[PATCH 0/5] kcov: suppress timer and scheduler coverage leaks

[PATCH 0/5] kcov: suppress timer and scheduler coverage leaks

[Karl Mehltretter]

KCOV excludes interrupt and scheduler coverage so syscall coverage stays
input-dependent. Instrumented callees can still record when uninstrumented
timer and scheduler paths run with in_task() true.

CONFIG_KCOV_SELFTEST [1] exposes three cases on x86-64: deferred
hrtimer rearm, __schedule() callees and PREEMPT_RT wakeups. Task-context
wakeups and new-task enqueue also add scheduler coverage to ordinary
syscalls.

Add a nestable KCOV_PAUSED bit. Use it around deferred hrtimer rearm,
__schedule(), try_to_wake_up() and wake_up_new_task(). This keeps coverage
from their instrumented callees without excluding those callees from real
task-context coverage.

Testing:

  - GCC builds across x86-64, arm32, arm64, MIPS32, PowerPC 32/64,
    s390, RISC-V 32/64, LoongArch, Xtensa and UML
  - x86-64 Clang and KCOV-disabled builds
  - KCOV selftest, 10/10 x86-64 boots with and without PREEMPT_RT
  - KCOV selftest, 3/3 RISC-V 32/64, LoongArch and s390 boots after
    isolating unrelated architecture entry leaks
  - 40 dummy_hcd/g_zero remote-KCOV cycles on x86-64 and arm64
  - 400 repeated fork calls on x86-64 PREEMPT_RT
  - syzkaller: five one-hour A/B pairs on four 2-vCPU PREEMPT_RT VMs.
    At ~110k executions, the five-run median was 4,142 vs. 3,216
    corpus entries (+28.8%) and 54,872 vs. 50,940 coverage (+7.7%).
    No unsuppressed reports

The USB runs no longer contained the baseline PCs from deferred rearm,
hrtick and scheduler wakeup callees. The fork run no longer contained the
baseline __smp_call_single_queue(), generic_exec_single() or
smp_call_function_single_async() PCs.

With KCOV disabled, the pause calls compile away. With KCOV enabled on
x86-64, __schedule() grows by 117 bytes across patches 2 and 3,
try_to_wake_up() by 106 bytes and wake_up_new_task() by 88 bytes.

[1] https://lore.kernel.org/r/20260724192122.73080-1-kmehltretter@gmail.com/

Karl Mehltretter (5):
  kcov: add kcov_pause()/kcov_resume() helpers
  hrtimer: pause KCOV during deferred rearm
  sched: pause KCOV in __schedule()
  sched: pause KCOV in try_to_wake_up()
  sched: pause KCOV in wake_up_new_task()

 include/linux/hrtimer_rearm.h | 18 ++++++++++++++++--
 include/linux/kcov.h          | 25 ++++++++++++++++++++++++-
 kernel/kcov.c                 |  2 +-
 kernel/sched/core.c           | 15 ++++++++++++++-
 4 files changed, 55 insertions(+), 5 deletions(-)

base-commit: 8ba098e6b6ff0db8edf28528d1552be261af30d4

[PATCH 4/5] sched: pause KCOV in try_to_wake_up()

[Karl Mehltretter]

try_to_wake_up() is uninstrumented, but it calls instrumented helpers
such as kthread_is_per_cpu(), CPU capacity helpers and SCHED_HRTICK
arming. They can record into current while in_task() is true.

CONFIG_KCOV_SELFTEST exposes this under PREEMPT_RT. The interrupt
selftest fails on x86_64 in kthread_is_per_cpu(): RT runs the timer
softirq in a thread, so the wakeup runs in task context during the
selftest's spin. The same helpers leak into non-RT syscall wakeups such
as a pipe write waking a reader.

Pause all of try_to_wake_up(). Wrapping only select_task_rq() would miss
SCHED_HRTICK arming during enqueue.

Fixes: 5c9a8750a640 ("kernel: add kcov code coverage")
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
---
 kernel/sched/core.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index d5663df6c702..1e562a7ff0af 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -4252,6 +4252,8 @@ int try_to_wake_up(struct task_struct *p, unsigned int state, int wake_flags)
 {
 	guard(preempt)();
 	int cpu, success = 0;
+	/* KCOV: sched/ is uninstrumented but the wakeup callees are not. */
+	unsigned int kcov_paused = kcov_pause(current);
 
 	wake_flags |= WF_TTWU;
 
@@ -4418,6 +4420,7 @@ int try_to_wake_up(struct task_struct *p, unsigned int state, int wake_flags)
 	if (success)
 		ttwu_stat(p, task_cpu(p), wake_flags);
 
+	kcov_resume(current, kcov_paused);
 	return success;
 }
 
-- 
2.53.0

Re: [PATCH 4/5] sched: pause KCOV in try_to_wake_up()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] The patch mixes a goto-based manual cleanup with a `guard()` declaration in the same function, violating cleanup subsystem guidelines.
--

--- Patch [4]: [PATCH 4/5] sched: pause KCOV in try_to_wake_up() ---
commit 96c5de7cc097dcbb15a79c4c86f4148070fd31cf
Author: Karl Mehltretter <kmehltretter@gmail.com>

sched: pause KCOV in try_to_wake_up()

This patch pauses KCOV instrumentation around try_to_wake_up() to prevent
instrumented helpers from recording into current while in task context. It
saves the pause state and manually resumes it at the function's exit label.

> diff --git a/kernel/sched/core.c b/kernel/sched/core.c
> --- a/kernel/sched/core.c
> +++ b/kernel/sched/core.c
> @@ -4252,6 +4252,8 @@ int try_to_wake_up(struct task_struct *p, unsigned int state, int wake_flags)
>  {
>  	guard(preempt)();
>  	int cpu, success = 0;
> +	/* KCOV: sched/ is uninstrumented but the wakeup callees are not. */
> +	unsigned int kcov_paused = kcov_pause(current);

[ ... ]

> @@ -4418,6 +4420,7 @@ int try_to_wake_up(struct task_struct *p, unsigned int state, int wake_flags)
>  	if (success)
>  		ttwu_stat(p, task_cpu(p), wake_flags);
>  
> +	kcov_resume(current, kcov_paused);
>  	return success;
>  }

[Severity: Low]
Does this mix manual goto-based cleanup with scope-based guard() declarations?

The cleanup subsystem guidelines recommend that goto-based error handling and
cleanup helpers should not be mixed in the same function, as it can confuse
ownership semantics and increase the risk of resource leaks if early returns
are added later.

In try_to_wake_up(), guard(preempt)() is used at the top of the function,
but this patch introduces a manual kcov_resume() cleanup step at the out:
label.

Could this KCOV pause and resume be handled using a scope-based cleanup helper
to match the existing guard() usage, preventing the mixed paradigms?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260807205027.31972-1-kmehltretter@gmail.com?part=4

Re: [PATCH 4/5] sched: pause KCOV in try_to_wake_up()

[Bradley Morgan]

On 7 August 2026 21:50:26 BST, Karl Mehltretter <kmehltretter@gmail.com>
wrote:
>try_to_wake_up() is uninstrumented, but it calls instrumented helpers
>such as kthread_is_per_cpu(), CPU capacity helpers and SCHED_HRTICK
>arming. They can record into current while in_task() is true.
>
>CONFIG_KCOV_SELFTEST exposes this under PREEMPT_RT. The interrupt
>selftest fails on x86_64 in kthread_is_per_cpu(): RT runs the timer
>softirq in a thread, so the wakeup runs in task context during the
>selftest's spin. The same helpers leak into non-RT syscall wakeups such
>as a pipe write waking a reader.
>
>Pause all of try_to_wake_up(). Wrapping only select_task_rq() would miss
>SCHED_HRTICK arming during enqueue.
>
>Fixes: 5c9a8750a640 ("kernel: add kcov code coverage")
>Assisted-by: Claude:claude-opus-4-8
>Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>

I don't mind.

Reviewed-by: Bradley Morgan <include@grrlz.net>

I saw sashikos "kind" reply, this isn't a bug, but a scoped guard,
could be built.

considering it would future proof against somebody adding a early return
later.


but tbh that's more a patch 1 decision to make.


>---
> kernel/sched/core.c | 3 +++
> 1 file changed, 3 insertions(+)
>
>diff --git a/kernel/sched/core.c b/kernel/sched/core.c
>index d5663df6c702..1e562a7ff0af 100644
>--- a/kernel/sched/core.c
>+++ b/kernel/sched/core.c
>@@ -4252,6 +4252,8 @@ int try_to_wake_up(struct task_struct *p, unsigned int state, int wake_flags)
> {
> 	guard(preempt)();
> 	int cpu, success = 0;
>+	/* KCOV: sched/ is uninstrumented but the wakeup callees are not. */
>+	unsigned int kcov_paused = kcov_pause(current);
> 
> 	wake_flags |= WF_TTWU;
> 
>@@ -4418,6 +4420,7 @@ int try_to_wake_up(struct task_struct *p, unsigned int state, int wake_flags)
> 	if (success)
> 		ttwu_stat(p, task_cpu(p), wake_flags);
> 
>+	kcov_resume(current, kcov_paused);
> 	return success;
> }
> 
>

Thanks!

Re: [PATCH 0/5] kcov: suppress timer and scheduler coverage leaks

[Peter Zijlstra]

On Fri, Aug 07, 2026 at 10:50:22PM +0200, Karl Mehltretter wrote:

> Karl Mehltretter (5):
>   kcov: add kcov_pause()/kcov_resume() helpers
>   hrtimer: pause KCOV during deferred rearm
>   sched: pause KCOV in __schedule()
>   sched: pause KCOV in try_to_wake_up()
>   sched: pause KCOV in wake_up_new_task()
> 
>  include/linux/hrtimer_rearm.h | 18 ++++++++++++++++--
>  include/linux/kcov.h          | 25 ++++++++++++++++++++++++-
>  kernel/kcov.c                 |  2 +-
>  kernel/sched/core.c           | 15 ++++++++++++++-
>  4 files changed, 55 insertions(+), 5 deletions(-)

You've send me a partial series; which is the same as not sending me
anything at all. If you want me to look at it, send the complete thing,
so I can evaluate the whole thing.