google / syzkaller

syzkaller is an unsupervised coverage-guided kernel fuzzer

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

pkg/cover: not all coverage points have matching kcov callbacks

ramosian-glider opened this issue · comments

An attempt to land 3392690 failed, because for many builds it turned out that kcov returned coverage data that didn't match any callbacks in the binaries.

It turned out that in some cases _RET_IP_ - 5 in __sanitizer_cov_trace_pc() does not point to call ... <__sanitizer_cov_trace_pc>, i.e. the coverage callback is called from elsewhere.

At least some of such cases are tail calls of __sanitizer_cov_trace_pc() from other functions. Dmitry pointed out that there's a bug in GCC: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=90746 that is only fixed in gcc-14. Until we switch to it on syzbot, we are unable to always verify that the coverage points are correct.

The problem does not reproduce with Clang builds, so for now we can enforce the consistency checks for Clang only.