The "nocb_bypass_timer" ends up calling wake_nocb_gp() which deletes
the pending "nocb_timer" (note they are not the same timers) for the
given rdp without resetting the matching state stored in nocb_defer
wakeup.
As a result, a future call_rcu() on that rdp may be fooled and think the
timer is armed when it's not, missing a deferred nocb_gp wakeup.
Fix this with resetting rdp->nocb_defer_wakeup when we disarm the timer.
Fixes: d1b222c6be1f (rcu/nocb: Add bypass callback queueing)
Cc: Stable <sta...@vger.kernel.org>
Cc: Josh Triplett <j...@joshtriplett.org>
Cc: Lai Jiangshan <jiangshan...@gmail.com>
Cc: Joel Fernandes <j...@joelfernandes.org>
Cc: Neeraj Upadhyay <neer...@codeaurora.org>
Cc: Boqun Feng <boqun.f...@gmail.com>
Signed-off-by: Frederic Weisbecker <frede...@kernel.org>
---
kernel/rcu/tree_plugin.h | 2 ++
1 file changed, 2 insertions(+)
diff --git a/kernel/rcu/tree_plugin.h b/kernel/rcu/tree_plugin.h
index 7e33dae0e6ee..a44f80d7661b 100644
--- a/kernel/rcu/tree_plugin.h
+++ b/kernel/rcu/tree_plugin.h
@@ -1705,6 +1705,8 @@ static bool wake_nocb_gp(struct rcu_data *rdp, bool force,
rcu_nocb_unlock_irqrestore(rdp, flags);
return false;
}
+
+ rdp->nocb_defer_wakeup = RCU_NOCB_WAKE_NOT;
del_timer(&rdp->nocb_timer);
rcu_nocb_unlock_irqrestore(rdp, flags);
raw_spin_lock_irqsave(&rdp_gp->nocb_gp_lock, flags);
--
2.25.1
