[PATCH] rcu-tasks: Track barrier callbacks in debugobjects

[PATCH] rcu-tasks: Track barrier callbacks in debugobjects

[Joel Fernandes]

rcu_tasks_invoke_cbs() now unqueues each callback from debugobjects.
However, rcu_barrier_tasks_generic() inserts its per-CPU barrier heads
directly with rcu_segcblist_entrain(), bypassing the queue hook in
call_rcu_tasks_generic(). This produces active_state and deactivate
warnings for untracked objects when a barrier callback runs.

Activate each barrier head before entrainment and undo that activation
when there are no callbacks to entrain behind. Successful entrainment
is balanced by the invocation path, as for ordinary callbacks.

The existing n_barrier_cbs=2 torture test reproduces the warnings before
this change and completes without them afterwards.

This fixes patch "rcu-tasks: Detect duplicate callback enqueue".

Cc: Kunwu Chan <kunwu.chan@gmail.com>
Cc: Paul E. McKenney <paulmck@kernel.org>
Signed-off-by: Joel Fernandes <joelagnelf@nvidia.com>
---
 kernel/rcu/tasks.h | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/kernel/rcu/tasks.h b/kernel/rcu/tasks.h
index d5d060a5c4b6..a20db323612b 100644
--- a/kernel/rcu/tasks.h
+++ b/kernel/rcu/tasks.h
@@ -470,9 +470,12 @@ static void __maybe_unused rcu_barrier_tasks_generic(struct rcu_tasks *rtp)
 			break;
 		rtpcp = per_cpu_ptr(rtp->rtpcpu, cpu);
 		rtpcp->barrier_q_head.func = rcu_barrier_tasks_generic_cb;
+		debug_rcu_head_queue(&rtpcp->barrier_q_head);
 		raw_spin_lock_irqsave_rcu_node(rtpcp, flags);
 		if (rcu_segcblist_entrain(&rtpcp->cblist, &rtpcp->barrier_q_head))
 			atomic_inc(&rtp->barrier_q_count);
+		else
+			debug_rcu_head_unqueue(&rtpcp->barrier_q_head);
 		raw_spin_unlock_irqrestore_rcu_node(rtpcp, flags);
 	}
 	if (atomic_sub_and_test(2, &rtp->barrier_q_count))
-- 
2.54.0

Re: [PATCH] rcu-tasks: Track barrier callbacks in debugobjects

[Bradley Morgan]

On 4 November 2026 15:30:45 GMT, Joel Fernandes <joelagnelf@nvidia.com>
wrote:
>rcu_tasks_invoke_cbs() now unqueues each callback from debugobjects.
>However, rcu_barrier_tasks_generic() inserts its per-CPU barrier heads
>directly with rcu_segcblist_entrain(), bypassing the queue hook in
>call_rcu_tasks_generic(). This produces active_state and deactivate
>warnings for untracked objects when a barrier callback runs.
>
>Activate each barrier head before entrainment and undo that activation
>when there are no callbacks to entrain behind. Successful entrainment
>is balanced by the invocation path, as for ordinary callbacks.
>
>The existing n_barrier_cbs=2 torture test reproduces the warnings before
>this change and completes without them afterwards.
>
>This fixes patch "rcu-tasks: Detect duplicate callback enqueue".
>
>Cc: Kunwu Chan <kunwu.chan@gmail.com>
>Cc: Paul E. McKenney <paulmck@kernel.org>

Thanks,

Reviewed-by: Bradley Morgan <brads@mainlining.org>

>Signed-off-by: Joel Fernandes <joelagnelf@nvidia.com>
>---
> kernel/rcu/tasks.h | 3 +++
> 1 file changed, 3 insertions(+)
>
>diff --git a/kernel/rcu/tasks.h b/kernel/rcu/tasks.h
>index d5d060a5c4b6..a20db323612b 100644
>--- a/kernel/rcu/tasks.h
>+++ b/kernel/rcu/tasks.h
>@@ -470,9 +470,12 @@ static void __maybe_unused rcu_barrier_tasks_generic(struct rcu_tasks *rtp)
> 			break;
> 		rtpcp = per_cpu_ptr(rtp->rtpcpu, cpu);
> 		rtpcp->barrier_q_head.func = rcu_barrier_tasks_generic_cb;
>+		debug_rcu_head_queue(&rtpcp->barrier_q_head);
> 		raw_spin_lock_irqsave_rcu_node(rtpcp, flags);
> 		if (rcu_segcblist_entrain(&rtpcp->cblist, &rtpcp->barrier_q_head))
> 			atomic_inc(&rtp->barrier_q_count);
>+		else
>+		

Wow!
	debug_rcu_head_unqueue(&rtpcp->barrier_q_head);
> 		raw_spin_unlock_irqrestore_rcu_node(rtpcp, flags);
> 	}
> 	if (atomic_sub_and_test(2, &rtp->barrier_q_count))
>

--- Thanks!

