From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wr1-f47.google.com (mail-wr1-f47.google.com [209.85.221.47]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A5C6E364926 for ; Fri, 5 Jun 2026 06:56:28 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.47 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780642591; cv=none; b=h6KIP+fQQueLbd0HcQZ2fCjNpQUGn2h0HVKrU0JwnQJ6rx76Z6OcHLi0iRJIhrZ+gJMsaHcK8iLf/vbb7N3pBMN4gP9bpilraUzPvEczt9Kepds/XV80VN8dMkCzvXa64lZmtYs6j94UdKzDqOG/ofM6O6L1C4CzxGTQgm8mQSc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780642591; c=relaxed/simple; bh=ZDvo2JB+1+eOw28zDMz66JG84t71fIwb6lfT3Y+53hc=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=K2PCo806XiP5rWeCh2rJHnG0ZyL7OSW/wcjh61/VpSPn/+vKKEXWugGJAzq+eVfPr7mvkym9XHE5MyzavNHEsABoO/81g16Xtb2KH+YlRGaFaNSxrnPBeeDFRpbwX4XsvDIOdOrECpsBoRpGQokcO5ongIHu2SbZwPMdkosqtCc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=EQIGjZpy; arc=none smtp.client-ip=209.85.221.47 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="EQIGjZpy" Received: by mail-wr1-f47.google.com with SMTP id ffacd0b85a97d-46015dc517aso1273456f8f.2 for ; Thu, 04 Jun 2026 23:56:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1780642587; x=1781247387; darn=vger.kernel.org; h=content-transfer-encoding:in-reply-to:from:references:cc:to :content-language:subject:user-agent:mime-version:date:message-id :from:to:cc:subject:date:message-id:reply-to; bh=FCTmNu4jgb4r7pFyMhscOVe9W8lUl5WIYLcG+5Yn3NU=; b=EQIGjZpyoAPkkcw+DI2ludlABPF7YBAfaO5u5q9WUzEwR9Au3BAIBfNI5JiymA3yHS e4LLgDW54CbO71ZclsAExlKkkSB3Fv1CAY5YMahFyx0u+nGmbIkSh35qGFGI5RTGXfal 9jszspuhlcxaLz4yHDy6I425umatBDOqUhWpxfW+jwrK3G7HN54ls+o3ieiNZFlveti6 kpEZB+dAHhK6tVjkx5EGGSbyjpRHkczD7tr6FowAm8r8tnmkpkUx8l7ygL9QjjRt1EB8 R58ZS+9XSWHua2tiYtLLmE2CX+uOgqz+D3jg3rcCigECa5duPegtbObKCP/jlCPjFNKU aFWQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780642587; x=1781247387; h=content-transfer-encoding:in-reply-to:from:references:cc:to :content-language:subject:user-agent:mime-version:date:message-id :x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=FCTmNu4jgb4r7pFyMhscOVe9W8lUl5WIYLcG+5Yn3NU=; b=IyEv6BFG65kGBcxODCzzUGCmJVOK+Zv2Yxz7fkfQVaDZP6bWV87ACVRJf8GbZv3Du8 emJyvRREQTHZI04mgAoEgOFRKPOQOHyn8ODN0vH8uU/8Nq8rykrY5sdpZXzCYp3U7+IW khLtB0pPVE4tEPIZZG4OKT0st9pG4jbd+gNTxHNYkoc2rDkAy2gRx1OaLIfstpEJebxM T8P1bdSCUe0Zb/fU46oG7TL/Si0G1/ihjD7d6LRVzLM9eHJ3iSdi2uyComYl0DDYFvVm N9yH36nCugkvVrNPsZANlPwvEg4ArR0WpcLKLU9zZ5iD+ICo8V75xdVcbns7tcEi+48o q4Rw== X-Forwarded-Encrypted: i=1; AFNElJ+PYC8M/DEc0rBDlRyiIgM6nc3MVpDLFFIOUEBrwOPEyXDXvFsfZ2w9ljMb4/yWfdkTqEbj2k/nmWJeAbw=@vger.kernel.org X-Gm-Message-State: AOJu0YxvNtXitR/yUCY8rFF+oCORgNfFpRRwJVacHWgFKU/ltvUbqjPG q/Io4TbTE+qhblMT3RuSmvA16E9y1KSTovPtv1boBnJol2z16kZLbWI8hT/eSw== X-Gm-Gg: Acq92OHjuIzSngkC8q3DMo7P+DQ4pYzCPH2w2WKpG8RqeI0VnGRullBptEB4R3DEhoU yzENpj5lK8c4j1dPyDjFB9KOcR29mK8shQi80tqFQ4XEOnydZyGBaPjIODieTYV2ZN5K6XuzUSW Lc+XuazqWV9Dq+kl4ZwiBt9HpIr/jPm2p5jJDeAP7jtVYgFPya/ZELf4QPp1LP3KmW9wlRutzX+ 1np5BcDuGsEmywh8v9TfcxQk/BwsEjOud53qplUQbPtx7vQB97Ekfayy9wUewcc2jyyRVzY90Pk IqGAg0ssQ34q/V7x/qVVKXNvdXxb/hSde3dM4IJIKNwOgZHEEjWgyNVYC/lSU0d/mgrcn5/j7DU magxXVTTxRQvJ9fHTBrgTz5fE+cSuXvrwju8Ndp5PiPCqToaqjOOhVLwKI2O4C64b2KEb/qfUrZ Y5dz6VLvcnO7Omtngef8/mmvjJG07lqOjb+eixQ8pax5NXAIbeiMFOQ0PxOmJmsjBf8hUYrX4JF C39nMD2H+y8zIPayAjsbrAfQFgchuZKmzYG X-Received: by 2002:adf:e006:0:20b0:441:1e8e:d8fd with SMTP id ffacd0b85a97d-46030658bc5mr2487297f8f.29.1780642586855; Thu, 04 Jun 2026 23:56:26 -0700 (PDT) Received: from ?IPV6:2001:9e8:f133:a901:840b:2bf2:919c:cec5? ([2001:9e8:f133:a901:840b:2bf2:919c:cec5]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-4601f2dcb13sm22537060f8f.2.2026.06.04.23.56.26 