Re: [PATCH RFC v4 02/13] rcu-tasks: Add a Tasks RCU implementation for reader-marked trampolines

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] rcu-tasks: NULL pointer dereference in rcu_tasks_irq_resched_enter() during early boot
--

commit ea4914f1671c6b6ff32f3cbc1cd74fa6dd51744d
Author: Josef Bacik <josef@toxicpanda.com>

rcu-tasks: Add a Tasks RCU implementation for reader-marked trampolines

This commit introduces a Tasks RCU implementation for architectures that
make their trampolines Tasks Trace RCU readers. It hooks into the generic
irq entry code to track preemptions. The tracking utilizes a per-CPU list
for tasks preempted during irq exit.

> diff --git a/kernel/entry/common.c b/kernel/entry/common.c
> index e4acd50bd81a1..94318519998c8 100644
> --- a/kernel/entry/common.c
> +++ b/kernel/entry/common.c

[ ... ]

> @@ -141,8 +142,13 @@ void raw_irqentry_exit_cond_resched(struct pt_regs *regs)
>  		rcu_irq_exit_check_preempt();
>  		if (IS_ENABLED(CONFIG_DEBUG_ENTRY))
>  			WARN_ON_ONCE(!on_thread_stack());
> -		if (need_resched() && arch_irqentry_exit_need_resched())
> +		if (need_resched() && arch_irqentry_exit_need_resched()) {
> +			if (IS_ENABLED(CONFIG_TASKS_RCU_TRAMPOLINE_READERS))
> +				rcu_tasks_irq_resched_enter(instruction_pointer(regs));
>  			preempt_schedule_irq();
> +			if (IS_ENABLED(CONFIG_TASKS_RCU_TRAMPOLINE_READERS))
> +				rcu_tasks_irq_resched_exit();
> +		}
>  	}
>  }

> diff --git a/kernel/rcu/tasks.h b/kernel/rcu/tasks.h
> index 627295396cd91..f03be742be48c 100644
> --- a/kernel/rcu/tasks.h
> +++ b/kernel/rcu/tasks.h

[ ... ]

> +void rcu_tasks_irq_resched_enter(unsigned long ip)
> +{
> +	struct task_struct *t = current;
> +	struct rcu_tasks_percpu *rtpcp = this_cpu_ptr(rcu_tasks.rtpcpu);
> +
> +	lockdep_assert_irqs_disabled();
> +	WRITE_ONCE(t->rcu_tasks_irq_ip, ip);
> +	t->rcu_tasks_exit_cpu = smp_processor_id();
> +	raw_spin_lock_rcu_node(rtpcp);
> +	list_add(&t->rcu_tasks_exit_list, &rtpcp->rtp_exit_list);

[Severity: Critical]
Could this cause a null pointer dereference regression during early boot?

When the trampoline reader feature is selected,
raw_irqentry_exit_cond_resched() hooks into the generic irq exit path to
call rcu_tasks_irq_resched_enter(). During early boot, interrupts are
enabled via local_irq_enable() in start_kernel(), meaning preemptions can
begin occurring.

However, the per-cpu rtp_exit_list list head cannot be statically
initialized and is dynamically initialized via cblist_init_generic() from
a core_initcall. Since core_initcalls are executed much later by the
kernel_init thread, any preemption before that phase will attempt to
list_add() to a zero-initialized (null) rtp_exit_list.

Would this lead to a kernel panic when the list macros dereference the
uninitialized head pointer?

> +	raw_spin_unlock_rcu_node(rtpcp);
> +
> +	if (unlikely(rcu_tasks_trampoline_text(ip)))
> +		rcu_tasks_tramp_hold(t);
> +	else
> +		rcu_tasks_tramp_release(t);
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260918-b4-rcu-tasks-preempt-qs-v4-0-63f0e9d69661@toxicpanda.com?part=2