[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CA+fCnZe_fuT2y4ryFeb8A49k19MY3Nct79JCoGwQh0hjcq6bqA@mail.gmail.com>
Date: Wed, 10 Apr 2024 12:56:39 +0200
From: Andrey Konovalov <andreyknvl@...il.com>
To: Johannes Berg <johannes@...solutions.net>, Dmitry Vyukov <dvyukov@...gle.com>
Cc: syzbot <syzbot+0438378d6f157baae1a2@...kaller.appspotmail.com>,
davem@...emloft.net, edumazet@...gle.com, kuba@...nel.org,
linux-kernel@...r.kernel.org, linux-wireless@...r.kernel.org,
netdev@...r.kernel.org, pabeni@...hat.com, syzkaller-bugs@...glegroups.com,
Aleksandr Nogikh <nogikh@...gle.com>
Subject: Re: [syzbot] [wireless?] WARNING in kcov_remote_start (3)
On Thu, Mar 28, 2024 at 12:45 PM Johannes Berg
<johannes@...solutions.net> wrote:
>
> On Thu, 2024-03-28 at 04:00 -0700, syzbot wrote:
> >
> > ------------[ cut here ]------------
> > WARNING: CPU: 1 PID: 2400 at kernel/kcov.c:860 kcov_remote_start+0x549/0x7e0 kernel/kcov.c:860
>
> This is
>
> /*
> * Check that kcov_remote_start() is not called twice in background
> * threads nor called by user tasks (with enabled kcov).
> */
> mode = READ_ONCE(t->kcov_mode);
> if (WARN_ON(in_task() && kcov_mode_enabled(mode))) {
> local_unlock_irqrestore(&kcov_percpu_data.lock, flags);
> return;
> }
>
> but I have no idea what that even means?
>
> > Workqueue: events_unbound cfg80211_wiphy_work
> > RIP: 0010:kcov_remote_start+0x549/0x7e0 kernel/kcov.c:860
> ...
> > Call Trace:
> > <TASK>
> > kcov_remote_start_common include/linux/kcov.h:48 [inline]
> > ieee80211_iface_work+0x21f/0xf10 net/mac80211/iface.c:1654
> > cfg80211_wiphy_work+0x221/0x260 net/wireless/core.c:437
> > process_one_work kernel/workqueue.c:3218 [inline]
> > process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3299
> > worker_thread+0x86d/0xd70 kernel/workqueue.c:3380
>
> It's a worker thread. Was this not intended to be called in threads?
I think the problem is that the KCOV annotations in the NFC code are
buggy: kcov_remote_stop() is never called if the loop in nci_rx_work()
exits on one of the breaks. With the recent addition of the nci_plen()
check, this started happening often. But breaks existed in the loop
before that too.
We need to move kcov_remote_stop() into the loop and call it every
time the loop exits.
Dmitry, could you PTAL and confirm this? You added the annotation for
NFC, AFAICS.
Thanks!
Powered by blists - more mailing lists