From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtpout.efficios.com (smtpout.efficios.com [158.69.130.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7B6184EA371; Fri, 25 Sep 2026 20:00:04 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=158.69.130.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790366406; cv=none; b=nouqvPTnxDFikdlyRFRZILk9EWNjLmIGlU19QdMOrQFOYRxpuZ0qFkRZB/Egqg9uv31s0rdLWZ2wdk7vHmglOsMzydEqsZXBjpGjRKTurdQxE4PNpJaS65BlCzEU0lgI0MzpBUt2kG8QrwQ/44NGxjUjd/KgxaKmhPEMh51XNGw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790366406; c=relaxed/simple; bh=hA0P3QXG4vIUQALa5dP18gAvwez1VjTIFyHeDe3I9TA=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=l3Z4fRd+C00nyHoekEhIJLrDAFODM7smDgT6oG/7uv5dBmc4kAQnfbyD9+EikezcngN+7tDTA7L1PG9UvRO9pfhFu7XBCqcTUIQKhPdybgP9qk1fbqjdM7RphHRfYyBYrI16nUYhWJ1qSpWx657hZ0hfKt9r2RZwHxMnd4cAhzI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=efficios.com; spf=pass smtp.mailfrom=efficios.com; dkim=pass (2048-bit key) header.d=efficios.com header.i=@efficios.com header.b=dovgLtC4; arc=none smtp.client-ip=158.69.130.18 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=efficios.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=efficios.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=efficios.com header.i=@efficios.com header.b="dovgLtC4" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=efficios.com; s=smtpout1; t=1790366403; bh=oBXpuKfAKM6qngbSZJkmYnuEFIrisykwM4g9m2Jhhyo=; h=From:To:Cc:Subject:Date:From; b=dovgLtC4xFy7ddBMs/fImF5IIGksQLGvcQ/WtoQK5HY6nTCiDWXkgDDcMAYPr6Mk2 OZo4bYYnZf37thh/R//lmO7dQUnbw+F18EcYAYN3T5enb9RJeVLTSvQIy1uEYjv/ER jBKffT9NvP0/MSG0quLoqHyHGivxhbkzxL6zilQ3+hNURv4lB7BQbtpBhlCtvj4zS/ oQVwdGayyQmqJLP6LonuI551mfe5qnVkscwOCzLxTNmtJ5HXeM2wgC+47XzE69MJnv Ch+VXXLoAEhsWIF/lQdkh53ukbBSAi6IuwQQZ1Uvm7j08uWpZAJcgKiQBwviC2HM96 SQPQFklmpIKkA== Received: from compudjdev.. (mtl.efficios.com [216.120.195.104]) by smtpout.efficios.com (Postfix) with ESMTPSA id 4hs1l732fyzg1W; Fri, 25 Sep 2026 16:00:03 -0400 (EDT) From: Mathieu Desnoyers To: "Paul E . McKenney" Cc: linux-kernel@vger.kernel.org, Mathieu Desnoyers , Boqun Feng , Bradley Morgan , Gary Guo , rcu@vger.kernel.org, lkmm@lists.linux.dev Subject: [PATCH v1] hazptr: Fix two-phase hazptr_synchronize race with detach Date: Fri, 25 Sep 2026 15:59:50 -0400 Message-ID: <20260925195958.4766-1-mathieu.desnoyers@efficios.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Boqun Feng pointed out that a detach happening concurrently with hazptr_synchronize can miss a slot. Indeed, scanning the per-CPU slots needs to be done *before* scanning the overflow lists. Fix the implementation accordingly. Signed-off-by: Mathieu Desnoyers Reported-by: Boqun Feng Cc: Paul E. McKenney Cc: Boqun Feng Cc: Bradley Morgan Cc: Gary Guo Cc: Cc: --- Changes since v0: - Load the new overflow list phase word in "hazptr_chain_backup_slot". - Rename the lock to hazptr_phase_lock to make it clear that it protects both the wildcard and the overflow list phases. --- kernel/hazptr.c | 50 +++++++++++++++++++++++++++++++++++++++---------- 1 file changed, 40 insertions(+), 10 deletions(-) diff --git a/kernel/hazptr.c b/kernel/hazptr.c index d3d1050d92cf..13faa5ba7677 100644 --- a/kernel/hazptr.c +++ b/kernel/hazptr.c @@ -13,6 +13,8 @@ #include #include +static DEFINE_MUTEX(hazptr_phase_lock); /* Protect the wildcard and list phase flip. */ + /* * The current hazard pointer wildcard. Flips between 1UL and 2UL to guarantee * hazptr_synchronize forward progress even with a steady stream of readers. @@ -20,10 +22,12 @@ * This