[PATCH 0/5] rcu: Record callback enqueue stacks and add torture tests

[PATCH 0/5] rcu: Record callback enqueue stacks and add torture tests

[Kunwu Chan]

This series adds KASAN auxiliary stack recording for RCU Tasks
callbacks, rcutorture coverage for duplicate-callback detection,
and KASAN aux-stack verification tests across RCU and SRCU flavors.

This series is based on [1]. For testing, I also applied Joel
Fernandes' fix for debugobjects tracking of barrier callbacks
[2], which is needed for the barrier tests.

The changes:
- Record the enqueueing stack in call_rcu_tasks_generic().
- Enable duplicate-callback testing for the "tasks" and
  "tasks-tracing" torture types.
- Add a KASAN aux-stack verification test module with a Kconfig
  choice for each supported flavor.
- Add one rcutorture scenario per flavor for the verification
  test.

Tested on x86_64:

- TASKS01, TASKS02, TASKS03, TRACE01, and TRACE02 completed
  3-minute runs successfully.

- With CONFIG_DEBUG_OBJECTS_RCU_HEAD=y and
  rcutorture.object_debug=1, duplicate-callback detection was
  triggered as expected for both torture types.

- TRACE01 was run for 1 minute with
  CONFIG_DEBUG_OBJECTS_RCU_HEAD=y and
  rcutorture.object_debug=1. The test detected both duplicate
  callback heads through the SRCU enqueue path:
[    0.405836] rcutorture: WARN: Duplicate call_tasks-tracing() test starting.
[    0.405852] ODEBUG: activate active (active state 1) object: 0000000020df980d object type: rcu_head hint: 0x0
[    0.734724] rcu: __call_srcu(): Duplicate call_srcu() CB 0000000020df980d->rcu_torture_leak_cb+0x0/0x10()
[    0.734780] ODEBUG: activate active (active state 1) object: 000000006634e8c9 object type: rcu_head hint: 0x0
[    0.776688] rcu: __call_srcu(): Duplicate call_srcu() CB 000000006634e8c9->rcu_torture_leak_cb+0x0/0x10()
[    0.779126] rcutorture: WARN: Duplicate call_tasks-tracing() test complete.
[   65.411342] tasks-tracing-torture:--- End of test: SUCCESS: ...

Both duplicate callback heads (the stack-allocated rh2 and
the kmalloc-allocated rhp) were rejected and neither was invoked.

- With CONFIG_DEBUG_OBJECTS_RCU_HEAD=y,
  object_debug=1, and n_barrier_cbs=4, the TASKS01 barrier
  test completed 630/630 rounds without barrier errors.
  The only debugobjects warnings were the four intentional
  warnings from the duplicate-callback test at startup.

- All five aux-stack scenarios (TASKSKASAN01, TREEKASAN01,
  SRCUKASAN01, TINYKASAN01, and SRCUTINYKASAN01) produced the
  expected KASAN use-after-free reports. Each report's
  "Last potentially related work creation" entry showed the
  expected enqueue helper:

===== TASKSKASAN01 =====
[    1.244567] BUG: KASAN: slab-use-after-free in aux_test_init+0x8d/0xb0
[    1.244707] Last potentially related work creation:
[    1.244716]  aux_test_call_rcu_tasks.constprop.0+0xc/0x20

===== TREEKASAN01 =====
[    0.670399] BUG: KASAN: slab-use-after-free in aux_test_init+0x8d/0xb0
[    0.670561] Last potentially related work creation:
[    0.670571]  aux_test_call_rcu_tree.constprop.0+0xc/0x20

===== SRCUKASAN01 =====
[    0.658679] BUG: KASAN: slab-use-after-free in aux_test_init+0x94/0xc0
[    0.658919] Last potentially related work creation:
[    0.658932]  aux_test_call_srcu.constprop.0+0x16/0x30

===== TINYKASAN01 =====
[    0.951503] BUG: KASAN: slab-use-after-free in aux_test_init+0x8d/0xb0
[    0.951641] Last potentially related work creation:
[    0.951650]  aux_test_call_rcu_tiny.constprop.0+0xc/0x20

===== SRCUTINYKASAN01 =====
[    1.009005] BUG: KASAN: slab-use-after-free in aux_test_init+0x94/0xc0
[    1.009141] Last potentially related work creation:
[    1.009150]  aux_test_call_srcu.constprop.0+0x16/0x30


These reports are intentional and are counted as runtime
errors by rcutorture.

[1] https://lore.kernel.org/all/20261027070923.3054462-1-kunwu.chan@gmail.com/
[2] https://lore.kernel.org/all/20261104153046.965890-1-joelagnelf@nvidia.com/

Kunwu Chan (5):
  rcu-tasks: Record callback enqueue stack
  rcutorture: Test duplicate call_rcu_tasks() callback enqueue
  rcutorture: Test duplicate call_rcu_tasks_trace() callback enqueue
  rcu: Add KASAN aux-stack verification test
  rcutorture: Add KASAN aux-stack verification scenarios

 kernel/rcu/Kconfig.debug                      |  38 +++++++
 kernel/rcu/Makefile                           |   1 +
 kernel/rcu/rcu_kasan_aux_test.c               | 107 ++++++++++++++++++
 kernel/rcu/rcutorture.c                       |   2 +
 kernel/rcu/tasks.h                            |   4 +
 .../rcutorture/configs/rcu/SRCUKASAN01        |   6 +
 .../rcutorture/configs/rcu/SRCUKASAN01.boot   |   2 +
 .../rcutorture/configs/rcu/SRCUTINYKASAN01    |  12 ++
 .../configs/rcu/SRCUTINYKASAN01.boot          |   2 +
 .../rcutorture/configs/rcu/TASKSKASAN01       |  13 +++
 .../rcutorture/configs/rcu/TASKSKASAN01.boot  |   2 +
 .../rcutorture/configs/rcu/TINYKASAN01        |  12 ++
 .../rcutorture/configs/rcu/TINYKASAN01.boot   |   2 +
 .../rcutorture/configs/rcu/TREEKASAN01        |   6 +
 .../rcutorture/configs/rcu/TREEKASAN01.boot   |   2 +
 15 files changed, 211 insertions(+)
 create mode 100644 kernel/rcu/rcu_kasan_aux_test.c
 create mode 100644 tools/testing/selftests/rcutorture/configs/rcu/SRCUKASAN01
 create mode 100644 tools/testing/selftests/rcutorture/configs/rcu/SRCUKASAN01.boot
 create mode 100644 tools/testing/selftests/rcutorture/configs/rcu/SRCUTINYKASAN01
 create mode 100644 tools/testing/selftests/rcutorture/configs/rcu/SRCUTINYKASAN01.boot
 create mode 100644 tools/testing/selftests/rcutorture/configs/rcu/TASKSKASAN01
 create mode 100644 tools/testing/selftests/rcutorture/configs/rcu/TASKSKASAN01.boot
 create mode 100644 tools/testing/selftests/rcutorture/configs/rcu/TINYKASAN01
 create mode 100644 tools/testing/selftests/rcutorture/configs/rcu/TINYKASAN01.boot
 create mode 100644 tools/testing/selftests/rcutorture/configs/rcu/TREEKASAN01
 create mode 100644 tools/testing/selftests/rcutorture/configs/rcu/TREEKASAN01.boot

-- 
2.43.0

[PATCH 1/5] rcu-tasks: Record callback enqueue stack

[Kunwu Chan]

Tree RCU records the code path that enqueued a given callback via
kasan_record_aux_stack(), but Tasks RCU does not.  KASAN reports
involving Tasks RCU callbacks therefore lack any hint as to which
code path did the enqueueing.  This commit therefore invokes
kasan_record_aux_stack() in call_rcu_tasks_generic(), covering both
call_rcu_tasks() and call_rcu_tasks_rude().

