Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

KCOV: traces interrupts #4868

Open
dvyukov opened this issue Jun 4, 2024 · 1 comment
Open

KCOV: traces interrupts #4868

dvyukov opened this issue Jun 4, 2024 · 1 comment
Labels

Comments

@dvyukov
Copy link
Collaborator

dvyukov commented Jun 4, 2024

Turns out KCOV is semi-broken on x86 since May 2020.
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6368558c37107bed35950cfbd994f49de07236dc
Added instrumented kvm_set_cpu_l1tf_flush_l1d() to interrupt entry outside of the official preempt count accounting for irqs, so KCOV think this function runs in task context. This adds the PC at random places in the KCOV trace, and since we hash adjacent PCs, this produces infinite amount of false fuzzing signal.

We could try to add noinstr here:
https://elixir.bootlin.com/linux/v6.10-rc2/source/arch/x86/include/asm/hardirq.h#L72
But it's unclear if it's guaranteed to suppress all of __this_cpu_write as well for both gcc and clang.

@dvyukov dvyukov added the bug label Jun 4, 2024
dvyukov added a commit to dvyukov/syzkaller that referenced this issue Jun 4, 2024
@dvyukov
Copy link
Collaborator Author

dvyukov commented Jun 4, 2024

Wonder if it's possible to call interrupt functions directly... or can we just JMP onto the function?
If it's possible to call it, then we could add a nice boot test: if KCOV config is enabled, call the interrupt function and check that kcov ignored all coverage callbacks. If not panic. Then if we have this in syzbot kernels, they will stack panicking on boot and we immediately notice.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

1 participant