Message-ID: <d4e9d61034eb6dd3afccc3d30e995ff89701e3b4.camel@sipsolutions.net>
Subject: Re: [gcov] 1391efa952: BUG:KASAN:slab-out-of-bounds_in_gcov_info_add
From:   Johannes Berg <johannes@sipsolutions.net>
To:     Linus Torvalds <torvalds@linux-foundation.org>,
        Greg Hackmann <ghackmann@android.com>,
        Tri Vo <trong@android.com>,
        Peter Oberparleiter <oberpar@linux.ibm.com>
Cc:     "Sang, Oliver" <oliver.sang@intel.com>,
        Nick Desaulniers <ndesaulniers@google.com>,
        Andrew Morton <akpm@linux-foundation.org>,
        LKML <linux-kernel@vger.kernel.org>,
        "lkp@lists.01.org" <lkp@lists.01.org>, lkp <lkp@intel.com>
Date:   Thu, 25 Nov 2021 21:42:47 +0100
In-Reply-To: <CAHk-=wj7OZQcHPdcTz1cAXN1fdRJ4kqqeQHqOTP8CChHHS=bjQ@mail.gmail.com>
References: <20211125142622.GD3109@xsang-OptiPlex-9020>
         <a5274ba1922d5eaf9568886191e0a05bdfc55506.camel@sipsolutions.net>
         <CAHk-=wj7OZQcHPdcTz1cAXN1fdRJ4kqqeQHqOTP8CChHHS=bjQ@mail.gmail.com>
Content-Type: text/plain; charset="UTF-8"
User-Agent: Evolution 3.42.1 (3.42.1-1.fc35) 
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Precedence: bulk

On Thu, 2021-11-25 at 09:48 -0800, Linus Torvalds wrote:
> 
> The report isn't wonderful (the KASAN report is garbled, and the "code
> disassembly" is not from the actual KASAN report, it's from the return
> to user space code), but it blames a 8-byte read at
> 
>     gcov_info_add (kernel/gcov/clang.c:328)
> 
> which in that kernel version (1391efa952e8) is that
> 
>         for (i = 0; i < sfn_ptr->num_counters; i++)
> ->              dfn_ptr->counters[i] += sfn_ptr->counters[i];
> 
> and so it looks like that 'sfn_ptr->counters[i]' access is the problem case.
> 

Not sure. Note the +=, so it has to read both sides first. Would KASAN
report the follow-up write as well?

The loop is going to sfn_ptr->num_counters, so that seems less likely to
get confused, unless clang has a bug, which is where the original
counters and num_counters comes from, afaict?

I mean, we seem to always consistently allocate counters from
num_counters for these things, but here we use sfn_ptr and dfn_ptr, and
the loop checks only dfn_ptr. Just being suspicious I guess, but I
really don't know anything about this. All I know that vmalloc made this
really slow on ARCH=um and so I converted all of this ... :)

johannes