Re: [PATCH v2 3/6] srcu: Make call_srcu() safe to call from any context

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Tiny SRCU's call_srcu() remains unsafe to call from NMI context, leaving it vulnerable to list corruption.
--

--- Patch [3]: [PATCH v2 3/6] srcu: Make call_srcu() safe to call from any context ---
commit e3be0303432c7c7afdd4ed014dae0987e25bf7d3
Author: Puranjay Mohan <puranjay@xxxxxxxxxx>

srcu: Make call_srcu() safe to call from any context

This commit updates Tree SRCU to make call_srcu() safe to call from any
context, including NMIs. It defers callbacks via a per-CPU irq_work when
interrupts are already disabled to prevent list corruption and deadlocks.

> srcu: Make call_srcu() safe to call from any context
> 
> call_srcu() has the same constraint as call_rcu(): its callback list and
> locks are only touched with interrupts disabled.  srcu_gp_start_if_needed()
> enqueues under raw_spin_lock_irqsave() and may walk the srcu_node tree, as
> do callback invocation and grace-period work.  A call_srcu() with
> interrupts disabled can race a list operation in flight on this CPU and
> corrupt the list or deadlock.  call_rcu_tasks_trace() is call_srcu() under
> the hood, so a sleepable BPF program freeing an object can reach this.

[Severity: High]
This isn't a bug introduced by this patch, but does Tiny SRCU also need a
similar fix to safely handle NMI contexts?

In kernel/rcu/srcutiny.c, call_srcu() relies solely on local_irq_save(),
which does not mask NMIs:

	local_irq_save(flags);
	*ssp->srcu_cb_tail = rhp;
	ssp->srcu_cb_tail = &rhp->next;
	local_irq_restore(flags);

If an NMI interrupts call_srcu() exactly between assigning the tail and
updating the tail pointer, and the NMI handler invokes call_srcu()
(e.g., via call_rcu_tasks_trace()) on the same srcu_struct, could this
overwrite the tail pointer and permanently detach the list?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260803134839.2103051-1-puranjay@xxxxxxxxxx?part=3