Messages in this thread | | | From | Dmitry Vyukov <> | Date | Tue, 17 Dec 2019 14:02:40 +0100 | Subject | Re: [BUG] kernel: kcov: a possible sleep-in-atomic-context bug in kcov_ioctl() |
| |
On Tue, Dec 17, 2019 at 1:56 PM Jia-Ju Bai <baijiaju1990@gmail.com> wrote: > > The kernel may sleep while holding a spinlock. > The function call path (from bottom to top) in Linux 4.19 is: > > kernel/kcov.c, 237: > vfree in kcov_put > kernel/kcov.c, 413: > kcov_put in kcov_ioctl_locked > kernel/kcov.c, 427: > kcov_ioctl_locked in kcov_ioctl > kernel/kcov.c, 426: > spin_lock in kcov_ioctl > > vfree() can sleep at runtime. > > I am not sure how to properly fix this possible bug, so I only report it. > A possible way is to replace vfree() with kfree(), and replace related > calls to vmalloc() with kmalloc(). > > This bug is found by a static analysis tool STCheck written by myself.
Hi Jia-Ju,
Are you sure kcov_ioctl_locked can really release the descriptor? It happens in the context of ioctl, which means there is an open reference for the file descriptor. So ioctl should not do vfree I would assume.
| |