[PATCH] rcutorture: Fix busted_srcud crash on module unload

[PATCH] rcutorture: Fix busted_srcud crash on module unload

[fuwenxin]

From: Fu Wenxin <fuwenxin@linux.alibaba.com>

Commit e4ed20c1603c ("rcutorture: Exercise DEFINE_STATIC_SRCU_FAST() and
init_srcu_struct_fast()") split SRCU torture initialization into two
helpers: srcu_torture_init(), which now only points srcu_ctlp at the
static srcu_ctl/srcu_ctlf/srcu_ctlfud structures, and the new
srcud_torture_init(), which calls init_srcu_struct(&srcu_ctld) for the
dynamically allocated srcu_ctld.

That commit updated srcud_ops to use srcud_torture_init(), but left
busted_srcud_ops pairing .init = srcu_torture_init (static srcu_ctl) with
.cleanup = srcu_torture_cleanup (which unconditionally calls
cleanup_srcu_struct(&srcu_ctld)). As a result srcu_ctld is never
initialized when running torture_type=busted_srcud, yet it is torn down
at module unload.

cleanup_srcu_struct() then dereferences ssp->srcu_sup, which is still
NULL for the zero-initialized srcu_ctld, and faults on the ->lock field
accessed by raw_spin_lock_irq_rcu_node():

  Unable to handle kernel paging request at virtual address dfff80000000001b
  ...
  el1_abort -> do_translation_fault -> do_bad_area -> die_kernel_fault

(The fault address is the KASAN shadow of NULL + offsetof(srcu_usage,
lock) == 0xd8.)

This is trivially reproducible:

  modprobe rcutorture torture_type=busted_srcud
  sleep 45
  rmmod rcutorture    # panic here

Fix it by making busted_srcud_ops initialize the same srcu_ctld that its
cleanup handler tears down, matching srcud_ops.

Fixes: e4ed20c1603c ("rcutorture: Exercise DEFINE_STATIC_SRCU_FAST() and init_srcu_struct_fast()")
Signed-off-by: Fu Wenxin <fuwenxin@linux.alibaba.com>
---
 kernel/rcu/rcutorture.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/rcu/rcutorture.c b/kernel/rcu/rcutorture.c
index 8a9282a0245cc..7cc78da1356f9 100644
--- a/kernel/rcu/rcutorture.c
+++ b/kernel/rcu/rcutorture.c
@@ -991,7 +991,7 @@ static struct rcu_torture_ops srcud_ops = {
 /* As above, but broken due to inappropriate reader extension. */
 static struct rcu_torture_ops busted_srcud_ops = {
 	.ttype		= SRCU_FLAVOR,
-	.init		= srcu_torture_init,
+	.init		= srcud_torture_init,
 	.cleanup	= srcu_torture_cleanup,
 	.readlock	= srcu_torture_read_lock,
 	.read_delay	= rcu_read_delay,
-- 
2.43.7

Re: [PATCH] rcutorture: Fix busted_srcud crash on module unload

[Joel Fernandes]

> On Oct 18, 2026, at 10:36 PM, fuwenxin@linux.alibaba.com wrote:
> 
> From: Fu Wenxin <fuwenxin@linux.alibaba.com>
> 
> Commit e4ed20c1603c ("rcutorture: Exercise DEFINE_STATIC_SRCU_FAST() and
> init_srcu_struct_fast()") split SRCU torture initialization into two
> helpers: srcu_torture_init(), which now only points srcu_ctlp at the
> static srcu_ctl/srcu_ctlf/srcu_ctlfud structures, and the new
> srcud_torture_init(), which calls init_srcu_struct(&srcu_ctld) for the
> dynamically allocated srcu_ctld.
> 
> That commit updated srcud_ops to use srcud_torture_init(), but left
> busted_srcud_ops pairing .init = srcu_torture_init (static srcu_ctl) with
> .cleanup = srcu_torture_cleanup (which unconditionally calls
> cleanup_srcu_struct(&srcu_ctld)). As a result srcu_ctld is never
> initialized when running torture_type=busted_srcud, yet it is torn down
> at module unload.
> 
> cleanup_srcu_struct() then dereferences ssp->srcu_sup, which is still
> NULL for the zero-initialized srcu_ctld, and faults on the ->lock field
> accessed by raw_spin_lock_irq_rcu_node():
> 
>  Unable to handle kernel paging request at virtual address dfff80000000001b
>  ...
>  el1_abort -> do_translation_fault -> do_bad_area -> die_kernel_fault
> 
> (The fault address is the KASAN shadow of NULL + offsetof(srcu_usage,
> lock) == 0xd8.)
> 
> This is trivially reproducible:
> 
>  modprobe rcutorture torture_type=busted_srcud
>  sleep 45
>  rmmod rcutorture    # panic here
> 
> Fix it by making busted_srcud_ops initialize the same srcu_ctld that its
> cleanup handler tears down, matching srcud_ops.
> 
> Fixes: e4ed20c1603c ("rcutorture: Exercise DEFINE_STATIC_SRCU_FAST() and init_srcu_struct_fast()")
> Signed-off-by: Fu Wenxin <fuwenxin@linux.alibaba.com>

Reviewed-by: Joel Fernandes <joelagnelf@nvidia.com>

Applying for 7.5, thanks.



