* [PATCH v2 01/10] srcu: Record callback registration stack for KASAN
2026-10-27 7:09 [PATCH v2 00/10] rcu: Improve callback diagnostics and validation Kunwu Chan
@ 2026-10-27 7:09 ` Kunwu Chan
2026-10-27 7:09 ` [PATCH v2 02/10] srcutiny: " Kunwu Chan
` (8 subsequent siblings)
9 siblings, 0 replies; 11+ messages in thread
From: Kunwu Chan @ 2026-10-27 7:09 UTC (permalink / raw)
To: jiangshanlai, paulmck, josh, work, frederic, neeraj.upadhyay,
joelagnelf, boqun, urezki
Cc: rostedt, mathieu.desnoyers, qiang.zhang, rcu, linux-kernel,
Kunwu Chan, Kunwu Chan
Record the callback registration stack in __call_srcu()
for KASAN diagnostics involving SRCU callbacks.
Suggested-by: Zqiang <qiang.zhang@linux.dev>
Signed-off-by: Kunwu Chan <chentao@kylinos.cn>
---
kernel/rcu/srcutree.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/kernel/rcu/srcutree.c b/kernel/rcu/srcutree.c
index 2b0e2b2d2c18..46fe2f0cef85 100644
--- a/kernel/rcu/srcutree.c
+++ b/kernel/rcu/srcutree.c
@@ -20,6 +20,7 @@
#include <linux/percpu.h>
#include <linux/preempt.h>
#include <linux/irq_work.h>
+#include <linux/kasan.h>
#include <linux/llist.h>
#include <linux/rcupdate_wait.h>
#include <linux/sched.h>
@@ -1530,6 +1531,10 @@ static void __call_srcu(struct srcu_struct *ssp, struct rcu_head *rhp,
{
if (WARN_ON_ONCE(ssp->srcu_reader_flavor == SRCU_READ_FLAVOR_ATOMIC))
return; // Leak the callback rather than corrupt SRCU state.
+
+ /* Record the caller: the irq_work's stack says nothing about it. */
+ kasan_record_aux_stack(rhp);
+
if (should_rcu_defer()) {
struct srcu_defer *sndp = this_cpu_ptr(&srcu_defer);
struct srcu_data *sdp;
--
2.43.0
^ permalink raw reply [flat|nested] 11+ messages in thread* [PATCH v2 02/10] srcutiny: Record callback registration stack for KASAN
2026-10-27 7:09 [PATCH v2 00/10] rcu: Improve callback diagnostics and validation Kunwu Chan
2026-10-27 7:09 ` [PATCH v2 01/10] srcu: Record callback registration stack for KASAN Kunwu Chan
@ 2026-10-27 7:09 ` Kunwu Chan
2026-10-27 7:09 ` [PATCH v2 03/10] rcu: Record callback registration stack for Tiny RCU Kunwu Chan
` (7 subsequent siblings)
9 siblings, 0 replies; 11+ messages in thread
From: Kunwu Chan @ 2026-10-27 7:09 UTC (permalink / raw)
To: jiangshanlai, paulmck, josh, work, frederic, neeraj.upadhyay,
joelagnelf, boqun, urezki
Cc: rostedt, mathieu.desnoyers, qiang.zhang, rcu, linux-kernel,
Kunwu Chan, Kunwu Chan
Record the callback registration stack in call_srcu()
for KASAN diagnostics involving Tiny SRCU callbacks.
