linux-kernel - Re: [PATCH PREEMPT_RT] kcov: fix locking splat from kcov_remote

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 10 Aug 2021 11:50:32 +0200
From:   Sebastian Andrzej Siewior <bigeasy@...utronix.de>
To:     Clark Williams <williams@...hat.com>
Cc:     Thomas Gleixner <tglx@...utronix.de>,
        Steven Rostedt <rostedt@...dmis.org>,
        Dmitry Vyukov <dvyukov@...gle.com>,
        Andrey Konovalov <andreyknvl@...il.com>,
        kasan-dev@...glegroups.com, linux-kernel@...r.kernel.org
Subject: Re: [PATCH PREEMPT_RT] kcov:  fix locking splat from
 kcov_remote_start()

On 2021-08-09 15:59:09 [-0500], Clark Williams wrote:
> Saw the following splat on 5.14-rc4-rt5 with:
…
> Change kcov_remote_lock from regular spinlock_t to raw_spinlock_t so that
> we don't get "sleeping function called from invalid context" on PREEMPT_RT kernel.

I'm not entirely happy with that:
- kcov_remote_start() decouples spin_lock_irq() and does local_irq_save()
  + spin_lock() which shouldn't be done as per
      Documentation/locking/locktypes.rst
  I would prefer to see the local_irq_save() replaced by
  local_lock_irqsave() so we get a context on what is going on.

- kcov_remote_reset() has a kfree() with that irq-off lock acquired.

- kcov_remote_add() has a kmalloc() and is invoked with that irq-off
  lock acquired.

- kcov_remote_area_put() uses INIT_LIST_HEAD() for no reason (just
  happen to notice).

- kcov_remote_stop() does local_irq_save() + spin_lock(&kcov->lock);.
  This should also create a splat.

- With lock kcov_remote_lock acquired there is a possible
  hash_for_each_safe() and list_for_each() iteration. I don't know what
  the limits are here but with a raw_spinlock_t it will contribute to
  the maximal latency. 

> Signed-off-by: Clark Williams <williams@...hat.com>

Sebastian