Re: [PATCH 2/2] sched/psi: Shut down rtpoll_timer in psi_cgroup_free()

[Suren Baghdasaryan]

On Mon, Jul 13, 2026 at 7:07 AM Suren Baghdasaryan <surenb@xxxxxxxxxx> wrote:
>
> On Mon, Jul 13, 2026 at 3:56 AM Johannes Weiner <hannes@xxxxxxxxxxx> wrote:
> >
> > On Sun, Jul 12, 2026 at 07:46:19AM -1000, Tejun Heo wrote:
> > > psi_schedule_rtpoll_work() is called locklessly from the scheduler hotpath
> > > and can race psi_trigger_destroy() taking down the last rtpoll trigger under
> > > rtpoll_trigger_lock:
> > >
> > >   psi_schedule_rtpoll_work()        psi_trigger_destroy()
> > >
> > >   rcu_read_lock();
> > >   task = rcu_dereference(rtpoll_task);
> > >                                     rcu_assign_pointer(rtpoll_task, NULL);
> > >                                     timer_delete(&rtpoll_timer);
> > >   mod_timer(&rtpoll_timer, ...);
> > >   rcu_read_unlock();
> > >                                     synchronize_rcu();
> > >                                     kthread_stop(task_to_destroy);
> > >
> > > The group can then be freed with the re-armed timer still pending, and
> > > poll_timer_fn() runs on freed memory.
> > >
> > > 461daba06bdc ("psi: eliminate kthread_worker from psi trigger scheduling
> > > mechanism") deleted the timer synchronously after the synchronize_rcu(),
> > > which prevented this but raced trigger creation instead: the deletion could
> > > cancel the timer that a new trigger set armed during the grace period and,
> > > as creation also reinitialized the timer at the time, corrupt it.
> > > 8f91efd870ea ("psi: Fix race between psi_trigger_create/destroy") moved the
> > > initialization into group_init() and the deletion into the locked section,
> > > trading the creation races for the window above.
> > >
> > > Neither placement in the destruction path works. A pending timer firing
> > > while the group is alive is harmless though. poll_timer_fn() just wakes the
> > > rtpoll waitqueue and doesn't re-arm itself. Bind the timer to the group's
> > > lifetime instead and shut it down in psi_cgroup_free(). Nothing can arm it
> > > by then. timer_shutdown_sync() because the timer is never armed again.
> > >
> > > Fixes: 8f91efd870ea ("psi: Fix race between psi_trigger_create/destroy")
> > > Cc: stable@xxxxxxxxxxxxxxx # v5.10+
> > > Reported-by: Sashiko AI <sashiko-bot@xxxxxxxxxx>
> > > Closes: https://lore.kernel.org/all/20260711000434.36C4A1F000E9@xxxxxxxxxxxxxxx/
> > > Signed-off-by: Tejun Heo <tj@xxxxxxxxxx>
> >
> > Acked-by: Johannes Weiner <hannes@xxxxxxxxxxx>

Acked-by: Suren Baghdasaryan <surenb@xxxxxxxxxx>


> >
> > Both these patches look good to me, but Suren can you please also take
> > a look?
>
> Yes, I'm on it. Need some time to remind myself of all the details of
> the implementation.