[PATCH 0/5] rcu: Record callback enqueue stacks and add torture tests

[PATCH 0/5] rcu: Record callback enqueue stacks and add torture tests

[Kunwu Chan]

This series adds KASAN auxiliary stack recording for RCU Tasks
callbacks, rcutorture coverage for duplicate-callback detection,
and KASAN aux-stack verification tests across RCU and SRCU flavors.

This series is based on [1]. For testing, I also applied Joel
Fernandes' fix for debugobjects tracking of barrier callbacks
[2], which is needed for the barrier tests.

The changes:
- Record the enqueueing stack in call_rcu_tasks_generic().
- Enable duplicate-callback testing for the "tasks" and
  "tasks-tracing" torture types.
- Add a KASAN aux-stack verification test module with a Kconfig
  choice for each supported flavor.
- Add one rcutorture scenario per flavor for the verification
  test.

Tested on x86_64:

- TASKS01, TASKS02, TASKS03, TRACE01, and TRACE02 completed
  3-minute runs successfully.

- With CONFIG_DEBUG_OBJECTS_RCU_HEAD=y and
  rcutorture.object_debug=1, duplicate-callback detection was
  triggered as expected for both torture types.

- TRACE01 was run for 1 minute with
  CONFIG_DEBUG_OBJECTS_RCU_HEAD=y and
  rcutorture.object_debug=1. The test detected both duplicate
  callback heads through the SRCU enqueue path:
[    0.405836] rcutorture: WARN: Duplicate call_tasks-tracing() test starting.
[    0.405852] ODEBUG: activate active (active state 1) object: 0000000020df980d object type: rcu_head hint: 0x0
[    0.734724] rcu: __call_srcu(): Duplicate call_srcu() CB 0000000020df980d->rcu_torture_leak_cb+0x0/0x10()
[    0.734780] ODEBUG: activate active (active state 1) object: 000000006634e8c9 object type: rcu_head hint: 0x0
[    0.776688] rcu: __call_srcu(): Duplicate call_srcu() CB 000000006634e8c9->rcu_torture_leak_cb+0x0/0x10()
[    0.779126] rcutorture: WARN: Duplicate call_tasks-tracing() test complete.
[   65.411342] tasks-tracing-torture:--- End of test: SUCCESS: ...

Both duplicate callback heads (the stack-allocated rh2 and
the kmalloc-allocated rhp) were rejected and neither was invoked.

- With CONFIG_DEBUG_OBJECTS_RCU_HEAD=y,
  object_debug=1, and n_barrier_cbs=4, the TASKS01 barrier
  test completed 630/630 rounds without barrier errors.
  The only debugobjects warnings were the four intentional
  warnings from the duplicate-callback test at startup.

- All five aux-stack scenarios (TASKSKASAN01, TREEKASAN01,
  SRCUKASAN01, TINYKASAN01, and SRCUTINYKASAN01) produced the
  expected KASAN use-after-free reports. Each report's
  "Last potentially related work creation" entry showed the
  expected enqueue helper:

===== TASKSKASAN01 =====
[    1.244567] BUG: KASAN: slab-use-after-free in aux_test_init+0x8d/0xb0
[    1.244707] Last potentially related work creation:
[    1.244716]  aux_test_call_rcu_tasks.constprop.0+0xc/0x20

===== TREEKASAN01 =====
[    0.670399] BUG: KASAN: slab-use-after-free in aux_test_init+0x8d/0xb0
[    0.670561] Last potentially related work creation:
[    0.670571]  aux_test_call_rcu_tree.constprop.0+0xc/0x20

===== SRCUKASAN01 =====
[    0.658679] BUG: KASAN: slab-use-after-free in aux_test_init+0x94/0xc0
[    0.658919] Last potentially related work creation:
[    0.658932]  aux_test_call_srcu.constprop.0+0x16/0x30

===== TINYKASAN01 =====
[    0.951503] BUG: KASAN: slab-use-after-free in aux_test_init+0x8d/0xb0
[    0.951641] Last potentially related work creation:
[    0.951650]  aux_test_call_rcu_tiny.constprop.0+0xc/0x20

===== SRCUTINYKASAN01 =====
[    1.009005] BUG: KASAN: slab-use-after-free in aux_test_init+0x94/0xc0
[    1.009141] Last potentially related work creation:
[    1.009150]  aux_test_call_srcu.constprop.0+0x16/0x30


These reports are intentional and are counted as runtime
errors by rcutorture.

