Received-SPF: pass (google.com: domain of linux-wireless+bounces-7863-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45d1:ec00::1 as permitted sender) client-ip=2604:1380:45d1:ec00::1;
Precedence: bulk
MIME-Version: 1.0
References: <0000000000007b02500614b66e31@google.com> <550cc81a3dffd07ec1235dc32fd7bbde22d9bf57.camel@sipsolutions.net>
 <CA+fCnZe_fuT2y4ryFeb8A49k19MY3Nct79JCoGwQh0hjcq6bqA@mail.gmail.com>
In-Reply-To: <CA+fCnZe_fuT2y4ryFeb8A49k19MY3Nct79JCoGwQh0hjcq6bqA@mail.gmail.com>
From: Dmitry Vyukov <dvyukov@google.com>
Date: Tue, 21 May 2024 06:43:19 +0200
Message-ID: <CACT4Y+ak6D2tY0b8JOFq4kKvfPRtv+GkFFE23jc6qTrx6mTqVw@mail.gmail.com>
Subject: Re: [syzbot] [wireless?] WARNING in kcov_remote_start (3)
To: Andrey Konovalov <andreyknvl@gmail.com>
Cc: Johannes Berg <johannes@sipsolutions.net>, 
	syzbot <syzbot+0438378d6f157baae1a2@syzkaller.appspotmail.com>, davem@davemloft.net, 
	edumazet@google.com, kuba@kernel.org, linux-kernel@vger.kernel.org, 
	linux-wireless@vger.kernel.org, netdev@vger.kernel.org, pabeni@redhat.com, 
	syzkaller-bugs@googlegroups.com, Aleksandr Nogikh <nogikh@google.com>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Wed, 10 Apr 2024 at 12:56, Andrey Konovalov <andreyknvl@gmail.com> wrote=
:
>
> On Thu, Mar 28, 2024 at 12:45=E2=80=AFPM Johannes Berg
> <johannes@sipsolutions.net> wrote:
> >
> > On Thu, 2024-03-28 at 04:00 -0700, syzbot wrote:
> > >
> > > ------------[ cut here ]------------
> > > WARNING: CPU: 1 PID: 2400 at kernel/kcov.c:860 kcov_remote_start+0x54=
9/0x7e0 kernel/kcov.c:860
> >
> > This is
> >
> >         /*
> >          * Check that kcov_remote_start() is not called twice in backgr=
ound
> >          * threads nor called by user tasks (with enabled kcov).
> >          */
> >         mode =3D READ_ONCE(t->kcov_mode);
> >         if (WARN_ON(in_task() && kcov_mode_enabled(mode))) {
> >                 local_unlock_irqrestore(&kcov_percpu_data.lock, flags);
> >                 return;
> >         }
> >
> > but I have no idea what that even means?
> >
> > > Workqueue: events_unbound cfg80211_wiphy_work
> > > RIP: 0010:kcov_remote_start+0x549/0x7e0 kernel/kcov.c:860
> > ...
> > > Call Trace:
> > >  <TASK>
> > >  kcov_remote_start_common include/linux/kcov.h:48 [inline]
> > >  ieee80211_iface_work+0x21f/0xf10 net/mac80211/iface.c:1654
> > >  cfg80211_wiphy_work+0x221/0x260 net/wireless/core.c:437
> > >  process_one_work kernel/workqueue.c:3218 [inline]
> > >  process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3299
> > >  worker_thread+0x86d/0xd70 kernel/workqueue.c:3380
> >
> > It's a worker thread. Was this not intended to be called in threads?
>
> I think the problem is that the KCOV annotations in the NFC code are
> buggy: kcov_remote_stop() is never called if the loop in nci_rx_work()
> exits on one of the breaks. With the recent addition of the nci_plen()
> check, this started happening often. But breaks existed in the loop
> before that too.
>
> We need to move kcov_remote_stop() into the loop and call it every
> time the loop exits.
>
> Dmitry, could you PTAL and confirm this? You added the annotation for
> NFC, AFAICS.


Missed this before somehow.
The other breaks seems to be from the switch, so should be fine:
https://elixir.bootlin.com/linux/v6.9-rc6/source/net/nfc/nci/core.c#L1528

Tetsuo, thanks for fixing it.