Re: [PATCH v2 00/10] rcu: Improve callback diagnostics and validation

[Joel Fernandes]

On Wed, Oct 28, 2026 at 10:17:25AM +0800, KunWu Chan wrote:
> On Wed, Oct 28, 2026 at 7:13 AM Joel Fernandes <joelagnelf@xxxxxxxxxx> wrote:
> >
> > On Tue, Oct 27, 2026 at 03:09:13PM +0800, Kunwu Chan wrote:
> > > Hi,
> > >
> > > This series improves callback diagnostics and validation across RCU,
> > > SRCU, and RCU Tasks.
> > >
> > > Patches 1-3 record callback registration stacks for KASAN in Tree
> > > SRCU, Tiny SRCU, and Tiny RCU.  KASAN prints the recorded auxiliary
> > > stack when reporting a use-after-free.
> > >
> > > Patches 4-6 add rcu_head alignment and NULL callback-function checks.
> > >
> > > Patches 7-10 detect duplicate callback enqueue attempts before
> > > queueing, using the RCU head debug-object mechanism.  A duplicate
> > > registration is rejected at entry and __ratelimit() controls the
> > > diagnostic output group (pr_err, mem_dump_obj, dump_stack).
> > > Detection requires CONFIG_DEBUG_OBJECTS_RCU_HEAD.
> > >
> > > Changes since v1:
> > > - Patches 7-9: __ratelimit() + dump_stack() instead of hard-coded limit
> > > - Patch 10 (new): same change for Tree RCU's rcu_do_enqueue()
> > > - Patch 9: fixed log format to avoid pseudo-function names
> > > - Tags: Reviewed-by (4-6), Suggested-by (7-10)
> > > - v1: https://lore.kernel.org/all/20261023101841.2910719-1-kunwu.chan@xxxxxxxxx/
> > >
> > >
> > > Testing:
> > >   rcutorture with KASAN (SRCU-N, SRCU-P, SRCU-T, SRCU-U, TINY01,
> > >   TINY02, TREE03, 3min each): all exitcode 0.
> > >
> > >   KASAN aux stack (QEMU, CONFIG_KASAN_GENERIC=y):
> > >     Last potentially related work creation:
> > >      kasan_save_stack+0x33/0x60
> > >      kasan_record_aux_stack+0x8c/0xa0
> > >      call_srcu+0xb2/0x390
> > >
> > >   Duplicate enqueue (QEMU, CONFIG_DEBUG_OBJECTS_RCU_HEAD=y):
> > >     call_srcu(): Duplicate call_srcu() CB ... ->cb
> > >     dump_stack_lvl+0x47/0x60
> > >     call_rcu_tasks_generic(): Duplicate CB for RCU Tasks, ... ->cb
> > >     dump_stack_lvl+0x47/0x60
> > >     rcu_do_enqueue(): Double-freed CB ... ->cb  slab kmalloc-16 ...
> > >
> > >
> > > Kunwu Chan (10):
> > >   srcu: Record callback registration stack for KASAN
> > >   srcutiny: Record callback registration stack for KASAN
> > >   rcu: Record callback registration stack for Tiny RCU
> > >   srcu: Validate callback arguments
> > >   rcu: Validate callback arguments in Tiny RCU
> > >   rcu-tasks: Validate callback arguments
> > >   srcu: Detect duplicate callback enqueue at registration
> > >   srcutiny: Detect duplicate callback enqueue
> > >   rcu-tasks: Detect duplicate callback enqueue
> > >   rcu: Improve duplicate callback diagnostics
> >
> >
> > Reviewed-by: Joel Fernandes <joelagnelf@xxxxxxxxxx>
> 
> Thanks, Joel.
> 
> >
> > All look good to me, applying for further testing and review for 7.5. Did you
> > also test double-call-srcu and confirm intended behavior? Thanks!
> >
> 
> Yes, I tested double call_srcu() under QEMU with
> CONFIG_DEBUG_OBJECTS_RCU_HEAD=y.
> Both Tree SRCU (direct and deferred paths) and Tiny SRCU triggered the expected
> duplicate-enqueue diagnostic with the callback symbol and dump_stack() output.

Great!

> 
> BTW, I'm working on follow-up rcutorture support for
> duplicate-callback testing and
> KASAN aux-stack verification.

Nice! How is that coming along?

thanks,

Joel Fernandes


> 
> Thanks for review.
> Kunwu
> 
> > thanks,
> >
> > Joel Fernandes
> >
> >
> > >
> > >  kernel/rcu/srcutiny.c | 34 ++++++++++++++++++++++++++++++++++
> > >  kernel/rcu/srcutree.c | 36 ++++++++++++++++++++++++++++++------
> > >  kernel/rcu/tasks.h    | 27 +++++++++++++++++++++++++++
> > >  kernel/rcu/tiny.c     | 11 +++++++++++
> > >  kernel/rcu/tree.c     |  9 +++++++--
> > >  5 files changed, 109 insertions(+), 8 deletions(-)
> > >
> > >
> > > base-commit: 940793b926aa94bf65ec404043050888e3053188
> > > --
> > > 2.43.0
> > >