Suggested-by: Zqiang <qiang.zhang@linux.dev>
Signed-off-by: Kunwu Chan <chentao@kylinos.cn>
---
kernel/rcu/srcutiny.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/kernel/rcu/srcutiny.c b/kernel/rcu/srcutiny.c
index 63a3f0a8bc53..3ee28885b96f 100644
--- a/kernel/rcu/srcutiny.c
+++ b/kernel/rcu/srcutiny.c
@@ -10,6 +10,7 @@
#include <linux/export.h>
#include <linux/irq_work.h>
+#include <linux/kasan.h>
#include <linux/llist.h>
#include <linux/mutex.h>
#include <linux/preempt.h>
@@ -290,6 +291,9 @@ EXPORT_SYMBOL_GPL(srcu_defer_drain);
void call_srcu(struct srcu_struct *ssp, struct rcu_head *rhp,
rcu_callback_t func)
{
+ /* Record the caller: the irq_work's stack says nothing about it. */
+ kasan_record_aux_stack(rhp);
+
if (should_rcu_defer()) {
/* A re-entrant call_srcu() during the drain would livelock it. */
if (READ_ONCE(srcu_defer_draining) && !in_nmi()) {
--
2.43.0
^ permalink raw reply [flat|nested] 11+ messages in thread* [PATCH v2 03/10] rcu: Record callback registration stack for Tiny RCU
2026-10-27 7:09 [PATCH v2 00/10] rcu: Improve callback diagnostics and validation Kunwu Chan
2026-10-27 7:09 ` [PATCH v2 01/10] srcu: Record callback registration stack for KASAN Kunwu Chan
2026-10-27 7:09 ` [PATCH v2 02/10] srcutiny: " Kunwu Chan
@ 2026-10-27 7:09 ` Kunwu Chan
2026-10-27 7:09 ` [PATCH v2 04/10] srcu: Validate callback arguments Kunwu Chan
` (6 subsequent siblings)
9 siblings, 0 replies; 11+ messages in thread
From: Kunwu Chan @ 2026-10-27 7:09 UTC (permalink / raw)
To: jiangshanlai, paulmck, josh, work, frederic, neeraj.upadhyay,
joelagnelf, boqun, urezki
Cc: rostedt, mathieu.desnoyers, qiang.zhang, rcu, linux-kernel,
Kunwu Chan, Kunwu Chan
Record the callback registration stack in call_rcu()
for KASAN diagnostics involving Tiny RCU callbacks.
Suggested-by: Zqiang <qiang.zhang@linux.dev>
Signed-off-by: Kunwu Chan <chentao@kylinos.cn>
---
kernel/rcu/tiny.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/kernel/rcu/tiny.c b/kernel/rcu/tiny.c
index 656b6a682e31..bd22fa43108d 100644
--- a/kernel/rcu/tiny.c
+++ b/kernel/rcu/tiny.c
@@ -12,6 +12,7 @@
#include <linux/completion.h>
#include <linux/interrupt.h>
#include <linux/irq_work.h>
+#include <linux/kasan.h>
#include <linux/llist.h>
#include <linux/notifier.h>
#include <linux/rcupdate_wait.h>
@@ -251,6 +252,9 @@ EXPORT_SYMBOL_GPL(synchronize_rcu);
*/
void call_rcu(struct rcu_head *head, rcu_callback_t func)
{
+ /* Record the caller: the irq_work's stack says nothing about it. */
+ kasan_record_aux_stack(head);
+
if (should_rcu_defer()) {
call_rcu_defer(head, func);
return;
--
2.43.0
^ permalink raw reply [flat|nested] 11+ messages in thread* [PATCH v2 04/10] srcu: Validate callback arguments
2026-10-27 7:09 [PATCH v2 00/10] rcu: Improve callback diagnostics and validation Kunwu Chan
` (2 preceding siblings ...)
2026-10-27 7:09 ` [PATCH v2 03/10] rcu: Record callback registration stack for Tiny RCU Kunwu Chan
@ 2026-10-27 7:09 ` Kunwu Chan
2026-10-27 7:09 ` [PATCH v2 05/10] rcu: Validate callback arguments in Tiny RCU Kunwu Chan
` (5 subsequent siblings)
9 siblings, 0 replies; 11+ messages in thread
From: Kunwu Chan @ 2026-10-27 7:09 UTC (permalink / raw)
To: jiangshanlai, paulmck, josh, work, frederic, neeraj.upadhyay,
joelagnelf, boqun, urezki
Cc: rostedt, mathieu.desnoyers, qiang.zhang, rcu, linux-kernel,
Kunwu Chan, Kunwu Chan
Check callback-head alignment and reject NULL callback
functions in the SRCU callback registration paths.
Reviewed-by: Paul E. McKenney <paulmck@kernel.org>
Signed-off-by: Kunwu Chan <chentao@kylinos.cn>
---
kernel/rcu/srcutiny.c | 7 +++++++
kernel/rcu/srcutree.c | 7 +++++++
2 files changed, 14 insertions(+)
diff --git a/kernel/rcu/srcutiny.c b/kernel/rcu/srcutiny.c
index 3ee28885b96f..98864977bed2 100644
--- a/kernel/rcu/srcutiny.c
+++ b/kernel/rcu/srcutiny.c
@@ -291,6 +291,13 @@ EXPORT_SYMBOL_GPL(srcu_defer_drain);
void call_srcu(struct srcu_struct *ssp, struct rcu_head *rhp,
rcu_callback_t func)
{
+ /* Misaligned rcu_head! */
+ WARN_ON_ONCE((unsigned long)rhp & (sizeof(void *) - 1));
+
+ /* Avoid NULL dereference if callback is NULL. */
+ if (WARN_ON_ONCE(!func))
+ return;
+
/* Record the caller: the irq_work's stack says nothing about it. */
kasan_record_aux_stack(rhp);
diff --git a/kernel/rcu/srcutree.c b/kernel/rcu/srcutree.c
index 46fe2f0cef85..1993ddbdb828 100644
--- a/kernel/rcu/srcutree.c
+++ b/kernel/rcu/srcutree.c
@@ -1529,6 +1529,13 @@ static void srcu_do_enqueue(struct srcu_struct *ssp, struct rcu_head *rhp,
static void __call_srcu(struct srcu_struct *ssp, struct rcu_head *rhp,
rcu_callback_t func, bool do_norm)
{
+ /* Misaligned rcu_head! */
+ WARN_ON_ONCE((unsigned long)rhp & (sizeof(void *) - 1));
+
+ /* Avoid NULL dereference if callback is NULL. */
+ if (WARN_ON_ONCE(!func))
+ return;
+
if (WARN_ON_ONCE(ssp->srcu_reader_flavor == SRCU_READ_FLAVOR_ATOMIC))
return; // Leak the callback rather than corrupt SRCU state.
--
2.43.0
^ permalink raw reply [flat|nested] 11+ messages in thread* [PATCH v2 05/10] rcu: Validate callback arguments in Tiny RCU
2026-10-27 7:09 [PATCH v2 00/10] rcu: Improve callback diagnostics and validation Kunwu Chan
` (3 preceding siblings ...)
2026-10-27 7:09 ` [PATCH v2 04/10] srcu: Validate callback arguments Kunwu Chan
@ 2026-10-27 7:09 ` Kunwu Chan
2026-10-27 7:09 ` [PATCH v2 06/10] rcu-tasks: Validate callback arguments Kunwu Chan
` (4 subsequent siblings)
9 siblings, 0 replies; 11+ messages in thread
From: Kunwu Chan @ 2026-10-27 7:09 UTC (permalink / raw)
To: jiangshanlai, paulmck, josh, work, frederic, neeraj.upadhyay,
joelagnelf, boqun, urezki
Cc: rostedt, mathieu.desnoyers, qiang.zhang, rcu, linux-kernel,
Kunwu Chan, Kunwu Chan
Check callback-head alignment and reject NULL callback
functions in Tiny RCU's call_rcu() path.
Reviewed-by: Paul E. McKenney <paulmck@kernel.org>
Signed-off-by: Kunwu Chan <chentao@kylinos.cn>
---
kernel/rcu/tiny.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/kernel/rcu/tiny.c b/kernel/rcu/tiny.c
index bd22fa43108d..ef0b0474f207 100644
--- a/kernel/rcu/tiny.c
+++ b/kernel/rcu/tiny.c
@@ -252,6 +252,13 @@ EXPORT_SYMBOL_GPL(synchronize_rcu);
*/
void call_rcu(struct rcu_head *head, rcu_callback_t func)
{
+ /* Misaligned rcu_head! */
+ WARN_ON_ONCE((unsigned long)head & (sizeof(void *) - 1));
+
+ /* Avoid NULL dereference if callback is NULL. */
+ if (WARN_ON_ONCE(!func))
+ return;
+
/* Record the caller: the irq_work's stack says nothing about it. */
kasan_record_aux_stack(head);
--
2.43.0
^ permalink raw reply [flat|nested] 11+ messages in thread* [PATCH v2 06/10] rcu-tasks: Validate callback arguments
2026-10-27 7:09 [PATCH v2 00/10] rcu: Improve callback diagnostics and validation Kunwu Chan
` (4 preceding siblings ...)
2026-10-27 7:09 ` [PATCH v2 05/10] rcu: Validate callback arguments in Tiny RCU Kunwu Chan
@ 2026-10-27 7:09 ` Kunwu Chan
2026-10-27 7:09 ` [PATCH v2 07/10] srcu: Detect duplicate callback enqueue at registration Kunwu Chan
` (3 subsequent siblings)
9 siblings, 0 replies; 11+ messages in thread
From: Kunwu Chan @ 2026-10-27 7:09 UTC (permalink / raw)
To: jiangshanlai, paulmck, josh, work, frederic, neeraj.upadhyay,
joelagnelf, boqun, urezki
Cc: rostedt, mathieu.desnoyers, qiang.zhang, rcu, linux-kernel,
Kunwu Chan, Kunwu Chan
Check callback-head alignment and reject NULL callback
functions in the generic RCU Tasks callback registration path.
Reviewed-by: Paul E. McKenney <paulmck@kernel.org>
Signed-off-by: Kunwu Chan <chentao@kylinos.cn>
---
kernel/rcu/tasks.h | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/kernel/rcu/tasks.h b/kernel/rcu/tasks.h
index fcac7361ec51..5d7f234795b4 100644
--- a/kernel/rcu/tasks.h
+++ b/kernel/rcu/tasks.h
@@ -351,6 +351,13 @@ static void call_rcu_tasks_generic(struct rcu_head *rhp, rcu_callback_t func,
bool needwake;
struct rcu_tasks_percpu *rtpcp;
+ /* Misaligned rcu_head! */
+ WARN_ON_ONCE((unsigned long)rhp & (sizeof(void *) - 1));
+
+ /* Avoid NULL dereference if callback is NULL. */
+ if (WARN_ON_ONCE(!func))
+ return;
+
rhp->next = NULL;
rhp->func = func;
local_irq_save(flags);
--
2.43.0
^ permalink raw reply [flat|nested] 11+ messages in thread* [PATCH v2 07/10] srcu: Detect duplicate callback enqueue at registration
2026-10-27 7:09 [PATCH v2 00/10] rcu: Improve callback diagnostics and validation Kunwu Chan
` (5 preceding siblings ...)
2026-10-27 7:09 ` [PATCH v2 06/10] rcu-tasks: Validate callback arguments Kunwu Chan
@ 2026-10-27 7:09 ` Kunwu Chan
2026-10-27 7:09 ` [PATCH v2 08/10] srcutiny: Detect duplicate callback enqueue Kunwu Chan
` (2 subsequent siblings)
9 siblings, 0 replies; 11+ messages in thread
From: Kunwu Chan @ 2026-10-27 7:09 UTC (permalink / raw)
To: jiangshanlai, paulmck, josh, work, frederic, neeraj.upadhyay,
joelagnelf, boqun, urezki
Cc: rostedt, mathieu.desnoyers, qiang.zhang, rcu, linux-kernel,
Kunwu Chan, Kunwu Chan
Move the duplicate-callback check from srcu_do_enqueue() to
__call_srcu() entry so that detected duplicate registrations
are rejected before they reach the deferred-list enqueue path.
Use __ratelimit() to limit the diagnostic output (error message,
object dump, and stack trace) as a group.
Suggested-by: Paul E. McKenney <paulmck@kernel.org>
Signed-off-by: Kunwu Chan <chentao@kylinos.cn>
---
kernel/rcu/srcutree.c | 24 ++++++++++++++++++------
1 file changed, 18 insertions(+), 6 deletions(-)
diff --git a/kernel/rcu/srcutree.c b/kernel/rcu/srcutree.c
index 1993ddbdb828..81423b3dffae 100644
--- a/kernel/rcu/srcutree.c
+++ b/kernel/rcu/srcutree.c
@@ -23,10 +23,12 @@
#include <linux/kasan.h>
#include <linux/llist.h>
#include <linux/rcupdate_wait.h>
+#include <linux/ratelimit.h>
#include <linux/sched.h>
#include <linux/smp.h>
#include <linux/delay.h>
#include <linux/module.h>
+#include <linux/mm.h>
#include <linux/slab.h>
#include <linux/srcu.h>
@@ -1511,12 +1513,6 @@ static unsigned long srcu_gp_start_if_needed(struct srcu_struct *ssp,
static void srcu_do_enqueue(struct srcu_struct *ssp, struct rcu_head *rhp,
rcu_callback_t func, bool do_norm)
{
- if (debug_rcu_head_queue(rhp)) {
- /* Probable double call_srcu(), so leak the callback. */
- WRITE_ONCE(rhp->func, srcu_leak_callback);
- WARN_ONCE(1, "call_srcu(): Leaked duplicate callback\n");
- return;
- }
rhp->func = func;
(void)srcu_gp_start_if_needed(ssp, rhp, do_norm);
}
@@ -1526,6 +1522,10 @@ static void srcu_do_enqueue(struct srcu_struct *ssp, struct rcu_head *rhp,
* disabled, so defer when interrupts are already off rather than enqueue into
* an operation that may be in flight on this CPU.
*/
+static DEFINE_RATELIMIT_STATE(rcu_srcu_dup_rs,
+ DEFAULT_RATELIMIT_INTERVAL,
+ DEFAULT_RATELIMIT_BURST);
+
static void __call_srcu(struct srcu_struct *ssp, struct rcu_head *rhp,
rcu_callback_t func, bool do_norm)
{
@@ -1539,6 +1539,17 @@ static void __call_srcu(struct srcu_struct *ssp, struct rcu_head *rhp,
if (WARN_ON_ONCE(ssp->srcu_reader_flavor == SRCU_READ_FLAVOR_ATOMIC))
return; // Leak the callback rather than corrupt SRCU state.
+ if (debug_rcu_head_queue(rhp)) {
+ if (__ratelimit(&rcu_srcu_dup_rs)) {
+ pr_err("%s(): Duplicate call_srcu() CB %p->%pS()\n",
+ __func__, rhp, rhp->func);
+ mem_dump_obj(rhp);
+ dump_stack();
+ }
+ WRITE_ONCE(rhp->func, srcu_leak_callback);
+ return;
+ }
+
/* Record the caller: the irq_work's stack says nothing about it. */
kasan_record_aux_stack(rhp);
@@ -1554,6 +1565,7 @@ static void __call_srcu(struct srcu_struct *ssp, struct rcu_head *rhp,
if (READ_ONCE(sndp->draining) && !in_nmi()) {
WARN_ONCE(IS_ENABLED(CONFIG_PROVE_RCU),
"call_srcu() re-entered during callback drain; leaking callback\n");
+ debug_rcu_head_unqueue(rhp);
return;
}
sdp = this_cpu_ptr(ssp->sda);
--
2.43.0
^ permalink raw reply [flat|nested] 11+ messages in thread* [PATCH v2 08/10] srcutiny: Detect duplicate callback enqueue
2026-10-27 7:09 [PATCH v2 00/10] rcu: Improve callback diagnostics and validation Kunwu Chan
` (6 preceding siblings ...)
2026-10-27 7:09 ` [PATCH v2 07/10] srcu: Detect duplicate callback enqueue at registration Kunwu Chan
@ 2026-10-27 7:09 ` Kunwu Chan
2026-10-27 7:09 ` [PATCH v2 09/10] rcu-tasks: " Kunwu Chan
2026-10-27 7:09 ` [PATCH v2 10/10] rcu: Improve duplicate callback diagnostics Kunwu Chan
9 siblings, 0 replies; 11+ messages in thread
From: Kunwu Chan @ 2026-10-27 7:09 UTC (permalink / raw)
To: jiangshanlai, paulmck, josh, work, frederic, neeraj.upadhyay,
joelagnelf, boqun, urezki
Cc: rostedt, mathieu.desnoyers, qiang.zhang, rcu, linux-kernel,
Kunwu Chan, Kunwu Chan
Detect duplicate callback enqueue attempts at call_srcu()
entry, before the deferred list can be corrupted. Use
__ratelimit() for the diagnostic output group.
Suggested-by: Paul E. McKenney <paulmck@kernel.org>
Signed-off-by: Kunwu Chan <chentao@kylinos.cn>
---
kernel/rcu/srcutiny.c | 23 +++++++++++++++++++++++
1 file changed, 23 insertions(+)
diff --git a/kernel/rcu/srcutiny.c b/kernel/rcu/srcutiny.c
index 98864977bed2..4c1e8d8595b3 100644
--- a/kernel/rcu/srcutiny.c
+++ b/kernel/rcu/srcutiny.c
@@ -12,9 +12,11 @@
#include <linux/irq_work.h>
#include <linux/kasan.h>
#include <linux/llist.h>
+#include <linux/mm.h>
#include <linux/mutex.h>
#include <linux/preempt.h>
#include <linux/rcupdate_wait.h>
+#include <linux/ratelimit.h>
#include <linux/sched.h>
#include <linux/delay.h>
#include <linux/srcu.h>
@@ -178,6 +180,7 @@ void srcu_drive_gp(struct work_struct *wp)
while (lh) {
rhp = lh;
lh = lh->next;
+ debug_rcu_head_unqueue(rhp);
debug_rcu_head_callback(rhp);
local_bh_disable();
rhp->func(rhp);
@@ -235,6 +238,8 @@ static void srcu_gp_start_if_needed(struct srcu_struct *ssp)
* Also called by __srcu_defer_drain() to re-issue a deferred callback, so it
* must not re-check the deferral condition.
*/
+static void srcu_leak_callback(struct rcu_head *rhp) { }
+
static void srcu_do_enqueue(struct srcu_struct *ssp, struct rcu_head *rhp,
rcu_callback_t func)
{
@@ -272,6 +277,8 @@ static void __srcu_defer_drain(struct srcu_struct *ssp)
llist_for_each_safe(node, next, llist_del_all(&ssp->defer_cbs)) {
struct rcu_head *rhp = (struct rcu_head *)node;
+ /* Bounds a node self-linked by a double call_srcu(). */
+ rhp->next = NULL;
srcu_do_enqueue(ssp, rhp, rhp->func);
}
local_irq_restore(flags);
@@ -288,6 +295,10 @@ void srcu_defer_drain(struct irq_work *iw)
}
EXPORT_SYMBOL_GPL(srcu_defer_drain);
+static DEFINE_RATELIMIT_STATE(rcu_srcutiny_dup_rs,
+ DEFAULT_RATELIMIT_INTERVAL,
+ DEFAULT_RATELIMIT_BURST);
+
void call_srcu(struct srcu_struct *ssp, struct rcu_head *rhp,
rcu_callback_t func)
{
@@ -298,6 +309,17 @@ void call_srcu(struct srcu_struct *ssp, struct rcu_head *rhp,
if (WARN_ON_ONCE(!func))
return;
+ if (debug_rcu_head_queue(rhp)) {
+ if (__ratelimit(&rcu_srcutiny_dup_rs)) {
+ pr_err("%s(): Duplicate call_srcu() CB %p->%pS()\n",
+ __func__, rhp, rhp->func);
+ mem_dump_obj(rhp);
+ dump_stack();
+ }
+ WRITE_ONCE(rhp->func, srcu_leak_callback);
+ return;
+ }
+
/* Record the caller: the irq_work's stack says nothing about it. */
kasan_record_aux_stack(rhp);
@@ -306,6 +328,7 @@ void call_srcu(struct srcu_struct *ssp, struct rcu_head *rhp,
if (READ_ONCE(srcu_defer_draining) && !in_nmi()) {
WARN_ONCE(IS_ENABLED(CONFIG_PROVE_RCU),
"call_srcu() re-entered during callback drain; leaking callback\n");
+ debug_rcu_head_unqueue(rhp);
return;
}
rhp->func = func;
--
2.43.0
^ permalink raw reply [flat|nested] 11+ messages in thread* [PATCH v2 09/10] rcu-tasks: Detect duplicate callback enqueue
2026-10-27 7:09 [PATCH v2 00/10] rcu: Improve callback diagnostics and validation Kunwu Chan
` (7 preceding siblings ...)
2026-10-27 7:09 ` [PATCH v2 08/10] srcutiny: Detect duplicate callback enqueue Kunwu Chan
@ 2026-10-27 7:09 ` Kunwu Chan
2026-10-27 7:09 ` [PATCH v2 10/10] rcu: Improve duplicate callback diagnostics Kunwu Chan
9 siblings, 0 replies; 11+ messages in thread
From: Kunwu Chan @ 2026-10-27 7:09 UTC (permalink / raw)
To: jiangshanlai, paulmck, josh, work, frederic, neeraj.upadhyay,
joelagnelf, boqun, urezki
Cc: rostedt, mathieu.desnoyers, qiang.zhang, rcu, linux-kernel,
Kunwu Chan, Kunwu Chan
Detect duplicate callback enqueue attempts in the generic
RCU Tasks callback registration path. Use __ratelimit()
for the diagnostic output group.
Suggested-by: Paul E. McKenney <paulmck@kernel.org>
Signed-off-by: Kunwu Chan <chentao@kylinos.cn>
---
kernel/rcu/tasks.h | 20 ++++++++++++++++++++
1 file changed, 20 insertions(+)
diff --git a/kernel/rcu/tasks.h b/kernel/rcu/tasks.h
index 5d7f234795b4..d5d060a5c4b6 100644
--- a/kernel/rcu/tasks.h
+++ b/kernel/rcu/tasks.h
@@ -6,6 +6,8 @@
*/
#ifdef CONFIG_TASKS_RCU_GENERIC
+#include <linux/mm.h>
+#include <linux/ratelimit.h>
#include "rcu_segcblist.h"
////////////////////////////////////////////////////////////////////////
@@ -339,6 +341,12 @@ static void call_rcu_tasks_iw_wakeup(struct irq_work *iwp)
}
// Enqueue a callback for the specified flavor of Tasks RCU.
+static void rcu_tasks_leak_callback(struct rcu_head *rhp) { }
+
+static DEFINE_RATELIMIT_STATE(rcu_tasks_dup_rs,
+ DEFAULT_RATELIMIT_INTERVAL,
+ DEFAULT_RATELIMIT_BURST);
+
static void call_rcu_tasks_generic(struct rcu_head *rhp, rcu_callback_t func,
struct rcu_tasks *rtp)
{
@@ -358,6 +366,17 @@ static void call_rcu_tasks_generic(struct rcu_head *rhp, rcu_callback_t func,
if (WARN_ON_ONCE(!func))
return;
+ if (debug_rcu_head_queue(rhp)) {
+ if (__ratelimit(&rcu_tasks_dup_rs)) {
+ pr_err("%s(): Duplicate CB for %s, %p->%pS()\n",
+ __func__, rtp->name, rhp, rhp->func);
+ mem_dump_obj(rhp);
+ dump_stack();
+ }
+ WRITE_ONCE(rhp->func, rcu_tasks_leak_callback);
+ return;
+ }
+
rhp->next = NULL;
rhp->func = func;
local_irq_save(flags);
@@ -586,6 +605,7 @@ static void rcu_tasks_invoke_cbs(struct rcu_tasks *rtp, struct rcu_tasks_percpu
raw_spin_unlock_irqrestore_rcu_node(rtpcp, flags);
len = rcl.len;
for (rhp = rcu_cblist_dequeue(&rcl); rhp; rhp = rcu_cblist_dequeue(&rcl)) {
+ debug_rcu_head_unqueue(rhp);
debug_rcu_head_callback(rhp);
local_bh_disable();
rhp->func(rhp);
--
2.43.0
^ permalink raw reply [flat|nested] 11+ messages in thread* [PATCH v2 10/10] rcu: Improve duplicate callback diagnostics
2026-10-27 7:09 [PATCH v2 00/10] rcu: Improve callback diagnostics and validation Kunwu Chan
` (8 preceding siblings ...)
2026-10-27 7:09 ` [PATCH v2 09/10] rcu-tasks: " Kunwu Chan
@ 2026-10-27 7:09 ` Kunwu Chan
9 siblings, 0 replies; 11+ messages in thread
From: Kunwu Chan @ 2026-10-27 7:09 UTC (permalink / raw)
To: jiangshanlai, paulmck, josh, work, frederic, neeraj.upadhyay,
joelagnelf, boqun, urezki
Cc: rostedt, mathieu.desnoyers, qiang.zhang, rcu, linux-kernel,
Kunwu Chan, Kunwu Chan
Use ratelimited diagnostics with dump_stack() for duplicate
callback detection in rcu_do_enqueue().
Suggested-by: Paul E. McKenney <paulmck@kernel.org>
Signed-off-by: Kunwu Chan <chentao@kylinos.cn>
---
kernel/rcu/tree.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c
index aea3aef7397e..a8ede50dbeff 100644
--- a/kernel/rcu/tree.c
+++ b/kernel/rcu/tree.c
@@ -25,6 +25,7 @@
#include <linux/rcupdate_wait.h>
#include <linux/interrupt.h>
#include <linux/llist.h>
+#include <linux/ratelimit.h>
#include <linux/sched.h>
#include <linux/sched/debug.h>
#include <linux/nmi.h>
@@ -3154,9 +3155,12 @@ static void check_cb_ovld(struct rcu_data *rdp)
* already disabled, and a drain of a remote CPU re-issues onto the draining
* CPU.
*/
+static DEFINE_RATELIMIT_STATE(rcu_dup_rs,
+ DEFAULT_RATELIMIT_INTERVAL,
+ DEFAULT_RATELIMIT_BURST);
+
static void rcu_do_enqueue(struct rcu_head *head, rcu_callback_t func, bool lazy_in)
{
- static atomic_t doublefrees;
unsigned long flags;
bool lazy;
struct rcu_data *rdp;
@@ -3167,9 +3171,10 @@ static void rcu_do_enqueue(struct rcu_head *head, rcu_callback_t func, bool lazy
* Use rcu:rcu_callback trace event to find the previous
* time callback was passed to call_rcu().
*/
- if (atomic_inc_return(&doublefrees) < 4) {
+ if (__ratelimit(&rcu_dup_rs)) {
pr_err("%s(): Double-freed CB %p->%pS()!!! ", __func__, head, head->func);
mem_dump_obj(head);
+ dump_stack();
}
WRITE_ONCE(head->func, rcu_leak_callback);
return;
--
2.43.0
^ permalink raw reply [flat|nested] 11+ messages in thread