[1] https://lore.kernel.org/all/20261027070923.3054462-1-kunwu.chan@gmail.com/
[2] https://lore.kernel.org/all/20261104153046.965890-1-joelagnelf@nvidia.com/

Kunwu Chan (5):
  rcu-tasks: Record callback enqueue stack
  rcutorture: Test duplicate call_rcu_tasks() callback enqueue
  rcutorture: Test duplicate call_rcu_tasks_trace() callback enqueue
  rcu: Add KASAN aux-stack verification test
  rcutorture: Add KASAN aux-stack verification scenarios

 kernel/rcu/Kconfig.debug                      |  38 +++++++
 kernel/rcu/Makefile                           |   1 +
 kernel/rcu/rcu_kasan_aux_test.c               | 107 ++++++++++++++++++
 kernel/rcu/rcutorture.c                       |   2 +
 kernel/rcu/tasks.h                            |   4 +
 .../rcutorture/configs/rcu/SRCUKASAN01        |   6 +
 .../rcutorture/configs/rcu/SRCUKASAN01.boot   |   2 +
 .../rcutorture/configs/rcu/SRCUTINYKASAN01    |  12 ++
 .../configs/rcu/SRCUTINYKASAN01.boot          |   2 +
 .../rcutorture/configs/rcu/TASKSKASAN01       |  13 +++
 .../rcutorture/configs/rcu/TASKSKASAN01.boot  |   2 +
 .../rcutorture/configs/rcu/TINYKASAN01        |  12 ++
 .../rcutorture/configs/rcu/TINYKASAN01.boot   |   2 +
 .../rcutorture/configs/rcu/TREEKASAN01        |   6 +
 .../rcutorture/configs/rcu/TREEKASAN01.boot   |   2 +
 15 files changed, 211 insertions(+)
 create mode 100644 kernel/rcu/rcu_kasan_aux_test.c
 create mode 100644 tools/testing/selftests/rcutorture/configs/rcu/SRCUKASAN01
 create mode 100644 tools/testing/selftests/rcutorture/configs/rcu/SRCUKASAN01.boot
 create mode 100644 tools/testing/selftests/rcutorture/configs/rcu/SRCUTINYKASAN01
 create mode 100644 tools/testing/selftests/rcutorture/configs/rcu/SRCUTINYKASAN01.boot
 create mode 100644 tools/testing/selftests/rcutorture/configs/rcu/TASKSKASAN01
 create mode 100644 tools/testing/selftests/rcutorture/configs/rcu/TASKSKASAN01.boot
 create mode 100644 tools/testing/selftests/rcutorture/configs/rcu/TINYKASAN01
 create mode 100644 tools/testing/selftests/rcutorture/configs/rcu/TINYKASAN01.boot
 create mode 100644 tools/testing/selftests/rcutorture/configs/rcu/TREEKASAN01
 create mode 100644 tools/testing/selftests/rcutorture/configs/rcu/TREEKASAN01.boot

-- 
2.43.0

[PATCH 1/5] rcu-tasks: Record callback enqueue stack

[Kunwu Chan]

Tree RCU records the code path that enqueued a given callback via
kasan_record_aux_stack(), but Tasks RCU does not.  KASAN reports
involving Tasks RCU callbacks therefore lack any hint as to which
code path did the enqueueing.  This commit therefore invokes
kasan_record_aux_stack() in call_rcu_tasks_generic(), covering both
call_rcu_tasks() and call_rcu_tasks_rude().

Suggested-by: Zqiang <qiang.zhang@linux.dev>
Cc: Kunwu Chan <kunwu.chan@gmail.com>
Signed-off-by: Kunwu Chan <chentao@kylinos.cn>
---
 kernel/rcu/tasks.h | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/kernel/rcu/tasks.h b/kernel/rcu/tasks.h
index a20db323612b..fd43cd5d5a48 100644
--- a/kernel/rcu/tasks.h
+++ b/kernel/rcu/tasks.h
@@ -6,6 +6,7 @@
  */
 
 #ifdef CONFIG_TASKS_RCU_GENERIC
+#include <linux/kasan.h>
 #include <linux/mm.h>
 #include <linux/ratelimit.h>
 #include "rcu_segcblist.h"
@@ -366,6 +367,9 @@ static void call_rcu_tasks_generic(struct rcu_head *rhp, rcu_callback_t func,
 	if (WARN_ON_ONCE(!func))
 		return;
 
