From: Peter Oberparleiter <oberpar@linux.ibm.com>
To: Mukesh Ojha <quic_mojha@quicinc.com>,
Andrew Morton <akpm@linux-foundation.org>
Cc: linux-kernel@vger.kernel.org, llvm@lists.linux.dev,
nathan@kernel.org, ndesaulniers@google.com, trix@redhat.com
Subject: Re: [PATCH v2] gcov: clang: fix the buffer overflow issue
Date: Thu, 10 Nov 2022 16:08:56 +0100 [thread overview]
Message-ID: <94dbb4c5-e895-0909-d231-893812cc9bc0@linux.ibm.com> (raw)
In-Reply-To: <1668020497-13142-1-git-send-email-quic_mojha@quicinc.com>
On 09.11.2022 20:01, Mukesh Ojha wrote:
> Currently, in clang version of gcov code when module is getting removed
> gcov_info_add() incorrectly adds the sfn_ptr->counter to all the
> dst->functions and it result in the kernel panic in below crash report.
> Fix this by properly handling it.
>
> [ 8.899094][ T599] Unable to handle kernel write to read-only memory at virtual address ffffff80461cc000
> [ 8.899100][ T599] Mem abort info:
> [ 8.899102][ T599] ESR = 0x9600004f
> [ 8.899103][ T599] EC = 0x25: DABT (current EL), IL = 32 bits
> [ 8.899105][ T599] SET = 0, FnV = 0
> [ 8.899107][ T599] EA = 0, S1PTW = 0
> [ 8.899108][ T599] FSC = 0x0f: level 3 permission fault
> [ 8.899110][ T599] Data abort info:
> [ 8.899111][ T599] ISV = 0, ISS = 0x0000004f
> [ 8.899113][ T599] CM = 0, WnR = 1
> [ 8.899114][ T599] swapper pgtable: 4k pages, 39-bit VAs, pgdp=00000000ab8de000
> [ 8.899116][ T599] [ffffff80461cc000] pgd=18000009ffcde003, p4d=18000009ffcde003, pud=18000009ffcde003, pmd=18000009ffcad003, pte=00600000c61cc787
> [ 8.899124][ T599] Internal error: Oops: 9600004f [#1] PREEMPT SMP
> [ 8.899265][ T599] Skip md ftrace buffer dump for: 0x1609e0
> ....
> ..,
> [ 8.899544][ T599] CPU: 7 PID: 599 Comm: modprobe Tainted: G S OE 5.15.41-android13-8-g38e9b1af6bce #1
> [ 8.899547][ T599] Hardware name: XXX (DT)
> [ 8.899549][ T599] pstate: 82400005 (Nzcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
> [ 8.899551][ T599] pc : gcov_info_add+0x9c/0xb8
> [ 8.899557][ T599] lr : gcov_event+0x28c/0x6b8
> [ 8.899559][ T599] sp : ffffffc00e733b00
> [ 8.899560][ T599] x29: ffffffc00e733b00 x28: ffffffc00e733d30 x27: ffffffe8dc297470
> [ 8.899563][ T599] x26: ffffffe8dc297000 x25: ffffffe8dc297000 x24: ffffffe8dc297000
> [ 8.899566][ T599] x23: ffffffe8dc0a6200 x22: ffffff880f68bf20 x21: 0000000000000000
> [ 8.899569][ T599] x20: ffffff880f68bf00 x19: ffffff8801babc00 x18: ffffffc00d7f9058
> [ 8.899572][ T599] x17: 0000000000088793 x16: ffffff80461cbe00 x15: 9100052952800785
> [ 8.899575][ T599] x14: 0000000000000200 x13: 0000000000000041 x12: 9100052952800785
> [ 8.899577][ T599] x11: ffffffe8dc297000 x10: ffffffe8dc297000 x9 : ffffff80461cbc80
> [ 8.899580][ T599] x8 : ffffff8801babe80 x7 : ffffffe8dc2ec000 x6 : ffffffe8dc2ed000
> [ 8.899583][ T599] x5 : 000000008020001f x4 : fffffffe2006eae0 x3 : 000000008020001f
> [ 8.899586][ T599] x2 : ffffff8027c49200 x1 : ffffff8801babc20 x0 : ffffff80461cb3a0
> [ 8.899589][ T599] Call trace:
> [ 8.899590][ T599] gcov_info_add+0x9c/0xb8
> [ 8.899592][ T599] gcov_module_notifier+0xbc/0x120
> [ 8.899595][ T599] blocking_notifier_call_chain+0xa0/0x11c
> [ 8.899598][ T599] do_init_module+0x2a8/0x33c
> [ 8.899600][ T599] load_module+0x23cc/0x261c
> [ 8.899602][ T599] __arm64_sys_finit_module+0x158/0x194
> [ 8.899604][ T599] invoke_syscall+0x94/0x2bc
> [ 8.899607][ T599] el0_svc_common+0x1d8/0x34c
> [ 8.899609][ T599] do_el0_svc+0x40/0x54
> [ 8.899611][ T599] el0_svc+0x94/0x2f0
> [ 8.899613][ T599] el0t_64_sync_handler+0x88/0xec
> [ 8.899615][ T599] el0t_64_sync+0x1b4/0x1b8
> [ 8.899618][ T599] Code: f905f56c f86e69ec f86e6a0f 8b0c01ec (f82e6a0c)
> [ 8.899620][ T599] ---[ end trace ed5218e9e5b6e2e6 ]---
>
> Signed-off-by: Mukesh Ojha <quic_mojha@quicinc.com>
Looks good to me! Successfully tested on s390.
Fixes: e178a5beb369 ("gcov: clang support")
Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Tested-by: Peter Oberparleiter <oberpar@linux.ibm.com>
And I'm not sure if this is strictly needed, but we could also add:
Cc: <stable@vger.kernel.org> # 5.2+
@Andrew: could you pick this up via your tree?
> ---
> v1..v2:
> - Addressed Peter O. comment.
>
> kernel/gcov/clang.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/kernel/gcov/clang.c b/kernel/gcov/clang.c
> index cbb0bed..7670a81 100644
> --- a/kernel/gcov/clang.c
> +++ b/kernel/gcov/clang.c
> @@ -280,6 +280,8 @@ void gcov_info_add(struct gcov_info *dst, struct gcov_info *src)
>
> for (i = 0; i < sfn_ptr->num_counters; i++)
> dfn_ptr->counters[i] += sfn_ptr->counters[i];
> +
> + sfn_ptr = list_next_entry(sfn_ptr, head);
> }
> }
>
--
Peter Oberparleiter
Linux on IBM Z Development - IBM Germany R&D
prev parent reply other threads:[~2022-11-10 15:09 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-11-09 19:01 [PATCH v2] gcov: clang: fix the buffer overflow issue Mukesh Ojha
2022-11-10 15:08 ` Peter Oberparleiter [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=94dbb4c5-e895-0909-d231-893812cc9bc0@linux.ibm.com \
--to=oberpar@linux.ibm.com \
--cc=akpm@linux-foundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=llvm@lists.linux.dev \
--cc=nathan@kernel.org \
--cc=ndesaulniers@google.com \
--cc=quic_mojha@quicinc.com \
--cc=trix@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox