[PATCH 0/1] Fix kernel build failure with CONFIG_GCOV_PROFILE_ALL=y

[PATCH 0/1] Fix kernel build failure with CONFIG_GCOV_PROFILE_ALL=y

[Konstantin Khorenko]

This patch fixes a build failure in net/core/skbuff.c that occurs when
CONFIG_GCOV_PROFILE_ALL=y is enabled.  The issue manifests as a
BUILD_BUG_ON compile-time assertion failure, even though the actual
runtime value satisfies the constraint.

Build failure without this patch
---------------------------------

With the following configuration enabled:

  CONFIG_GCOV_KERNEL=y
  CONFIG_GCOV_PROFILE_ALL=y
  # CONFIG_GCOV_PROFILE_FTRACE is not set
  CONFIG_GCOV_PROFILE_RDS=y
  CONFIG_GCOV_PROFILE_URING=y

The kernel fails to build with:

  In file included from <command-line>:
  In function 'skb_extensions_init',
      inlined from 'skb_init' at net/core/skbuff.c:5214:2:
  ././include/linux/compiler_types.h:706:45: error: call to '__compiletime_assert_1490' declared with attribute error: BUILD_BUG_ON failed: skb_ext_total_length() > 255
    706 |         _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__)
        |                                             ^
  ././include/linux/compiler_types.h:687:25: note: in definition of macro '__compiletime_assert'
    687 |                         prefix ## suffix();                             \
        |                         ^~~~~~
  ././include/linux/compiler_types.h:706:9: note: in expansion of macro '_compiletime_assert'
    706 |         _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__)
        |         ^~~~~~~~~~~~~~~~~~~
  ./include/linux/build_bug.h:40:37: note: in expansion of macro 'compiletime_assert'
     40 | #define BUILD_BUG_ON_MSG(cond, msg) compiletime_assert(!(cond), msg)
        |                                     ^~~~~~~~~~~~~~~~~~
  ./include/linux/build_bug.h:51:9: note: in expansion of macro 'BUILD_BUG_ON_MSG'
     51 |         BUILD_BUG_ON_MSG(condition, "BUILD_BUG_ON failed: " #condition)
        |         ^~~~~~~~~~~~~~~~
  net/core/skbuff.c:5163:9: note: in expansion of macro 'BUILD_BUG_ON'
   5163 |         BUILD_BUG_ON(skb_ext_total_length() > 255);
        |         ^~~~~~~~~~~~
  make[4]: *** [scripts/Makefile.build:289: net/core/skbuff.o] Error 1

Root cause
----------

CONFIG_GCOV_PROFILE_ALL adds -fprofile-arcs -ftest-coverage -fno-tree-loop-im
to all kernel compilation units.  The skb_ext_total_length() function uses
a __always_inline loop over skb_ext_type_len[] array.  GCOV instrumentation
inserts branch counters, and -fno-tree-loop-im prevents loop optimization,
breaking the compiler's ability to constant-fold the result.  BUILD_BUG_ON
requires a compile-time constant and fails.

The problem is more pronounced in recent kernels (7.0+) where the number of
SKB extensions grew from 4 to 5+ (with addition of SKB_EXT_CAN, SKB_EXT_PSP,
etc.).  With 4 elements, GCC can still unroll and fold; with 5+, it gives up.

This affects both older and newer GCC versions (tested with GCC 11.4.1 and
GCC 16.0.1 20260327 experimental).

Solution
--------

Add a CONFIG_GCOV_PROFILE_ALL guard to the BUILD_BUG_ON, following the
existing pattern for CONFIG_KCOV_INSTRUMENT_ALL which has the same issue.

Konstantin Khorenko (1):
  net: fix skb_ext_total_length() BUILD_BUG_ON with CONFIG_GCOV_PROFILE_ALL

 net/core/skbuff.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

-- 
2.43.5

[PATCH 1/1] net: fix skb_ext_total_length() BUILD_BUG_ON with CONFIG_GCOV_PROFILE_ALL

[Konstantin Khorenko]

When CONFIG_GCOV_PROFILE_ALL=y is enabled, GCC inserts branch profiling
counters into skb_ext_total_length() and, combined with -fno-tree-loop-im
from GCOV, prevents the compiler from constant-folding the loop that
sums skb_ext_type_len[] array elements.  This causes the compile-time
BUILD_BUG_ON(skb_ext_total_length() > 255) check to fail, even though
the actual computed value is well below 255.

