cbce871a12303d6186b4.1585233617.git.andreyknvl@google.com
Link: http://lkml.kernel.org/r/ee1a1dec43059da5d7664c85c1addc89c4cd58de.1584655448.git.andreyknvl@google.com
Signed-off-by: Linus Torvalds

kcov: move t->kcov_sequence assignment

2020-06-05T02:06:20+00:00

Move t->kcov_sequence assignment before assigning t->kcov_mode for
consistency.

Signed-off-by: Andrey Konovalov 
Signed-off-by: Andrew Morton 
Reviewed-by: Dmitry Vyukov 
Cc: Alan Stern 
Cc: Alexander Potapenko 
Cc: Greg Kroah-Hartman 
Cc: Marco Elver 
Cc: Andrey Konovalov 
Link: http://lkml.kernel.org/r/5889efe35e0b300e69dba97216b1288d9c2428a8.1585233617.git.andreyknvl@google.com
Link: http://lkml.kernel.org/r/f0283c676bab3335cb48bfe12d375a3da4719f59.1584655448.git.andreyknvl@google.com
Signed-off-by: Linus Torvalds

kcov: move t->kcov assignments into kcov_start/stop

2020-06-05T02:06:20+00:00

Every time kcov_start/stop() is called, t->kcov is also assigned, so move
the assignment into the functions.

Signed-off-by: Andrey Konovalov 
Signed-off-by: Andrew Morton 
Reviewed-by: Dmitry Vyukov 
Cc: Alan Stern 
Cc: Alexander Potapenko 
Cc: Greg Kroah-Hartman 
Cc: Marco Elver 
Cc: Andrey Konovalov 
Link: http://lkml.kernel.org/r/6644839d3567df61ade3c4b246a46cacbe4f9e11.1585233617.git.andreyknvl@google.com
Link: http://lkml.kernel.org/r/82625ef3ff878f0b585763cc31d09d9b08ca37d6.1584655448.git.andreyknvl@google.com
Signed-off-by: Linus Torvalds

kcov: fix potential use-after-free in kcov_remote_start

2020-06-05T02:06:20+00:00

If vmalloc() fails in kcov_remote_start() we'll access remote->kcov
without holding kcov_remote_lock, so remote might potentially be freed at
that point.  Cache kcov pointer in a local variable.

Signed-off-by: Andrey Konovalov 
Signed-off-by: Andrew Morton 
Reviewed-by: Dmitry Vyukov 
Cc: Alan Stern 
Cc: Alexander Potapenko 
Cc: Greg Kroah-Hartman 
Cc: Marco Elver 
Cc: Andrey Konovalov 
Link: http://lkml.kernel.org/r/9d9134359725a965627b7e8f2652069f86f1d1fa.1585233617.git.andreyknvl@google.com
Link: http://lkml.kernel.org/r/de0d3d30ff90776a2a509cc34c7c1c7521bda125.1584655448.git.andreyknvl@google.com
Signed-off-by: Linus Torvalds

kcov: cleanup debug messages

2020-06-05T02:06:20+00:00

Patch series "kcov: collect coverage from usb soft interrupts", v4.

This patchset extends kcov to allow collecting coverage from soft
interrupts and then uses the new functionality to collect coverage from
USB code.

This has allowed to find at least one new HID bug [1], which was recently
fixed by Alan [2].

[1] https://syzkaller.appspot.com/bug?extid=09ef48aa58261464b621
[2] https://patchwork.kernel.org/patch/11283319/

Any subsystem that uses softirqs (e.g. timers) can make use of this in
the future. Looking at the recent syzbot reports, an obvious candidate
is the networking subsystem [3, 4, 5 and many more].

[3] https://syzkaller.appspot.com/bug?extid=522ab502c69badc66ab7
[4] https://syzkaller.appspot.com/bug?extid=57f89d05946c53dbbb31
[5] https://syzkaller.appspot.com/bug?extid=df358e65d9c1b9d3f5f4

This pach (of 7):

Previous commit left a lot of excessive debug messages, clean them up.

Link; http://lkml.kernel.org/r/cover.1585233617.git.andreyknvl@google.com
Link; http://lkml.kernel.org/r/ab5e2885ce674ba6e04368551e51eeb6a2c11baf.1585233617.git.andreyknvl@google.com
Signed-off-by: Andrey Konovalov 
Signed-off-by: Andrew Morton 
Reviewed-by: Dmitry Vyukov 
Cc: Greg Kroah-Hartman 
Cc: Alan Stern 
Cc: Alexander Potapenko 
Cc: Marco Elver 
Cc: Andrey Konovalov 
Link: http://lkml.kernel.org/r/4a497134b2cf7a9d306d28e3dd2746f5446d1605.1584655448.git.andreyknvl@google.com
Signed-off-by: Linus Torvalds

kernel/kcov.c: fix typos in kcov_remote_start documentation

2020-05-08T02:27:20+00:00

Signed-off-by: Maciej Grochowski 
Signed-off-by: Andrew Morton 
Reviewed-by: Andrey Konovalov 
Link: http://lkml.kernel.org/r/20200420030259.31674-1-maciek.grochowski@gmail.com
Signed-off-by: Linus Torvalds