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Thu, 04 Jun 2026 23:56:26 -0700 (PDT) Message-ID: Date: Fri, 5 Jun 2026 08:56:25 +0200 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH] MIPS: smp: report dying CPU to RCU in stop_this_cpu() Content-Language: en-US To: Huacai Chen Cc: Thomas Bogendoerfer , linux-mips@vger.kernel.org, Sebastian Andrzej Siewior , Clark Williams , Steven Rostedt , Thomas Gleixner , Jiayuan Chen , linux-rt-devel@lists.linux.dev, linux-kernel@vger.kernel.org, stable@vger.kernel.org References: <20260604182407.3109536-1-jelonek.jonas@gmail.com> From: Jonas Jelonek In-Reply-To: Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Hi Huacai, On 05.06.26 05:01, Huacai Chen wrote: > Hi, Jonas, > > On Fri, Jun 5, 2026 at 2:25 AM Jonas Jelonek wrote: >> smp_send_stop() parks all secondary CPUs in stop_this_cpu(). The function >> marks the CPU offline for the scheduler via set_cpu_online(false) but >> never informs RCU, so RCU keeps expecting a quiescent state from CPUs >> that are now spinning forever with interrupts disabled. >> >> As long as nothing waits for an RCU grace period after smp_send_stop() >> this is harmless, which is why it went unnoticed. Since commit >> 91840be8f710 ("irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT") >> however, irq_work_sync() calls synchronize_rcu() on architectures without >> an irq_work self-IPI, i.e. where arch_irq_work_has_interrupt() returns >> false. That is the asm-generic default used by MIPS. Any irq_work_sync() >> issued in the reboot/shutdown path after smp_send_stop() then blocks on >> a grace period that can never complete, hanging the reboot: >> >> WARNING: CPU: 0 PID: 15 at kernel/irq_work.c:144 irq_work_queue_on >> ... >> rcu: INFO: rcu_sched detected stalls on CPUs/tasks: >> rcu: Offline CPU 1 blocking current GP. >> rcu: Offline CPU 2 blocking current GP. >> rcu: Offline CPU 3 blocking current GP. >> >> This issue popped up during kernel bump downstream in OpenWrt from >> 6.18.33 to 6.18.34, since the suspected change has been backported to >> 6.18 stable branch [1]. > Now 91840be8f710 ("irq_work: Fix use-after-free in irq_work_single() > on PREEMPT_RT") has been backported to as early as 6.1 LTS. Yes, as also pointed out by Sebastian I should adjust this paragraph to be more accurate. >> Call rcutree_report_cpu_dead() once interrupts are disabled, mirroring the >> generic CPU-hotplug offline path (and arm64's stop handling), so RCU stops >> waiting on the parked CPUs and grace periods can still complete. >> >> [1] https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-6.18.y&id=18c0456ea2615b1a743a6db739c74411c3b42bc6 >> >> Fixes: 91840be8f710 ("irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT") >> CC: stable@vger.kernel.org >> Signed-off-by: Jonas Jelonek >> >> diff --git a/arch/mips/kernel/smp.c b/arch/mips/kernel/smp.c >> index 4868e79f3b30..0f28b4a62e72 100644 >> --- a/arch/mips/kernel/smp.c >> +++ b/arch/mips/kernel/smp.c >> @@ -20,6 +20,7 @@ >> #include >> #include >> #include >> +#include >> #include >> #include >> #include >> @@ -422,6 +423,7 @@ static void stop_this_cpu(void *dummy) >> set_cpu_online(smp_processor_id(), false); >> calculate_cpu_foreign_map(); >> local_irq_disable(); >> + rcutree_report_cpu_dead(); > I'm not sure but maybe it is better to before local_irq_disable()? rcutree_report_cpu_dead() starts with lockdep_assert_irqs_disabled() so it needs IRQs disabled already. > Huacai >> while (1); >> } >> >> -- >> 2.51.0 >> >> Best, Jonas