Re: [PATCH] hazptr: handle NULL address in hazptr_detach

[Mathieu Desnoyers <mathieu.desnoyers@efficios.com>]

On 2026-09-08 11:24, Bradley Morgan wrote:
> On 8 September 2026 16:22:14 BST, Mathieu Desnoyers
> <mathieu.desnoyers@efficios.com> wrote:
>> When hazptr_acquire loads a NULL pointer, it sets:
>>
>> - slot_item->slot.addr = NULL,
>> - slot_item->ctx.ctx = ctx
>> - ctx->slot = slot
>>
>> And it returns NULL.
>>
>> Then hazptr_detach is called on this ctx, it will act on the ctx as if
>> needed to be promoted to backup slot, even though it has a NULL addr.
>>
>> Looking at what hazptr_note_context_switch() does before promoting
>> to backup slot, it checks for a NULL slot->addr, which is exactly
>> what is missing from hazptr_detach.
>>
>> With this in place there would be no need to explicitly check the
>> hazptr_acquire() return value before calling hazptr_detach().
>>
>> hazptr_release() has a early return check for NULL addr as well, so it
>> makes sense that detach does an early return (no-op) similarly.
>>
> 
> You shall kill me for this!!
> 
> Could you perhaps do a splat in ze commit description pls?

The splat is available at the "Closes" URL below. I'm not sure whether
we should duplicate this verbose information ?

Paul ?

Thanks,

Mathieu

> 
> 
>> Fixes: 6357ec235c59 ("hazptrtorture: Fix hazptr ownership issue")
>> Reported-by: kernel test robot <yi1.lai@intel.com>
>> Closes: https://lore.kernel.org/oe-lkp/202608130915.62b53936-lkp@intel.com
>> Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
>> Reviewed-by: Bradley Morgan <brads@mainlining.org>
>> Cc: Paul E. McKenney <paulmck@kernel.org>
>> Cc: Boqun Feng <boqun@kernel.org>
>> Cc: Bradley Morgan <brads@mainlining.org>
>> Cc: <rcu@vger.kernel.org>
>> Cc: <lkmm@lists.linux.dev>
>> ---
>> include/linux/hazptr.h | 4 +++-
>> 1 file changed, 3 insertions(+), 1 deletion(-)
>>
>> diff --git a/include/linux/hazptr.h b/include/linux/hazptr.h
>> index 43122c5673bd..d1670121947a 100644
>> --- a/include/linux/hazptr.h
>> +++ b/include/linux/hazptr.h
>> @@ -160,10 +160,12 @@ void hazptr_detach(struct hazptr_ctx *ctx)
>> 	struct hazptr_slot *slot;
>>
>> 	guard(preempt)();
>> +	slot = ctx->slot;
>> +	if (!slot->addr)
>> +		return;
>> #ifdef CONFIG_HAZPTR_DEBUG
>> 	ctx->detach_task = ctx->detach_cpu = true;
>> #endif
>> -	slot = ctx->slot;
>> 	if (unlikely(hazptr_slot_is_backup(ctx, slot)))
>> 		return;
>> 	hazptr_promote_to_backup_slot(ctx, slot);
>>
> 
> --- Thanks!
> https://lore.kernel.org/all/EE579805-42F2-4C58-B752-F28779EEB717@grrlz.net/


-- 
Mathieu Desnoyers
EfficiOS Inc.
https://www.efficios.com