Re: [PATCH] rcu-tasks: Track barrier callbacks in debugobjects

[KunWu Chan]

Hi Joel,

I ran into the same warnings while testing rcutorture changes on top
of my earlier series,
so thanks for posting the fix.

Verified on x86_64 with torture_type=tasks object_debug=1 n_barrier_cbs=2:

Without the patch, each barrier round triggers:
ODEBUG: active_state not available (active state 0) object:
(____ptrval____) object type: rcu_head hint: 0x0

With the patch applied, the warnings are gone, and 300+ barrier rounds
complete cleanly.

I'd like to include this as the first patch in my follow-up series,
since the new
rcutorture tasks coverage depends on it. Please let me know if that's an issue.

Tested-by:  Kunwu Chan <chentao@kylinos.cn>
Reviewed-by: Kunwu Chan <chentao@kylinos.cn>

Thanks,
Kunwu

On Wed, Nov 4, 2026 at 11:31 PM Joel Fernandes <joelagnelf@nvidia.com> wrote:
>
> rcu_tasks_invoke_cbs() now unqueues each callback from debugobjects.
> However, rcu_barrier_tasks_generic() inserts its per-CPU barrier heads
> directly with rcu_segcblist_entrain(), bypassing the queue hook in
> call_rcu_tasks_generic(). This produces active_state and deactivate
> warnings for untracked objects when a barrier callback runs.
>
> Activate each barrier head before entrainment and undo that activation
> when there are no callbacks to entrain behind. Successful entrainment
> is balanced by the invocation path, as for ordinary callbacks.
>
> The existing n_barrier_cbs=2 torture test reproduces the warnings before
> this change and completes without them afterwards.
>
> This fixes patch "rcu-tasks: Detect duplicate callback enqueue".
>
> Cc: Kunwu Chan <kunwu.chan@gmail.com>
> Cc: Paul E. McKenney <paulmck@kernel.org>
> Signed-off-by: Joel Fernandes <joelagnelf@nvidia.com>
> ---
>  kernel/rcu/tasks.h | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/kernel/rcu/tasks.h b/kernel/rcu/tasks.h
> index d5d060a5c4b6..a20db323612b 100644
> --- a/kernel/rcu/tasks.h
> +++ b/kernel/rcu/tasks.h
> @@ -470,9 +470,12 @@ static void __maybe_unused rcu_barrier_tasks_generic(struct rcu_tasks *rtp)
>                         break;
>                 rtpcp = per_cpu_ptr(rtp->rtpcpu, cpu);
>                 rtpcp->barrier_q_head.func = rcu_barrier_tasks_generic_cb;
> +               debug_rcu_head_queue(&rtpcp->barrier_q_head);
>                 raw_spin_lock_irqsave_rcu_node(rtpcp, flags);
>                 if (rcu_segcblist_entrain(&rtpcp->cblist, &rtpcp->barrier_q_head))
>                         atomic_inc(&rtp->barrier_q_count);
> +               else
> +                       debug_rcu_head_unqueue(&rtpcp->barrier_q_head);
>                 raw_spin_unlock_irqrestore_rcu_node(rtpcp, flags);
>         }
>         if (atomic_sub_and_test(2, &rtp->barrier_q_count))
> --
> 2.54.0
>

Re: [PATCH] rcu-tasks: Track barrier callbacks in debugobjects

[kernel test robot]

Hello,

kernel test robot noticed "WARNING:at_lib/debugobjects.c:#debug_print_object" on:

commit: 658b1b4ca701213b64469ec43cd8f10adaf395f2 ("[PATCH] rcu-tasks: Track barrier callbacks in debugobjects")
url: https://github.com/intel-lab-lkp/linux/commits/Joel-Fernandes/rcu-tasks-Track-barrier-callbacks-in-debugobjects/20261104-103045
base: https://git.kernel.org/cgit/linux/kernel/git/rcu/linux.git rcu/dev patch link: https://lore.kernel.org/all/20261104153046.965890-1-joelagnelf@nvidia.com/
patch subject: [PATCH] rcu-tasks: Track barrier callbacks in debugobjects

in testcase: rcutorture
with following parameters:

	runtime: 300s
	test: default
	torture_type: tasks


config: x86_64-randconfig-072-20260623
compiler: gcc-14
test machine: qemu-system-x86_64 -enable-kvm -cpu Cascadelake-Server-noTSX,enforce -smp 4 -m 16G

(please refer to attached dmesg/kmsg for entire log/backtrace)


If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <yi1.lai@intel.com>
| Closes: https://lore.kernel.org/oe-lkp/202611102000.66498f89-lkp@intel.com


