* [PATCH 1/5] rcu-tasks: Record callback enqueue stack
2026-11-06 14:39 [PATCH 0/5] rcu: Record callback enqueue stacks and add torture tests Kunwu Chan
@ 2026-11-06 14:39 ` Kunwu Chan
2026-11-06 14:39 ` [PATCH 2/5] rcutorture: Test duplicate call_rcu_tasks() callback enqueue Kunwu Chan
` (4 subsequent siblings)
5 siblings, 0 replies; 7+ messages in thread
From: Kunwu Chan @ 2026-11-06 14:39 UTC (permalink / raw)
To: dave, paulmck, josh, frederic, neeraj.upadhyay, joelagnelf,
boqun, urezki
Cc: rostedt, mathieu.desnoyers, jiangshanlai, qiang.zhang,
linux-kernel, rcu, Kunwu Chan, Kunwu Chan
Tree RCU records the code path that enqueued a given callback via
kasan_record_aux_stack(), but Tasks RCU does not. KASAN reports
involving Tasks RCU callbacks therefore lack any hint as to which
code path did the enqueueing. This commit therefore invokes
kasan_record_aux_stack() in call_rcu_tasks_generic(), covering both
call_rcu_tasks() and call_rcu_tasks_rude().
Suggested-by: Zqiang <qiang.zhang@linux.dev>
Cc: Kunwu Chan <kunwu.chan@gmail.com>
Signed-off-by: Kunwu Chan <chentao@kylinos.cn>
---
kernel/rcu/tasks.h | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/kernel/rcu/tasks.h b/kernel/rcu/tasks.h
index a20db323612b..fd43cd5d5a48 100644
--- a/kernel/rcu/tasks.h
+++ b/kernel/rcu/tasks.h
@@ -6,6 +6,7 @@
*/
#ifdef CONFIG_TASKS_RCU_GENERIC
+#include <linux/kasan.h>
#include <linux/mm.h>
#include <linux/ratelimit.h>
#include "rcu_segcblist.h"
@@ -366,6 +367,9 @@ static void call_rcu_tasks_generic(struct rcu_head *rhp, rcu_callback_t func,
if (WARN_ON_ONCE(!func))
return;
+ /* Record the caller: the irq_work's stack says nothing about it. */
+ kasan_record_aux_stack(rhp);
+
if (debug_rcu_head_queue(rhp)) {
if (__ratelimit(&rcu_tasks_dup_rs)) {
pr_err("%s(): Duplicate CB for %s, %p->%pS()\n",
--
2.43.0
^ permalink raw reply [flat|nested] 7+ messages in thread* [PATCH 2/5] rcutorture: Test duplicate call_rcu_tasks() callback enqueue
2026-11-06 14:39 [PATCH 0/5] rcu: Record callback enqueue stacks and add torture tests Kunwu Chan
2026-11-06 14:39 ` [PATCH 1/5] rcu-tasks: Record callback enqueue stack Kunwu Chan
@ 2026-11-06 14:39 ` Kunwu Chan
2026-11-06 14:39 ` [PATCH 3/5] rcutorture: Test duplicate call_rcu_tasks_trace() " Kunwu Chan
` (3 subsequent siblings)
5 siblings, 0 replies; 7+ messages in thread
From: Kunwu Chan @ 2026-11-06 14:39 UTC (permalink / raw)
To: dave, paulmck, josh, frederic, neeraj.upadhyay, joelagnelf,
boqun, urezki
Cc: rostedt, mathieu.desnoyers, jiangshanlai, qiang.zhang,
linux-kernel, rcu, Kunwu Chan, Kunwu Chan
The rcu_test_debug_objects() function double-enqueues an rcu_head
to test debug-objects duplicate-callback detection, but only for
torture types whose ->debug_objects field is set. This commit
therefore sets ->debug_objects for the "tasks" torture type so
that call_rcu_tasks()'s duplicate-callback detection is tested.
