On Mon, 28 Jul 2025 at 20:43, Soham Bagchi <soham.bagchi@xxxxxxxx> wrote: > > KCOV Remote uses two separate memory buffers, one private to the kernel > space (kcov_remote_areas) and the second one shared between user and > kernel space (kcov->area). After every pair of kcov_remote_start() and > kcov_remote_stop(), the coverage data collected in the > kcov_remote_areas is copied to kcov->area so the user can read the > collected coverage data. This memcpy() is located in kcov_move_area(). > > The load/store pattern on the kernel-side [1] is: > > ``` > /* dst_area === kcov->area, dst_area[0] is where the count is stored */ > dst_len = READ_ONCE(*(unsigned long *)dst_area); > ... > memcpy(dst_entries, src_entries, ...); > ... > WRITE_ONCE(*(unsigned long *)dst_area, dst_len + entries_moved); > ``` > > And for the user [2]: > > ``` > /* cover is equivalent to kcov->area */ > n = __atomic_load_n(&cover[0], __ATOMIC_RELAXED); > ``` > > Without a write-memory barrier, the atomic load for the user can > potentially read fresh values of the count stored at cover[0], > but continue to read stale coverage data from the buffer itself. > Hence, we recommend adding a write-memory barrier between the > memcpy() and the WRITE_ONCE() in kcov_move_area(). > > [1] https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/kernel/kcov.c?h=master#n978 > [2] https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/Documentation/dev-tools/kcov.rst#n364 > > Signed-off-by: Soham Bagchi <soham.bagchi@xxxxxxxx> Reviewed-by: Marco Elver <elver@xxxxxxxxxx> > --- > kernel/kcov.c | 9 +++++++++ > 1 file changed, 9 insertions(+) > > diff --git a/kernel/kcov.c b/kernel/kcov.c > index 187ba1b80bd..f6ee6d7dc2c 100644 > --- a/kernel/kcov.c > +++ b/kernel/kcov.c > @@ -978,6 +978,15 @@ static void kcov_move_area(enum kcov_mode mode, void *dst_area, > memcpy(dst_entries, src_entries, bytes_to_move); > entries_moved = bytes_to_move >> entry_size_log; > > + /* > + * A write memory barrier is required here, to ensure > + * that the writes from the memcpy() are visible before > + * the count is updated. Without this, it is possible for > + * a user to observe a new count value but stale > + * coverage data. > + */ > + smp_wmb(); > + > switch (mode) { > case KCOV_MODE_TRACE_PC: > WRITE_ONCE(*(unsigned long *)dst_area, dst_len + entries_moved); > -- > 2.34.1 > > -- > You received this message because you are subscribed to the Google Groups "kasan-dev" group. > To unsubscribe from this group and stop receiving emails from it, send an email to kasan-dev+unsubscribe@xxxxxxxxxxxxxxxx. > To view this discussion visit https://groups.google.com/d/msgid/kasan-dev/20250728184318.1839137-1-soham.bagchi%40utah.edu.