+	/* Record the caller: the irq_work's stack says nothing about it. */
+	kasan_record_aux_stack(rhp);
+
 	if (debug_rcu_head_queue(rhp)) {
 		if (__ratelimit(&rcu_tasks_dup_rs)) {
 			pr_err("%s(): Duplicate CB for %s, %p->%pS()\n",
-- 
2.43.0

[PATCH 2/5] rcutorture: Test duplicate call_rcu_tasks() callback enqueue

[Kunwu Chan]

The rcu_test_debug_objects() function double-enqueues an rcu_head
to test debug-objects duplicate-callback detection, but only for
torture types whose ->debug_objects field is set.  This commit
therefore sets ->debug_objects for the "tasks" torture type so
that call_rcu_tasks()'s duplicate-callback detection is tested.

Suggested-by: Zqiang <qiang.zhang@linux.dev>
Cc: Kunwu Chan <kunwu.chan@gmail.com>
Signed-off-by: Kunwu Chan <chentao@kylinos.cn>
---
 kernel/rcu/rcutorture.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/kernel/rcu/rcutorture.c b/kernel/rcu/rcutorture.c
index 968343be4e0d..a056a79aa3d2 100644
--- a/kernel/rcu/rcutorture.c
+++ b/kernel/rcu/rcutorture.c
@@ -1221,6 +1221,7 @@ static struct rcu_torture_ops tasks_ops = {
 	.get_gp_data	= rcu_tasks_get_gp_data,
 	.irq_capable	= 1,
 	.slow_gps	= 1,
+	.debug_objects	= 1,
 	.name		= "tasks"
 };
 
-- 
2.43.0

[PATCH 3/5] rcutorture: Test duplicate call_rcu_tasks_trace() callback enqueue

[Kunwu Chan]

The rcu_test_debug_objects() function tests duplicate-callback
detection, but only for torture types whose ->debug_objects field
is set.  This commit therefore sets ->debug_objects for the
"tasks-tracing" torture type so that duplicate call_rcu_tasks_trace()
invocations are detected.  The detection itself is provided by
__call_srcu() because call_rcu_tasks_trace() is implemented
in terms of call_srcu().

Suggested-by: Zqiang <qiang.zhang@linux.dev>
Cc: Kunwu Chan <kunwu.chan@gmail.com>
Signed-off-by: Kunwu Chan <chentao@kylinos.cn>
---
 kernel/rcu/rcutorture.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/kernel/rcu/rcutorture.c b/kernel/rcu/rcutorture.c
index a056a79aa3d2..5ee9e70a6199 100644
--- a/kernel/rcu/rcutorture.c
+++ b/kernel/rcu/rcutorture.c
@@ -1315,6 +1315,7 @@ static struct rcu_torture_ops tasks_tracing_ops = {
 	.irq_capable	= 1,
 	.slow_gps	= 1,
 	.nmi_capable	= 1,
+	.debug_objects	= 1,
 	.name		= "tasks-tracing"
 };
 
-- 
2.43.0

[PATCH 4/5] rcu: Add KASAN aux-stack verification test

[Kunwu Chan]

Add a test module that verifies kasan_record_aux_stack()
recording for RCU callbacks.  The flavor to test is selected at
build time by a Kconfig choice.  The test enqueues a callback from
a noinline helper, drains it while the rcu_head is still allocated,
then frees the rcu_head and triggers a use-after-free report.  The
report should list the enqueue helper under "Last potentially
related work creation:".

Draining before the free keeps the callback from ever running on
freed memory, and the post-call statement in the helper prevents
GCC from tail-calling the enqueue API, which would drop the
helper's frame from the recorded stack.

Suggested-by: Zqiang <qiang.zhang@linux.dev>
Cc: Kunwu Chan <kunwu.chan@gmail.com>
Signed-off-by: Kunwu Chan <chentao@kylinos.cn>
---
 kernel/rcu/Kconfig.debug        |  38 ++++++++++++
 kernel/rcu/Makefile             |   1 +
 kernel/rcu/rcu_kasan_aux_test.c | 107 ++++++++++++++++++++++++++++++++
 3 files changed, 146 insertions(+)
 create mode 100644 kernel/rcu/rcu_kasan_aux_test.c

diff --git a/kernel/rcu/Kconfig.debug b/kernel/rcu/Kconfig.debug
index 7c3c6017b266..5c6c07d36157 100644
--- a/kernel/rcu/Kconfig.debug
+++ b/kernel/rcu/Kconfig.debug
@@ -53,6 +53,44 @@ config RCU_TORTURE_TEST
 	  Say M if you want the RCU torture tests to build as a module.
 	  Say N if you are unsure.
 
+config RCU_KASAN_AUX_TEST
+	tristate "KASAN aux-stack verification test for RCU callbacks"
+	depends on DEBUG_KERNEL && KASAN_GENERIC
+	help
+	  This option builds a test that verifies that the selected
+	  RCU flavor's callback-enqueueing path records the
+	  enqueueing call path via kasan_record_aux_stack().
+	  The test intentionally triggers a single KASAN
+	  use-after-free report at init time.  The report should
+	  list the enqueue helper under "Last potentially related
+	  work creation:".  Check the kernel log for the report.
+	  Select the RCU flavor to test below.
+
+choice
+	prompt "RCU flavor"
+	depends on RCU_KASAN_AUX_TEST
+
+config RCU_KASAN_AUX_TEST_FLAVOR_TREE
+	bool "Tree RCU (call_rcu)"
+	depends on TREE_RCU
+
+config RCU_KASAN_AUX_TEST_FLAVOR_TINY
+	bool "Tiny RCU (call_rcu)"
+	depends on TINY_RCU
+
+config RCU_KASAN_AUX_TEST_FLAVOR_SRCU_TREE
+	bool "Tree SRCU (call_srcu)"
+	depends on TREE_SRCU
+
+config RCU_KASAN_AUX_TEST_FLAVOR_SRCU_TINY
+	bool "Tiny SRCU (call_srcu)"
+	depends on TINY_SRCU
+
+config RCU_KASAN_AUX_TEST_FLAVOR_TASKS
+	bool "RCU Tasks (call_rcu_tasks)"
+	depends on TASKS_RCU
+endchoice
+
 config RCU_TORTURE_TEST_CHK_RDR_STATE
 	bool "Check rcutorture reader state"
 	depends on RCU_TORTURE_TEST
diff --git a/kernel/rcu/Makefile b/kernel/rcu/Makefile
index 478ef2237fee..bca05ac9c4cc 100644
--- a/kernel/rcu/Makefile
+++ b/kernel/rcu/Makefile
@@ -12,6 +12,7 @@ obj-$(CONFIG_TREE_SRCU) += srcutree.o
 obj-$(CONFIG_TINY_SRCU) += srcutiny.o
 obj-$(CONFIG_HAZPTR_TORTURE_TEST) += hazptrtorture.o
 obj-$(CONFIG_RCU_TORTURE_TEST) += rcutorture.o
+obj-$(CONFIG_RCU_KASAN_AUX_TEST) += rcu_kasan_aux_test.o
 obj-$(CONFIG_RCU_SCALE_TEST) += rcuscale.o
 obj-$(CONFIG_RCU_REF_SCALE_TEST) += refscale.o
 obj-$(CONFIG_TREE_RCU) += tree.o
diff --git a/kernel/rcu/rcu_kasan_aux_test.c b/kernel/rcu/rcu_kasan_aux_test.c
new file mode 100644
index 000000000000..df3169ac39b0
--- /dev/null
+++ b/kernel/rcu/rcu_kasan_aux_test.c
@@ -0,0 +1,107 @@
+// SPDX-License-Identifier: GPL-2.0+
+/*
+ * KASAN auxiliary-stack verification test for RCU callbacks.
+ *
+ * Copyright (C) 2026 Kunwu Chan <kunwu.chan@gmail.com>
+ *
+ * For each supported RCU flavor, this module enqueues a callback
+ * from a noinline helper, drains it while the rcu_head is still
+ * allocated, then frees the rcu_head and immediately reads the
+ * freed memory.  The resulting KASAN use-after-free report should
+ * list the enqueue helper under "Last potentially related work
+ * creation:", which verifies that the flavor's enqueue path called
+ * kasan_record_aux_stack().  Check the kernel log for the report.
+ */
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include <linux/module.h>
+#include <linux/rcupdate.h>
+#include <linux/slab.h>
+#include <linux/srcu.h>
+
+static void aux_test_cb(struct rcu_head *rhp)
+{
+	/* Empty: runs while the rcu_head is still live. */
+}
+
+#ifdef CONFIG_RCU_KASAN_AUX_TEST_FLAVOR_TREE
+static noinline void aux_test_call_rcu_tree(struct rcu_head *rhp,
+					    rcu_callback_t func)
+{
+	call_rcu(rhp, func);
+
+	/*
+	 * Prevent tail-call optimization so that this function remains
+	 * in the stack recorded by kasan_record_aux_stack().
+	 */
+	pr_info("Tree RCU: callback enqueued\n");
+}
+#endif
+
+#ifdef CONFIG_RCU_KASAN_AUX_TEST_FLAVOR_TINY
+static noinline void aux_test_call_rcu_tiny(struct rcu_head *rhp,
+					    rcu_callback_t func)
+{
+	call_rcu(rhp, func);
+	pr_info("Tiny RCU: callback enqueued\n");
+}
+#endif
+
+#if defined(CONFIG_RCU_KASAN_AUX_TEST_FLAVOR_SRCU_TREE) || \
+	defined(CONFIG_RCU_KASAN_AUX_TEST_FLAVOR_SRCU_TINY)
+DEFINE_STATIC_SRCU(test_srcu);
+static noinline void aux_test_call_srcu(struct rcu_head *rhp,
+					rcu_callback_t func)
+{
+	call_srcu(&test_srcu, rhp, func);
+	pr_info("SRCU: callback enqueued\n");
+}
+#endif
+
+#ifdef CONFIG_RCU_KASAN_AUX_TEST_FLAVOR_TASKS
+static noinline void aux_test_call_rcu_tasks(struct rcu_head *rhp,
+					     rcu_callback_t func)
+{
+	call_rcu_tasks(rhp, func);
+	pr_info("RCU Tasks: callback enqueued\n");
+}
+#endif
+
+static int __init aux_test_init(void)
+{
+	struct rcu_head *rhp = kmalloc(sizeof(*rhp), GFP_KERNEL);
+
+	if (!rhp)
+		return -ENOMEM;
+
+#if defined(CONFIG_RCU_KASAN_AUX_TEST_FLAVOR_TREE)
+	aux_test_call_rcu_tree(rhp, aux_test_cb);
+	rcu_barrier();
+#elif defined(CONFIG_RCU_KASAN_AUX_TEST_FLAVOR_TINY)
+	aux_test_call_rcu_tiny(rhp, aux_test_cb);
+	rcu_barrier();
+#elif defined(CONFIG_RCU_KASAN_AUX_TEST_FLAVOR_SRCU_TREE) || \
+	defined(CONFIG_RCU_KASAN_AUX_TEST_FLAVOR_SRCU_TINY)
+	aux_test_call_srcu(rhp, aux_test_cb);
+	srcu_barrier(&test_srcu);
+#elif defined(CONFIG_RCU_KASAN_AUX_TEST_FLAVOR_TASKS)
+	aux_test_call_rcu_tasks(rhp, aux_test_cb);
+	rcu_barrier_tasks();
+#else
+#error "No RCU flavor selected for KASAN aux-stack test"
+#endif
+
+	kfree(rhp);
+
+	/* Immediate read of the freed memory to trigger the report. */
+	(void)READ_ONCE(*(u8 *)rhp);
+
+	pr_info("done, see kernel log for the KASAN report\n");
+	return 0;
+}
+
+module_init(aux_test_init);
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Kunwu Chan <kunwu.chan@gmail.com>");
+MODULE_DESCRIPTION("KASAN aux-stack verification for RCU callbacks");
-- 
2.43.0

[PATCH 5/5] rcutorture: Add KASAN aux-stack verification scenarios

[Kunwu Chan]

Add one rcutorture scenario per RCU flavor for the aux-stack
verification test: TASKSKASAN01, TREEKASAN01, TINYKASAN01,
SRCUKASAN01, and SRCUTINYKASAN01.  Each sets CONFIG_KASAN=y,
CONFIG_RCU_KASAN_AUX_TEST=y, the appropriate flavor choice, and
the kernel config needed for that RCU implementation.

Suggested-by: Zqiang <qiang.zhang@linux.dev>
Cc: Kunwu Chan <kunwu.chan@gmail.com>
Signed-off-by: Kunwu Chan <chentao@kylinos.cn>
---
 .../selftests/rcutorture/configs/rcu/SRCUKASAN01    |  6 ++++++
 .../rcutorture/configs/rcu/SRCUKASAN01.boot         |  2 ++
 .../rcutorture/configs/rcu/SRCUTINYKASAN01          | 12 ++++++++++++
 .../rcutorture/configs/rcu/SRCUTINYKASAN01.boot     |  2 ++
 .../selftests/rcutorture/configs/rcu/TASKSKASAN01   | 13 +++++++++++++
 .../rcutorture/configs/rcu/TASKSKASAN01.boot        |  2 ++
 .../selftests/rcutorture/configs/rcu/TINYKASAN01    | 12 ++++++++++++
 .../rcutorture/configs/rcu/TINYKASAN01.boot         |  2 ++
 .../selftests/rcutorture/configs/rcu/TREEKASAN01    |  6 ++++++
 .../rcutorture/configs/rcu/TREEKASAN01.boot         |  2 ++
 10 files changed, 59 insertions(+)
 create mode 100644 tools/testing/selftests/rcutorture/configs/rcu/SRCUKASAN01
 create mode 100644 tools/testing/selftests/rcutorture/configs/rcu/SRCUKASAN01.boot
 create mode 100644 tools/testing/selftests/rcutorture/configs/rcu/SRCUTINYKASAN01
 create mode 100644 tools/testing/selftests/rcutorture/configs/rcu/SRCUTINYKASAN01.boot
 create mode 100644 tools/testing/selftests/rcutorture/configs/rcu/TASKSKASAN01
 create mode 100644 tools/testing/selftests/rcutorture/configs/rcu/TASKSKASAN01.boot
 create mode 100644 tools/testing/selftests/rcutorture/configs/rcu/TINYKASAN01
 create mode 100644 tools/testing/selftests/rcutorture/configs/rcu/TINYKASAN01.boot
 create mode 100644 tools/testing/selftests/rcutorture/configs/rcu/TREEKASAN01
 create mode 100644 tools/testing/selftests/rcutorture/configs/rcu/TREEKASAN01.boot