Suggested-by: Zqiang <qiang.zhang@linux.dev>
Cc: Kunwu Chan <kunwu.chan@gmail.com>
Signed-off-by: Kunwu Chan <chentao@kylinos.cn>
---
kernel/rcu/rcutorture.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/kernel/rcu/rcutorture.c b/kernel/rcu/rcutorture.c
index 968343be4e0d..a056a79aa3d2 100644
--- a/kernel/rcu/rcutorture.c
+++ b/kernel/rcu/rcutorture.c
@@ -1221,6 +1221,7 @@ static struct rcu_torture_ops tasks_ops = {
.get_gp_data = rcu_tasks_get_gp_data,
.irq_capable = 1,
.slow_gps = 1,
+ .debug_objects = 1,
.name = "tasks"
};
--
2.43.0
^ permalink raw reply [flat|nested] 7+ messages in thread* [PATCH 3/5] rcutorture: Test duplicate call_rcu_tasks_trace() callback enqueue
2026-11-06 14:39 [PATCH 0/5] rcu: Record callback enqueue stacks and add torture tests Kunwu Chan
2026-11-06 14:39 ` [PATCH 1/5] rcu-tasks: Record callback enqueue stack Kunwu Chan
2026-11-06 14:39 ` [PATCH 2/5] rcutorture: Test duplicate call_rcu_tasks() callback enqueue Kunwu Chan
@ 2026-11-06 14:39 ` Kunwu Chan
2026-11-06 14:39 ` [PATCH 4/5] rcu: Add KASAN aux-stack verification test Kunwu Chan
` (2 subsequent siblings)
5 siblings, 0 replies; 7+ messages in thread
From: Kunwu Chan @ 2026-11-06 14:39 UTC (permalink / raw)
To: dave, paulmck, josh, frederic, neeraj.upadhyay, joelagnelf,
boqun, urezki
Cc: rostedt, mathieu.desnoyers, jiangshanlai, qiang.zhang,
linux-kernel, rcu, Kunwu Chan, Kunwu Chan
The rcu_test_debug_objects() function tests duplicate-callback
detection, but only for torture types whose ->debug_objects field
is set. This commit therefore sets ->debug_objects for the
"tasks-tracing" torture type so that duplicate call_rcu_tasks_trace()
invocations are detected. The detection itself is provided by
__call_srcu() because call_rcu_tasks_trace() is implemented
in terms of call_srcu().
Suggested-by: Zqiang <qiang.zhang@linux.dev>
Cc: Kunwu Chan <kunwu.chan@gmail.com>
Signed-off-by: Kunwu Chan <chentao@kylinos.cn>
---
kernel/rcu/rcutorture.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/kernel/rcu/rcutorture.c b/kernel/rcu/rcutorture.c
index a056a79aa3d2..5ee9e70a6199 100644
--- a/kernel/rcu/rcutorture.c
+++ b/kernel/rcu/rcutorture.c
@@ -1315,6 +1315,7 @@ static struct rcu_torture_ops tasks_tracing_ops = {
.irq_capable = 1,
.slow_gps = 1,
.nmi_capable = 1,
+ .debug_objects = 1,
.name = "tasks-tracing"
};
--
2.43.0
^ permalink raw reply [flat|nested] 7+ messages in thread* [PATCH 4/5] rcu: Add KASAN aux-stack verification test
2026-11-06 14:39 [PATCH 0/5] rcu: Record callback enqueue stacks and add torture tests Kunwu Chan
` (2 preceding siblings ...)
2026-11-06 14:39 ` [PATCH 3/5] rcutorture: Test duplicate call_rcu_tasks_trace() " Kunwu Chan
@ 2026-11-06 14:39 ` Kunwu Chan
2026-11-06 14:39 ` [PATCH 5/5] rcutorture: Add KASAN aux-stack verification scenarios Kunwu Chan
2026-11-06 18:49 ` [PATCH 0/5] rcu: Record callback enqueue stacks and add torture tests Joel Fernandes
5 siblings, 0 replies; 7+ messages in thread
From: Kunwu Chan @ 2026-11-06 14:39 UTC (permalink / raw)
To: dave, paulmck, josh, frederic, neeraj.upadhyay, joelagnelf,
boqun, urezki
Cc: rostedt, mathieu.desnoyers, jiangshanlai, qiang.zhang,
linux-kernel, rcu, Kunwu Chan, Kunwu Chan
Add a test module that verifies kasan_record_aux_stack()
recording for RCU callbacks. The flavor to test is selected at
build time by a Kconfig choice. The test enqueues a callback from
a noinline helper, drains it while the rcu_head is still allocated,
then frees the rcu_head and triggers a use-after-free report. The
report should list the enqueue helper under "Last potentially
related work creation:".
