Tetsuo Handa
2eed77fdcb
kcov: fix data corruption and race conditions on PREEMPT_RT
syzbot is reporting KCOV state corruption on PREEMPT_RT kernels, for the
temporary storage used for saving/restoring remote KCOV state is currently
allocated as the per-CPU area.
On PREEMPT_RT kernels, softirq handlers run as preemptible task threads
(e.g., ksoftirqd). If a softirq context preempts a task running a remote
KCOV session, it safely saves the task's state into the per-CPU area.
However, if that softirq thread is subsequently preempted by a higher-
priority softirq thread on the same CPU, the second softirq will overwrite
the same per-CPU area, permanently destroying the original task's KCOV
state.
Fix this data corruption by moving the temporary storage from the per-CPU
area to the per-thread area. Since each softirq thread now owns its own
task context, nested softirq preemption no longer causes data overwrites.
Note that while the temporary storage is now on a per-thread basis, the
per-CPU kcov_percpu_data.lock must be retained, for we need to ensure that
kcov_remote_start() and kcov_remote_stop() operate atomically without
racing against asynchronous interrupts that manipulate the current task's
KCOV state.
It is likely that GFP_KERNEL allocation by vmalloc_node() in kcov_init()
has already called panic() before returning NULL, for there will be no
OOM-killable userspace processes when __init function of built-in module
runs. But this patch also fixes crashing the kernel when vmalloc_node()
in kcov_init() returned NULL, for kcov_init() left per-CPU irq_area == NULL
but kcov_remote_start() depends on per-CPU irq_area != NULL, resulting in
(1) doing vmalloc() in kcov_remote_start() despite !in_task() context
(2) out-of-array-bounds access if (1) succeeded but
kcov->remote_size < CONFIG_KCOV_IRQ_AREA_SIZE
(3) always leak memory allocated by (1), eventually killing all
OOM-killable userspace processes
problems.
Link: https://lore.kernel.org/43552d09-2ce2-4b19-b0d3-a2d1ab952145@I-love.SAKURA.ne.jp
Reported-by: syzbot+3f51ad7ac3ae57a6fdcc@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=3f51ad7ac3ae57a6fdcc
Reported-by: syzbot+47cf95ca1f9dcca872c8@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=47cf95ca1f9dcca872c8
Reported-by: syzbot+8a173e13208949931dc7@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=8a173e13208949931dc7
Reported-by: syzbot+90984d3713722683112e@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=90984d3713722683112e
Analyzed-by: AI Mode in Google Search (no mail address)
Fixes: 5ff3b30ab5 ("kcov: collect coverage from interrupts")
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Reviewed-by: Alexander Potapenko <glider@google.com>
Cc: Alan Stern <stern@rowland.harvard.edu>
Cc: Andrey Konovalov <andreyknvl@gmail.com>
Cc: Christoph Hellwig <hch@infradead.org>
Cc: Clark Williams <williams@redhat.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Marco Elver <elver@google.com>
Cc: Mark Brown <broonie@kernel.org>
Cc: Roman Gushchin <roman.gushchin@linux.dev>
Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-05 11:20:13 -07:00
..
2026-07-03 07:38:16 +02:00
2026-07-03 07:38:16 +02:00
2026-07-23 10:24:12 -07:00
2026-07-16 09:12:24 +02:00
2026-07-03 07:38:16 +02:00
2026-07-03 07:38:14 +02:00
2026-07-03 07:37:43 +02:00
2026-07-14 16:33:21 -05:00
2026-06-18 08:50:52 -07:00
2026-07-03 07:38:16 +02:00
2026-06-11 10:26:40 +02:00
2026-07-03 07:38:16 +02:00
2026-06-23 15:51:14 -07:00
2026-06-17 11:32:14 +01:00
2026-07-23 08:19:29 -07:00
2026-07-03 07:38:16 +02:00
2026-06-21 17:05:45 +02:00
2026-06-23 08:11:21 +02:00
2026-07-03 07:38:16 +02:00
2026-06-08 10:03:43 +02:00
2026-07-03 07:38:16 +02:00
2026-06-17 12:10:11 +01:00
2026-07-03 07:38:16 +02:00
2026-07-03 07:38:16 +02:00
2026-07-03 07:38:16 +02:00
2026-07-03 07:38:16 +02:00
2026-07-08 14:07:19 -04:00
2026-07-03 07:38:16 +02:00
2026-07-03 07:38:16 +02:00
2026-07-03 07:38:16 +02:00
2026-07-03 07:38:16 +02:00
2026-07-14 16:44:40 +02:00
2026-07-15 12:13:30 +02:00
