1. Patchew
  2. linux
  3. View series

[PATCH] smp_wmb() in kcov_move_area() after memcpy()

Soham Bagchi posted 1 patch 2 months, 3 weeks ago 
kernel/kcov.c | 9 +++++++++
1 file changed, 9 insertions(+)
[PATCH] smp_wmb() in kcov_move_area() after memcpy()
Posted by Soham Bagchi 2 months, 3 weeks ago 
KCOV Remote uses two separate memory buffers, one private to the kernel
space (kcov_remote_areas) and the second one shared between user and
kernel space (kcov->area). After every pair of kcov_remote_start() and
kcov_remote_stop(), the coverage data collected in the
kcov_remote_areas is copied to kcov->area so the user can read the
collected coverage data. This memcpy() is located in kcov_move_area().

The load/store pattern on the kernel-side [1] is:

```
/* dst_area === kcov->area, dst_area[0] is where the count is stored */
dst_len = READ_ONCE(*(unsigned long *)dst_area);
...
memcpy(dst_entries, src_entries, ...);
...
WRITE_ONCE(*(unsigned long *)dst_area, dst_len + entries_moved);
```

And for the user [2]:

```
/* cover is equivalent to kcov->area */
n = __atomic_load_n(&cover[0], __ATOMIC_RELAXED);
```

Without a write-memory barrier, the atomic load for the user can
potentially read fresh values of the count stored at cover[0],
but continue to read stale coverage data from the buffer itself.
Hence, we recommend adding a write-memory barrier between the
memcpy() and the WRITE_ONCE() in kcov_move_area().

[1] https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/kernel/kcov.c?h=master#n978
[2] https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/Documentation/dev-tools/kcov.rst#n364

Signed-off-by: Soham Bagchi <sohambagchi@outlook.com>
---
 kernel/kcov.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/kernel/kcov.c b/kernel/kcov.c
index 187ba1b80bd..d6f015eff56 100644
--- a/kernel/kcov.c
+++ b/kernel/kcov.c
@@ -978,6 +978,15 @@ static void kcov_move_area(enum kcov_mode mode, void *dst_area,
 	memcpy(dst_entries, src_entries, bytes_to_move);
 	entries_moved = bytes_to_move >> entry_size_log;
 
+	/**
+	 * A write memory barrier is required here, to ensure
+	 * that the writes from the memcpy() are visible before
+	 * the count is updated. Without this, it is possible for
+	 * a user to observe a new count value but stale 
+	 * coverage data.
+	 */
+	smp_wmb();
+
 	switch (mode) {
 	case KCOV_MODE_TRACE_PC:
 		WRITE_ONCE(*(unsigned long *)dst_area, dst_len + entries_moved);
-- 
2.34.1
Re: [PATCH] smp_wmb() in kcov_move_area() after memcpy()
Posted by Marco Elver 2 months, 3 weeks ago 
[+Cc glider@google.com]

On Thu, 17 Jul 2025 at 04:48, Soham Bagchi <sohambagchi@outlook.com> wrote:

Patch title should be something like "kcov: use write barrier after
memcpy() in kcov_move_area()".

> KCOV Remote uses two separate memory buffers, one private to the kernel
> space (kcov_remote_areas) and the second one shared between user and
> kernel space (kcov->area). After every pair of kcov_remote_start() and
> kcov_remote_stop(), the coverage data collected in the
> kcov_remote_areas is copied to kcov->area so the user can read the
> collected coverage data. This memcpy() is located in kcov_move_area().
>
> The load/store pattern on the kernel-side [1] is:
>
> ```
> /* dst_area === kcov->area, dst_area[0] is where the count is stored */
> dst_len = READ_ONCE(*(unsigned long *)dst_area);
> ...
> memcpy(dst_entries, src_entries, ...);
> ...
> WRITE_ONCE(*(unsigned long *)dst_area, dst_len + entries_moved);
> ```
>
> And for the user [2]:
>
> ```
> /* cover is equivalent to kcov->area */
> n = __atomic_load_n(&cover[0], __ATOMIC_RELAXED);
> ```
>
> Without a write-memory barrier, the atomic load for the user can
> potentially read fresh values of the count stored at cover[0],
> but continue to read stale coverage data from the buffer itself.
> Hence, we recommend adding a write-memory barrier between the
> memcpy() and the WRITE_ONCE() in kcov_move_area().
>
> [1] https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/kernel/kcov.c?h=master#n978
> [2] https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/Documentation/dev-tools/kcov.rst#n364
>
> Signed-off-by: Soham Bagchi <sohambagchi@outlook.com>

Thanks for the patch.

