Tetsuo Handa
2eed77fdcb
kcov: fix data corruption and race conditions on PREEMPT_RT
syzbot is reporting KCOV state corruption on PREEMPT_RT kernels, for the
temporary storage used for saving/restoring remote KCOV state is currently
allocated as the per-CPU area.
On PREEMPT_RT kernels, softirq handlers run as preemptible task threads
(e.g., ksoftirqd). If a softirq context preempts a task running a remote
KCOV session, it safely saves the task's state into the per-CPU area.
However, if that softirq thread is subsequently preempted by a higher-
priority softirq thread on the same CPU, the second softirq will overwrite
the same per-CPU area, permanently destroying the original task's KCOV
state.
Fix this data corruption by moving the temporary storage from the per-CPU
area to the per-thread area. Since each softirq thread now owns its own
task context, nested softirq preemption no longer causes data overwrites.
Note that while the temporary storage is now on a per-thread basis, the
per-CPU kcov_percpu_data.lock must be retained, for we need to ensure that
kcov_remote_start() and kcov_remote_stop() operate atomically without
racing against asynchronous interrupts that manipulate the current task's
KCOV state.
It is likely that GFP_KERNEL allocation by vmalloc_node() in kcov_init()
has already called panic() before returning NULL, for there will be no
OOM-killable userspace processes when __init function of built-in module
runs. But this patch also fixes crashing the kernel when vmalloc_node()
in kcov_init() returned NULL, for kcov_init() left per-CPU irq_area == NULL
but kcov_remote_start() depends on per-CPU irq_area != NULL, resulting in
(1) doing vmalloc() in kcov_remote_start() despite !in_task() context
(2) out-of-array-bounds access if (1) succeeded but
kcov->remote_size < CONFIG_KCOV_IRQ_AREA_SIZE
(3) always leak memory allocated by (1), eventually killing all
OOM-killable userspace processes
problems.
Link: https://lore.kernel.org/43552d09-2ce2-4b19-b0d3-a2d1ab952145@I-love.SAKURA.ne.jp
Reported-by: syzbot+3f51ad7ac3ae57a6fdcc@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=3f51ad7ac3ae57a6fdcc
Reported-by: syzbot+47cf95ca1f9dcca872c8@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=47cf95ca1f9dcca872c8
Reported-by: syzbot+8a173e13208949931dc7@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=8a173e13208949931dc7
Reported-by: syzbot+90984d3713722683112e@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=90984d3713722683112e
Analyzed-by: AI Mode in Google Search (no mail address)
Fixes: 5ff3b30ab5 ("kcov: collect coverage from interrupts")
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Reviewed-by: Alexander Potapenko <glider@google.com>
Cc: Alan Stern <stern@rowland.harvard.edu>
Cc: Andrey Konovalov <andreyknvl@gmail.com>
Cc: Christoph Hellwig <hch@infradead.org>
Cc: Clark Williams <williams@redhat.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Marco Elver <elver@google.com>
Cc: Mark Brown <broonie@kernel.org>
Cc: Roman Gushchin <roman.gushchin@linux.dev>
Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-05 11:20:13 -07:00
..