Suggested-by: Zqiang <qiang.zhang@linux.dev>
Cc: Kunwu Chan <kunwu.chan@gmail.com>
Signed-off-by: Kunwu Chan <chentao@kylinos.cn>
---
 kernel/rcu/tasks.h | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/kernel/rcu/tasks.h b/kernel/rcu/tasks.h
index a20db323612b..fd43cd5d5a48 100644
--- a/kernel/rcu/tasks.h
+++ b/kernel/rcu/tasks.h
@@ -6,6 +6,7 @@
  */
 
 #ifdef CONFIG_TASKS_RCU_GENERIC
+#include <linux/kasan.h>
 #include <linux/mm.h>
 #include <linux/ratelimit.h>
 #include "rcu_segcblist.h"
@@ -366,6 +367,9 @@ static void call_rcu_tasks_generic(struct rcu_head *rhp, rcu_callback_t func,
 	if (WARN_ON_ONCE(!func))
 		return;
 
+	/* Record the caller: the irq_work's stack says nothing about it. */
+	kasan_record_aux_stack(rhp);
+
 	if (debug_rcu_head_queue(rhp)) {
 		if (__ratelimit(&rcu_tasks_dup_rs)) {
 			pr_err("%s(): Duplicate CB for %s, %p->%pS()\n",
-- 
2.43.0

[PATCH 2/5] rcutorture: Test duplicate call_rcu_tasks() callback enqueue

[Kunwu Chan]

The rcu_test_debug_objects() function double-enqueues an rcu_head
to test debug-objects duplicate-callback detection, but only for
torture types whose ->debug_objects field is set.  This commit
therefore sets ->debug_objects for the "tasks" torture type so
that call_rcu_tasks()'s duplicate-callback detection is tested.

Suggested-by: Zqiang <qiang.zhang@linux.dev>
Cc: Kunwu Chan <kunwu.chan@gmail.com>
Signed-off-by: Kunwu Chan <chentao@kylinos.cn>
---
 kernel/rcu/rcutorture.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/kernel/rcu/rcutorture.c b/kernel/rcu/rcutorture.c
index 968343be4e0d..a056a79aa3d2 100644
--- a/kernel/rcu/rcutorture.c
+++ b/kernel/rcu/rcutorture.c
@@ -1221,6 +1221,7 @@ static struct rcu_torture_ops tasks_ops = {
 	.get_gp_data	= rcu_tasks_get_gp_data,
 	.irq_capable	= 1,
 	.slow_gps	= 1,
+	.debug_objects	= 1,
 	.name		= "tasks"
 };
 
-- 
2.43.0

[PATCH 3/5] rcutorture: Test duplicate call_rcu_tasks_trace() callback enqueue

[Kunwu Chan]

The rcu_test_debug_objects() function tests duplicate-callback
detection, but only for torture types whose ->debug_objects field
is set.  This commit therefore sets ->debug_objects for the
"tasks-tracing" torture type so that duplicate call_rcu_tasks_trace()
invocations are detected.  The detection itself is provided by
__call_srcu() because call_rcu_tasks_trace() is implemented
in terms of call_srcu().

Suggested-by: Zqiang <qiang.zhang@linux.dev>
Cc: Kunwu Chan <kunwu.chan@gmail.com>
Signed-off-by: Kunwu Chan <chentao@kylinos.cn>
---
 kernel/rcu/rcutorture.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/kernel/rcu/rcutorture.c b/kernel/rcu/rcutorture.c
index a056a79aa3d2..5ee9e70a6199 100644
--- a/kernel/rcu/rcutorture.c
+++ b/kernel/rcu/rcutorture.c
@@ -1315,6 +1315,7 @@ static struct rcu_torture_ops tasks_tracing_ops = {
 	.irq_capable	= 1,
 	.slow_gps	= 1,
 	.nmi_capable	= 1,
+	.debug_objects	= 1,
 	.name		= "tasks-tracing"
 };
 
-- 
2.43.0

[PATCH 4/5] rcu: Add KASAN aux-stack verification test

[Kunwu Chan]

Add a test module that verifies kasan_record_aux_stack()
recording for RCU callbacks.  The flavor to test is selected at
build time by a Kconfig choice.  The test enqueues a callback from
a noinline helper, drains it while the rcu_head is still allocated,
then frees the rcu_head and triggers a use-after-free report.  The
report should list the enqueue helper under "Last potentially
related work creation:".

Draining before the free keeps the callback from ever running on
freed memory, and the post-call statement in the helper prevents
GCC from tail-calling the enqueue API, which would drop the
helper's frame from the recorded stack.

Suggested-by: Zqiang <qiang.zhang@linux.dev>
Cc: Kunwu Chan <kunwu.chan@gmail.com>
Signed-off-by: Kunwu Chan <chentao@kylinos.cn>
---
 kernel/rcu/Kconfig.debug        |  38 ++++++++++++
 kernel/rcu/Makefile             |   1 +
 kernel/rcu/rcu_kasan_aux_test.c | 107 ++++++++++++++++++++++++++++++++
 3 files changed, 146 insertions(+)
 create mode 100644 kernel/rcu/rcu_kasan_aux_test.c

diff --git a/kernel/rcu/Kconfig.debug b/kernel/rcu/Kconfig.debug
index 7c3c6017b266..5c6c07d36157 100644
--- a/kernel/rcu/Kconfig.debug
+++ b/kernel/rcu/Kconfig.debug
@@ -53,6 +53,44 @@ config RCU_TORTURE_TEST
 	  Say M if you want the RCU torture tests to build as a module.
 	  Say N if you are unsure.
 
+config RCU_KASAN_AUX_TEST
+	tristate "KASAN aux-stack verification test for RCU callbacks"
+	depends on DEBUG_KERNEL && KASAN_GENERIC
+	help
+	  This option builds a test that verifies that the selected
+	  RCU flavor's callback-enqueueing path records the
+	  enqueueing call path via kasan_record_aux_stack().
+	  The test intentionally triggers a single KASAN
+	  use-after-free report at init time.  The report should
+	  list the enqueue helper under "Last potentially related
+	  work creation:".  Check the kernel log for the report.
+	  Select the RCU flavor to test below.
+
+choice
+	prompt "RCU flavor"
+	depends on RCU_KASAN_AUX_TEST
+
+config RCU_KASAN_AUX_TEST_FLAVOR_TREE
+	bool "Tree RCU (call_rcu)"
+	depends on TREE_RCU
+
+config RCU_KASAN_AUX_TEST_FLAVOR_TINY
+	bool "Tiny RCU (call_rcu)"
+	depends on TINY_RCU
+
+config RCU_KASAN_AUX_TEST_FLAVOR_SRCU_TREE
+	bool "Tree SRCU (call_srcu)"
+	depends on TREE_SRCU
+
+config RCU_KASAN_AUX_TEST_FLAVOR_SRCU_TINY
+	bool "Tiny SRCU (call_srcu)"
+	depends on TINY_SRCU
+
+config RCU_KASAN_AUX_TEST_FLAVOR_TASKS
+	bool "RCU Tasks (call_rcu_tasks)"
+	depends on TASKS_RCU
+endchoice
+
 config RCU_TORTURE_TEST_CHK_RDR_STATE
 	bool "Check rcutorture reader state"
 	depends on RCU_TORTURE_TEST
diff --git a/kernel/rcu/Makefile b/kernel/rcu/Makefile
index 478ef2237fee..bca05ac9c4cc 100644
--- a/kernel/rcu/Makefile
+++ b/kernel/rcu/Makefile
@@ -12,6 +12,7 @@ obj-$(CONFIG_TREE_SRCU) += srcutree.o
 obj-$(CONFIG_TINY_SRCU) += srcutiny.o
 obj-$(CONFIG_HAZPTR_TORTURE_TEST) += hazptrtorture.o
 obj-$(CONFIG_RCU_TORTURE_TEST) += rcutorture.o
+obj-$(CONFIG_RCU_KASAN_AUX_TEST) += rcu_kasan_aux_test.o
 obj-$(CONFIG_RCU_SCALE_TEST) += rcuscale.o
 obj-$(CONFIG_RCU_REF_SCALE_TEST) += refscale.o
 obj-$(CONFIG_TREE_RCU) += tree.o
diff --git a/kernel/rcu/rcu_kasan_aux_test.c b/kernel/rcu/rcu_kasan_aux_test.c
new file mode 100644
index 000000000000..df3169ac39b0
--- /dev/null
+++ b/kernel/rcu/rcu_kasan_aux_test.c
@@ -0,0 +1,107 @@
+// SPDX-License-Identifier: GPL-2.0+
+/*
+ * KASAN auxiliary-stack verification test for RCU callbacks.
+ *
+ * Copyright (C) 2026 Kunwu Chan <kunwu.chan@gmail.com>
+ *
+ * For each supported RCU flavor, this module enqueues a callback
+ * from a noinline helper, drains it while the rcu_head is still
+ * allocated, then frees the rcu_head and immediately reads the
+ * freed memory.  The resulting KASAN use-after-free report should
+ * list the enqueue helper under "Last potentially related work
+ * creation:", which verifies that the flavor's enqueue path called
+ * kasan_record_aux_stack().  Check the kernel log for the report.
+ */
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include <linux/module.h>
+#include <linux/rcupdate.h>
+#include <linux/slab.h>
+#include <linux/srcu.h>
+
+static void aux_test_cb(struct rcu_head *rhp)
+{
+	/* Empty: runs while the rcu_head is still live. */
+}
+
+#ifdef CONFIG_RCU_KASAN_AUX_TEST_FLAVOR_TREE
+static noinline void aux_test_call_rcu_tree(struct rcu_head *rhp,
+					    rcu_callback_t func)
+{
+	call_rcu(rhp, func);
+
+	/*
+	 * Prevent tail-call optimization so that this function remains
+	 * in the stack recorded by kasan_record_aux_stack().
+	 */
+	pr_info("Tree RCU: callback enqueued\n");
+}
+#endif
+
+#ifdef CONFIG_RCU_KASAN_AUX_TEST_FLAVOR_TINY
+static noinline void aux_test_call_rcu_tiny(struct rcu_head *rhp,
+					    rcu_callback_t func)
+{
+	call_rcu(rhp, func);
+	pr_info("Tiny RCU: callback enqueued\n");
+}
+#endif
+
+#if defined(CONFIG_RCU_KASAN_AUX_TEST_FLAVOR_SRCU_TREE) || \
+	defined(CONFIG_RCU_KASAN_AUX_TEST_FLAVOR_SRCU_TINY)
+DEFINE_STATIC_SRCU(test_srcu);
+static noinline void aux_test_call_srcu(struct rcu_head *rhp,
+					rcu_callback_t func)
+{
+	call_srcu(&test_srcu, rhp, func);
+	pr_info("SRCU: callback enqueued\n");
+}
+#endif
+
+#ifdef CONFIG_RCU_KASAN_AUX_TEST_FLAVOR_TASKS
+static noinline void aux_test_call_rcu_tasks(struct rcu_head *rhp,
+					     rcu_callback_t func)
+{
+	call_rcu_tasks(rhp, func);
+	pr_info("RCU Tasks: callback enqueued\n");
+}
+#endif
+
+static int __init aux_test_init(void)
+{
+	struct rcu_head *rhp = kmalloc(sizeof(*rhp), GFP_KERNEL);
+
+	if (!rhp)
+		return -ENOMEM;
+
+#if defined(CONFIG_RCU_KASAN_AUX_TEST_FLAVOR_TREE)
+	aux_test_call_rcu_tree(rhp, aux_test_cb);
+	rcu_barrier();
+#elif defined(CONFIG_RCU_KASAN_AUX_TEST_FLAVOR_TINY)
+	aux_test_call_rcu_tiny(rhp, aux_test_cb);
+	rcu_barrier();
+#elif defined(CONFIG_RCU_KASAN_AUX_TEST_FLAVOR_SRCU_TREE) || \
+	defined(CONFIG_RCU_KASAN_AUX_TEST_FLAVOR_SRCU_TINY)
+	aux_test_call_srcu(rhp, aux_test_cb);
+	srcu_barrier(&test_srcu);
+#elif defined(CONFIG_RCU_KASAN_AUX_TEST_FLAVOR_TASKS)
+	aux_test_call_rcu_tasks(rhp, aux_test_cb);
+	rcu_barrier_tasks();
+#else
+#error "No RCU flavor selected for KASAN aux-stack test"
+#endif
+
+	kfree(rhp);
+
+	/* Immediate read of the freed memory to trigger the report. */
+	(void)READ_ONCE(*(u8 *)rhp);
+
+	pr_info("done, see kernel log for the KASAN report\n");
+	return 0;
+}
+
+module_init(aux_test_init);
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Kunwu Chan <kunwu.chan@gmail.com>");
+MODULE_DESCRIPTION("KASAN aux-stack verification for RCU callbacks");
-- 
2.43.0

[PATCH 5/5] rcutorture: Add KASAN aux-stack verification scenarios

[Kunwu Chan]

Add one rcutorture scenario per RCU flavor for the aux-stack
verification test: TASKSKASAN01, TREEKASAN01, TINYKASAN01,
SRCUKASAN01, and SRCUTINYKASAN01.  Each sets CONFIG_KASAN=y,
CONFIG_RCU_KASAN_AUX_TEST=y, the appropriate flavor choice, and
the kernel config needed for that RCU implementation.

Suggested-by: Zqiang <qiang.zhang@linux.dev>
Cc: Kunwu Chan <kunwu.chan@gmail.com>
Signed-off-by: Kunwu Chan <chentao@kylinos.cn>
---
 .../selftests/rcutorture/configs/rcu/SRCUKASAN01    |  6 ++++++
 .../rcutorture/configs/rcu/SRCUKASAN01.boot         |  2 ++
 .../rcutorture/configs/rcu/SRCUTINYKASAN01          | 12 ++++++++++++
 .../rcutorture/configs/rcu/SRCUTINYKASAN01.boot     |  2 ++
 .../selftests/rcutorture/configs/rcu/TASKSKASAN01   | 13 +++++++++++++
 .../rcutorture/configs/rcu/TASKSKASAN01.boot        |  2 ++
 .../selftests/rcutorture/configs/rcu/TINYKASAN01    | 12 ++++++++++++
 .../rcutorture/configs/rcu/TINYKASAN01.boot         |  2 ++
 .../selftests/rcutorture/configs/rcu/TREEKASAN01    |  6 ++++++
 .../rcutorture/configs/rcu/TREEKASAN01.boot         |  2 ++
 10 files changed, 59 insertions(+)
 create mode 100644 tools/testing/selftests/rcutorture/configs/rcu/SRCUKASAN01
 create mode 100644 tools/testing/selftests/rcutorture/configs/rcu/SRCUKASAN01.boot
 create mode 100644 tools/testing/selftests/rcutorture/configs/rcu/SRCUTINYKASAN01
 create mode 100644 tools/testing/selftests/rcutorture/configs/rcu/SRCUTINYKASAN01.boot
 create mode 100644 tools/testing/selftests/rcutorture/configs/rcu/TASKSKASAN01
 create mode 100644 tools/testing/selftests/rcutorture/configs/rcu/TASKSKASAN01.boot
 create mode 100644 tools/testing/selftests/rcutorture/configs/rcu/TINYKASAN01
 create mode 100644 tools/testing/selftests/rcutorture/configs/rcu/TINYKASAN01.boot
 create mode 100644 tools/testing/selftests/rcutorture/configs/rcu/TREEKASAN01
 create mode 100644 tools/testing/selftests/rcutorture/configs/rcu/TREEKASAN01.boot

diff --git a/tools/testing/selftests/rcutorture/configs/rcu/SRCUKASAN01 b/tools/testing/selftests/rcutorture/configs/rcu/SRCUKASAN01
new file mode 100644
index 000000000000..c115af0446ee
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/rcu/SRCUKASAN01
@@ -0,0 +1,6 @@
+CONFIG_KASAN=y
+CONFIG_KASAN_GENERIC=y
+CONFIG_KASAN_INLINE=y
+CONFIG_RCU_EXPERT=y
+CONFIG_RCU_KASAN_AUX_TEST=y
+CONFIG_RCU_KASAN_AUX_TEST_FLAVOR_SRCU_TREE=y
diff --git a/tools/testing/selftests/rcutorture/configs/rcu/SRCUKASAN01.boot b/tools/testing/selftests/rcutorture/configs/rcu/SRCUKASAN01.boot
new file mode 100644
index 000000000000..69ed391bd61c
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/rcu/SRCUKASAN01.boot
@@ -0,0 +1,2 @@
+rcutorture.torture_type=srcu
+rcutorture.stat_interval=60
diff --git a/tools/testing/selftests/rcutorture/configs/rcu/SRCUTINYKASAN01 b/tools/testing/selftests/rcutorture/configs/rcu/SRCUTINYKASAN01
new file mode 100644
index 000000000000..e42387061bb9
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/rcu/SRCUTINYKASAN01
@@ -0,0 +1,12 @@
+CONFIG_SMP=n
+CONFIG_PREEMPT_LAZY=y
+CONFIG_PREEMPT_NONE=n
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=n
+CONFIG_PREEMPT_DYNAMIC=n
+CONFIG_RCU_EXPERT=y
+CONFIG_KASAN=y
+CONFIG_KASAN_GENERIC=y
+CONFIG_KASAN_INLINE=y
+CONFIG_RCU_KASAN_AUX_TEST=y
+CONFIG_RCU_KASAN_AUX_TEST_FLAVOR_SRCU_TINY=y
diff --git a/tools/testing/selftests/rcutorture/configs/rcu/SRCUTINYKASAN01.boot b/tools/testing/selftests/rcutorture/configs/rcu/SRCUTINYKASAN01.boot
new file mode 100644
index 000000000000..69ed391bd61c
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/rcu/SRCUTINYKASAN01.boot
@@ -0,0 +1,2 @@
+rcutorture.torture_type=srcu
+rcutorture.stat_interval=60
diff --git a/tools/testing/selftests/rcutorture/configs/rcu/TASKSKASAN01 b/tools/testing/selftests/rcutorture/configs/rcu/TASKSKASAN01
new file mode 100644
index 000000000000..e4c1d9740498
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/rcu/TASKSKASAN01
@@ -0,0 +1,13 @@
+CONFIG_SMP=n
+CONFIG_PREEMPT_LAZY=y
+CONFIG_PREEMPT_NONE=n
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=n
+CONFIG_PREEMPT_DYNAMIC=n
+CONFIG_FORCE_TASKS_RCU=y
+CONFIG_RCU_EXPERT=y
+CONFIG_KASAN=y
+CONFIG_KASAN_GENERIC=y
+CONFIG_KASAN_INLINE=y
+CONFIG_RCU_KASAN_AUX_TEST=y
+CONFIG_RCU_KASAN_AUX_TEST_FLAVOR_TASKS=y
diff --git a/tools/testing/selftests/rcutorture/configs/rcu/TASKSKASAN01.boot b/tools/testing/selftests/rcutorture/configs/rcu/TASKSKASAN01.boot
new file mode 100644
index 000000000000..b9b6d67cbc5f
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/rcu/TASKSKASAN01.boot
@@ -0,0 +1,2 @@
+rcutorture.torture_type=tasks
+rcutorture.stat_interval=60
diff --git a/tools/testing/selftests/rcutorture/configs/rcu/TINYKASAN01 b/tools/testing/selftests/rcutorture/configs/rcu/TINYKASAN01
new file mode 100644
index 000000000000..219e599fa8f3
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/rcu/TINYKASAN01
@@ -0,0 +1,12 @@
+CONFIG_SMP=n
+CONFIG_PREEMPT_LAZY=y
+CONFIG_PREEMPT_NONE=n
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=n
+CONFIG_PREEMPT_DYNAMIC=n
+CONFIG_RCU_EXPERT=y
+CONFIG_KASAN=y
+CONFIG_KASAN_GENERIC=y
+CONFIG_KASAN_INLINE=y
+CONFIG_RCU_KASAN_AUX_TEST=y
+CONFIG_RCU_KASAN_AUX_TEST_FLAVOR_TINY=y
diff --git a/tools/testing/selftests/rcutorture/configs/rcu/TINYKASAN01.boot b/tools/testing/selftests/rcutorture/configs/rcu/TINYKASAN01.boot
new file mode 100644
index 000000000000..d5dafe68a5da
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/rcu/TINYKASAN01.boot
@@ -0,0 +1,2 @@
+rcutorture.torture_type=rcu
+rcutorture.stat_interval=60
diff --git a/tools/testing/selftests/rcutorture/configs/rcu/TREEKASAN01 b/tools/testing/selftests/rcutorture/configs/rcu/TREEKASAN01
new file mode 100644
index 000000000000..578711fb2d43
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/rcu/TREEKASAN01
@@ -0,0 +1,6 @@
+CONFIG_KASAN=y
+CONFIG_KASAN_GENERIC=y
+CONFIG_KASAN_INLINE=y
+CONFIG_RCU_EXPERT=y
+CONFIG_RCU_KASAN_AUX_TEST=y
+CONFIG_RCU_KASAN_AUX_TEST_FLAVOR_TREE=y
diff --git a/tools/testing/selftests/rcutorture/configs/rcu/TREEKASAN01.boot b/tools/testing/selftests/rcutorture/configs/rcu/TREEKASAN01.boot
new file mode 100644
index 000000000000..d5dafe68a5da
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/rcu/TREEKASAN01.boot
@@ -0,0 +1,2 @@
+rcutorture.torture_type=rcu
+rcutorture.stat_interval=60
-- 
2.43.0

Re: [PATCH 0/5] rcu: Record callback enqueue stacks and add torture tests

[Joel Fernandes]

On 11/6/2026 9:39 AM, Kunwu Chan wrote:
> This series adds KASAN auxiliary stack recording for RCU Tasks
> callbacks, rcutorture coverage for duplicate-callback detection,
> and KASAN aux-stack verification tests across RCU and SRCU flavors.
> 
> This series is based on [1]. For testing, I also applied Joel
> Fernandes' fix for debugobjects tracking of barrier callbacks
> [2], which is needed for the barrier tests.
> 
> The changes:
> - Record the enqueueing stack in call_rcu_tasks_generic().
> - Enable duplicate-callback testing for the "tasks" and
>   "tasks-tracing" torture types.
> - Add a KASAN aux-stack verification test module with a Kconfig
>   choice for each supported flavor.
> - Add one rcutorture scenario per flavor for the verification
>   test.
> 
> Tested on x86_64:
> 
> - TASKS01, TASKS02, TASKS03, TRACE01, and TRACE02 completed
>   3-minute runs successfully.
> 
> - With CONFIG_DEBUG_OBJECTS_RCU_HEAD=y and
>   rcutorture.object_debug=1, duplicate-callback detection was
>   triggered as expected for both torture types.
> 
> - TRACE01 was run for 1 minute with
>   CONFIG_DEBUG_OBJECTS_RCU_HEAD=y and
>   rcutorture.object_debug=1. The test detected both duplicate
>   callback heads through the SRCU enqueue path:
> [    0.405836] rcutorture: WARN: Duplicate call_tasks-tracing() test starting.
> [    0.405852] ODEBUG: activate active (active state 1) object: 0000000020df980d object type: rcu_head hint: 0x0
> [    0.734724] rcu: __call_srcu(): Duplicate call_srcu() CB 0000000020df980d->rcu_torture_leak_cb+0x0/0x10()
> [    0.734780] ODEBUG: activate active (active state 1) object: 000000006634e8c9 object type: rcu_head hint: 0x0
> [    0.776688] rcu: __call_srcu(): Duplicate call_srcu() CB 000000006634e8c9->rcu_torture_leak_cb+0x0/0x10()
> [    0.779126] rcutorture: WARN: Duplicate call_tasks-tracing() test complete.
> [   65.411342] tasks-tracing-torture:--- End of test: SUCCESS: ...
> 
> Both duplicate callback heads (the stack-allocated rh2 and
> the kmalloc-allocated rhp) were rejected and neither was invoked.
> 
> - With CONFIG_DEBUG_OBJECTS_RCU_HEAD=y,
>   object_debug=1, and n_barrier_cbs=4, the TASKS01 barrier
>   test completed 630/630 rounds without barrier errors.
>   The only debugobjects warnings were the four intentional
>   warnings from the duplicate-callback test at startup.
> 
> - All five aux-stack scenarios (TASKSKASAN01, TREEKASAN01,
>   SRCUKASAN01, TINYKASAN01, and SRCUTINYKASAN01) produced the
>   expected KASAN use-after-free reports. Each report's
>   "Last potentially related work creation" entry showed the
>   expected enqueue helper:
> 
> ===== TASKSKASAN01 =====
> [    1.244567] BUG: KASAN: slab-use-after-free in aux_test_init+0x8d/0xb0
> [    1.244707] Last potentially related work creation:
> [    1.244716]  aux_test_call_rcu_tasks.constprop.0+0xc/0x20
> 
> ===== TREEKASAN01 =====
> [    0.670399] BUG: KASAN: slab-use-after-free in aux_test_init+0x8d/0xb0
> [    0.670561] Last potentially related work creation:
> [    0.670571]  aux_test_call_rcu_tree.constprop.0+0xc/0x20
> 
> ===== SRCUKASAN01 =====
> [    0.658679] BUG: KASAN: slab-use-after-free in aux_test_init+0x94/0xc0
> [    0.658919] Last potentially related work creation:
> [    0.658932]  aux_test_call_srcu.constprop.0+0x16/0x30
> 
> ===== TINYKASAN01 =====
> [    0.951503] BUG: KASAN: slab-use-after-free in aux_test_init+0x8d/0xb0
> [    0.951641] Last potentially related work creation:
> [    0.951650]  aux_test_call_rcu_tiny.constprop.0+0xc/0x20
> 
> ===== SRCUTINYKASAN01 =====
> [    1.009005] BUG: KASAN: slab-use-after-free in aux_test_init+0x94/0xc0
> [    1.009141] Last potentially related work creation:
> [    1.009150]  aux_test_call_srcu.constprop.0+0x16/0x30
> 
> 

I'm not feeling very excited about adding more configs just for KASAN. That
sounds like a maintenance burden. I believe Paul already has KASAN testing in
his scripts. Is it possible to activate this testing only when those are enabled?

Thanks.

Re: [PATCH 0/5] rcu: Record callback enqueue stacks and add torture tests

[Paul E. McKenney]

On Fri, Nov 06, 2026 at 01:49:04PM -0500, Joel Fernandes wrote:
> 
> 
> On 11/6/2026 9:39 AM, Kunwu Chan wrote:
> > This series adds KASAN auxiliary stack recording for RCU Tasks
> > callbacks, rcutorture coverage for duplicate-callback detection,
> > and KASAN aux-stack verification tests across RCU and SRCU flavors.
> > 
> > This series is based on [1]. For testing, I also applied Joel
> > Fernandes' fix for debugobjects tracking of barrier callbacks
> > [2], which is needed for the barrier tests.
> > 
> > The changes:
> > - Record the enqueueing stack in call_rcu_tasks_generic().
> > - Enable duplicate-callback testing for the "tasks" and
> >   "tasks-tracing" torture types.
> > - Add a KASAN aux-stack verification test module with a Kconfig
> >   choice for each supported flavor.
> > - Add one rcutorture scenario per flavor for the verification
> >   test.
> > 
> > Tested on x86_64:
> > 
> > - TASKS01, TASKS02, TASKS03, TRACE01, and TRACE02 completed
> >   3-minute runs successfully.
> > 
> > - With CONFIG_DEBUG_OBJECTS_RCU_HEAD=y and
> >   rcutorture.object_debug=1, duplicate-callback detection was
> >   triggered as expected for both torture types.
> > 
> > - TRACE01 was run for 1 minute with
> >   CONFIG_DEBUG_OBJECTS_RCU_HEAD=y and
> >   rcutorture.object_debug=1. The test detected both duplicate
> >   callback heads through the SRCU enqueue path:
> > [    0.405836] rcutorture: WARN: Duplicate call_tasks-tracing() test starting.
> > [    0.405852] ODEBUG: activate active (active state 1) object: 0000000020df980d object type: rcu_head hint: 0x0
> > [    0.734724] rcu: __call_srcu(): Duplicate call_srcu() CB 0000000020df980d->rcu_torture_leak_cb+0x0/0x10()
> > [    0.734780] ODEBUG: activate active (active state 1) object: 000000006634e8c9 object type: rcu_head hint: 0x0
> > [    0.776688] rcu: __call_srcu(): Duplicate call_srcu() CB 000000006634e8c9->rcu_torture_leak_cb+0x0/0x10()
> > [    0.779126] rcutorture: WARN: Duplicate call_tasks-tracing() test complete.
> > [   65.411342] tasks-tracing-torture:--- End of test: SUCCESS: ...
> > 
> > Both duplicate callback heads (the stack-allocated rh2 and
> > the kmalloc-allocated rhp) were rejected and neither was invoked.
> > 
> > - With CONFIG_DEBUG_OBJECTS_RCU_HEAD=y,
> >   object_debug=1, and n_barrier_cbs=4, the TASKS01 barrier
> >   test completed 630/630 rounds without barrier errors.
> >   The only debugobjects warnings were the four intentional
> >   warnings from the duplicate-callback test at startup.
> > 
> > - All five aux-stack scenarios (TASKSKASAN01, TREEKASAN01,
> >   SRCUKASAN01, TINYKASAN01, and SRCUTINYKASAN01) produced the
> >   expected KASAN use-after-free reports. Each report's
> >   "Last potentially related work creation" entry showed the
> >   expected enqueue helper:
> > 
> > ===== TASKSKASAN01 =====
> > [    1.244567] BUG: KASAN: slab-use-after-free in aux_test_init+0x8d/0xb0
> > [    1.244707] Last potentially related work creation:
> > [    1.244716]  aux_test_call_rcu_tasks.constprop.0+0xc/0x20
> > 
> > ===== TREEKASAN01 =====
> > [    0.670399] BUG: KASAN: slab-use-after-free in aux_test_init+0x8d/0xb0
> > [    0.670561] Last potentially related work creation:
> > [    0.670571]  aux_test_call_rcu_tree.constprop.0+0xc/0x20
> > 
> > ===== SRCUKASAN01 =====
> > [    0.658679] BUG: KASAN: slab-use-after-free in aux_test_init+0x94/0xc0
> > [    0.658919] Last potentially related work creation:
> > [    0.658932]  aux_test_call_srcu.constprop.0+0x16/0x30
> > 
> > ===== TINYKASAN01 =====
> > [    0.951503] BUG: KASAN: slab-use-after-free in aux_test_init+0x8d/0xb0
> > [    0.951641] Last potentially related work creation:
> > [    0.951650]  aux_test_call_rcu_tiny.constprop.0+0xc/0x20
> > 
> > ===== SRCUTINYKASAN01 =====
> > [    1.009005] BUG: KASAN: slab-use-after-free in aux_test_init+0x94/0xc0
> > [    1.009141] Last potentially related work creation:
> > [    1.009150]  aux_test_call_srcu.constprop.0+0x16/0x30
> 
> I'm not feeling very excited about adding more configs just for KASAN. That
> sounds like a maintenance burden. I believe Paul already has KASAN testing in
> his scripts. Is it possible to activate this testing only when those are enabled?

The usual way that I do KASAN testing is with the --kasan argument
to kvm.sh.  I use --kconfig and --bootargs to specify further testing,
usually as another option in torture.sh.  This causes the testing to
be carried out as a matter of course.

One good thing is that the Kconfig choice in patch 4/5 is automated so
that RCU_KASAN_AUX_TEST causes the right testing to happen depending on
what is configured.

Is it possible to drive this from --kasan and the rcutorture.object_debug
kernel boot parameter or something similar?  Or is there a better way
to make the overall testing happen?

							Thanx, Paul

Re: [PATCH 0/5] rcu: Record callback enqueue stacks and add torture tests

[Zqiang]

> 
> On Fri, Nov 06, 2026 at 01:49:04PM -0500, Joel Fernandes wrote:
> 
> > 
> > On 11/6/2026 9:39 AM, Kunwu Chan wrote:
> >  This series adds KASAN auxiliary stack recording for RCU Tasks
> >  callbacks, rcutorture coverage for duplicate-callback detection,
> >  and KASAN aux-stack verification tests across RCU and SRCU flavors.
> >  
> >  This series is based on [1]. For testing, I also applied Joel
> >  Fernandes' fix for debugobjects tracking of barrier callbacks
> >  [2], which is needed for the barrier tests.
> >  
> >  The changes:
> >  - Record the enqueueing stack in call_rcu_tasks_generic().
> >  - Enable duplicate-callback testing for the "tasks" and
> >  "tasks-tracing" torture types.
> >  - Add a KASAN aux-stack verification test module with a Kconfig
> >  choice for each supported flavor.
> >  - Add one rcutorture scenario per flavor for the verification
> >  test.
> >  
> >  Tested on x86_64:
> >  
> >  - TASKS01, TASKS02, TASKS03, TRACE01, and TRACE02 completed
> >  3-minute runs successfully.
> >  
> >  - With CONFIG_DEBUG_OBJECTS_RCU_HEAD=y and
> >  rcutorture.object_debug=1, duplicate-callback detection was
> >  triggered as expected for both torture types.
> >  
> >  - TRACE01 was run for 1 minute with
> >  CONFIG_DEBUG_OBJECTS_RCU_HEAD=y and
> >  rcutorture.object_debug=1. The test detected both duplicate
> >  callback heads through the SRCU enqueue path:
> >  [ 0.405836] rcutorture: WARN: Duplicate call_tasks-tracing() test starting.
> >  [ 0.405852] ODEBUG: activate active (active state 1) object: 0000000020df980d object type: rcu_head hint: 0x0
> >  [ 0.734724] rcu: __call_srcu(): Duplicate call_srcu() CB 0000000020df980d->rcu_torture_leak_cb+0x0/0x10()
> >  [ 0.734780] ODEBUG: activate active (active state 1) object: 000000006634e8c9 object type: rcu_head hint: 0x0
> >  [ 0.776688] rcu: __call_srcu(): Duplicate call_srcu() CB 000000006634e8c9->rcu_torture_leak_cb+0x0/0x10()
> >  [ 0.779126] rcutorture: WARN: Duplicate call_tasks-tracing() test complete.
> >  [ 65.411342] tasks-tracing-torture:--- End of test: SUCCESS: ...
> >  
> >  Both duplicate callback heads (the stack-allocated rh2 and
> >  the kmalloc-allocated rhp) were rejected and neither was invoked.
> >  
> >  - With CONFIG_DEBUG_OBJECTS_RCU_HEAD=y,
> >  object_debug=1, and n_barrier_cbs=4, the TASKS01 barrier
> >  test completed 630/630 rounds without barrier errors.
> >  The only debugobjects warnings were the four intentional
> >  warnings from the duplicate-callback test at startup.
> >  
> >  - All five aux-stack scenarios (TASKSKASAN01, TREEKASAN01,
> >  SRCUKASAN01, TINYKASAN01, and SRCUTINYKASAN01) produced the
> >  expected KASAN use-after-free reports. Each report's
> >  "Last potentially related work creation" entry showed the
> >  expected enqueue helper:
> >  
> >  ===== TASKSKASAN01 =====
> >  [ 1.244567] BUG: KASAN: slab-use-after-free in aux_test_init+0x8d/0xb0
> >  [ 1.244707] Last potentially related work creation:
> >  [ 1.244716] aux_test_call_rcu_tasks.constprop.0+0xc/0x20
> >  
> >  ===== TREEKASAN01 =====
> >  [ 0.670399] BUG: KASAN: slab-use-after-free in aux_test_init+0x8d/0xb0
> >  [ 0.670561] Last potentially related work creation:
> >  [ 0.670571] aux_test_call_rcu_tree.constprop.0+0xc/0x20
> >  
> >  ===== SRCUKASAN01 =====
> >  [ 0.658679] BUG: KASAN: slab-use-after-free in aux_test_init+0x94/0xc0
> >  [ 0.658919] Last potentially related work creation:
> >  [ 0.658932] aux_test_call_srcu.constprop.0+0x16/0x30
> >  
> >  ===== TINYKASAN01 =====
> >  [ 0.951503] BUG: KASAN: slab-use-after-free in aux_test_init+0x8d/0xb0
> >  [ 0.951641] Last potentially related work creation:
> >  [ 0.951650] aux_test_call_rcu_tiny.constprop.0+0xc/0x20
> >  
> >  ===== SRCUTINYKASAN01 =====
> >  [ 1.009005] BUG: KASAN: slab-use-after-free in aux_test_init+0x94/0xc0
> >  [ 1.009141] Last potentially related work creation:
> >  [ 1.009150] aux_test_call_srcu.constprop.0+0x16/0x30
> >  
> >  I'm not feeling very excited about adding more configs just for KASAN. That
> >  sounds like a maintenance burden. I believe Paul already has KASAN testing in
> >  his scripts. Is it possible to activate this testing only when those are enabled?
> > 
> The usual way that I do KASAN testing is with the --kasan argument
> to kvm.sh. I use --kconfig and --bootargs to specify further testing,
> usually as another option in torture.sh. This causes the testing to
> be carried out as a matter of course.
> 
> One good thing is that the Kconfig choice in patch 4/5 is automated so
> that RCU_KASAN_AUX_TEST causes the right testing to happen depending on
> what is configured.
> 
> Is it possible to drive this from --kasan and the rcutorture.object_debug
> kernel boot parameter or something similar? Or is there a better way
> to make the overall testing happen?

Hello, Kunwu

Perhaps we can simplify this testing, similar to object_debug testing.
double-free also should output stack (I did not actually test the
modifications below) which record by kasan_record_aux_stack():


diff --git a/kernel/rcu/rcutorture.c b/kernel/rcu/rcutorture.c
index 968343be4e0d..93b30bf90cc9 100644
--- a/kernel/rcu/rcutorture.c
+++ b/kernel/rcu/rcutorture.c
@@ -120,6 +120,7 @@ torture_param(bool, nmi_calls, true, "Exercise ->call() from NMI on nmi_capable
 torture_param(int, nreaders, -1, "Number of RCU reader threads");
 torture_param(bool, nwriters, 1, "Number of RCU writer threads (0 or 1)");
 torture_param(int, object_debug, 0, "Enable debug-object double call_rcu() testing");
+torture_param(int, kasan_debug, 0, "Enable call_rcu() kasan testing");
 torture_param(int, onoff_holdoff, 0, "Time after boot before CPU hotplugs (s)");
 torture_param(int, onoff_interval, 0, "Time between CPU hotplugs (jiffies), 0=disable");
 torture_param(bool, gpwrap_lag, true, "Enable grace-period wrap lag testing");
@@ -4632,6 +4633,25 @@ static void rcu_test_debug_objects(void)
        kfree(rhp);
 }

+static void rcu_free_cb(struct rcu_head *rhp)
+{
+       kfree(rhp);
+}
+
+static void rcu_test_kasan(void)
+{
+       if (!IS_ENABLED(CONFIG_KASAN_GENERIC) ||
+                       !cur_ops->call || !cur_ops->cb_barrier)
+               return;
+
+       struct rcu_head *rhp = kmalloc_obj(*rhp);
+       if (rhp) {
+               cur_ops->call(rhp, rcu_free_cb);
+               cur_ops->cb_barrier();
+       }
+       kfree(rhp);
+}
+
 static void rcutorture_sync(void)
 {
        static unsigned long n;
@@ -5191,6 +5211,9 @@ rcu_torture_init(void)
        if (object_debug)
                rcu_test_debug_objects();

+       if (kasan_debug)
+               rcu_test_kasan();
+
        if (cur_ops->gp_slow_register && !WARN_ON_ONCE(!cur_ops->gp_slow_unregister))
                cur_ops->gp_slow_register(&rcu_fwd_cb_nodelay);



Thanks
Zqiang


> 
>  Thanx, Paul
>

Re: [PATCH 0/5] rcu: Record callback enqueue stacks and add torture tests

[KunWu Chan]

On Sat, Nov 7, 2026 at 12:20 PM Zqiang <qiang.zhang@linux.dev> wrote:
>
> >
> > On Fri, Nov 06, 2026 at 01:49:04PM -0500, Joel Fernandes wrote:
> >
> > >
> > > On 11/6/2026 9:39 AM, Kunwu Chan wrote:
> > >  This series adds KASAN auxiliary stack recording for RCU Tasks
> > >  callbacks, rcutorture coverage for duplicate-callback detection,
> > >  and KASAN aux-stack verification tests across RCU and SRCU flavors.
> > >
> > >  This series is based on [1]. For testing, I also applied Joel
> > >  Fernandes' fix for debugobjects tracking of barrier callbacks
> > >  [2], which is needed for the barrier tests.
> > >
> > >  The changes:
> > >  - Record the enqueueing stack in call_rcu_tasks_generic().
> > >  - Enable duplicate-callback testing for the "tasks" and
> > >  "tasks-tracing" torture types.
> > >  - Add a KASAN aux-stack verification test module with a Kconfig
> > >  choice for each supported flavor.
> > >  - Add one rcutorture scenario per flavor for the verification
> > >  test.
> > >
> > >  Tested on x86_64:
> > >
> > >  - TASKS01, TASKS02, TASKS03, TRACE01, and TRACE02 completed
> > >  3-minute runs successfully.
> > >
> > >  - With CONFIG_DEBUG_OBJECTS_RCU_HEAD=y and
> > >  rcutorture.object_debug=1, duplicate-callback detection was
> > >  triggered as expected for both torture types.
> > >
> > >  - TRACE01 was run for 1 minute with
> > >  CONFIG_DEBUG_OBJECTS_RCU_HEAD=y and
> > >  rcutorture.object_debug=1. The test detected both duplicate
> > >  callback heads through the SRCU enqueue path:
> > >  [ 0.405836] rcutorture: WARN: Duplicate call_tasks-tracing() test starting.
> > >  [ 0.405852] ODEBUG: activate active (active state 1) object: 0000000020df980d object type: rcu_head hint: 0x0
> > >  [ 0.734724] rcu: __call_srcu(): Duplicate call_srcu() CB 0000000020df980d->rcu_torture_leak_cb+0x0/0x10()
> > >  [ 0.734780] ODEBUG: activate active (active state 1) object: 000000006634e8c9 object type: rcu_head hint: 0x0
> > >  [ 0.776688] rcu: __call_srcu(): Duplicate call_srcu() CB 000000006634e8c9->rcu_torture_leak_cb+0x0/0x10()
> > >  [ 0.779126] rcutorture: WARN: Duplicate call_tasks-tracing() test complete.
> > >  [ 65.411342] tasks-tracing-torture:--- End of test: SUCCESS: ...
> > >
> > >  Both duplicate callback heads (the stack-allocated rh2 and
> > >  the kmalloc-allocated rhp) were rejected and neither was invoked.
> > >
> > >  - With CONFIG_DEBUG_OBJECTS_RCU_HEAD=y,
> > >  object_debug=1, and n_barrier_cbs=4, the TASKS01 barrier
> > >  test completed 630/630 rounds without barrier errors.
> > >  The only debugobjects warnings were the four intentional
> > >  warnings from the duplicate-callback test at startup.
> > >
> > >  - All five aux-stack scenarios (TASKSKASAN01, TREEKASAN01,
> > >  SRCUKASAN01, TINYKASAN01, and SRCUTINYKASAN01) produced the
> > >  expected KASAN use-after-free reports. Each report's
> > >  "Last potentially related work creation" entry showed the
> > >  expected enqueue helper:
> > >
> > >  ===== TASKSKASAN01 =====
> > >  [ 1.244567] BUG: KASAN: slab-use-after-free in aux_test_init+0x8d/0xb0
> > >  [ 1.244707] Last potentially related work creation:
> > >  [ 1.244716] aux_test_call_rcu_tasks.constprop.0+0xc/0x20
> > >
> > >  ===== TREEKASAN01 =====
> > >  [ 0.670399] BUG: KASAN: slab-use-after-free in aux_test_init+0x8d/0xb0
> > >  [ 0.670561] Last potentially related work creation:
> > >  [ 0.670571] aux_test_call_rcu_tree.constprop.0+0xc/0x20
> > >
> > >  ===== SRCUKASAN01 =====
> > >  [ 0.658679] BUG: KASAN: slab-use-after-free in aux_test_init+0x94/0xc0
> > >  [ 0.658919] Last potentially related work creation:
> > >  [ 0.658932] aux_test_call_srcu.constprop.0+0x16/0x30
> > >
> > >  ===== TINYKASAN01 =====
> > >  [ 0.951503] BUG: KASAN: slab-use-after-free in aux_test_init+0x8d/0xb0
> > >  [ 0.951641] Last potentially related work creation:
> > >  [ 0.951650] aux_test_call_rcu_tiny.constprop.0+0xc/0x20
> > >
> > >  ===== SRCUTINYKASAN01 =====
> > >  [ 1.009005] BUG: KASAN: slab-use-after-free in aux_test_init+0x94/0xc0
> > >  [ 1.009141] Last potentially related work creation:
> > >  [ 1.009150] aux_test_call_srcu.constprop.0+0x16/0x30
> > >
> > >  I'm not feeling very excited about adding more configs just for KASAN. That
> > >  sounds like a maintenance burden. I believe Paul already has KASAN testing in
> > >  his scripts. Is it possible to activate this testing only when those are enabled?
> > >
> > The usual way that I do KASAN testing is with the --kasan argument
> > to kvm.sh. I use --kconfig and --bootargs to specify further testing,
> > usually as another option in torture.sh. This causes the testing to
> > be carried out as a matter of course.
> >
> > One good thing is that the Kconfig choice in patch 4/5 is automated so
> > that RCU_KASAN_AUX_TEST causes the right testing to happen depending on
> > what is configured.
> >
> > Is it possible to drive this from --kasan and the rcutorture.object_debug
> > kernel boot parameter or something similar? Or is there a better way
> > to make the overall testing happen?
>
> Hello, Kunwu
>
> Perhaps we can simplify this testing, similar to object_debug testing.
> double-free also should output stack (I did not actually test the
> modifications below) which record by kasan_record_aux_stack():
>
>
> diff --git a/kernel/rcu/rcutorture.c b/kernel/rcu/rcutorture.c
> index 968343be4e0d..93b30bf90cc9 100644
> --- a/kernel/rcu/rcutorture.c
> +++ b/kernel/rcu/rcutorture.c
> @@ -120,6 +120,7 @@ torture_param(bool, nmi_calls, true, "Exercise ->call() from NMI on nmi_capable
>  torture_param(int, nreaders, -1, "Number of RCU reader threads");
>  torture_param(bool, nwriters, 1, "Number of RCU writer threads (0 or 1)");
>  torture_param(int, object_debug, 0, "Enable debug-object double call_rcu() testing");
> +torture_param(int, kasan_debug, 0, "Enable call_rcu() kasan testing");
>  torture_param(int, onoff_holdoff, 0, "Time after boot before CPU hotplugs (s)");
>  torture_param(int, onoff_interval, 0, "Time between CPU hotplugs (jiffies), 0=disable");
>  torture_param(bool, gpwrap_lag, true, "Enable grace-period wrap lag testing");
> @@ -4632,6 +4633,25 @@ static void rcu_test_debug_objects(void)
>         kfree(rhp);
>  }
>
> +static void rcu_free_cb(struct rcu_head *rhp)
> +{
> +       kfree(rhp);
> +}
> +
> +static void rcu_test_kasan(void)
> +{
> +       if (!IS_ENABLED(CONFIG_KASAN_GENERIC) ||
> +                       !cur_ops->call || !cur_ops->cb_barrier)
> +               return;
> +
> +       struct rcu_head *rhp = kmalloc_obj(*rhp);
> +       if (rhp) {
> +               cur_ops->call(rhp, rcu_free_cb);
> +               cur_ops->cb_barrier();
> +       }
> +       kfree(rhp);
> +}
> +
>  static void rcutorture_sync(void)
>  {
>         static unsigned long n;
> @@ -5191,6 +5211,9 @@ rcu_torture_init(void)
>         if (object_debug)
>                 rcu_test_debug_objects();
>
> +       if (kasan_debug)
> +               rcu_test_kasan();
> +
>         if (cur_ops->gp_slow_register && !WARN_ON_ONCE(!cur_ops->gp_slow_unregister))
>                 cur_ops->gp_slow_register(&rcu_fwd_cb_nodelay);
>
>
>
> Thanks
> Zqiang
>

Thanks Joel, Paul, and Zqiang.

I agree that we should avoid extra KASAN-specific configs and integrate the
testing into the existing KASAN/torture workflow. I'll look into how
best to do that.

Zqiang, thanks for the code suggestion.
I'll look more closely at which callback paths it covers and how the
intentional
KASAN report should be handled by the torture scripts. The important part is
to make sure that "Last potentially related work creation" points to
the expected
callback enqueue helper, rather than just triggering a KASAN report.

I'll consider all these points for the next revision.

Thanks,
Kunwu

>
> >
> >  Thanx, Paul
> >