tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

x86/kexec: Disable KCOV instrumentation after load_segments()

The load_segments() function changes segment registers, invalidating GS base
(which KCOV relies on for per-cpu data). When CONFIG_KCOV is enabled, any
subsequent instrumented C code call (e.g. native_gdt_invalidate()) begins
crashing the kernel in an endless loop.

To reproduce the problem, it's sufficient to do kexec on a KCOV-instrumented
kernel:

$ kexec -l /boot/otherKernel
$ kexec -e

The real-world context for this problem is enabling crash dump collection in
syzkaller. For this, the tool loads a panic kernel before fuzzing and then
calls makedumpfile after the panic. This workflow requires both CONFIG_KEXEC
and CONFIG_KCOV to be enabled simultaneously.

Adding safeguards directly to the KCOV fast-path (__sanitizer_cov_trace_pc())
is also undesirable as it would introduce an extra performance overhead.

Disabling instrumentation for the individual functions would be too fragile,
so disable KCOV instrumentation for the entire machine_kexec_64.c and
physaddr.c. If coverage-guided fuzzing ever needs these components in the
future, other approaches should be considered.

The problem is not relevant for 32 bit kernels as CONFIG_KCOV is not supported
there.

[ bp: Space out comment for better readability. ]

Fixes: 0d345996e4cb ("x86/kernel: increase kcov coverage under arch/x86/kernel folder")
Signed-off-by: Aleksandr Nogikh <nogikh@google.com>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Reviewed-by: Dmitry Vyukov <dvyukov@google.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260325154825.551191-1-nogikh@google.com

authored by

Aleksandr Nogikh and committed by
Borislav Petkov (AMD) 917e3ad3 7aaa8047

+16
+14
arch/x86/kernel/Makefile
··· 44 44 KCOV_INSTRUMENT_unwind_frame.o := n 45 45 KCOV_INSTRUMENT_unwind_guess.o := n 46 46 47 + # Disable KCOV to prevent crashes during kexec: load_segments() invalidates 48 + # the GS base, which KCOV relies on for per-CPU data. 49 + # 50 + # As KCOV and KEXEC compatibility should be preserved (e.g. syzkaller is 51 + # using it to collect crash dumps during kernel fuzzing), disabling 52 + # KCOV for KEXEC kernels is not an option. Selectively disabling KCOV 53 + # instrumentation for individual affected functions can be fragile, while 54 + # adding more checks to KCOV would slow it down. 55 + # 56 + # As a compromise solution, disable KCOV instrumentation for the whole 57 + # source code file. If its coverage is ever needed, other approaches 58 + # should be considered. 59 + KCOV_INSTRUMENT_machine_kexec_64.o := n 60 + 47 61 CFLAGS_head32.o := -fno-stack-protector 48 62 CFLAGS_head64.o := -fno-stack-protector 49 63 CFLAGS_irq.o := -I $(src)/../include/asm/trace
+2
arch/x86/mm/Makefile
··· 4 4 KCOV_INSTRUMENT_mem_encrypt.o := n 5 5 KCOV_INSTRUMENT_mem_encrypt_amd.o := n 6 6 KCOV_INSTRUMENT_pgprot.o := n 7 + # See the "Disable KCOV" comment in arch/x86/kernel/Makefile. 8 + KCOV_INSTRUMENT_physaddr.o := n 7 9 8 10 KASAN_SANITIZE_mem_encrypt.o := n 9 11 KASAN_SANITIZE_mem_encrypt_amd.o := n