From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out-176.mta1.migadu.com (out-176.mta1.migadu.com [95.215.58.176]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 864D539CD06 for ; Fri, 17 Jul 2026 09:14:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=95.215.58.176 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784279690; cv=none; b=gPGgjkh6+QHZL2srGVhh25IBknnXu2i9RoAU0o0V8M4P/qRLEIS2mxinYHL+a7j2RbIRa4WhDgRMj1q8AG8j+IeHktOqNoqDd6SQryxpuTGvlL4uvrK+/VxvWVF5lVTPJ6CXsSKrV8g8EvHggqf1jGYq4LChzvnXSgcdXrP0lzM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784279690; c=relaxed/simple; bh=jBIhVxImfy7Y02ed8/XE9iAYMrS1zJGYZ7GlKbV7LBQ=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=YNOHLN0/IvEXkVwiNutZsgO+GuQIeuwMHcGeLEehR8IkIXoguZcJYjZPc2hlVZHueiCoAsATlkax9+q1sEkNpUVfByRc7+onhZG6aslb3r83Rw3+MGU8ABKvUKS/j2+Xoi5vWkbxsVwa0Rn+HQ2Z9mN0V+wZiYrRHOYJ8szqDJs= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=EM0r+Lf6; arc=none smtp.client-ip=95.215.58.176 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="EM0r+Lf6" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1784279681; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=Shm6+5tCo7g2dcIrw8xO73vGal+ZnMWlk3xZshwJCSc=; b=EM0r+Lf6OWRRDzp4jjHJrLOt91qcnAC1Hqc+oYh2cizh2ffsaZ6K/yEn0jqjYKcMGyiIYX hW6BJ3m6A9ZiSFGS6sVNTEfj+v/cfGH3MBvaYKzZO3mmtFJJy4MPM8o50ISavTKJRK8CZd sTUupTqU+7/b9SzdWFEvceW/eYS2XSI= From: Guopeng Zhang To: Johannes Weiner , Suren Baghdasaryan Cc: Peter Zijlstra , Ingo Molnar , Juri Lelli , Vincent Guittot , Dietmar Eggemann , Steven Rostedt , Ben Segall , Mel Gorman , Valentin Schneider , K Prateek Nayak , Tejun Heo , Zhaoyang Huang , "ziwei.dai" , Chengming Zhou , linux-kernel@vger.kernel.org Subject: [PATCH 0/3] sched/psi: Fix rtpoll teardown races Date: Fri, 17 Jul 2026 17:14:11 +0800 Message-ID: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Migadu-Flow: FLOW_OUT From: Guopeng Zhang Last-trigger rtpoll teardown clears rtpoll_task under rtpoll_trigger_lock, but has to stop the old worker after dropping the lock because the worker takes the same lock. A new trigger can therefore install a replacement worker before the old worker exits. Lockless psi_schedule_rtpoll_work() readers can also overlap with teardown after having observed the old worker. This leaves three separate races: - the old worker can consume a timer wakeup intended for its replacement and then exit, leaving the replacement asleep while rtpoll_scheduled remains set; - a lockless reader that observed the old rtpoll_task can call mod_timer() after teardown called timer_delete(), leaving a stale timer pending after the last trigger has been removed; - after a replacement has published its worker and armed the timer, the old teardown can clear rtpoll_scheduled, allowing a later task change to rearm an already pending timer unnecessarily. The patches are ordered as follows: 1. Check for worker stop before consuming the shared wakeup, and process every wakeup that is consumed. 2. Wait for pre-existing RCU readers before deleting the timer synchronously under rtpoll_trigger_lock. 3. Building on patch 2, clear rtpoll_scheduled during the locked timer teardown, before a replacement worker can be published. Testing ======= Temporary A/B instrumentation directly exercised the timer rearm race addressed by patch 2. One lockless RCU reader per group was held for up to 10 ms after it read a non-NULL rtpoll_task. On the unfixed kernel, teardown unpublished the worker, deleted the timer, and released the reader. The reader then observed the NULL pointer and rearmed the timer with a 10-second expiry. On the fixed kernel, synchronize_rcu() waited for the reader to rearm the timer and leave its read-side critical section before timer_delete_sync() removed it. After the grace period and before stopping the old worker, the instrumentation checked under rtpoll_trigger_lock whether the timer was pending while no replacement worker was published. It logged and synchronously deleted any timer found this way. Both runs used the same test VM, kernel configuration, script, workload, and instrumentation. Without patch 2: CPU workers: 128 Duration: 60 seconds Trigger cycles: 2029 CPU PSI some total delta: 60561126 usec Pending timer after teardown: observed With patch 2: CPU workers: 128 Duration: 60 seconds Trigger cycles: 2045 CPU PSI some total delta: 60423170 usec Pending timer after teardown: not observed in 2045 trigger cycles The temporary instrumentation is not part of this series. Guopeng Zhang (3): sched/psi: Avoid losing wakeups during rtpoll worker replacement sched/psi: Prevent stale timer rearm after rtpoll teardown sched/psi: Avoid clobbering rtpoll_scheduled during teardown kernel/sched/psi.c | 28 +++++++++++++++++++--------- 1 file changed, 19 insertions(+), 9 deletions(-) base-commit: 1a1757b76427f6201bfe0bf1bea9f7574f332a93 -- 2.43.0