Draining before the free keeps the callback from ever running on
freed memory, and the post-call statement in the helper prevents
GCC from tail-calling the enqueue API, which would drop the
helper's frame from the recorded stack.
Suggested-by: Zqiang <qiang.zhang@linux.dev>
Cc: Kunwu Chan <kunwu.chan@gmail.com>
Signed-off-by: Kunwu Chan <chentao@kylinos.cn>
---
kernel/rcu/Kconfig.debug | 38 ++++++++++++
kernel/rcu/Makefile | 1 +
kernel/rcu/rcu_kasan_aux_test.c | 107 ++++++++++++++++++++++++++++++++
3 files changed, 146 insertions(+)
create mode 100644 kernel/rcu/rcu_kasan_aux_test.c
diff --git a/kernel/rcu/Kconfig.debug b/kernel/rcu/Kconfig.debug
index 7c3c6017b266..5c6c07d36157 100644
--- a/kernel/rcu/Kconfig.debug
+++ b/kernel/rcu/Kconfig.debug
@@ -53,6 +53,44 @@ config RCU_TORTURE_TEST
Say M if you want the RCU torture tests to build as a module.
Say N if you are unsure.
+config RCU_KASAN_AUX_TEST
+ tristate "KASAN aux-stack verification test for RCU callbacks"
+ depends on DEBUG_KERNEL && KASAN_GENERIC
+ help
+ This option builds a test that verifies that the selected
+ RCU flavor's callback-enqueueing path records the
+ enqueueing call path via kasan_record_aux_stack().
+ The test intentionally triggers a single KASAN
+ use-after-free report at init time. The report should
+ list the enqueue helper under "Last potentially related
+ work creation:". Check the kernel log for the report.
+ Select the RCU flavor to test below.
+
+choice
+ prompt "RCU flavor"
+ depends on RCU_KASAN_AUX_TEST
+
+config RCU_KASAN_AUX_TEST_FLAVOR_TREE
+ bool "Tree RCU (call_rcu)"
+ depends on TREE_RCU
+
+config RCU_KASAN_AUX_TEST_FLAVOR_TINY
+ bool "Tiny RCU (call_rcu)"
+ depends on TINY_RCU
+
+config RCU_KASAN_AUX_TEST_FLAVOR_SRCU_TREE
+ bool "Tree SRCU (call_srcu)"
+ depends on TREE_SRCU
+
+config RCU_KASAN_AUX_TEST_FLAVOR_SRCU_TINY
+ bool "Tiny SRCU (call_srcu)"
+ depends on TINY_SRCU
+
+config RCU_KASAN_AUX_TEST_FLAVOR_TASKS
+ bool "RCU Tasks (call_rcu_tasks)"
+ depends on TASKS_RCU
+endchoice
+
config RCU_TORTURE_TEST_CHK_RDR_STATE
bool "Check rcutorture reader state"
depends on RCU_TORTURE_TEST
diff --git a/kernel/rcu/Makefile b/kernel/rcu/Makefile
index 478ef2237fee..bca05ac9c4cc 100644
--- a/kernel/rcu/Makefile
+++ b/kernel/rcu/Makefile
@@ -12,6 +12,7 @@ obj-$(CONFIG_TREE_SRCU) += srcutree.o
obj-$(CONFIG_TINY_SRCU) += srcutiny.o
obj-$(CONFIG_HAZPTR_TORTURE_TEST) += hazptrtorture.o
obj-$(CONFIG_RCU_TORTURE_TEST) += rcutorture.o
+obj-$(CONFIG_RCU_KASAN_AUX_TEST) += rcu_kasan_aux_test.o
obj-$(CONFIG_RCU_SCALE_TEST) += rcuscale.o
obj-$(CONFIG_RCU_REF_SCALE_TEST) += refscale.o
obj-$(CONFIG_TREE_RCU) += tree.o
diff --git a/kernel/rcu/rcu_kasan_aux_test.c b/kernel/rcu/rcu_kasan_aux_test.c
new file mode 100644
index 000000000000..df3169ac39b0
--- /dev/null
+++ b/kernel/rcu/rcu_kasan_aux_test.c
@@ -0,0 +1,107 @@
+// SPDX-License-Identifier: GPL-2.0+
+/*
+ * KASAN auxiliary-stack verification test for RCU callbacks.
