Re: RCU warning off ublk_buf_cleanup() -> mas_for_each()

[Bernd Schubert <bernd@bsbernd.com>]

On 4/21/26 19:47, Jens Axboe wrote:
> Hi Ming,
> 
> Ran into the below running tests on the current tree:
> 
> =============================
> WARNING: suspicious RCU usage
> 7.0.0+ #16 Tainted: G                 N 
> -----------------------------
> lib/maple_tree.c:759 suspicious rcu_dereference_check() usage!
> 
> other info that might help us debug this:
> 
> 
> rcu_scheduler_active = 2, debug_locks = 1
> 1 lock held by iou-wrk-55535/55536:
>  #0: ffff800085a451a0 (ublk_ctl_mutex){+.+.}-{4:4}, at: ublk_ctrl_del_dev+0xdc/0x2f8
> 
> stack backtrace:
> CPU: 4 UID: 0 PID: 55536 Comm: iou-wrk-55535 Tainted: G                 N  7.0.0+ #16 PREEMPT 
> Tainted: [N]=TEST
> Hardware name: linux,dummy-virt (DT)
> Call trace:
>  show_stack+0x1c/0x30 (C)
>  dump_stack_lvl+0x68/0x90
>  dump_stack+0x18/0x20
>  lockdep_rcu_suspicious+0x170/0x200
>  mas_walk+0x3f0/0x6a0
>  mas_find+0x1b4/0x6b0
>  ublk_buf_cleanup+0xe0/0x240
>  ublk_cdev_rel+0x34/0x1b0
>  device_release+0xa4/0x350
>  kobject_put+0x138/0x250
>  put_device+0x18/0x30
>  ublk_put_device+0x18/0x28
>  ublk_ctrl_del_dev+0x120/0x2f8
>  ublk_ctrl_uring_cmd+0x598/0x29b8
>  io_uring_cmd+0x1e0/0x468
>  __io_issue_sqe+0xa4/0x748
>  io_issue_sqe+0x80/0xf68
>  io_wq_submit_work+0x26c/0xdc8
>  io_worker_handle_work+0x334/0xf20
>  io_wq_worker+0x278/0x9e8
>  ret_from_fork+0x10/0x20
> Buffer I/O error on dev ublkb0, logical block 0, async page read
> Buffer I/O error on dev ublkb0, logical block 0, async page read
>  ublkb0: unable to read partition table
> Buffer I/O error on dev ublkb0, logical block 0, async page read
> Buffer I/O error on dev ublkb0, logical block 0, async page read
> Buffer I/O error on dev ublkb0, logical block 512, async page read
> Buffer I/O error on dev ublkb0, logical block 512, async page read
> Buffer I/O error on dev ublkb0, logical block 0, async page read
> Buffer I/O error on dev ublkb0, logical block 512, async page read
> 
> and I briefly looked at it, but then just gave up as a) the maple tree
> documentation is not that detailed, and b) other in-tree users also just
> call mas_for_each() without either a lock held or RCU read side locked.
> 
> Adding Liam for shedding some light on this...
> 

Hmm, that is another one, I run into

Date:   Thu Apr 16 15:16:04 2026 +0200

    ublk: Add rcu_read_lock/unlock in ublk_buf_cleanup
    
    [  399.994025] =============================
    [  399.994694] WARNING: suspicious RCU usage
    [  399.995464] 7.0.0+ #52 Not tainted
    [  399.996034] -----------------------------
    [  399.996697] lib/maple_tree.c:780 suspicious rcu_dereference_check() usage!
    [  399.997748]
                   other info that might help us debug this:
    
    [  399.998961]
                   rcu_scheduler_active = 2, debug_locks = 1
    [  399.999957] 1 lock held by iou-wrk-1495/1509:
    [  400.000596]  #0: ffffffffa05e4590 (ublk_ctl_mutex){+.+.}-{4:4}, at: ublk_ctrl_del_dev+0x3d/0x190 [ublk_drv]
    [  400.001796]
                   stack backtrace:
    [  400.002492] CPU: 40 UID: 0 PID: 1509 Comm: iou-wrk-1495 Not tainted 7.0.0+ #52 PREEMPT
    [  400.002496] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-debian-1.17.0-1ubuntu1 04/01/2014
    [  400.002498] Call Trace:
    [  400.002500]  <TASK>
    [  400.002503]  dump_stack_lvl+0x54/0x70
    [  400.002511]  lockdep_rcu_suspicious+0x119/0x160
    [  400.002521]  mas_start+0xed/0x140
    [  400.002531]  mas_find+0x1a6/0x270
    [  400.002538]  ublk_cdev_rel+0xb8/0x320 [ublk_drv]


And have in my pbuf branch

index eb9b5dd8122c..208f6b5ad892 100644
--- a/drivers/block/ublk_drv.c
+++ b/drivers/block/ublk_drv.c
@@ -5478,6 +5478,7 @@ static void ublk_buf_cleanup(struct ublk_device *ub)
        struct ublk_buf_range *range;
        struct page *pages[32];
 
+       rcu_read_lock();
        mas_for_each(&mas, range, ULONG_MAX) {
                unsigned long base = mas.index;
                unsigned long nr = mas.last - base + 1;
@@ -5495,6 +5496,7 @@ static void ublk_buf_cleanup(struct ublk_device *ub)
                }
                kfree(range);
        }
+       rcu_read_unlock();
        mtree_destroy(&ub->buf_tree);
        ida_destroy(&ub->buf_ida);
 }


Thanks,
Bernd