diff --git a/tools/testing/selftests/rcutorture/configs/rcu/SRCUKASAN01 b/tools/testing/selftests/rcutorture/configs/rcu/SRCUKASAN01
new file mode 100644
index 000000000000..c115af0446ee
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/rcu/SRCUKASAN01
@@ -0,0 +1,6 @@
+CONFIG_KASAN=y
+CONFIG_KASAN_GENERIC=y
+CONFIG_KASAN_INLINE=y
+CONFIG_RCU_EXPERT=y
+CONFIG_RCU_KASAN_AUX_TEST=y
+CONFIG_RCU_KASAN_AUX_TEST_FLAVOR_SRCU_TREE=y
diff --git a/tools/testing/selftests/rcutorture/configs/rcu/SRCUKASAN01.boot b/tools/testing/selftests/rcutorture/configs/rcu/SRCUKASAN01.boot
new file mode 100644
index 000000000000..69ed391bd61c
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/rcu/SRCUKASAN01.boot
@@ -0,0 +1,2 @@
+rcutorture.torture_type=srcu
+rcutorture.stat_interval=60
diff --git a/tools/testing/selftests/rcutorture/configs/rcu/SRCUTINYKASAN01 b/tools/testing/selftests/rcutorture/configs/rcu/SRCUTINYKASAN01
new file mode 100644
index 000000000000..e42387061bb9
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/rcu/SRCUTINYKASAN01
@@ -0,0 +1,12 @@
+CONFIG_SMP=n
+CONFIG_PREEMPT_LAZY=y
+CONFIG_PREEMPT_NONE=n
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=n
+CONFIG_PREEMPT_DYNAMIC=n
+CONFIG_RCU_EXPERT=y
+CONFIG_KASAN=y
+CONFIG_KASAN_GENERIC=y
+CONFIG_KASAN_INLINE=y
+CONFIG_RCU_KASAN_AUX_TEST=y
+CONFIG_RCU_KASAN_AUX_TEST_FLAVOR_SRCU_TINY=y
diff --git a/tools/testing/selftests/rcutorture/configs/rcu/SRCUTINYKASAN01.boot b/tools/testing/selftests/rcutorture/configs/rcu/SRCUTINYKASAN01.boot
new file mode 100644
index 000000000000..69ed391bd61c
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/rcu/SRCUTINYKASAN01.boot
@@ -0,0 +1,2 @@
+rcutorture.torture_type=srcu
+rcutorture.stat_interval=60
diff --git a/tools/testing/selftests/rcutorture/configs/rcu/TASKSKASAN01 b/tools/testing/selftests/rcutorture/configs/rcu/TASKSKASAN01
new file mode 100644
index 000000000000..e4c1d9740498
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/rcu/TASKSKASAN01
@@ -0,0 +1,13 @@
+CONFIG_SMP=n
+CONFIG_PREEMPT_LAZY=y
+CONFIG_PREEMPT_NONE=n
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=n
+CONFIG_PREEMPT_DYNAMIC=n
+CONFIG_FORCE_TASKS_RCU=y
+CONFIG_RCU_EXPERT=y
+CONFIG_KASAN=y
+CONFIG_KASAN_GENERIC=y
+CONFIG_KASAN_INLINE=y
+CONFIG_RCU_KASAN_AUX_TEST=y
+CONFIG_RCU_KASAN_AUX_TEST_FLAVOR_TASKS=y
diff --git a/tools/testing/selftests/rcutorture/configs/rcu/TASKSKASAN01.boot b/tools/testing/selftests/rcutorture/configs/rcu/TASKSKASAN01.boot
new file mode 100644
index 000000000000..b9b6d67cbc5f
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/rcu/TASKSKASAN01.boot
@@ -0,0 +1,2 @@
+rcutorture.torture_type=tasks
+rcutorture.stat_interval=60
diff --git a/tools/testing/selftests/rcutorture/configs/rcu/TINYKASAN01 b/tools/testing/selftests/rcutorture/configs/rcu/TINYKASAN01
new file mode 100644
index 000000000000..219e599fa8f3
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/rcu/TINYKASAN01
@@ -0,0 +1,12 @@
+CONFIG_SMP=n
+CONFIG_PREEMPT_LAZY=y
+CONFIG_PREEMPT_NONE=n
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=n
+CONFIG_PREEMPT_DYNAMIC=n
+CONFIG_RCU_EXPERT=y
+CONFIG_KASAN=y
+CONFIG_KASAN_GENERIC=y
+CONFIG_KASAN_INLINE=y
+CONFIG_RCU_KASAN_AUX_TEST=y
+CONFIG_RCU_KASAN_AUX_TEST_FLAVOR_TINY=y
diff --git a/tools/testing/selftests/rcutorture/configs/rcu/TINYKASAN01.boot b/tools/testing/selftests/rcutorture/configs/rcu/TINYKASAN01.boot
new file mode 100644
index 000000000000..d5dafe68a5da
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/rcu/TINYKASAN01.boot
@@ -0,0 +1,2 @@
+rcutorture.torture_type=rcu
+rcutorture.stat_interval=60
diff --git a/tools/testing/selftests/rcutorture/configs/rcu/TREEKASAN01 b/tools/testing/selftests/rcutorture/configs/rcu/TREEKASAN01
new file mode 100644
index 000000000000..578711fb2d43
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/rcu/TREEKASAN01
@@ -0,0 +1,6 @@
+CONFIG_KASAN=y
+CONFIG_KASAN_GENERIC=y
+CONFIG_KASAN_INLINE=y
+CONFIG_RCU_EXPERT=y
+CONFIG_RCU_KASAN_AUX_TEST=y
+CONFIG_RCU_KASAN_AUX_TEST_FLAVOR_TREE=y
diff --git a/tools/testing/selftests/rcutorture/configs/rcu/TREEKASAN01.boot b/tools/testing/selftests/rcutorture/configs/rcu/TREEKASAN01.boot
new file mode 100644
index 000000000000..d5dafe68a5da
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/rcu/TREEKASAN01.boot
@@ -0,0 +1,2 @@
+rcutorture.torture_type=rcu
+rcutorture.stat_interval=60
-- 
2.43.0

Re: [PATCH 0/5] rcu: Record callback enqueue stacks and add torture tests

[Joel Fernandes]