2026-06-17 11:21:40 -07:00
2026-06-16 08:53:53 -07:00
2026-07-03 07:38:16 +02:00
2026-06-24 06:53:25 -06:00
2026-06-16 13:02:47 +05:30
2026-06-16 10:07:36 -06:00
2026-06-30 16:31:56 +02:00
2026-06-07 10:03:01 -07:00
2026-06-14 13:47:38 -07:00
2026-06-17 09:18:14 +01:00
2026-06-07 10:03:01 -07:00
2026-07-16 16:11:29 -07:00
2026-06-06 15:08:36 -07:00
2026-06-17 12:03:56 +01:00
2026-06-05 14:46:51 +02:00
2026-06-15 13:51:27 +05:30
2026-06-21 11:31:28 -07:00
2026-06-08 18:21:32 -07:00
2026-06-15 14:21:14 +05:30
2026-06-15 14:21:14 +05:30
2026-06-15 05:01:15 +05:30
2026-06-22 12:20:21 -07:00
2026-07-09 15:48:53 -07:00
2026-06-05 00:34:55 -04:00
2026-07-03 07:38:16 +02:00
2026-07-03 07:38:16 +02:00
2026-06-13 13:24:34 -07:00
2026-07-03 07:38:16 +02:00
2026-06-04 14:49:27 -07:00
2026-06-25 10:18:34 -07:00
2026-06-22 19:52:36 +00:00
2026-06-09 16:00:11 +02:00
2026-06-15 03:59:45 +05:30
2026-07-01 10:33:38 +02:00
2026-07-03 07:38:16 +02:00
2026-06-18 16:39:31 -07:00
2026-07-01 19:02:56 -07:00
2026-07-20 10:39:24 -07:00
2026-06-15 02:50:44 +05:30
2026-06-05 13:36:22 +02:00
2026-06-07 10:03:00 -07:00
2026-07-07 10:42:28 -04:00
2026-06-29 23:24:46 +01:00
2026-07-03 07:38:16 +02:00
2026-06-21 11:37:16 -07:00
2026-06-16 08:10:21 +05:30
2026-07-03 07:38:16 +02:00
2026-06-17 00:15:09 +02:00
2026-07-03 07:38:16 +02:00
2026-07-06 14:11:09 +02:00
2026-06-08 08:59:03 +02:00
2026-06-05 17:46:17 -07:00
2026-07-08 14:41:01 +02:00
2026-07-03 07:38:16 +02:00
2026-06-15 02:13:01 +03:00
2026-07-03 07:38:16 +02:00
2026-06-06 19:51:14 -05:00
2026-06-16 09:48:00 -06:00
2026-07-01 15:26:47 +02:00
2026-06-17 12:33:23 -07:00
2026-06-23 12:08:51 -05:00
2026-07-03 07:38:16 +02:00
2026-07-03 07:38:16 +02:00
2026-06-10 10:42:55 -04:00
2026-06-15 16:33:40 +02:00
2026-06-06 15:21:40 +02:00
2026-06-16 00:39:57 +02:00
2026-06-17 11:28:52 +01:00
2026-06-05 11:44:10 +01:00
2026-06-08 18:21:24 -07:00
2026-08-05 11:20:13 -07:00
2026-07-03 07:38:16 +02:00
2026-07-03 07:38:16 +02:00
2026-07-27 14:36:26 -07:00
2026-07-03 07:38:16 +02:00
2026-06-04 14:45:02 -07:00
2026-06-19 10:14:34 -07:00
2026-06-08 18:21:29 -07:00
2026-06-08 18:21:27 -07:00
2026-07-03 07:37:43 +02:00
2026-06-11 15:17:30 -07:00
2026-06-15 03:59:45 +05:30
2026-06-12 16:43:10 -07:00
2026-06-25 10:18:40 -07:00
2026-07-01 15:26:29 +02:00
2026-06-09 12:42:20 +02:00
2026-06-08 10:21:54 -04:00
2026-06-08 12:06:41 -04:00
2026-06-23 18:36:41 -07:00
2026-08-03 21:10:06 -07:00
2026-06-08 18:21:23 -07:00
2026-06-26 22:18:34 -04:00
2026-07-03 07:38:16 +02:00
2026-07-03 07:38:16 +02:00
2026-07-01 19:02:54 -07:00
2026-06-04 14:45:07 -07:00
2026-07-09 15:48:56 -07:00
2026-06-21 11:37:38 -07:00
2026-06-09 17:04:02 -05:00
2026-07-03 07:38:16 +02:00
2026-07-03 07:38:16 +02:00
2026-06-11 13:41:25 +02:00
2026-06-16 08:44:43 +05:30
2026-06-17 09:18:14 +01:00
2026-06-09 10:13:04 -07:00
2026-07-03 07:38:16 +02:00
2026-06-10 11:08:23 +02:00
2026-07-03 07:38:14 +02:00
2026-07-03 07:38:16 +02:00
2026-08-03 21:10:10 -07:00
2026-06-10 00:58:04 +02:00
2026-06-04 11:04:18 +02:00
2026-08-05 11:20:12 -07:00
2026-08-05 11:20:12 -07:00
2026-06-15 03:05:50 +05:30
2026-06-07 12:36:13 -07:00
2026-07-03 07:38:16 +02:00
2026-07-03 07:38:16 +02:00
2026-06-23 00:13:21 +02:00
2026-08-05 11:20:13 -07:00
2026-07-03 07:38:16 +02:00
2026-06-23 12:03:44 -07:00
2026-06-21 13:20:19 -07:00
2026-07-15 11:10:14 +02:00
2026-07-21 11:28:21 +02:00
2026-07-03 07:38:16 +02:00
2026-06-17 08:17:00 +01:00
2026-08-05 11:20:13 -07:00
2026-06-18 16:39:31 -07:00
2026-06-08 18:21:31 -07:00
2026-06-17 09:18:14 +01:00
2026-08-03 21:10:11 -07:00
2026-07-03 07:38:16 +02:00
2026-07-03 07:38:16 +02:00
2026-06-04 11:04:18 +02:00
2026-06-07 10:03:01 -07:00
2026-07-07 10:42:29 -04:00
2026-06-21 13:20:19 -07:00
2026-07-03 07:38:16 +02:00
2026-06-08 18:21:29 -07:00
2026-06-04 18:22:45 +02:00
2026-06-29 13:46:50 -06:00
2026-07-03 07:38:16 +02:00
2026-06-08 18:21:31 -07:00
2026-06-15 16:33:40 +02:00
2026-06-08 11:53:18 -07:00
2026-07-03 07:38:16 +02:00
2026-06-06 15:22:44 +02:00
2026-07-03 07:38:16 +02:00