Re: [PATCH -rcu/dev 3/4] hazptr: Do not warn when a backup slot is released on another CPU

[Bradley Morgan <brads@mainlining.org>]

On 27 October 2026 16:38:05 GMT, Andrea Parri <parri.andrea@gmail.com>
wrote:
>With CONFIG_HAZPTR_DEBUG, hazptr_release_debug() warns when a hazard
>pointer is released on a CPU other than the one that acquired it,
>unless ->detach_cpu is set.  hazptr_detach() sets it, and so does
>hazptr_note_context_switch() when it promotes a per-CPU slot to the
>backup slot.
>
>__hazptr_acquire() can also put the hazard pointer in the backup slot
>directly, when all per-CPU slots are in use or the pointer changes
>under __hazptr_try_acquire().  Nothing sets ->detach_cpu then, so if
>the task is migrated before the release, the check warns although the
>backup slot can be released on any CPU.
>
>From hazptrtorture, with CPU hotplug and readers that nest a second
>hazard pointer, as "hazptrtorture: Nest a second hazard pointer in
>readers" makes them do (without the nesting, 30-minute PREEMPT and
>NOPREEMPT runs do not hit it):
>
>    Hazard Pointer (addr=00000000e2979b1e) released on remote cpu without context switch. Acquire: caller=hazptr_torture_read_lock+0x43/0xb0, pid=80, cpu=0. Release: pid=80, cpu=1.
>    WARNING: ./include/linux/hazptr.h:293 at hazptr_torture_read_unlock+0x80/0x160, CPU#1: hazptr_torture_/80
>    Call Trace:
>     <TASK>
>     hazptr_torture_reader_tail+0x88/0x250
>     hazptr_torture_nested_reader+0x6c/0x90
>     hazptr_torture_reader+0x2f5/0x550
>     kthread+0xdf/0x110
>     ret_from_fork+0x179/0x240
>     ret_from_fork_asm+0x1a/0x30
>     </TASK>
>
>Set ->detach_cpu when __hazptr_acquire() falls back to the backup slot.
>The remote-task check still applies to such a hazard pointer.
>
>The false positive was found with the help of an LLM.
>
>Fixes: 3d48872eb74f ("hazptr: Introduce CONFIG_HAZPTR_DEBUG misuse detection")

Reviewed-by: Bradley Morgan <brads@mainlining.org>

>Signed-off-by: Andrea Parri <parri.andrea@gmail.com>
>---
> kernel/hazptr.c | 4 ++++
> 1 file changed, 4 insertions(+)
>
>diff --git a/kernel/hazptr.c b/kernel/hazptr.c
>index b15b84ebd4ceb..b06164aac3a70 100644
>--- a/kernel/hazptr.c
>+++ b/kernel/hazptr.c
>@@ -112,6 +112,10 @@ void *__hazptr_acquire(struct hazptr_ctx *ctx, void * const *addr_p)
> 	 *   synchronize forward progress.
> 	 */
> 	slot = hazptr_chain_backup_slot(ctx);
>+#ifdef CONFIG_HAZPTR_DEBUG
>+	/* Unlike a per-CPU slot, the backup slot can be released on any CPU. */
>+	ctx->detach_cpu = true;
>+#endif

Makes enough sense.

> 	WRITE_ONCE(slot->addr, HAZPTR_WILDCARD);	/* Store B */
> 
> 	/* Memory ordering: Store B before Load A. */
>


--- Thanks!