On 11/6/2026 9:39 AM, Kunwu Chan wrote:
> This series adds KASAN auxiliary stack recording for RCU Tasks
> callbacks, rcutorture coverage for duplicate-callback detection,
> and KASAN aux-stack verification tests across RCU and SRCU flavors.
> 
> This series is based on [1]. For testing, I also applied Joel
> Fernandes' fix for debugobjects tracking of barrier callbacks
> [2], which is needed for the barrier tests.
> 
> The changes:
> - Record the enqueueing stack in call_rcu_tasks_generic().
> - Enable duplicate-callback testing for the "tasks" and
>   "tasks-tracing" torture types.
> - Add a KASAN aux-stack verification test module with a Kconfig
>   choice for each supported flavor.
> - Add one rcutorture scenario per flavor for the verification
>   test.
> 
> Tested on x86_64:
> 
> - TASKS01, TASKS02, TASKS03, TRACE01, and TRACE02 completed
>   3-minute runs successfully.
> 
> - With CONFIG_DEBUG_OBJECTS_RCU_HEAD=y and
>   rcutorture.object_debug=1, duplicate-callback detection was
>   triggered as expected for both torture types.
> 
> - TRACE01 was run for 1 minute with
>   CONFIG_DEBUG_OBJECTS_RCU_HEAD=y and
>   rcutorture.object_debug=1. The test detected both duplicate
>   callback heads through the SRCU enqueue path:
> [    0.405836] rcutorture: WARN: Duplicate call_tasks-tracing() test starting.
> [    0.405852] ODEBUG: activate active (active state 1) object: 0000000020df980d object type: rcu_head hint: 0x0
> [    0.734724] rcu: __call_srcu(): Duplicate call_srcu() CB 0000000020df980d->rcu_torture_leak_cb+0x0/0x10()
> [    0.734780] ODEBUG: activate active (active state 1) object: 000000006634e8c9 object type: rcu_head hint: 0x0
> [    0.776688] rcu: __call_srcu(): Duplicate call_srcu() CB 000000006634e8c9->rcu_torture_leak_cb+0x0/0x10()
> [    0.779126] rcutorture: WARN: Duplicate call_tasks-tracing() test complete.
> [   65.411342] tasks-tracing-torture:--- End of test: SUCCESS: ...
> 
> Both duplicate callback heads (the stack-allocated rh2 and
> the kmalloc-allocated rhp) were rejected and neither was invoked.
> 
> - With CONFIG_DEBUG_OBJECTS_RCU_HEAD=y,
>   object_debug=1, and n_barrier_cbs=4, the TASKS01 barrier
>   test completed 630/630 rounds without barrier errors.
>   The only debugobjects warnings were the four intentional
>   warnings from the duplicate-callback test at startup.
> 
> - All five aux-stack scenarios (TASKSKASAN01, TREEKASAN01,
>   SRCUKASAN01, TINYKASAN01, and SRCUTINYKASAN01) produced the
>   expected KASAN use-after-free reports. Each report's
>   "Last potentially related work creation" entry showed the
>   expected enqueue helper:
> 
> ===== TASKSKASAN01 =====
> [    1.244567] BUG: KASAN: slab-use-after-free in aux_test_init+0x8d/0xb0
> [    1.244707] Last potentially related work creation:
> [    1.244716]  aux_test_call_rcu_tasks.constprop.0+0xc/0x20
> 
> ===== TREEKASAN01 =====
> [    0.670399] BUG: KASAN: slab-use-after-free in aux_test_init+0x8d/0xb0
> [    0.670561] Last potentially related work creation:
> [    0.670571]  aux_test_call_rcu_tree.constprop.0+0xc/0x20
> 
> ===== SRCUKASAN01 =====
> [    0.658679] BUG: KASAN: slab-use-after-free in aux_test_init+0x94/0xc0
> [    0.658919] Last potentially related work creation:
> [    0.658932]  aux_test_call_srcu.constprop.0+0x16/0x30
> 
> ===== TINYKASAN01 =====
> [    0.951503] BUG: KASAN: slab-use-after-free in aux_test_init+0x8d/0xb0
> [    0.951641] Last potentially related work creation:
> [    0.951650]  aux_test_call_rcu_tiny.constprop.0+0xc/0x20
> 
> ===== SRCUTINYKASAN01 =====
> [    1.009005] BUG: KASAN: slab-use-after-free in aux_test_init+0x94/0xc0
> [    1.009141] Last potentially related work creation:
> [    1.009150]  aux_test_call_srcu.constprop.0+0x16/0x30
> 
> 

I'm not feeling very excited about adding more configs just for KASAN. That
sounds like a maintenance burden. I believe Paul already has KASAN testing in
his scripts. Is it possible to activate this testing only when those are enabled?

Thanks.