On Fri, May 06 2022 at 16:52, Alexander Potapenko wrote: > On Thu, May 5, 2022 at 11:56 PM Thomas Gleixner <tglx@xxxxxxxxxxxxx> wrote: >> @@ -452,6 +455,7 @@ irqentry_state_t noinstr irqentry_nmi_en >> rcu_nmi_enter(); >> >> instrumentation_begin(); >> + unpoison(regs); >> trace_hardirqs_off_finish(); >> ftrace_nmi_enter(); >> instrumentation_end(); >> >> As I said: 4 places :) > > These four instances still do not look sufficient. > Right now I am seeing e.g. reports with the following stack trace: > > BUG: KMSAN: uninit-value in irqtime_account_process_tick+0x255/0x580 > kernel/sched/cputime.c:382 > irqtime_account_process_tick+0x255/0x580 kernel/sched/cputime.c:382 > account_process_tick+0x98/0x450 kernel/sched/cputime.c:476 > update_process_times+0xe4/0x3e0 kernel/time/timer.c:1786 > tick_sched_handle kernel/time/tick-sched.c:243 > tick_sched_timer+0x83e/0x9e0 kernel/time/tick-sched.c:1473 > __run_hrtimer+0x518/0xe50 kernel/time/hrtimer.c:1685 > __hrtimer_run_queues kernel/time/hrtimer.c:1749 > hrtimer_interrupt+0x838/0x15a0 kernel/time/hrtimer.c:1811 > local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1086 > __sysvec_apic_timer_interrupt+0x1ae/0x680 arch/x86/kernel/apic/apic.c:1103 > sysvec_apic_timer_interrupt+0x95/0xc0 arch/x86/kernel/apic/apic.c:1097 > ... > (uninit creation stack trace is irrelevant here, because it is some > random value from the stack) > > sysvec_apic_timer_interrupt() receives struct pt_regs from > uninstrumented code, so regs can be partially uninitialized. > They are not passed down the call stack directly, but are instead > saved by set_irq_regs() in sysvec_apic_timer_interrupt() and loaded by > get_irq_regs() in tick_sched_timer(). sysvec_apic_timer_interrupt() invokes irqentry_enter() _before_ set_irq_regs() and irqentry_enter() unpoisons @reg. Confused...