+ *
+ * Copyright (C) 2026 Kunwu Chan <kunwu.chan@gmail.com>
+ *
+ * For each supported RCU flavor, this module enqueues a callback
+ * from a noinline helper, drains it while the rcu_head is still
+ * allocated, then frees the rcu_head and immediately reads the
+ * freed memory. The resulting KASAN use-after-free report should
+ * list the enqueue helper under "Last potentially related work
+ * creation:", which verifies that the flavor's enqueue path called
+ * kasan_record_aux_stack(). Check the kernel log for the report.
+ */
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include <linux/module.h>
+#include <linux/rcupdate.h>
+#include <linux/slab.h>
+#include <linux/srcu.h>
+
+static void aux_test_cb(struct rcu_head *rhp)
+{
+ /* Empty: runs while the rcu_head is still live. */
+}
+
+#ifdef CONFIG_RCU_KASAN_AUX_TEST_FLAVOR_TREE
+static noinline void aux_test_call_rcu_tree(struct rcu_head *rhp,
+ rcu_callback_t func)
+{
+ call_rcu(rhp, func);
+
+ /*
+ * Prevent tail-call optimization so that this function remains
+ * in the stack recorded by kasan_record_aux_stack().
+ */
+ pr_info("Tree RCU: callback enqueued\n");
+}
+#endif
+
+#ifdef CONFIG_RCU_KASAN_AUX_TEST_FLAVOR_TINY
+static noinline void aux_test_call_rcu_tiny(struct rcu_head *rhp,
+ rcu_callback_t func)
+{
+ call_rcu(rhp, func);
+ pr_info("Tiny RCU: callback enqueued\n");
+}
+#endif
+
+#if defined(CONFIG_RCU_KASAN_AUX_TEST_FLAVOR_SRCU_TREE) || \
+ defined(CONFIG_RCU_KASAN_AUX_TEST_FLAVOR_SRCU_TINY)
+DEFINE_STATIC_SRCU(test_srcu);
+static noinline void aux_test_call_srcu(struct rcu_head *rhp,
+ rcu_callback_t func)
+{
+ call_srcu(&test_srcu, rhp, func);
+ pr_info("SRCU: callback enqueued\n");
+}
+#endif
+
+#ifdef CONFIG_RCU_KASAN_AUX_TEST_FLAVOR_TASKS
+static noinline void aux_test_call_rcu_tasks(struct rcu_head *rhp,
+ rcu_callback_t func)
+{
+ call_rcu_tasks(rhp, func);
+ pr_info("RCU Tasks: callback enqueued\n");
+}
+#endif
+
+static int __init aux_test_init(void)
+{
+ struct rcu_head *rhp = kmalloc(sizeof(*rhp), GFP_KERNEL);
+
+ if (!rhp)
+ return -ENOMEM;
+
+#if defined(CONFIG_RCU_KASAN_AUX_TEST_FLAVOR_TREE)
+ aux_test_call_rcu_tree(rhp, aux_test_cb);
+ rcu_barrier();
+#elif defined(CONFIG_RCU_KASAN_AUX_TEST_FLAVOR_TINY)
+ aux_test_call_rcu_tiny(rhp, aux_test_cb);
+ rcu_barrier();
+#elif defined(CONFIG_RCU_KASAN_AUX_TEST_FLAVOR_SRCU_TREE) || \
+ defined(CONFIG_RCU_KASAN_AUX_TEST_FLAVOR_SRCU_TINY)
+ aux_test_call_srcu(rhp, aux_test_cb);
+ srcu_barrier(&test_srcu);
+#elif defined(CONFIG_RCU_KASAN_AUX_TEST_FLAVOR_TASKS)
+ aux_test_call_rcu_tasks(rhp, aux_test_cb);
+ rcu_barrier_tasks();
+#else
+#error "No RCU flavor selected for KASAN aux-stack test"
+#endif
+
+ kfree(rhp);
+
+ /* Immediate read of the freed memory to trigger the report. */
+ (void)READ_ONCE(*(u8 *)rhp);
+
+ pr_info("done, see kernel log for the KASAN report\n");
+ return 0;
+}
+
+module_init(aux_test_init);
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Kunwu Chan <kunwu.chan@gmail.com>");
+MODULE_DESCRIPTION("KASAN aux-stack verification for RCU callbacks");
--
2.43.0
^ permalink raw reply [flat|nested] 7+ messages in thread* [PATCH 5/5] rcutorture: Add KASAN aux-stack verification scenarios
2026-11-06 14:39 [PATCH 0/5] rcu: Record callback enqueue stacks and add torture tests Kunwu Chan
` (3 preceding siblings ...)
