Re: [PATCH v6] kcov: fix data corruption and race conditions on PREEMPT_RT by moving saved remote state to task_struct

[Sebastian Andrzej Siewior]

On 2026-07-10 20:32:27 [+0900], Tetsuo Handa wrote:
> syzbot is reporting KCOV state corruption on PREEMPT_RT kernels, for the
> temporary storage used for saving/restoring remote KCOV state is currently
> allocated as the per-CPU area.
> 
> On PREEMPT_RT kernels, softirq handlers run as preemptible task threads
> (e.g., ksoftirqd). If a softirq context preempts a task running a remote
> KCOV session, it safely saves the task's state into the per-CPU area.
> However, if that softirq thread is subsequently preempted by a higher-
> priority softirq thread on the same CPU, the second softirq will overwrite
> the same per-CPU area, permanently destroying the original task's KCOV
> state.
> 
> Fix this data corruption by moving the temporary storage from the per-CPU
> area to the per-thread area. Since each softirq thread now owns its own
> task context, nested softirq preemption no longer causes data overwrites.
> 
> Note that while the temporary storage is now on a per-thread basis, the
> per-CPU kcov_percpu_data.lock must be retained, for we need to ensure that
> kcov_remote_start() and kcov_remote_stop() operate atomically without
> racing against asynchronous interrupts that manipulate the current task's
> KCOV state.
> 
> Reported-by: syzbot+3f51ad7ac3ae57a6fdcc@xxxxxxxxxxxxxxxxxxxxxxxxx
> Closes: https://syzkaller.appspot.com/bug?extid=3f51ad7ac3ae57a6fdcc
> Reported-by: syzbot+47cf95ca1f9dcca872c8@xxxxxxxxxxxxxxxxxxxxxxxxx
> Closes: https://syzkaller.appspot.com/bug?extid=47cf95ca1f9dcca872c8
> Reported-by: syzbot+8a173e13208949931dc7@xxxxxxxxxxxxxxxxxxxxxxxxx
> Closes: https://syzkaller.appspot.com/bug?extid=8a173e13208949931dc7
> Reported-by: syzbot+90984d3713722683112e@xxxxxxxxxxxxxxxxxxxxxxxxx
> Closes: https://syzkaller.appspot.com/bug?extid=90984d3713722683112e
> Analyzed-by: AI Mode in Google Search (no mail address)
> Fixes: 5ff3b30ab57d ("kcov: collect coverage from interrupts")
> Signed-off-by: Tetsuo Handa <penguin-kernel@xxxxxxxxxxxxxxxxxxx>

No complains from my side. Thank you.

Sebastian