The kernel already has a guard for CONFIG_KCOV_INSTRUMENT_ALL, which
causes the same problem.  Add a similar guard for GCOV.

The number of loop iterations matters: with 4 extension types (as in
earlier kernels), GCC 11 can still constant-fold despite GCOV. With 5+
types (after SKB_EXT_CAN and other additions), it gives up.  This is
why the issue only manifests in recent kernels with GCOV enabled.

Tested with GCC 11.4.1 and GCC 16.0.1 20260327 (experimental) - both
exhibit the same behavior.

Note that skb_ext_total_length() is still correct at runtime; this
change only allows the build to succeed when GCOV_PROFILE_ALL is
enabled for coverage analysis.

Fixes: 5d21d0a65b57 ("net: generalize calculation of skb extensions length")

Signed-off-by: Konstantin Khorenko <khorenko@virtuozzo.com>
---
 net/core/skbuff.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 0e217041958a..98c3d4e63219 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -5159,7 +5159,7 @@ static __always_inline unsigned int skb_ext_total_length(void)
 static void skb_extensions_init(void)
 {
 	BUILD_BUG_ON(SKB_EXT_NUM > 8);
-#if !IS_ENABLED(CONFIG_KCOV_INSTRUMENT_ALL)
+#if !IS_ENABLED(CONFIG_KCOV_INSTRUMENT_ALL) && !IS_ENABLED(CONFIG_GCOV_PROFILE_ALL)
 	BUILD_BUG_ON(skb_ext_total_length() > 255);
 #endif
 
-- 
2.43.5

Re: [PATCH 1/1] net: fix skb_ext_total_length() BUILD_BUG_ON with CONFIG_GCOV_PROFILE_ALL

[Thomas Weißschuh]

On 2026-03-30 16:53:37+0300, Konstantin Khorenko wrote:
> When CONFIG_GCOV_PROFILE_ALL=y is enabled, GCC inserts branch profiling
> counters into skb_ext_total_length() and, combined with -fno-tree-loop-im
> from GCOV, prevents the compiler from constant-folding the loop that
> sums skb_ext_type_len[] array elements.  This causes the compile-time
> BUILD_BUG_ON(skb_ext_total_length() > 255) check to fail, even though
> the actual computed value is well below 255.
> 
> The kernel already has a guard for CONFIG_KCOV_INSTRUMENT_ALL, which
> causes the same problem.  Add a similar guard for GCOV.
> 
> The number of loop iterations matters: with 4 extension types (as in
> earlier kernels), GCC 11 can still constant-fold despite GCOV. With 5+
> types (after SKB_EXT_CAN and other additions), it gives up.  This is
> why the issue only manifests in recent kernels with GCOV enabled.
> 
> Tested with GCC 11.4.1 and GCC 16.0.1 20260327 (experimental) - both
> exhibit the same behavior.
> 
> Note that skb_ext_total_length() is still correct at runtime; this
> change only allows the build to succeed when GCOV_PROFILE_ALL is
> enabled for coverage analysis.
> 
> Fixes: 5d21d0a65b57 ("net: generalize calculation of skb extensions length")
> 
> Signed-off-by: Konstantin Khorenko <khorenko@virtuozzo.com>

Reviewed-by: Thomas Weißschuh <linux@weissschuh.net>

Would it help to mark skb_ext_total_length() as
'notrace'/'no_instrument_function'?


Thomas

Re: [PATCH 1/1] net: fix skb_ext_total_length() BUILD_BUG_ON with CONFIG_GCOV_PROFILE_ALL

[Konstantin Khorenko]

On 3/30/26 16:48, Thomas Weißschuh wrote:
> On 2026-03-30 16:53:37+0300, Konstantin Khorenko wrote:
>> When CONFIG_GCOV_PROFILE_ALL=y is enabled, GCC inserts branch profiling
>> counters into skb_ext_total_length() and, combined with -fno-tree-loop-im
>> from GCOV, prevents the compiler from constant-folding the loop that
>> sums skb_ext_type_len[] array elements.  This causes the compile-time
>> BUILD_BUG_ON(skb_ext_total_length() > 255) check to fail, even though
>> the actual computed value is well below 255.
>>
>> The kernel already has a guard for CONFIG_KCOV_INSTRUMENT_ALL, which
>> causes the same problem.  Add a similar guard for GCOV.
>>
>> The number of loop iterations matters: with 4 extension types (as in
>> earlier kernels), GCC 11 can still constant-fold despite GCOV. With 5+
>> types (after SKB_EXT_CAN and other additions), it gives up.  This is
>> why the issue only manifests in recent kernels with GCOV enabled.
>>
>> Tested with GCC 11.4.1 and GCC 16.0.1 20260327 (experimental) - both
>> exhibit the same behavior.
>>
>> Note that skb_ext_total_length() is still correct at runtime; this
>> change only allows the build to succeed when GCOV_PROFILE_ALL is
>> enabled for coverage analysis.
>>
>> Fixes: 5d21d0a65b57 ("net: generalize calculation of skb extensions length")
>>
>> Signed-off-by: Konstantin Khorenko <khorenko@virtuozzo.com>
> 
> Reviewed-by: Thomas Weißschuh <linux@weissschuh.net>

