Re: [PATCH] sched/psi: Remove the RCU wait from trigger destruction

[Tejun Heo <tj@kernel.org>]

On Sat, Oct 10, 2026 at 12:15:00PM -0700, Shakeel Butt wrote:
> In the Meta fleet, we found PSI trigger destruction waiting for an RCU
> grace period while holding kernfs node_mutex, blocking other users [1].
> File close and node drain hold this mutex while calling the release
> callback. Cgroup removal and disabling cgroup.pressure also hold
> cgroup_mutex during the drain.
> 
> The wait was added by commit 0e94682b73bf ("psi: introduce psi monitor")
> to protect worker and trigger lookups. Commit 461daba06bdc
> ("psi: eliminate kthread_worker from psi trigger scheduling mechanism")
> replaced the worker queue with a group timer. The scheduler now only
> checks whether rtpoll_task is NULL; it uses neither the task nor the
> trigger. Commit a06247c6804f ("psi: Fix uaf issue when psi trigger is
> destroyed while being polled") removed trigger replacement and polling's
> RCU lookup.
> 
> Trigger lists are protected by mutexes. Proc poll/select entries are
> removed before their file references are dropped. eventpoll_release()
> removes epoll entries before the file release callback.
> Commit aff037078eca ("sched/psi: use kernfs polling functions for PSI
> trigger polling") moved cgroup polling to a kernfs waitqueue whose
> lifetime follows the file.
> 
> A late timer firing only wakes the group waitqueue. The system group is
> static, and commit 5457025fa8ca ("sched/psi: Shut down rtpoll_timer in
> psi_cgroup_free()") shuts down the cgroup timer before freeing the group.
> Cgroup reclamation already waits for scheduler readers.
> 
> Remove synchronize_rcu() from psi_trigger_destroy() and use
> rcu_access_pointer() for the worker NULL check. Keep kthread_stop()
> outside the trigger mutex.
> 
> Tested trigger churn, notifications and cgroup removal in an 8-CPU VM
> with KASAN, lockdep, and full and lazy preemption. No warnings were found.
> 
> Link: https://github.com/bpftrace/user-tools/tree/master/runnablelockmonitor [1]
> Signed-off-by: Shakeel Butt <shakeel.butt@linux.dev>

Acked-by: Tejun Heo <tj@kernel.org>

Thanks.

-- 
tejun