Re: [PATCH] hazptr: handle NULL address in hazptr_detach

[Bradley Morgan]

On 8 September 2026 16:22:14 BST, Mathieu Desnoyers
<mathieu.desnoyers@xxxxxxxxxxxx> wrote:
>When hazptr_acquire loads a NULL pointer, it sets:
>
>- slot_item->slot.addr = NULL,
>- slot_item->ctx.ctx = ctx
>- ctx->slot = slot
>
>And it returns NULL.
>
>Then hazptr_detach is called on this ctx, it will act on the ctx as if
>needed to be promoted to backup slot, even though it has a NULL addr.
>
>Looking at what hazptr_note_context_switch() does before promoting
>to backup slot, it checks for a NULL slot->addr, which is exactly
>what is missing from hazptr_detach.
>
>With this in place there would be no need to explicitly check the
>hazptr_acquire() return value before calling hazptr_detach().
>
>hazptr_release() has a early return check for NULL addr as well, so it
>makes sense that detach does an early return (no-op) similarly.
>

You shall kill me for this!!

Could you perhaps do a splat in ze commit description pls?


>Fixes: 6357ec235c59 ("hazptrtorture: Fix hazptr ownership issue")
>Reported-by: kernel test robot <yi1.lai@xxxxxxxxx>
>Closes: https://lore.kernel.org/oe-lkp/202608130915.62b53936-lkp@xxxxxxxxx
>Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@xxxxxxxxxxxx>
>Reviewed-by: Bradley Morgan <brads@xxxxxxxxxxxxxx>
>Cc: Paul E. McKenney <paulmck@xxxxxxxxxx>
>Cc: Boqun Feng <boqun@xxxxxxxxxx>
>Cc: Bradley Morgan <brads@xxxxxxxxxxxxxx>
>Cc: <rcu@xxxxxxxxxxxxxxx>
>Cc: <lkmm@xxxxxxxxxxxxxxx>
>---
> include/linux/hazptr.h | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
>diff --git a/include/linux/hazptr.h b/include/linux/hazptr.h
>index 43122c5673bd..d1670121947a 100644
>--- a/include/linux/hazptr.h
>+++ b/include/linux/hazptr.h
>@@ -160,10 +160,12 @@ void hazptr_detach(struct hazptr_ctx *ctx)
> 	struct hazptr_slot *slot;
> 
> 	guard(preempt)();
>+	slot = ctx->slot;
>+	if (!slot->addr)
>+		return;
> #ifdef CONFIG_HAZPTR_DEBUG
> 	ctx->detach_task = ctx->detach_cpu = true;
> #endif
>-	slot = ctx->slot;
> 	if (unlikely(hazptr_slot_is_backup(ctx, slot)))
> 		return;
> 	hazptr_promote_to_backup_slot(ctx, slot);
>

--- Thanks!
https://lore.kernel.org/all/EE579805-42F2-4C58-B752-F28779EEB717@xxxxxxxxx/