2026-11-06 14:39 ` [PATCH 4/5] rcu: Add KASAN aux-stack verification test Kunwu Chan
@ 2026-11-06 14:39 ` Kunwu Chan
2026-11-06 18:49 ` [PATCH 0/5] rcu: Record callback enqueue stacks and add torture tests Joel Fernandes
5 siblings, 0 replies; 7+ messages in thread
From: Kunwu Chan @ 2026-11-06 14:39 UTC (permalink / raw)
To: dave, paulmck, josh, frederic, neeraj.upadhyay, joelagnelf,
boqun, urezki
Cc: rostedt, mathieu.desnoyers, jiangshanlai, qiang.zhang,
linux-kernel, rcu, Kunwu Chan, Kunwu Chan
Add one rcutorture scenario per RCU flavor for the aux-stack
verification test: TASKSKASAN01, TREEKASAN01, TINYKASAN01,
SRCUKASAN01, and SRCUTINYKASAN01. Each sets CONFIG_KASAN=y,
CONFIG_RCU_KASAN_AUX_TEST=y, the appropriate flavor choice, and
the kernel config needed for that RCU implementation.
Suggested-by: Zqiang <qiang.zhang@linux.dev>
Cc: Kunwu Chan <kunwu.chan@gmail.com>
Signed-off-by: Kunwu Chan <chentao@kylinos.cn>
---
.../selftests/rcutorture/configs/rcu/SRCUKASAN01 | 6 ++++++
.../rcutorture/configs/rcu/SRCUKASAN01.boot | 2 ++
.../rcutorture/configs/rcu/SRCUTINYKASAN01 | 12 ++++++++++++
.../rcutorture/configs/rcu/SRCUTINYKASAN01.boot | 2 ++
.../selftests/rcutorture/configs/rcu/TASKSKASAN01 | 13 +++++++++++++
.../rcutorture/configs/rcu/TASKSKASAN01.boot | 2 ++
.../selftests/rcutorture/configs/rcu/TINYKASAN01 | 12 ++++++++++++
.../rcutorture/configs/rcu/TINYKASAN01.boot | 2 ++
.../selftests/rcutorture/configs/rcu/TREEKASAN01 | 6 ++++++
.../rcutorture/configs/rcu/TREEKASAN01.boot | 2 ++
10 files changed, 59 insertions(+)
create mode 100644 tools/testing/selftests/rcutorture/configs/rcu/SRCUKASAN01
create mode 100644 tools/testing/selftests/rcutorture/configs/rcu/SRCUKASAN01.boot
create mode 100644 tools/testing/selftests/rcutorture/configs/rcu/SRCUTINYKASAN01
create mode 100644 tools/testing/selftests/rcutorture/configs/rcu/SRCUTINYKASAN01.boot
create mode 100644 tools/testing/selftests/rcutorture/configs/rcu/TASKSKASAN01
create mode 100644 tools/testing/selftests/rcutorture/configs/rcu/TASKSKASAN01.boot
create mode 100644 tools/testing/selftests/rcutorture/configs/rcu/TINYKASAN01
create mode 100644 tools/testing/selftests/rcutorture/configs/rcu/TINYKASAN01.boot
create mode 100644 tools/testing/selftests/rcutorture/configs/rcu/TREEKASAN01
create mode 100644 tools/testing/selftests/rcutorture/configs/rcu/TREEKASAN01.boot
diff --git a/tools/testing/selftests/rcutorture/configs/rcu/SRCUKASAN01 b/tools/testing/selftests/rcutorture/configs/rcu/SRCUKASAN01
new file mode 100644
index 000000000000..c115af0446ee
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/rcu/SRCUKASAN01
@@ -0,0 +1,6 @@
+CONFIG_KASAN=y
+CONFIG_KASAN_GENERIC=y
+CONFIG_KASAN_INLINE=y
+CONFIG_RCU_EXPERT=y
+CONFIG_RCU_KASAN_AUX_TEST=y
+CONFIG_RCU_KASAN_AUX_TEST_FLAVOR_SRCU_TREE=y
diff --git a/tools/testing/selftests/rcutorture/configs/rcu/SRCUKASAN01.boot b/tools/testing/selftests/rcutorture/configs/rcu/SRCUKASAN01.boot
new file mode 100644
index 000000000000..69ed391bd61c
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/rcu/SRCUKASAN01.boot
@@ -0,0 +1,2 @@
+rcutorture.torture_type=srcu
+rcutorture.stat_interval=60
diff --git a/tools/testing/selftests/rcutorture/configs/rcu/SRCUTINYKASAN01 b/tools/testing/selftests/rcutorture/configs/rcu/SRCUTINYKASAN01
new file mode 100644
index 000000000000..e42387061bb9
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/rcu/SRCUTINYKASAN01
@@ -0,0 +1,12 @@
+CONFIG_SMP=n
+CONFIG_PREEMPT_LAZY=y
+CONFIG_PREEMPT_NONE=n
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=n
+CONFIG_PREEMPT_DYNAMIC=n
+CONFIG_RCU_EXPERT=y
+CONFIG_KASAN=y
+CONFIG_KASAN_GENERIC=y
+CONFIG_KASAN_INLINE=y
+CONFIG_RCU_KASAN_AUX_TEST=y
+CONFIG_RCU_KASAN_AUX_TEST_FLAVOR_SRCU_TINY=y
diff --git a/tools/testing/selftests/rcutorture/configs/rcu/SRCUTINYKASAN01.boot b/tools/testing/selftests/rcutorture/configs/rcu/SRCUTINYKASAN01.boot
new file mode 100644
index 000000000000..69ed391bd61c
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/rcu/SRCUTINYKASAN01.boot
@@ -0,0 +1,2 @@
+rcutorture.torture_type=srcu
+rcutorture.stat_interval=60
diff --git a/tools/testing/selftests/rcutorture/configs/rcu/TASKSKASAN01 b/tools/testing/selftests/rcutorture/configs/rcu/TASKSKASAN01
new file mode 100644
index 000000000000..e4c1d9740498
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/rcu/TASKSKASAN01
@@ -0,0 +1,13 @@
+CONFIG_SMP=n
+CONFIG_PREEMPT_LAZY=y
+CONFIG_PREEMPT_NONE=n
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=n
+CONFIG_PREEMPT_DYNAMIC=n
+CONFIG_FORCE_TASKS_RCU=y
+CONFIG_RCU_EXPERT=y
+CONFIG_KASAN=y
+CONFIG_KASAN_GENERIC=y
+CONFIG_KASAN_INLINE=y
+CONFIG_RCU_KASAN_AUX_TEST=y
+CONFIG_RCU_KASAN_AUX_TEST_FLAVOR_TASKS=y
diff --git a/tools/testing/selftests/rcutorture/configs/rcu/TASKSKASAN01.boot b/tools/testing/selftests/rcutorture/configs/rcu/TASKSKASAN01.boot
new file mode 100644
index 000000000000..b9b6d67cbc5f
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/rcu/TASKSKASAN01.boot
@@ -0,0 +1,2 @@
+rcutorture.torture_type=tasks
+rcutorture.stat_interval=60
diff --git a/tools/testing/selftests/rcutorture/configs/rcu/TINYKASAN01 b/tools/testing/selftests/rcutorture/configs/rcu/TINYKASAN01
new file mode 100644
index 000000000000..219e599fa8f3
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/rcu/TINYKASAN01
@@ -0,0 +1,12 @@
+CONFIG_SMP=n
+CONFIG_PREEMPT_LAZY=y
+CONFIG_PREEMPT_NONE=n