Besides the minor nits, this looks good.

> ---
>  kernel/kcov.c | 9 +++++++++
>  1 file changed, 9 insertions(+)
>
> diff --git a/kernel/kcov.c b/kernel/kcov.c
> index 187ba1b80bd..d6f015eff56 100644
> --- a/kernel/kcov.c
> +++ b/kernel/kcov.c
> @@ -978,6 +978,15 @@ static void kcov_move_area(enum kcov_mode mode, void *dst_area,
>         memcpy(dst_entries, src_entries, bytes_to_move);
>         entries_moved = bytes_to_move >> entry_size_log;
>
> +       /**

This is incorrect comment style - this is a kernel-doc comment, but
not appropriate here.

> +        * A write memory barrier is required here, to ensure
> +        * that the writes from the memcpy() are visible before
> +        * the count is updated. Without this, it is possible for
> +        * a user to observe a new count value but stale
> +        * coverage data.
> +        */
> +       smp_wmb();
> +
>         switch (mode) {
>         case KCOV_MODE_TRACE_PC:
>                 WRITE_ONCE(*(unsigned long *)dst_area, dst_len + entries_moved);
> --
> 2.34.1
>
Re: [PATCH] smp_wmb() in kcov_move_area() after memcpy()
Posted by Alexander Potapenko 2 months, 3 weeks ago 
On Thu, Jul 17, 2025 at 9:16 AM Marco Elver <elver@google.com> wrote:
>
> [+Cc glider@google.com]
>
> On Thu, 17 Jul 2025 at 04:48, Soham Bagchi <sohambagchi@outlook.com> wrote:
>
> Patch title should be something like "kcov: use write barrier after
> memcpy() in kcov_move_area()".
>
> > KCOV Remote uses two separate memory buffers, one private to the kernel
> > space (kcov_remote_areas) and the second one shared between user and
> > kernel space (kcov->area). After every pair of kcov_remote_start() and
> > kcov_remote_stop(), the coverage data collected in the
> > kcov_remote_areas is copied to kcov->area so the user can read the
> > collected coverage data. This memcpy() is located in kcov_move_area().
> >
> > The load/store pattern on the kernel-side [1] is:
> >
> > ```
> > /* dst_area === kcov->area, dst_area[0] is where the count is stored */
> > dst_len = READ_ONCE(*(unsigned long *)dst_area);
> > ...
> > memcpy(dst_entries, src_entries, ...);
> > ...
> > WRITE_ONCE(*(unsigned long *)dst_area, dst_len + entries_moved);
> > ```
> >
> > And for the user [2]:
> >
> > ```
> > /* cover is equivalent to kcov->area */
> > n = __atomic_load_n(&cover[0], __ATOMIC_RELAXED);

We shouldn't probably suggest the users to use relaxed loads either.

> > ```
> >
> > Without a write-memory barrier, the atomic load for the user can
> > potentially read fresh values of the count stored at cover[0],
> > but continue to read stale coverage data from the buffer itself.
> > Hence, we recommend adding a write-memory barrier between the
> > memcpy() and the WRITE_ONCE() in kcov_move_area().
> >
> > [1] https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/kernel/kcov.c?h=master#n978
> > [2] https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/Documentation/dev-tools/kcov.rst#n364
> >
> > Signed-off-by: Soham Bagchi <sohambagchi@outlook.com>
Reviewed-by: Alexander Potapenko <glider@google.com>

Patchew 2.1-devel-b67e4c2

© 2016 - 2025 Red Hat, Inc.