also affects the overflow list selection: the current list used by * readers is array[(unsigned long) hazptr_wildcard - 1]. */ -static DEFINE_MUTEX(hazptr_wildcard_lock); /* Protect the wildcard flip. */ void *hazptr_wildcard = (void *) 1UL; EXPORT_SYMBOL_GPL(hazptr_wildcard); +/* The current overflow list phase. */ +static unsigned int hazptr_overflow_list_phase; + struct hazptr_overflow_list { raw_spinlock_t lock; /* Lock protecting overflow list and list generation. */ struct hlist_head head; /* Overflow list head. */ @@ -53,6 +57,12 @@ void *flip_wildcard(void *wildcard) return ((unsigned long) wildcard == 1UL) ? (void *) 2UL : (void *) 1UL; } +static +unsigned int flip_list_phase(unsigned int phase) +{ + return 1 - phase; +} + static bool is_wildcard(void *addr) { @@ -178,15 +188,12 @@ void hazptr_synchronize_cpu_slots(int cpu, void *addr, void *scan_wildcard) } static -void hazptr_scan_period(void *addr, void *scan_wildcard) +void hazptr_scan_cpu_slots_period(void *addr, void *scan_wildcard) { - unsigned int scan_idx = (unsigned long) scan_wildcard - 1; int cpu; /* Scan all CPUs slots. */ for_each_possible_cpu(cpu) { - struct hazptr_overflow_list_flip *overflow_list_flip = per_cpu_ptr(&percpu_overflow_list_flip, cpu); - /* * Scan CPU slots. * Forward progress against recurring wildcards is guaranteed @@ -199,6 +206,17 @@ void hazptr_scan_period(void *addr, void *scan_wildcard) * to acquire that same hazard pointer value. */ hazptr_synchronize_cpu_slots(cpu, addr, scan_wildcard); + } +} + +static +void hazptr_scan_overflow_list_period(void *addr, unsigned int scan_idx) +{ + int cpu; + + /* Scan all CPUs overflow lists. */ + for_each_possible_cpu(cpu) { + struct hazptr_overflow_list_flip *overflow_list_flip = per_cpu_ptr(&percpu_overflow_list_flip, cpu); /* * Scan backup slots in percpu overflow lists. @@ -218,6 +236,7 @@ void hazptr_scan_period(void *addr, void *scan_wildcard) */ void hazptr_synchronize(void *addr) { + unsigned int scan_list_phase; void *scan_wildcard; /* @@ -235,18 +254,29 @@ void hazptr_synchronize(void *addr) /* Memory ordering: Store A before Load B. */ smp_mb(); - guard(mutex)(&hazptr_wildcard_lock); + guard(mutex)(&hazptr_phase_lock); + + /* Scan per-CPU slots. */ scan_wildcard = flip_wildcard(hazptr_wildcard); - hazptr_scan_period(addr, scan_wildcard); - WRITE_ONCE(hazptr_wildcard, scan_wildcard); /* Flip the current wildcard. */ - hazptr_scan_period(addr, flip_wildcard(scan_wildcard)); + hazptr_scan_cpu_slots_period(addr, scan_wildcard); + WRITE_ONCE(hazptr_wildcard, scan_wildcard); /* Flip the current wildcard. */ + hazptr_scan_cpu_slots_period(addr, flip_wildcard(scan_wildcard)); + + /* + * Scan overflow lists *after* scanning per-CPU slots. See + * hazptr_promote_to_backup_slot() for scan ordering requirement. + */ + scan_list_phase = flip_list_phase(hazptr_overflow_list_phase); + hazptr_scan_overflow_list_period(addr, scan_list_phase); + WRITE_ONCE(hazptr_overflow_list_phase, scan_list_phase); /* Flip the current list phase. */ + hazptr_scan_overflow_list_period(addr, flip_list_phase(scan_list_phase)); } EXPORT_SYMBOL_GPL(hazptr_synchronize); struct hazptr_slot *hazptr_chain_backup_slot(struct hazptr_ctx *ctx) { struct hazptr_overflow_list_flip *overflow_list_flip = this_cpu_ptr(&percpu_overflow_list_flip); - unsigned int list_idx = (unsigned long) READ_ONCE(hazptr_wildcard) - 1; + unsigned int list_idx = READ_ONCE(hazptr_overflow_list_phase); struct hazptr_overflow_list *overflow_list = &overflow_list_flip->array[list_idx]; struct hazptr_slot *slot = &ctx->backup_slot.slot; -- 2.43.0