Re: [gcov] 1391efa952: BUG:KASAN:slab-out-of-bounds_in_gcov_info_add

[Johannes Berg <johannes@sipsolutions.net>]

On Thu, 2021-11-25 at 09:48 -0800, Linus Torvalds wrote:
> 
> The report isn't wonderful (the KASAN report is garbled, and the "code
> disassembly" is not from the actual KASAN report, it's from the return
> to user space code), but it blames a 8-byte read at
> 
>     gcov_info_add (kernel/gcov/clang.c:328)
> 
> which in that kernel version (1391efa952e8) is that
> 
>         for (i = 0; i < sfn_ptr->num_counters; i++)
> ->              dfn_ptr->counters[i] += sfn_ptr->counters[i];
> 
> and so it looks like that 'sfn_ptr->counters[i]' access is the problem case.
> 

Not sure. Note the +=, so it has to read both sides first. Would KASAN
report the follow-up write as well?

The loop is going to sfn_ptr->num_counters, so that seems less likely to
get confused, unless clang has a bug, which is where the original
counters and num_counters comes from, afaict?

I mean, we seem to always consistently allocate counters from
num_counters for these things, but here we use sfn_ptr and dfn_ptr, and
the loop checks only dfn_ptr. Just being suspicious I guess, but I
really don't know anything about this. All I know that vmalloc made this
really slow on ARCH=um and so I converted all of this ... :)

johannes