Thank you very much for the review, Tomas!

> Would it help to mark skb_ext_total_length() as
> 'notrace'/'no_instrument_function'?

That's interesting.

"notrace" did not help, after all it just disables ftrace instrumentation in the beginning of functions.

But! i have also tried __no_profile (__no_profile_instrument_function__) and it helps!

-static __always_inline unsigned int skb_ext_total_length(void)
+static __always_inline __no_profile unsigned int skb_ext_total_length(void)


__no_profile_instrument_function__ tells GCC not to insert GCOV counters
into this specific function,
so without GCOV counters in the loop body, the loop becomes "clean" and
even though -fno-tree-loop-im is still active globally,
gcc can now constant-fold this clean loop.

As a result skb_ext_total_length() is fully evaluated at compile time and BUILD_BUG_ON succeeds.

Thus we can probably use this hack and create the following patch instead:

diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 0e217041958a..47c7f0ab6e84 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -5145,7 +5145,7 @@ static const u8 skb_ext_type_len[] = {
  #endif
  };

-static __always_inline unsigned int skb_ext_total_length(void)
+static __always_inline __no_profile unsigned int skb_ext_total_length(void)
  {
         unsigned int l = SKB_EXT_CHUNKSIZEOF(struct skb_ext);
         int i;
@@ -5159,9 +5159,7 @@ static __always_inline unsigned int skb_ext_total_length(void)
  static void skb_extensions_init(void)
  {
         BUILD_BUG_ON(SKB_EXT_NUM > 8);
-#if !IS_ENABLED(CONFIG_KCOV_INSTRUMENT_ALL)
         BUILD_BUG_ON(skb_ext_total_length() > 255);
-#endif

         skbuff_ext_cache = kmem_cache_create("skbuff_ext_cache",
                                              SKB_EXT_ALIGN_VALUE * skb_ext_total_length(),


Tomas, do you want me to send the v2 patch with that solution?

--
Best regards,

Konstantin Khorenko,
Virtuozzo Linux Kernel Team

Re: [PATCH 1/1] net: fix skb_ext_total_length() BUILD_BUG_ON with CONFIG_GCOV_PROFILE_ALL

[Thomas Weißschuh]

On 2026-03-30 19:23:01+0200, Konstantin Khorenko wrote:

(...)

> Thus we can probably use this hack and create the following patch instead:
> 
> diff --git a/net/core/skbuff.c b/net/core/skbuff.c
> index 0e217041958a..47c7f0ab6e84 100644
> --- a/net/core/skbuff.c
> +++ b/net/core/skbuff.c
> @@ -5145,7 +5145,7 @@ static const u8 skb_ext_type_len[] = {
>  #endif
>  };
> 
> -static __always_inline unsigned int skb_ext_total_length(void)
> +static __always_inline __no_profile unsigned int skb_ext_total_length(void)
>  {
>         unsigned int l = SKB_EXT_CHUNKSIZEOF(struct skb_ext);
>         int i;
> @@ -5159,9 +5159,7 @@ static __always_inline unsigned int skb_ext_total_length(void)
>  static void skb_extensions_init(void)
>  {
>         BUILD_BUG_ON(SKB_EXT_NUM > 8);
> -#if !IS_ENABLED(CONFIG_KCOV_INSTRUMENT_ALL)
>         BUILD_BUG_ON(skb_ext_total_length() > 255);
> -#endif
> 
>         skbuff_ext_cache = kmem_cache_create("skbuff_ext_cache",
>                                              SKB_EXT_ALIGN_VALUE * skb_ext_total_length(),
> 
> 
> Tomas, do you want me to send the v2 patch with that solution?

Yeah, I think this should have been the correct solution from beginning.
If you send this patch feel free to add my Reviewed-by.


Thomas