mirror of
https://mirrors.bfsu.edu.cn/git/linux.git
synced 2024-11-11 04:18:39 +08:00
kcov: update pos before writing pc in trace function
In __sanitizer_cov_trace_pc(), previously we write pc before updating pos. However, some early interrupt code could bypass check_kcov_mode() check and invoke __sanitizer_cov_trace_pc(). If such interrupt is raised between writing pc and updating pos, the pc could be overitten by the recursive __sanitizer_cov_trace_pc(). As suggested by Dmitry, we cold update pos before writing pc to avoid such interleaving. Apply the same change to write_comp_data(). Link: https://lkml.kernel.org/r/20220523053531.1572793-1-liu3101@purdue.edu Signed-off-by: Congyu Liu <liu3101@purdue.edu> Reviewed-by: Dmitry Vyukov <dvyukov@google.com> Cc: Andrey Konovalov <andreyknvl@gmail.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
This commit is contained in:
parent
863e0d81b6
commit
3159d79b56
@ -204,8 +204,16 @@ void notrace __sanitizer_cov_trace_pc(void)
|
||||
/* The first 64-bit word is the number of subsequent PCs. */
|
||||
pos = READ_ONCE(area[0]) + 1;
|
||||
if (likely(pos < t->kcov_size)) {
|
||||
area[pos] = ip;
|
||||
/* Previously we write pc before updating pos. However, some
|
||||
* early interrupt code could bypass check_kcov_mode() check
|
||||
* and invoke __sanitizer_cov_trace_pc(). If such interrupt is
|
||||
* raised between writing pc and updating pos, the pc could be
|
||||
* overitten by the recursive __sanitizer_cov_trace_pc().
|
||||
* Update pos before writing pc to avoid such interleaving.
|
||||
*/
|
||||
WRITE_ONCE(area[0], pos);
|
||||
barrier();
|
||||
area[pos] = ip;
|
||||
}
|
||||
}
|
||||
EXPORT_SYMBOL(__sanitizer_cov_trace_pc);
|
||||
@ -236,11 +244,13 @@ static void notrace write_comp_data(u64 type, u64 arg1, u64 arg2, u64 ip)
|
||||
start_index = 1 + count * KCOV_WORDS_PER_CMP;
|
||||
end_pos = (start_index + KCOV_WORDS_PER_CMP) * sizeof(u64);
|
||||
if (likely(end_pos <= max_pos)) {
|
||||
/* See comment in __sanitizer_cov_trace_pc(). */
|
||||
WRITE_ONCE(area[0], count + 1);
|
||||
barrier();
|
||||
area[start_index] = type;
|
||||
area[start_index + 1] = arg1;
|
||||
area[start_index + 2] = arg2;
|
||||
area[start_index + 3] = ip;
|
||||
WRITE_ONCE(area[0], count + 1);
|
||||
}
|
||||
}
|
||||
|
||||
|
Loading…
Reference in New Issue
Block a user