Messages in this thread Patch in this message | | | Date | Tue, 8 May 2018 15:51:58 -0700 | From | Andrew Morton <> | Subject | Re: [PATCH 2/3] kcov: prefault the kcov_area |
| |
On Fri, 4 May 2018 14:55:34 +0100 Mark Rutland <mark.rutland@arm.com> wrote:
> On many architectures the vmalloc area is lazily faulted in upon first > access. This is problematic for KCOV, as __sanitizer_cov_trace_pc > accesses the (vmalloc'd) kcov_area, and fault handling code may be > instrumented. If an access to kcov_area faults, this will result in > mutual recursion through the fault handling code and > __sanitizer_cov_trace_pc(), eventually leading to stack corruption > and/or overflow. > > We can avoid this by faulting in the kcov_area before > __sanitizer_cov_trace_pc() is permitted to access it. Once it has been > faulted in, it will remain present in the process page tables, and will > not fault again. > > ... > > --- a/kernel/kcov.c > +++ b/kernel/kcov.c > @@ -324,6 +324,17 @@ static int kcov_close(struct inode *inode, struct file *filep) > return 0; > } > > +static void kcov_fault_in_area(struct kcov *kcov)
It would be nice to have a comment here explaining why the function exists.
umm, this?
--- a/kernel/kcov.c~kcov-prefault-the-kcov_area-fix-fix +++ a/kernel/kcov.c @@ -324,6 +324,10 @@ static int kcov_close(struct inode *inod return 0; } +/* + * fault in a lazily-faulted vmalloc area, to avoid recursion issues if the + * vmalloc fault handler itself is instrumented. + */ static void kcov_fault_in_area(struct kcov *kcov) { unsigned long stride = PAGE_SIZE / sizeof(unsigned long); > +{ > + unsigned long stride = PAGE_SIZE / sizeof(unsigned long); > + unsigned long *area = kcov->area; > + unsigned long offset; > + > + for (offset = 0; offset < kcov->size; offset += stride) { > + READ_ONCE(area[offset]); > + } > +}
| |