Re: RCU warning off ublk_buf_cleanup() -> mas_for_each()

Jens Axboe
2026-04-23T22:02:10Z

On 4/23/26 3:51 PM, Bernd Schubert wrote:
>
>
> On 4/23/26 23:48, Jens Axboe wrote:
>> On 4/23/26 3:45 PM, Bernd Schubert wrote:
>>>
>>>
>>> On 4/21/26 19:47, Jens Axboe wrote:
>>>> Hi Ming,
>>>>
>>>> Ran into the below running tests on the current tree:
>>>>
>>>> =============================
>>>> WARNING: suspicious RCU usage
>>>> 7.0.0+ #16 Tainted: G N
>>>> -----------------------------
>>>> lib/maple_tree.c:759 suspicious rcu_dereference_check() usage!
>>>>
>>>> other info that might help us debug this:
>>>>
>>>>
>>>> rcu_scheduler_active = 2, debug_locks = 1
>>>> 1 lock held by iou-wrk-55535/55536:
>>>> #0: ffff800085a451a0 (ublk_ctl_mutex){+.+.}-{4:4}, at: ublk_ctrl_del_dev+0xdc/0x2f8
>>>>
>>>> stack backtrace:
>>>> CPU: 4 UID: 0 PID: 55536 Comm: iou-wrk-55535 Tainted: G N 7.0.0+ #16 PREEMPT
>>>> Tainted: [N]=TEST
>>>> Hardware name: linux,dummy-virt (DT)
>>>> Call trace:
>>>> show_stack+0x1c/0x30 (C)
>>>> dump_stack_lvl+0x68/0x90
>>>> dump_stack+0x18/0x20
>>>> lockdep_rcu_suspicious+0x170/0x200
>>>> mas_walk+0x3f0/0x6a0
>>>> mas_find+0x1b4/0x6b0
>>>> ublk_buf_cleanup+0xe0/0x240
>>>> ublk_cdev_rel+0x34/0x1b0
>>>> device_release+0xa4/0x350
>>>> kobject_put+0x138/0x250
>>>> put_device+0x18/0x30
>>>> ublk_put_device+0x18/0x28
>>>> ublk_ctrl_del_dev+0x120/0x2f8
>>>> ublk_ctrl_uring_cmd+0x598/0x29b8
>>>> io_uring_cmd+0x1e0/0x468
>>>> __io_issue_sqe+0xa4/0x748
>>>> io_issue_sqe+0x80/0xf68
>>>> io_wq_submit_work+0x26c/0xdc8
>>>> io_worker_handle_work+0x334/0xf20
>>>> io_wq_worker+0x278/0x9e8
>>>> ret_from_fork+0x10/0x20
>>>> Buffer I/O error on dev ublkb0, logical block 0, async page read
>>>> Buffer I/O error on dev ublkb0, logical block 0, async page read
>>>> ublkb0: unable to read partition table
>>>> Buffer I/O error on dev ublkb0, logical block 0, async page read
>>>> Buffer I/O error on dev ublkb0, logical block 0, async page read
>>>> Buffer I/O error on dev ublkb0, logical block 512, async page read
>>>> Buffer I/O error on dev ublkb0, logical block 512, async page read
>>>> Buffer I/O error on dev ublkb0, logical block 0, async page read
>>>> Buffer I/O error on dev ublkb0, logical block 512, async page read
>>>>
>>>> and I briefly looked at it, but then just gave up as a) the maple tree
>>>> documentation is not that detailed, and b) other in-tree users also just
>>>> call mas_for_each() without either a lock held or RCU read side locked.
>>>>
>>>> Adding Liam for shedding some light on this...
>>>>
>>>
>>> Hmm, that is another one, I run into
>>>
>>> Date: Thu Apr 16 15:16:04 2026 +0200
>>>
>>> ublk: Add rcu_read_lock/unlock in ublk_buf_cleanup
>>>
>>> [ 399.994025] =============================
>>> [ 399.994694] WARNING: suspicious RCU usage
>>> [ 399.995464] 7.0.0+ #52 Not tainted
>>> [ 399.996034] -----------------------------
>>> [ 399.996697] lib/maple_tree.c:780 suspicious rcu_dereference_check() usage!
>>> [ 399.997748]
>>> other info that might help us debug this:
>>>
>>> [ 399.998961]
>>> rcu_scheduler_active = 2, debug_locks = 1
>>> [ 399.999957] 1 lock held by iou-wrk-1495/1509:
>>> [ 400.000596] #0: ffffffffa05e4590 (ublk_ctl_mutex){+.+.}-{4:4}, at: ublk_ctrl_del_dev+0x3d/0x190 [ublk_drv]
>>> [ 400.001796]
>>> stack backtrace:
>>> [ 400.002492] CPU: 40 UID: 0 PID: 1509 Comm: iou-wrk-1495 Not tainted 7.0.0+ #52 PREEMPT
>>> [ 400.002496] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-debian-1.17.0-1ubuntu1 04/01/2014
>>> [ 400.002498] Call Trace:
>>> [ 400.002500] <TASK>
>>> [ 400.002503] dump_stack_lvl+0x54/0x70
>>> [ 400.002511] lockdep_rcu_suspicious+0x119/0x160
>>> [ 400.002521] mas_start+0xed/0x140
>>> [ 400.002531] mas_find+0x1a6/0x270
>>> [ 400.002538] ublk_cdev_rel+0xb8/0x320 [ublk_drv]
>>>
>>>
>>> And have in my pbuf branch
>>>
>>> index eb9b5dd8122c..208f6b5ad892 100644
>>> --- a/drivers/block/ublk_drv.c
>>> +++ b/drivers/block/ublk_drv.c
>>> @@ -5478,6 +5478,7 @@ static void ublk_buf_cleanup(struct ublk_device *ub)
>>> struct ublk_buf_range *range;
>>> struct page *pages[32];
>>>
>>> + rcu_read_lock();
>>> mas_for_each(&mas, range, ULONG_MAX) {
>>> unsigned long base = mas.index;
>>> unsigned long nr = mas.last - base + 1;
>>> @@ -5495,6 +5496,7 @@ static void ublk_buf_cleanup(struct ublk_device *ub)
>>> }
>>> kfree(range);
>>> }
>>> + rcu_read_unlock();
>>> mtree_destroy(&ub->buf_tree);
>>> ida_destroy(&ub->buf_ida);
>>> }
>>
>> Fixed in patches going to Linus tomorrow, see HEAD~3..HEAD~1 in this
>> branch:
>>
>> https://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux.git/log/?h=block-7.1
>>
>
> Thank you, will check after getting some sleep.

Sounds good - fixes the issue on my end.

--
Jens Axboe