runtime: make SIGPROF skip stacks that are being copied

sigprof tracebacks the stack across systemstack switches to make
profile tracebacks more complete. However, it does this even if the
user stack is currently being copied, which means it may be in an
inconsistent state that will cause the traceback to panic.

One specific way this can happen is during stack shrinking. Some
goroutine blocks for STW, then enters gchelper, which then assists
with root marking. If that root marking happens to pick the original
goroutine and its stack needs to be shrunk, it will begin to copy that
stack. During this copy, the stack is generally inconsistent and, in
particular, the actual locations of the stack barriers and their
recorded locations are temporarily out of sync. If a SIGPROF happens
during this inconsistency, it will walk the stack all the way back to
the blocked goroutine and panic when it fails to unwind the stack
barriers.

Fix this by disallowing jumping to the user stack during SIGPROF if
that user stack is in the process of being copied.

Fixes #12932.

Change-Id: I9ef694c2c01e3653e292ce22612418dd3daff1b4
Reviewed-on: https://go-review.googlesource.com/16819
Reviewed-by: Daniel Morsing <daniel.morsing@gmail.com>
Run-TryBot: Austin Clements <austin@google.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>

diff --git a/src/runtime/proc.go b/src/runtime/proc.go
index 11ecdae5ae4b35ee9632c3631aafd92e2e3adfd0..7da99e7e9427248cfdf95e6625f379649a017fd3 100644 (file)
--- a/src/runtime/proc.go
+++ b/src/runtime/proc.go
@@ -2913,7 +2913,14 @@ func sigprof(pc, sp, lr uintptr, gp *g, mp *m) {
                // This is especially important on windows, since all syscalls are cgo calls.
                n = gentraceback(mp.curg.syscallpc, mp.curg.syscallsp, 0, mp.curg, 0, &stk[0], len(stk), nil, nil, 0)
        } else if traceback {
-               n = gentraceback(pc, sp, lr, gp, 0, &stk[0], len(stk), nil, nil, _TraceTrap|_TraceJumpStack)
+               flags := uint(_TraceTrap | _TraceJumpStack)
+               if gp.m.curg != nil && readgstatus(gp.m.curg) == _Gcopystack {
+                       // We can traceback the system stack, but
+                       // don't jump to the potentially inconsistent
+                       // user stack.
+                       flags &^= _TraceJumpStack
+               }
+               n = gentraceback(pc, sp, lr, gp, 0, &stk[0], len(stk), nil, nil, flags)
        }
        if !traceback || n <= 0 {
                // Normal traceback is impossible or has failed.