• Mark Rutland's avatar
    kcsan: Report observed value changes · 7bbe6dc0
    Mark Rutland authored
    When a thread detects that a memory location was modified without its
    watchpoint being hit, the report notes that a change was detected, but
    does not provide concrete values for the change. Knowing the concrete
    values can be very helpful in tracking down any racy writers (e.g. as
    specific values may only be written in some portions of code, or under
    certain conditions).
    
    When we detect a modification, let's report the concrete old/new values,
    along with the access's mask of relevant bits (and which relevant bits
    were modified). This can make it easier to identify potential racy
    writers. As the snapshots are at most 8 bytes, we can only report values
    for acceses up to this size, but this appears to cater for the common
    case.
    
    When we detect a race via a watchpoint, we may or may not have concrete
    values for the modification. To be helpful, let's attempt to log them
    when we do as they can be ignored where irrelevant.
    
    The resulting reports appears as follows, with values zero-padded to the
    access width:
    
    | ==================================================================
    | BUG: KCSAN: data-race in el0_svc_common+0x34/0x25c arch/arm64/kernel/syscall.c:96
    |
    | race at unknown origin, with read to 0xffff00007ae6aa00 of 8 bytes by task 223 on cpu 1:
    |  el0_svc_common+0x34/0x25c arch/arm64/kernel/syscall.c:96
    |  do_el0_svc+0x48/0xec arch/arm64/kernel/syscall.c:178
    |  el0_svc arch/arm64/kernel/entry-common.c:226 [inline]
    |  el0_sync_handler+0x1a4/0x390 arch/arm64/kernel/entry-common.c:236
    |  el0_sync+0x140/0x180 arch/arm64/kernel/entry.S:674
    |
    | value changed: 0x0000000000000000 -> 0x0000000000000002
    |
    | Reported by Kernel Concurrency Sanitizer on:
    | CPU: 1 PID: 223 Comm: syz-executor.1 Not tainted 5.8.0-rc3-00094-ga73f923ecc8e-dirty #3
    | Hardware name: linux,dummy-virt (DT)
    | ==================================================================
    
    If an access mask is set, it is shown underneath the "value changed"
    line as "bits changed: 0x<bits changed> with mask 0x<non-zero mask>".
    Signed-off-by: default avatarMark Rutland <mark.rutland@arm.com>
    [ elver@google.com: align "value changed" and "bits changed" lines,
      which required massaging the message; do not print bits+mask if no
      mask set. ]
    Signed-off-by: default avatarMarco Elver <elver@google.com>
    Signed-off-by: default avatarPaul E. McKenney <paulmck@kernel.org>
    7bbe6dc0
core.c 36.6 KB