syzkaller icon indicating copy to clipboard operation
syzkaller copied to clipboard

pkg/cover: not all coverage points have matching kcov callbacks

Open ramosian-glider opened this issue 1 year ago • 1 comments

An attempt to land https://github.com/google/syzkaller/commit/3392690e404b6ba5022825d33259bc2e9e89eb53 failed, because for many builds it turned out that kcov returned coverage data that didn't match any callbacks in the binaries.

It turned out that in some cases _RET_IP_ - 5 in __sanitizer_cov_trace_pc() does not point to call ... <__sanitizer_cov_trace_pc>, i.e. the coverage callback is called from elsewhere.

At least some of such cases are tail calls of __sanitizer_cov_trace_pc() from other functions. Dmitry pointed out that there's a bug in GCC: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=90746 that is only fixed in gcc-14. Until we switch to it on syzbot, we are unable to always verify that the coverage points are correct.

ramosian-glider avatar Jan 19 '24 11:01 ramosian-glider

The problem does not reproduce with Clang builds, so for now we can enforce the consistency checks for Clang only.

ramosian-glider avatar Jan 22 '24 11:01 ramosian-glider