Re: [PATCH v4 2/6] rcu: Make Tiny call_rcu() safe to call from any context

On Mon, Aug 10, 2026 at 1:43 PM <[email protected]> wrote:
>
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [High] Moving `debug_rcu_head_queue()` into `rcu_do_enqueue()` bypasses debugobjects tracking for deferred RCU callbacks, masking use-after-free bugs and causing list corruption on double frees.
> --
>
> --- Patch [2]: [PATCH v4 2/6] rcu: Make Tiny call_rcu() safe to call from any context ---
> commit b9d1d9e1aa870c19c3d9b30019cdb1bc509b6703
> Author: Puranjay Mohan <[email protected]>
>
> rcu: Make Tiny call_rcu() safe to call from any context
>
> This commit updates Tiny call_rcu() to handle interrupts-disabled contexts
> when the scheduler is active. It defers the callback on a lockless list
> which is re-issued later via an irq_work, similar to Tree RCU.
>
> > diff --git a/kernel/rcu/tiny.c b/kernel/rcu/tiny.c
> > index dccccd6be9411..656b6a682e31a 100644
> > --- a/kernel/rcu/tiny.c
> > +++ b/kernel/rcu/tiny.c
> [ ... ]
> > @@ -157,29 +251,19 @@ EXPORT_SYMBOL_GPL(synchronize_rcu);
> >   */
> >  void call_rcu(struct rcu_head *head, rcu_callback_t func)
> >  {
> > -     static atomic_t doublefrees;
> > -     unsigned long flags;
> > -
> > -     if (debug_rcu_head_queue(head)) {
> > -             if (atomic_inc_return(&doublefrees) < 4) {
> > -                     pr_err("%s(): Double-freed CB %p->%pS()!!!  ", __func__, head, head->func);
> > -                     mem_dump_obj(head);
> > -             }
> > +     if (should_rcu_defer()) {
> > +             call_rcu_defer(head, func);
> >               return;
> >       }
>
> [Severity: High]
> Does moving debug_rcu_head_queue() into rcu_do_enqueue() bypass debugobjects
> tracking for deferred RCU callbacks?
>
> Execution is routed to call_rcu_defer() before debug_rcu_head_queue() can
> activate the object in the debugobjects tracker. Adding to the lockless list
> in call_rcu_defer() overwrites head->next without verifying if the RCU head
> is already enqueued.
>
> If a caller erroneously frees the object or double-queues it during the
> deferral window before the timer tick issues the irq_work drain, could this
> mask use-after-free bugs or create cyclic structures on double frees?

double calling call_rcu() is already a BUG and doing it from NMI is
one level more. debug_rcu_head_queue() can't be called from NMI, until
we have something that can work from NMI we have to go with the
current implementation.