Re: [BUG] srcu: false-positive WARN in cleanup_srcu_struct() after 78a38cbf6f20

[Sunho Park <shpark061104@gmail.com>]

On 8/26/26 22:13, Zqiang wrote:
> In this SRCU_SIZE_SMALL mode, when queue delayed work timer, the cblist is always no-empty.
> unless invoke start_poll_synchronize_srcu() to begin SRCU garce period,
> otherwise invoke call_srcu() or synchronize_srcu*() will insert callback.
Right, every grace period which armed the delay_work timer is started by 
the real call_srcu(&kvm->srcu, &bus->rcu, __free_bus) in 
kvm_io_bus_register_dev(). I missed one point: the invoke work which 
invoked the barrier callbacks is not queued by the nearest end of grace 
period. It was queued by the timer of a previous end of GP, and it 
started only after the last GP had ended. Meanwhile the srcu_gp_end() 
from the last GP armed another timer even though the work was already 
queued. The timeline is as below:

1. call_srcu(&kvm->srcu, &bus->rcu, __free_bus)
2. One end of GP comes, arms a timer.
3. The timer is fired and an invoke work is queued to rcu_gp_wq. The 
timer is disabled now.
4. Another call_srcu(&kvm->srcu, &bus->rcu, __free_bus)
5. srcu_barrier() is called and queues barrier callbacks, waits for 
srcu_invoke_callbacks() to invoke them.
6. The end of GP from step 4 comes, arms another timer.
7. The invoke work queued in step 3 starts, srcu_invoke_callbacks() is 
called. It starts invoking callbacks without subtracting the cblist len 
field. It will call rcu_segcblist_add_len(&sdp->srcu_cblist, -len) after 
the invoking loop is over.
When I debugged, there were five __free_bus(the real callbacks) and one 
barrier callback, so the cblist len field was 6.
8. Barrier callback is invoked, still the cblist len field is not 
subtracted as srcu_invoke_callbacks()'s invoking loop is not over.
9. srcu_barrier() wakes up by completion and cleanup_srcu_struct() is 
called before the timer armed in step 6 expires.
At this point the cblist is physically empty (head == NULL, all seglen 
are 0) as all six callbacks have already been invoked. Only the cblist 
len field is stale(>0).

Thanks
Sunho Park