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=n
+CONFIG_PREEMPT_DYNAMIC=n
+CONFIG_RCU_EXPERT=y
+CONFIG_KASAN=y
+CONFIG_KASAN_GENERIC=y
+CONFIG_KASAN_INLINE=y
+CONFIG_RCU_KASAN_AUX_TEST=y
+CONFIG_RCU_KASAN_AUX_TEST_FLAVOR_TINY=y
diff --git a/tools/testing/selftests/rcutorture/configs/rcu/TINYKASAN01.boot b/tools/testing/selftests/rcutorture/configs/rcu/TINYKASAN01.boot
new file mode 100644
index 000000000000..d5dafe68a5da
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/rcu/TINYKASAN01.boot
@@ -0,0 +1,2 @@
+rcutorture.torture_type=rcu
+rcutorture.stat_interval=60
diff --git a/tools/testing/selftests/rcutorture/configs/rcu/TREEKASAN01 b/tools/testing/selftests/rcutorture/configs/rcu/TREEKASAN01
new file mode 100644
index 000000000000..578711fb2d43
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/rcu/TREEKASAN01
@@ -0,0 +1,6 @@
+CONFIG_KASAN=y
+CONFIG_KASAN_GENERIC=y
+CONFIG_KASAN_INLINE=y
+CONFIG_RCU_EXPERT=y
+CONFIG_RCU_KASAN_AUX_TEST=y
+CONFIG_RCU_KASAN_AUX_TEST_FLAVOR_TREE=y
diff --git a/tools/testing/selftests/rcutorture/configs/rcu/TREEKASAN01.boot b/tools/testing/selftests/rcutorture/configs/rcu/TREEKASAN01.boot
new file mode 100644
index 000000000000..d5dafe68a5da
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/rcu/TREEKASAN01.boot
@@ -0,0 +1,2 @@
+rcutorture.torture_type=rcu
+rcutorture.stat_interval=60
--
2.43.0
^ permalink raw reply [flat|nested] 7+ messages in thread* Re: [PATCH 0/5] rcu: Record callback enqueue stacks and add torture tests
2026-11-06 14:39 [PATCH 0/5] rcu: Record callback enqueue stacks and add torture tests Kunwu Chan
` (4 preceding siblings ...)
2026-11-06 14:39 ` [PATCH 5/5] rcutorture: Add KASAN aux-stack verification scenarios Kunwu Chan
@ 2026-11-06 18:49 ` Joel Fernandes
5 siblings, 0 replies; 7+ messages in thread
From: Joel Fernandes @ 2026-11-06 18:49 UTC (permalink / raw)
To: Kunwu Chan, dave, paulmck, josh, frederic, neeraj.upadhyay,
boqun, urezki
Cc: rostedt, mathieu.desnoyers, jiangshanlai, qiang.zhang, linux-kernel, rcu
On 11/6/2026 9:39 AM, Kunwu Chan wrote:
> This series adds KASAN auxiliary stack recording for RCU Tasks
> callbacks, rcutorture coverage for duplicate-callback detection,
> and KASAN aux-stack verification tests across RCU and SRCU flavors.
>
> This series is based on [1]. For testing, I also applied Joel
> Fernandes' fix for debugobjects tracking of barrier callbacks
> [2], which is needed for the barrier tests.
>
> The changes:
> - Record the enqueueing stack in call_rcu_tasks_generic().
> - Enable duplicate-callback testing for the "tasks" and
> "tasks-tracing" torture types.
> - Add a KASAN aux-stack verification test module with a Kconfig
> choice for each supported flavor.