2025-02-09 18:08:11 +08:00
2026-05-28 13:14:23 -07:00
2026-07-09 11:06:22 -04:00
2026-02-21 17:09:51 -08:00
2026-06-09 16:00:11 +02:00
2026-06-16 16:33:57 +05:30
2025-01-24 22:47:28 -08:00
2025-08-16 17:24:31 +08:00
2026-08-03 21:10:07 -07:00
2026-02-21 17:09:51 -08:00
2026-08-03 21:10:16 -07:00
2026-02-21 17:09:51 -08:00
2026-06-18 16:39:31 -07:00
2026-08-03 21:10:11 -07:00
2026-06-15 13:57:13 +05:30
2026-02-21 17:09:51 -08:00
2025-03-16 22:30:49 -07:00
2024-07-03 19:30:23 -07:00
2026-02-21 17:09:51 -08:00
2025-03-26 21:35:28 -07:00
2026-06-21 14:09:49 -07:00
2026-07-14 16:44:40 +02:00
2023-09-19 13:21:33 -07:00
2025-04-11 17:32:37 -07:00
2024-06-24 22:25:06 -07:00
2026-07-23 18:23:45 +03:00
2025-02-28 11:42:34 +01:00
2025-01-22 15:07:01 -05:00
2026-03-05 22:16:08 -05:00
2026-05-28 21:24:43 -07:00
2024-09-01 20:43:33 -07:00
2026-03-27 21:19:48 -07:00
2026-05-28 11:36:53 -04:00
2026-04-01 20:03:07 -04:00
2026-05-28 11:39:16 -04:00
2022-04-26 17:58:51 -04:00
2026-07-01 08:08:27 +09:00
2025-09-13 17:32:53 -07:00
2026-02-21 01:02:28 -08:00
2026-07-10 10:26:58 -06:00
2026-01-20 19:44:15 -08:00
2026-02-05 14:10:00 -08:00
2022-09-01 16:55:35 +02:00
2025-11-21 18:42:01 +00:00
2024-10-30 15:29:59 +01:00
2024-09-01 20:43:29 -07:00
2025-09-08 14:58:50 -07:00
2026-05-28 21:24:50 -07:00
2024-04-09 22:06:00 -07:00
2026-06-21 11:31:28 -07:00
2026-05-26 17:15:30 -04:00
2026-02-21 17:09:51 -08:00
2025-02-24 16:37:23 -05:00
2021-08-19 09:02:55 +09:00
2021-06-22 13:56:43 +02:00
2026-06-22 16:38:57 +02:00
2026-01-05 16:43:33 +01:00
2026-03-27 21:19:43 -07:00
2023-06-09 17:44:17 -07:00
2024-10-02 17:23:23 -04:00
2024-07-28 15:49:18 -07:00
2024-10-02 17:23:23 -04:00
2026-02-22 12:05:31 -08:00
2023-06-09 17:44:17 -07:00
2025-09-22 20:10:58 -07:00
2023-06-09 17:44:15 -07:00
2025-05-05 16:18:09 -05:00
2026-02-21 01:02:28 -08:00
2023-02-02 22:50:01 -08:00
2024-06-24 22:25:11 -07:00
2023-02-02 22:50:01 -08:00
2025-10-05 10:48:33 -07:00
2025-09-13 17:32:52 -07:00
2026-02-21 17:09:51 -08:00
2025-03-25 06:26:55 -07:00
2022-09-11 21:55:10 -07:00
2023-11-25 09:43:18 +01:00
2026-05-28 21:24:57 -07:00
2025-05-11 17:54:06 -07:00
2021-01-03 20:05:18 -05:00
2025-09-13 17:32:46 -07:00
2025-01-12 20:21:00 -08:00
2025-09-22 15:52:44 -04:00
2026-03-23 13:33:51 -04:00
2026-03-23 13:33:51 -04:00
2026-01-26 19:03:46 -08:00
2024-03-13 00:03:21 -07:00
2025-09-28 11:36:13 -07:00
2024-09-09 09:41:47 -04:00
2026-07-07 10:42:28 -04:00
2026-02-21 17:09:51 -08:00
2026-01-20 19:44:19 -08:00
2025-11-06 11:51:04 -05:00
2026-02-21 01:02:28 -08:00
2026-03-27 21:19:42 -07:00
2026-06-17 15:37:47 -07:00
2025-10-14 14:45:22 -07:00
2024-04-22 17:11:20 -03:00
2025-03-01 21:00:22 +01:00
2024-10-29 07:14:29 +00:00
2026-07-01 15:26:29 +02:00
2024-08-20 17:13:40 +02:00
2021-08-19 09:02:55 +09:00
2026-08-03 21:10:09 -07:00
2026-08-05 11:20:13 -07:00
2025-09-21 14:21:58 -07:00
2025-08-28 16:58:46 -07:00
2023-12-05 11:14:40 +01:00
2024-12-17 13:46:53 -07:00
2025-10-27 16:22:02 -07:00
2026-01-07 12:16:03 -08:00
2026-01-26 19:07:09 -08:00
2026-04-09 14:36:52 +02:00
2026-04-09 14:36:52 +02:00
2026-05-28 21:24:49 -07:00
2021-05-19 15:05:11 +02:00
2026-03-30 16:58:33 +02:00
2025-01-25 20:22:23 -08:00
2026-04-02 23:36:22 -07:00
2025-05-27 19:40:34 -07:00
2026-06-03 11:38:47 +02:00
2026-01-05 16:43:33 +01:00
2026-02-21 17:09:51 -08:00
2024-10-14 16:33:24 -05:00
2026-02-21 17:09:51 -08:00
2026-02-21 17:09:51 -08:00
2026-06-21 13:20:19 -07:00
2026-06-02 15:22:14 -07:00
2025-03-16 23:24:14 -07:00
2025-03-19 19:17:58 +01:00
2024-02-22 19:01:55 -08:00
2026-05-28 21:24:59 -07:00
2023-08-18 10:18:55 -07:00
2026-02-22 08:26:33 -08:00
2026-02-12 15:45:57 -08:00
2025-05-11 17:54:13 -07:00
2026-02-21 01:02:28 -08:00
2024-12-11 20:13:00 -08:00
2024-12-11 20:13:00 -08:00
2026-02-21 17:09:51 -08:00
2026-04-02 23:36:24 -07:00
2024-09-01 20:43:34 -07:00
2024-11-06 20:11:14 -08:00
2026-02-21 01:02:28 -08:00
2026-01-11 06:09:11 -10:00
2023-08-21 13:07:22 -07:00
2023-06-12 11:31:50 -07:00
2026-08-03 21:10:09 -07:00
2025-11-20 14:03:45 -08:00
2026-02-21 17:09:51 -08:00
2026-02-27 16:40:16 +01:00
2025-01-29 15:21:31 +01:00
2026-02-21 01:02:28 -08:00
2021-07-08 11:48:20 -07:00
2026-07-17 09:04:45 +10:00
2025-08-07 06:30:17 -06:00
2026-07-01 15:26:29 +02:00
2026-05-28 21:24:41 -07:00
2022-09-23 16:46:19 +02:00
2026-02-21 01:02:28 -08:00
2024-10-02 17:23:23 -04:00
2025-07-10 17:52:13 +02:00
2025-04-01 15:20:46 -07:00
2026-02-21 17:09:51 -08:00
2026-05-13 10:54:08 -07:00
2026-08-03 21:10:06 -07:00
2025-11-18 15:27:35 +01:00
2025-11-18 15:27:35 +01:00
2025-11-20 14:03:43 -08:00
2021-06-18 11:43:09 +02:00
2026-03-24 13:39:53 -04:00
2024-05-09 09:25:08 -07:00
2026-04-20 17:57:36 -07:00
2026-05-28 12:20:19 +02:00
2026-02-21 17:09:51 -08:00
2024-06-04 17:40:02 +02:00
2026-06-11 11:42:21 -07:00
2024-09-01 20:43:40 -07:00
2024-05-19 14:36:20 -07:00
2024-05-19 14:36:20 -07:00
2024-06-24 22:25:11 -07:00
2024-06-24 22:25:11 -07:00
2025-11-24 15:08:48 -08:00
2026-07-20 17:41:26 -07:00
2025-03-25 10:18:31 -03:00
2026-04-18 00:10:48 -07:00
2025-05-11 17:54:09 -07:00
2022-02-25 09:36:06 +01:00
2026-04-27 05:54:25 -07:00
2026-02-21 17:09:51 -08:00
2026-06-19 10:14:34 -07:00
2024-06-24 22:25:11 -07:00
2026-02-21 17:09:51 -08:00
2025-09-09 12:27:18 +02:00
2026-02-21 17:09:51 -08:00
2025-06-19 17:02:04 -07:00
2026-06-05 08:00:07 -07:00
2024-06-24 22:25:11 -07:00
2024-06-24 22:25:11 -07:00
2025-04-14 14:13:41 +02:00
2025-04-15 13:50:17 -07:00
2026-06-02 15:22:32 -07:00
2026-04-03 07:14:24 -10:00
2025-05-11 17:48:19 -07:00
2026-05-28 21:24:50 -07:00
2026-02-27 16:40:16 +01:00
2023-12-29 12:22:29 -08:00
2026-03-27 21:19:44 -07:00
2024-06-24 22:25:04 -07:00
2026-03-27 21:19:44 -07:00
2025-08-25 06:11:06 -07:00
2025-03-07 19:58:05 -08:00
2026-08-05 11:20:12 -07:00
2024-07-30 13:04:36 -10:00
2026-05-28 21:24:44 -07:00
2026-03-27 21:19:41 -07:00
2026-06-17 12:05:20 -07:00
2024-12-09 13:48:29 -08:00
2025-09-13 16:54:46 -07:00
2025-11-12 10:00:17 -08:00