From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from galois.linutronix.de (Galois.linutronix.de [193.142.43.55]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8E1AB349CC0 for ; Fri, 10 Jul 2026 14:24:20 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=193.142.43.55 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783693462; cv=none; b=HEZaZ6lxakcwdL4zWa2hgPzwfOkgDu4/Gv4mwM32oTGw4VU5ELe5xDEkeTlq2Cvgzm37NDhISjy0HHZlUAmUFrrDDPSGgbY10AAQeYIWiLsU1otrtNpRpQrOA0b1pgY4XiZXmrrMbJRt8zxESrdG7H7TTEwEq1XmWRdyPQNeYO0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783693462; c=relaxed/simple; bh=RMkc3haTej6UIXXYMgdJnHR6dBvkim5gN3Z2UHMsA/k=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=ORoOIhf6V03/wHHqyGNZdSpsuEBCm/yTgl+bsYZjNjHLkK9S3aicShvlGA5CbpKYRoUYpIGrSY9mZ0btxI1xDcMKoQ8bczFTrL46ilf5naIXnuWRNWEJkHGx5sDDOa15Ig2BMHKLwtfP+n67wRExMt/N5JEkEDxvGVgKsndh4x8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linutronix.de; spf=pass smtp.mailfrom=linutronix.de; dkim=pass (2048-bit key) header.d=linutronix.de header.i=@linutronix.de header.b=wLQtgFm4; dkim=permerror (0-bit key) header.d=linutronix.de header.i=@linutronix.de header.b=y4becw6p; arc=none smtp.client-ip=193.142.43.55 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linutronix.de Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linutronix.de Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=linutronix.de header.i=@linutronix.de header.b="wLQtgFm4"; dkim=permerror (0-bit key) header.d=linutronix.de header.i=@linutronix.de header.b="y4becw6p" Date: Fri, 10 Jul 2026 16:24:16 +0200 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020; t=1783693458; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=tFZYWjdDLwQU6/FNaPdtlxng0G64MOsVB8C09nmBnKI=; b=wLQtgFm4ALumQ73rwYlPX2q7Z/4jfuI0fpOZ7pw83Z2cx3bbWSivHv13lx83k755eEC8KF hpXd8+DqizqpGdaIZobo7pyoY6Vy9gsAkpMA7UWe0l3biXu2n8xkOjiwdY17Uo3rH1dsCt 46zy2s5Jkz3xDYU5WGS2R+bhgsKdW5EVeOdE1OFazWJaOiLURefa7Q4e/kpsJa3b4x/Cou kIRmVxPokTNCi8ePzOCJOEj4+G0UBorWkHXPYNq6ygaIK7maENTUvs3iSo07y5tXKKwa6z i0GtpYa6mMhWoi2lm/cSeMZMhAz1BdbdV1S8K3wzR9jMcpdtMekhMJNdOBQ5eg== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020e; t=1783693458; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=tFZYWjdDLwQU6/FNaPdtlxng0G64MOsVB8C09nmBnKI=; b=y4becw6pV8MQy/K7VHYzQ80MTzcKt8mKO7Hnx1iCOjuu4iDuN3T82faltZdrYfdwxvOYdN haacPEmnwKGyEqAQ== From: Sebastian Andrzej Siewior To: Tetsuo Handa Cc: Alexander Potapenko , Dmitry Vyukov , kasan-dev , LKML , Alan Stern , Andrew Morton , Andrey Konovalov , Andrey Konovalov , Clark Williams , Greg Kroah-Hartman , Marco Elver , Roman Gushchin Subject: Re: [PATCH v6] kcov: fix data corruption and race conditions on PREEMPT_RT by moving saved remote state to task_struct Message-ID: <20260710142416.YnGT-pdK@linutronix.de> References: <20260521181450.Ax-chxOE@linutronix.de> <88c3951e-f733-4733-ab81-4feeb5de6b51@I-love.SAKURA.ne.jp> <7aff4d71-a6a0-4898-9491-2a3973e9d0cc@I-love.SAKURA.ne.jp> <7eb7e90a-69a7-4290-93ff-cc0f37ab69f4@I-love.SAKURA.ne.jp> <8eef915c-96d4-4901-b404-60a19d5f9f54@I-love.SAKURA.ne.jp> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: On 2026-07-10 20:32:27 [+0900], Tetsuo Handa wrote: > syzbot is reporting KCOV state corruption on PREEMPT_RT kernels, for the > temporary storage used for saving/restoring remote KCOV state is currently > allocated as the per-CPU area. > > On PREEMPT_RT kernels, softirq handlers run as preemptible task threads > (e.g., ksoftirqd). If a softirq context preempts a task running a remote > KCOV session, it safely saves the task's state into the per-CPU area. > However, if that softirq thread is subsequently preempted by a higher- > priority softirq thread on the same CPU, the second softirq will overwrite > the same per-CPU area, permanently destroying the original task's KCOV > state. > > Fix this data corruption by moving the temporary storage from the per-CPU > area to the per-thread area. Since each softirq thread now owns its own > task context, nested softirq preemption no longer causes data overwrites. > > Note that while the temporary storage is now on a per-thread basis, the > per-CPU kcov_percpu_data.lock must be retained, for we need to ensure that > kcov_remote_start() and kcov_remote_stop() operate atomically without > racing against asynchronous interrupts that manipulate the current task's > KCOV state. > > Reported-by: syzbot+3f51ad7ac3ae57a6fdcc@syzkaller.appspotmail.com > Closes: https://syzkaller.appspot.com/bug?extid=3f51ad7ac3ae57a6fdcc > Reported-by: syzbot+47cf95ca1f9dcca872c8@syzkaller.appspotmail.com > Closes: https://syzkaller.appspot.com/bug?extid=47cf95ca1f9dcca872c8 > Reported-by: syzbot+8a173e13208949931dc7@syzkaller.appspotmail.com > Closes: https://syzkaller.appspot.com/bug?extid=8a173e13208949931dc7 > Reported-by: syzbot+90984d3713722683112e@syzkaller.appspotmail.com > Closes: https://syzkaller.appspot.com/bug?extid=90984d3713722683112e > Analyzed-by: AI Mode in Google Search (no mail address) > Fixes: 5ff3b30ab57d ("kcov: collect coverage from interrupts") > Signed-off-by: Tetsuo Handa No complains from my side. Thank you. Sebastian