> - Add one rcutorture scenario per flavor for the verification
> test.
>
> Tested on x86_64:
>
> - TASKS01, TASKS02, TASKS03, TRACE01, and TRACE02 completed
> 3-minute runs successfully.
>
> - With CONFIG_DEBUG_OBJECTS_RCU_HEAD=y and
> rcutorture.object_debug=1, duplicate-callback detection was
> triggered as expected for both torture types.
>
> - TRACE01 was run for 1 minute with
> CONFIG_DEBUG_OBJECTS_RCU_HEAD=y and
> rcutorture.object_debug=1. The test detected both duplicate
> callback heads through the SRCU enqueue path:
> [ 0.405836] rcutorture: WARN: Duplicate call_tasks-tracing() test starting.
> [ 0.405852] ODEBUG: activate active (active state 1) object: 0000000020df980d object type: rcu_head hint: 0x0
> [ 0.734724] rcu: __call_srcu(): Duplicate call_srcu() CB 0000000020df980d->rcu_torture_leak_cb+0x0/0x10()
> [ 0.734780] ODEBUG: activate active (active state 1) object: 000000006634e8c9 object type: rcu_head hint: 0x0
> [ 0.776688] rcu: __call_srcu(): Duplicate call_srcu() CB 000000006634e8c9->rcu_torture_leak_cb+0x0/0x10()
> [ 0.779126] rcutorture: WARN: Duplicate call_tasks-tracing() test complete.
> [ 65.411342] tasks-tracing-torture:--- End of test: SUCCESS: ...
>
> Both duplicate callback heads (the stack-allocated rh2 and
> the kmalloc-allocated rhp) were rejected and neither was invoked.
>
> - With CONFIG_DEBUG_OBJECTS_RCU_HEAD=y,
> object_debug=1, and n_barrier_cbs=4, the TASKS01 barrier
> test completed 630/630 rounds without barrier errors.
> The only debugobjects warnings were the four intentional
> warnings from the duplicate-callback test at startup.
>
> - All five aux-stack scenarios (TASKSKASAN01, TREEKASAN01,
> SRCUKASAN01, TINYKASAN01, and SRCUTINYKASAN01) produced the
> expected KASAN use-after-free reports. Each report's
> "Last potentially related work creation" entry showed the
> expected enqueue helper:
>
> ===== TASKSKASAN01 =====
> [ 1.244567] BUG: KASAN: slab-use-after-free in aux_test_init+0x8d/0xb0
> [ 1.244707] Last potentially related work creation:
> [ 1.244716] aux_test_call_rcu_tasks.constprop.0+0xc/0x20
>
> ===== TREEKASAN01 =====
> [ 0.670399] BUG: KASAN: slab-use-after-free in aux_test_init+0x8d/0xb0
> [ 0.670561] Last potentially related work creation:
> [ 0.670571] aux_test_call_rcu_tree.constprop.0+0xc/0x20
>
> ===== SRCUKASAN01 =====
> [ 0.658679] BUG: KASAN: slab-use-after-free in aux_test_init+0x94/0xc0
> [ 0.658919] Last potentially related work creation:
> [ 0.658932] aux_test_call_srcu.constprop.0+0x16/0x30
>
> ===== TINYKASAN01 =====
> [ 0.951503] BUG: KASAN: slab-use-after-free in aux_test_init+0x8d/0xb0
> [ 0.951641] Last potentially related work creation:
> [ 0.951650] aux_test_call_rcu_tiny.constprop.0+0xc/0x20
>
> ===== SRCUTINYKASAN01 =====
> [ 1.009005] BUG: KASAN: slab-use-after-free in aux_test_init+0x94/0xc0
> [ 1.009141] Last potentially related work creation:
> [ 1.009150] aux_test_call_srcu.constprop.0+0x16/0x30
>
>
I'm not feeling very excited about adding more configs just for KASAN. That
sounds like a maintenance burden. I believe Paul already has KASAN testing in
his scripts. Is it possible to activate this testing only when those are enabled?
Thanks.
^ permalink raw reply [flat|nested] 7+ messages in thread