timeout(9): fix miscellaneous remote kcov(4) bugs

Commit v1.77 introduced remote kcov support for timeouts.  We need to
tweak a few things to make our support more correct:

- Set to_process for barrier timeouts to the calling thread's parent
  process.  Currently it is uninitialized, so during timeout_run() we
  are passing stack garbage to kcov_remote_enter(9).

- Set to_process to NULL during timeout_set_flags(9).  If in the
  future we forget to properly initialize to_process before reaching
  timeout_run(), we'll pass NULL to kcov_remote_enter(9).

  anton@ says this is harmless.  I assume it is also preferable to
  passing stack garbage.

- Save a copy of to_process on the stack in timeout_run() before
  calling to_func to ensure that we pass the same process pointer
  to kcov_remote_leave(9) upon return.  The timeout may be freely
  modified from to_func, so to_process may have changed when we
  return.

Tested by anton@.

ok anton@

1 files changed, 6 insertions, 3 deletions

diff --git a/sys/kern/kern_timeout.c b/sys/kern/kern_timeout.c
index 407b782bf06..b5393076737 100644
--- a/sys/kern/kern_timeout.c
+++ b/sys/kern/kern_timeout.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: kern_timeout.c,v 1.77 2020/08/01 08:40:20 anton Exp $	*/
+/*	$OpenBSD: kern_timeout.c,v 1.78 2020/08/06 17:54:08 cheloha Exp $	*/
 /*
  * Copyright (c) 2001 Thomas Nordin <nordin@openbsd.org>
  * Copyright (c) 2000-2001 Artur Grabowski <art@openbsd.org>
@@ -240,6 +240,7 @@ timeout_set_flags(struct timeout *to, void (*fn)(void *), void *arg, int flags)
 {
 	to->to_func = fn;
 	to->to_arg = arg;
+	to->to_process = NULL;
 	to->to_flags = flags | TIMEOUT_INITIALIZED;
 }
 
@@ -432,6 +433,7 @@ timeout_barrier(struct timeout *to)
 		struct timeout barrier;
 
 		timeout_set_proc(&barrier, timeout_proc_barrier, &c);
+		barrier.to_process = curproc->p_p;
 
 		mtx_enter(&timeout_mutex);
 		SET(barrier.to_flags, TIMEOUT_ONQUEUE);
@@ -501,11 +503,12 @@ timeout_run(struct timeout *to)
 	mtx_leave(&timeout_mutex);
 	timeout_sync_enter(needsproc);
 #if NKCOV > 0
-	kcov_remote_enter(KCOV_REMOTE_COMMON, to->to_process);
+	struct process *kcov_process = to->to_process;
+	kcov_remote_enter(KCOV_REMOTE_COMMON, kcov_process);
 #endif
 	fn(arg);
 #if NKCOV > 0
-	kcov_remote_leave(KCOV_REMOTE_COMMON, to->to_process);
+	kcov_remote_leave(KCOV_REMOTE_COMMON, kcov_process);
 #endif
 	timeout_sync_leave(needsproc);
 	mtx_enter(&timeout_mutex);