> ---
> kernel/rcu/rcutorture.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/kernel/rcu/rcutorture.c b/kernel/rcu/rcutorture.c
> index 8a9282a0245cc..7cc78da1356f9 100644
> --- a/kernel/rcu/rcutorture.c
> +++ b/kernel/rcu/rcutorture.c
> @@ -991,7 +991,7 @@ static struct rcu_torture_ops srcud_ops = {
> /* As above, but broken due to inappropriate reader extension. */
> static struct rcu_torture_ops busted_srcud_ops = {
>    .ttype        = SRCU_FLAVOR,
> -    .init        = srcu_torture_init,
> +    .init        = srcud_torture_init,
>    .cleanup    = srcu_torture_cleanup,
>    .readlock    = srcu_torture_read_lock,
>    .read_delay    = rcu_read_delay,
> --
> 2.43.7
> 

Re: [PATCH] rcutorture: Fix busted_srcud crash on module unload

[Bradley Morgan]

On 19 October 2026 03:36:44 BST, fuwenxin@linux.alibaba.com wrote:
>From: Fu Wenxin <fuwenxin@linux.alibaba.com>
>
>Commit e4ed20c1603c ("rcutorture: Exercise DEFINE_STATIC_SRCU_FAST() and
>init_srcu_struct_fast()") split SRCU torture initialization into two
>helpers: srcu_torture_init(), which now only points srcu_ctlp at the
>static srcu_ctl/srcu_ctlf/srcu_ctlfud structures, and the new
>srcud_torture_init(), which calls init_srcu_struct(&srcu_ctld) for the
>dynamically allocated srcu_ctld.
>
>That commit updated srcud_ops to use srcud_torture_init(), but left
>busted_srcud_ops pairing .init = srcu_torture_init (static srcu_ctl) with
>.cleanup = srcu_torture_cleanup (which unconditionally calls
>cleanup_srcu_struct(&srcu_ctld)). As a result srcu_ctld is never
>initialized when running torture_type=busted_srcud, yet it is torn down
>at module unload.
>
>cleanup_srcu_struct() then dereferences ssp->srcu_sup, which is still
>NULL for the zero-initialized srcu_ctld, and faults on the ->lock field
>accessed by raw_spin_lock_irq_rcu_node():
>
>  Unable to handle kernel paging request at virtual address dfff80000000001b
>  ...
>  el1_abort -> do_translation_fault -> do_bad_area -> die_kernel_fault
>
>(The fault address is the KASAN shadow of NULL + offsetof(srcu_usage,
>lock) == 0xd8.)
>
>This is trivially reproducible:
>
>  modprobe rcutorture torture_type=busted_srcud
>  sleep 45
>  rmmod rcutorture    # panic here
>
>Fix it by making busted_srcud_ops initialize the same srcu_ctld that its
>cleanup handler tears down, matching srcud_ops.
>
>Fixes: e4ed20c1603c ("rcutorture: Exercise DEFINE_STATIC_SRCU_FAST() and init_srcu_struct_fast()")

Nice catch! I reproduced this bug on my PowerPC host:

Reviewed-by: Bradley Morgan <brads@mainlining.org>

Tested-by: Bradley Morgan <brads@mainlining.org> # Power10

>Signed-off-by: Fu Wenxin <fuwenxin@linux.alibaba.com>
>---
> kernel/rcu/rcutorture.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
>diff --git a/kernel/rcu/rcutorture.c b/kernel/rcu/rcutorture.c
>index 8a9282a0245cc..7cc78da1356f9 100644
>--- a/kernel/rcu/rcutorture.c
>+++ b/kernel/rcu/rcutorture.c
>@@ -991,7 +991,7 @@ static struct rcu_torture_ops srcud_ops = {
> /* As above, but broken due to inappropriate reader extension. */
> static struct rcu_torture_ops busted_srcud_ops = {
> 	.ttype		= SRCU_FLAVOR,
>-	.init		= srcu_torture_init,
>+	.init		= srcud_torture_init,
> 	.cleanup	= srcu_torture_cleanup,
> 	.readlock	= srcu_torture_read_lock,
> 	.read_delay	= rcu_read_delay,
>



--- Thanks!
"I'm not a very positive person" - Linus torvalds