Re: [PATCH v4 2/6] rcu: Make Tiny call_rcu() safe to call from any context

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Moving `debug_rcu_head_queue()` into `rcu_do_enqueue()` bypasses debugobjects tracking for deferred RCU callbacks, masking use-after-free bugs and causing list corruption on double frees.
--

--- Patch [2]: [PATCH v4 2/6] rcu: Make Tiny call_rcu() safe to call from any context ---
commit b9d1d9e1aa870c19c3d9b30019cdb1bc509b6703
Author: Puranjay Mohan <puranjay@kernel.org>

rcu: Make Tiny call_rcu() safe to call from any context

This commit updates Tiny call_rcu() to handle interrupts-disabled contexts
when the scheduler is active. It defers the callback on a lockless list
which is re-issued later via an irq_work, similar to Tree RCU.

> diff --git a/kernel/rcu/tiny.c b/kernel/rcu/tiny.c
> index dccccd6be9411..656b6a682e31a 100644
> --- a/kernel/rcu/tiny.c
> +++ b/kernel/rcu/tiny.c
[ ... ]
> @@ -157,29 +251,19 @@ EXPORT_SYMBOL_GPL(synchronize_rcu);
>   */
>  void call_rcu(struct rcu_head *head, rcu_callback_t func)
>  {
> -	static atomic_t doublefrees;
> -	unsigned long flags;
> -
> -	if (debug_rcu_head_queue(head)) {
> -		if (atomic_inc_return(&doublefrees) < 4) {
> -			pr_err("%s(): Double-freed CB %p->%pS()!!!  ", __func__, head, head->func);
> -			mem_dump_obj(head);
> -		}
> +	if (should_rcu_defer()) {
> +		call_rcu_defer(head, func);
>  		return;
>  	}

[Severity: High]
Does moving debug_rcu_head_queue() into rcu_do_enqueue() bypass debugobjects
tracking for deferred RCU callbacks?

Execution is routed to call_rcu_defer() before debug_rcu_head_queue() can
activate the object in the debugobjects tracker. Adding to the lockless list
in call_rcu_defer() overwrites head->next without verifying if the RCU head
is already enqueued.

If a caller erroneously frees the object or double-queues it during the
deferral window before the timer tick issues the irq_work drain, could this
mask use-after-free bugs or create cyclic structures on double frees?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260810122758.183765-1-puranjay@kernel.org?part=2