Re: [PATCH v2 1/6] rcu: Make call_rcu() safe to call from any context

Thank you for your contribution! Sashiko AI review found 1 potential issue(=
s) to consider:
- [High] Concurrent `rcu_barrier()` calls can cause missed wakeups and syst=
em hangs in `irq_work_sync()` on architectures without IPI-based `irq_work`.
--

--- Patch [1]: [PATCH v2 1/6] rcu: Make call_rcu() safe to call from any co=
ntext ---
commit f033f4bd0a671eccd668878bff133f083ff63d97
Author: Puranjay Mohan <[email protected]>

rcu: Make call_rcu() safe to call from any context

This commit makes call_rcu() safe to call from any context by deferring
the callback on a per-CPU llist when interrupts are disabled, and raising
an irq_work to re-issue it once interrupts are enabled. It introduces
rcu_defer_flush() to flush these deferred callbacks during rcu_barrier().

> diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c
> index 96848fc1f02b8..31e2d2207ac03 100644
> --- a/kernel/rcu/tree.c
> +++ b/kernel/rcu/tree.c

[ ... ]

> @@ -3896,8 +3990,12 @@ void rcu_barrier(void)
>  	unsigned long flags;
>  	unsigned long gseq;
>  	struct rcu_data *rdp;
> -	unsigned long s =3D rcu_seq_snap(&rcu_state.barrier_sequence);
> +	unsigned long s;
> =20
> +	/* Register any deferred callbacks before snapshotting the sequence. */
> +	rcu_defer_flush();
> +

[Severity: High]
Because rcu_defer_flush() is called before taking the rcu_state.barrier_mut=
ex,
can multiple threads execute it concurrently?

If multiple threads call rcu_defer_flush() concurrently, they will both
call irq_work_sync(&rdp->defer_work) on the same per-CPU irq_work:

kernel/rcu/tree.c:rcu_defer_flush() {
...
    if (cpu_online(cpu))
        irq_work_sync(&rdp->defer_work);
...
}

On architectures where arch_irq_work_has_interrupt() is false,
irq_work_sync() waits using rcuwait_wait_event(). Since rcuwait only
supports a single waiter, won't concurrent callers overwrite the internal
task pointer, causing one of the threads to miss the wakeup and hang
indefinitely?

> +	s =3D rcu_seq_snap(&rcu_state.barrier_sequence);
>  	rcu_barrier_trace(TPS("Begin"), -1, s);
> =20
>  	/* Take mutex to serialize concurrent rcu_barrier() requests. */
>  	mutex_lock(&rcu_state.barrier_mutex);

--=20
Sashiko AI review =C2=B7 https://sashiko.dev/#/patchset/20260803134839.2103=
[email protected]?part=3D1