[  325.412340][ T1259] ------------[ cut here ]------------
[  325.413965][ T1259] ODEBUG: activate active (active state 1) object: ffffffff8a7b1f08 object type: rcu_head hint: 0x0
[  325.416551][ T1259] WARNING: lib/debugobjects.c:629 at debug_print_object+0x191/0x1d0, CPU#0: rcu_torture_fak/1259
[  325.419281][ T1259] Modules linked in: rcutorture torture
[  325.420580][ T1259] CPU: 0 UID: 0 PID: 1259 Comm: rcu_torture_fak Tainted: G                T   7.0.0-rc6-00019-g658b1b4ca701 #1 PREEMPT
[  325.423791][ T1259] Tainted: [T]=RANDSTRUCT
[  325.424756][ T1259] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  325.427494][ T1259] RIP: 0010:debug_print_object+0x1a6/0x1d0
[  325.428858][ T1259] Code: c1 ea 03 80 3c 02 00 74 05 e8 76 71 25 ff 48 8d 3d 0f 1c f3 0a 41 54 48 8b 14 dd c0 75 72 87 4d 89 f9 4d 89 f0 89 e9 4c 89 ee <67> 48 0f b9 3a 58 ff 05 32 2a ef 0a 5b 5d 41 5c 41 5d 41 5e 41 5f
[  325.433880][ T1259] RSP: 0018:ffffc90000357c70 EFLAGS: 00010246
[  325.435364][ T1259] RAX: dffffc0000000000 RBX: 0000000000000003 RCX: 0000000000000001
[  325.437272][ T1259] RDX: ffffffff87727500 RSI: ffffffff87726e60 RDI: ffffffff8d6cac90
[  325.439305][ T1259] RBP: 0000000000000001 R08: ffffffff8a7b1f08 R09: ffffffff872da660
[  325.441227][ T1259] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
[  325.443291][ T1259] R13: ffffffff87726e60 R14: ffffffff8a7b1f08 R15: ffffffff872da660
[  325.445186][ T1259] FS:  0000000000000000(0000) GS:0000000000000000(0000) knlGS:0000000000000000
[  325.447423][ T1259] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  325.449011][ T1259] CR2: 000000000805b740 CR3: 0000000154e57001 CR4: 00000000007706b0
[  325.451076][ T1259] PKRU: 55555554
[  325.451919][ T1259] Call Trace:
[  325.452654][ T1259]  <TASK>
[  325.453464][ T1259]  debug_object_activate+0x207/0x2a0
[  325.454826][ T1259]  ? debug_object_init_on_stack+0x20/0x20
[  325.456217][ T1259]  ? find_held_lock+0x2b/0x80
[  325.457536][ T1259]  ? lockdep_init_map_type+0xb1/0x200
[  325.462417][ T1259]  ? lockdep_init_map_type+0xb1/0x200
[  325.464677][ T1259]  ? __init_swait_queue_head+0xd3/0x140
[  325.471162][ T1259]  rcu_barrier_tasks_generic+0x10d/0x2a0
[  325.474128][ T1259]  rcu_torture_fakewriter+0x157/0x870 [rcutorture]
[  325.477019][ T1259]  ? rcu_read_delay+0x250/0x250 [rcutorture]
[  325.479711][ T1259]  ? lockdep_hardirqs_on+0xd0/0x100
[  325.481709][ T1259]  ? _raw_spin_unlock_irqrestore+0x4c/0xa0
[  325.483416][ T1259]  ? __kthread_parkme+0xfe/0x200
[  325.484751][ T1259]  ? rcu_read_delay+0x250/0x250 [rcutorture]
[  325.486553][ T1259]  kthread+0x3cd/0x3e0
[  325.487554][ T1259]  ? kthread_affine_node+0x150/0x150
[  325.488909][ T1259]  ret_from_fork+0x7a/0x7c0
[  325.490231][ T1259]  ? arch_exit_to_user_mode_prepare+0x150/0x150
[  325.491925][ T1259]  ? switch_fpu+0x14/0x1b0
[  325.493054][ T1259]  ? __switch_to+0x573/0xa70
[  325.494357][ T1259]  ? kthread_affine_node+0x150/0x150
[  325.495663][ T1259]  ret_from_fork_asm+0x11/0x20
[  325.496861][ T1259]  </TASK>
[  325.497866][ T1259] irq event stamp: 1019
[  325.499064][ T1259] hardirqs last  enabled at (1033): [<ffffffff815720e0>] __up_console_sem+0x40/0x60
[  325.501497][ T1259] hardirqs last disabled at (1048): [<ffffffff815720c0>] __up_console_sem+0x20/0x60
[  325.503957][ T1259] softirqs last  enabled at (1074): [<ffffffff8148eb5f>] handle_softirqs+0x61f/0x6f0
[  325.506531][ T1259] softirqs last disabled at (1095): [<ffffffff8148ecd8>] __irq_exit_rcu+0xa8/0x1e0
[  325.508825][ T1259] ---[ end trace 0000000000000000 ]---
[  325.649375][ T1259] ------------[ cut here ]------------


The kernel config and materials to reproduce are available at:
https://download.01.org/0day-ci/archive/20261110/202611102000.66498f89-lkp@intel.com


--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki