From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-ot1-f72.google.com (mail-ot1-f72.google.com [209.85.210.72]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1CE1B37C92C for ; Fri, 21 Aug 2026 12:09:36 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.72 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787314181; cv=none; b=q3dBu+xaJ2JqgLk6S57jNknrHnaAUEYNjLwhslmmDfbEv67RVinA+GrzrMiXfevyQT1bxA1dn+5tVwNAtIPbNvXPoGykljvjbkyDjGlMgG1BxvWMZlHQ43dzSEgbxe8dFmiHYj6OIFT79xtJXc0cdATnrU/BBIk0fLu+h3NVRcU= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787314181; c=relaxed/simple; bh=SlNCSbRw53ZAzgYa8D1xAooHv+IH3tdv8V84Hz+2vxs=; h=MIME-Version:Date:In-Reply-To:Message-ID:Subject:From:To: Content-Type; b=AeO2pgDwsx5oi4EtU5a47/n9vAqNfV2HjBbYemUpNgPjhWwixiqDns8U7qlgv5G49j8VaExo62KRCOMyFojcqqqK7G7GHDft5dP3tkMCkjCgAZ4Qb9eQ7s2OczJ1e68BgOxBQwhl+OlwBNNHaAY1Qpp3m0m5X9kozRjxyt9uV04= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com; arc=none smtp.client-ip=209.85.210.72 Authentication-Results: smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com Received: by mail-ot1-f72.google.com with SMTP id 46e09a7af769-7eb64224fd2so1843801a34.0 for ; Fri, 21 Aug 2026 05:09:36 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787314175; x=1787918975; h=content-transfer-encoding:content-type:to:from:subject:message-id :in-reply-to:date:mime-version:x-gm-message-state:from:to:cc:subject :date:message-id:reply-to:content-type; bh=av6mLv/dNldrSZKPPueb14mF6vGj5FAcRv6EktCjC50=; b=JZ0YNnkYrWZbuPBgwrbp6wAVmwgcDhuj8mtQVVm8hqBheWS7HeKh3jJOX8sr9FUVM3 y18rkzQhcF6pWPP9qH3kdvCyeSVqyY471o1Okesa1aralop7DeCaBFZ5GspoPzditVeS Wsb2VrFUEOi/+yXfozZHjqrL7hxgvYBScqBCh3ZvYIYe3DYclkkSLY10KpPJMB4zAMLN F6LENAaTlq0emE7DjijtaD2k6vdikip0ZDdc7D6ndnEhkTDfpxymvDrmjGsbeu/NmDi7 3yRTInXdQzMOQ2w3JG1m/QBixnsWFgKaUm/HgvgMaQ7+5IKlsRs2IQnfjUrihXTZoda7 SxaA== X-Gm-Message-State: AOJu0YxpxNWmlgrRF8xFlRfoTzOPf9kH13O0U9v1qz5MY/VMDWsYCrmI GXo1z4HW3ybDdYKXqaxHltRKbIkkaL1hHn0SN1SE1NAnb47mQN43NbCwgKTcDd+sc2tuzfC1/3M F9B3Yi8pkuoQmabEEErtkTn1jQCmgze8FFy5elj7B9mIDl0FA0JNDn92NiRU= Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Received: by 2002:a05:6820:5507:b0:6ac:8e23:3078 with SMTP id 006d021491bc7-6b1591d99b6mr5094454eaf.5.1787314174785; Fri, 21 Aug 2026 05:09:34 -0700 (PDT) Date: Fri, 21 Aug 2026 05:09:34 -0700 In-Reply-To: <6936812a.a70a0220.38f243.0090.GAE@google.com> X-Google-Appengine-App-Id: s~syzkaller X-Google-Appengine-App-Id-Alias: syzkaller Message-ID: <6a883ffe.91706f20.16b6e3.02a8.GAE@google.com> Subject: Forwarded: Re: [syzbot] [mm?] BUG: sleeping function called from invalid context in kvm_mmu_notifier_invalidate_range_start From: syzbot To: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable For archival purposes, forwarding an incoming command email to linux-kernel@vger.kernel.org. *** Subject: Re: [syzbot] [mm?] BUG: sleeping function called from invalid cont= ext in kvm_mmu_notifier_invalidate_range_start Author: dwmw2@infradead.org #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git= master Commit 312364f3534cc ("kernel.h: Add non_block_start/end()") added non_block_star()/end(). The intention was to catch any callbacks which depend on locks or sleep able conditionals in order to ensure forward progress. According to the commit message spinlocks were excluded "because spinlocks can't have an indirect dependency upon the page allocator=E2=80=A6". On PREEMPT_RT this leads to a splat because spinlock_t and rwlock_t are turned into a sleeping spinlock which have a might_sleep() as they could schedule() on lock contention. Besids mm, the other used of non_block_start() is pwm. Here the hrtimer can acnqure a spinlock_t on RT and I can't tell other user but I assume it is not atomic on RT since it wouldn't be able to acquire its own (spinlock_t) lock. Since spinlock_t (and rwlock_t) are not problem, add a sleeping_lock argument to __might_resched() signaling if this is scheduling request is from a sleeping lock (true) or regular scheduling request (false). Add the `true' argument to rtlock_might_resched() which is used on PREEMPT_RT for both sleeping lock types. Cc: Michal Hocko Cc: David Woodhouse Cc: Sean Young Cc: Thierry Reding Signed-off-by: Sebastian Andrzej Siewior --- include/linux/kernel.h | 5 +++-- include/linux/sched.h | 24 ++++++++++++------------ kernel/locking/spinlock_rt.c | 2 +- kernel/sched/core.c | 7 ++++--- 4 files changed, 20 insertions(+), 18 deletions(-) diff --git a/include/linux/kernel.h b/include/linux/kernel.h index e5570a16cbb1a..fbafdfe9bdb78 100644 --- a/include/linux/kernel.h +++ b/include/linux/kernel.h @@ -70,7 +70,8 @@ extern int dynamic_might_resched(void); #endif /* CONFIG_PREEMPT_* */ =20 #ifdef CONFIG_DEBUG_ATOMIC_SLEEP -extern void __might_resched(const char *file, int line, unsigned int offse= ts); +extern void __might_resched(const char *file, int line, unsigned int offse= ts, + bool rt_sleeping_lock); extern void __might_sleep(const char *file, int line); extern void __cant_sleep(const char *file, int line, int preempt_offset); extern void __cant_migrate(const char *file, int line); @@ -128,7 +129,7 @@ extern void __cant_migrate(const char *file, int line); # define non_block_end() WARN_ON(current->non_block_count-- =3D=3D 0) #else static inline void __might_resched(const char *file, int line, - unsigned int offsets) { } + unsigned int offsets, bool rt_sleeping_lock) { } static inline void __might_sleep(const char *file, int line) { } # define might_sleep() do { might_resched(); } while (0) # define cant_sleep() do { } while (0) diff --git a/include/linux/sched.h b/include/linux/sched.h index 373bcc0598d10..650e42d55e1e8 100644 --- a/include/linux/sched.h +++ b/include/linux/sched.h @@ -2158,9 +2158,9 @@ static inline int _cond_resched(void) =20 #endif /* !CONFIG_PREEMPTION || CONFIG_PREEMPT_DYNAMIC */ =20 -#define cond_resched() ({ \ - __might_resched(__FILE__, __LINE__, 0); \ - _cond_resched(); \ +#define cond_resched() ({ \ + __might_resched(__FILE__, __LINE__, 0, false); \ + _cond_resched(); \ }) =20 extern int __cond_resched_lock(spinlock_t *lock) __must_hold(lock); @@ -2186,19 +2186,19 @@ extern int __cond_resched_rwlock_write(rwlock_t *lo= ck) __must_hold(lock); (PREEMPT_LOCK_OFFSET + (1U << MIGHT_RESCHED_RCU_SHIFT)) #endif =20 -#define cond_resched_lock(lock) ({ \ - __might_resched(__FILE__, __LINE__, PREEMPT_LOCK_RESCHED_OFFSETS); \ - __cond_resched_lock(lock); \ +#define cond_resched_lock(lock) ({ \ + __might_resched(__FILE__, __LINE__, PREEMPT_LOCK_RESCHED_OFFSETS, false);= \ + __cond_resched_lock(lock); \ }) =20 -#define cond_resched_rwlock_read(lock) ({ \ - __might_resched(__FILE__, __LINE__, PREEMPT_LOCK_RESCHED_OFFSETS); \ - __cond_resched_rwlock_read(lock); \ +#define cond_resched_rwlock_read(lock) ({ \ + __might_resched(__FILE__, __LINE__, PREEMPT_LOCK_RESCHED_OFFSETS, false);= \ + __cond_resched_rwlock_read(lock); \ }) =20 -#define cond_resched_rwlock_write(lock) ({ \ - __might_resched(__FILE__, __LINE__, PREEMPT_LOCK_RESCHED_OFFSETS); \ - __cond_resched_rwlock_write(lock); \ +#define cond_resched_rwlock_write(lock) ({ \ + __might_resched(__FILE__, __LINE__, PREEMPT_LOCK_RESCHED_OFFSETS, false);= \ + __cond_resched_rwlock_write(lock); \ }) =20 #ifndef CONFIG_PREEMPT_RT diff --git a/kernel/locking/spinlock_rt.c b/kernel/locking/spinlock_rt.c index 1d5e1b3c60bfa..0a89e7f10af18 100644 --- a/kernel/locking/spinlock_rt.c +++ b/kernel/locking/spinlock_rt.c @@ -33,7 +33,7 @@ (rcu_preempt_depth() << MIGHT_RESCHED_RCU_SHIFT) =20 #define rtlock_might_resched() \ - __might_resched(__FILE__, __LINE__, RTLOCK_RESCHED_OFFSETS) + __might_resched(__FILE__, __LINE__, RTLOCK_RESCHED_OFFSETS, true) =20 static __always_inline void rtlock_lock(struct rt_mutex_base *rtm) { diff --git a/kernel/sched/core.c b/kernel/sched/core.c index 96226707c2f61..ee0fbb41fc61c 100644 --- a/kernel/sched/core.c +++ b/kernel/sched/core.c @@ -9123,7 +9123,7 @@ void __might_sleep(const char *file, int line) (void *)current->task_state_change, (void *)current->task_state_change); =20 - __might_resched(file, line, 0); + __might_resched(file, line, 0, false); } EXPORT_SYMBOL(__might_sleep); =20 @@ -9148,7 +9148,8 @@ static inline bool resched_offsets_ok(unsigned int of= fsets) return nested =3D=3D offsets; } =20 -void __might_resched(const char *file, int line, unsigned int offsets) +void __might_resched(const char *file, int line, unsigned int offsets, + bool rt_sleeping_lock) { /* Ratelimiting timestamp: */ static unsigned long prev_jiffy; @@ -9159,7 +9160,7 @@ void __might_resched(const char *file, int line, unsi= gned int offsets) rcu_sleep_check(); =20 if ((resched_offsets_ok(offsets) && !irqs_disabled() && - !is_idle_task(current) && !current->non_block_count) || + !is_idle_task(current) && (rt_sleeping_lock || !current->non_block_c= ount)) || system_state =3D=3D SYSTEM_BOOTING || system_state > SYSTEM_RUNNING |= | oops_in_progress) return; --=20 2.55.0