>
> Hello Zqiang,
>
> On Thu, Jul 09, 2026 at 06:06:02PM +0800, Zqiang wrote:
>
> >
> > In the cleanup_srcu_struct(), when iterating over per-cpu's srcu_data,
> > the timer_delete_sync(&sdp->delay_work) is called to cancel the delay
> > timer before flush_work(&sdp->work).
> >
> > However, if the timer_delete_sync() returns 1 means that it successfully
> > deleted an pending timer before it had a chance to fire, also means that
> > the sdp->work cannot be queued, the subsequent flush_work(&sdp->work)
> > will returns immediately without waiting for anything, this causes SRCU
> > callbacks to not be processed.
> >
> > Fix this by checking the return value of timer_delete_sync(), if it
> > returns 1, explicitly queue sdp->work so that the following flush_work()
> > can correctly wait for the work to complete.
> >
> > Signed-off-by: Zqiang <[email protected]>
> > ---
> > kernel/rcu/srcutree.c | 6 +++++-
> > 1 file changed, 5 insertions(+), 1 deletion(-)
> >
> > diff --git a/kernel/rcu/srcutree.c b/kernel/rcu/srcutree.c
> > index 7c2f7cc131f7..02c322b7c6f1 100644
> > --- a/kernel/rcu/srcutree.c
> > +++ b/kernel/rcu/srcutree.c
> > @@ -725,7 +725,11 @@ void cleanup_srcu_struct(struct srcu_struct *ssp)
> > for_each_possible_cpu(cpu) {
> > struct srcu_data *sdp = per_cpu_ptr(ssp->sda, cpu);
> >
> > - timer_delete_sync(&sdp->delay_work);
> > + //In most scenarios, calling srcu_barrier before cleanup
> > + //will not trigger WARN_ON().
> > + if (WARN_ON(timer_delete_sync(&sdp->delay_work)) &&
> > + rcu_cpu_beenfullyonline(sdp->cpu))
> > + queue_work_on(sdp->cpu, rcu_gp_wq, &sdp->work);
> >
> I started seeing this on my tests, it is not trivial to decode this one,
> but, I can try harder if _really_ needed.
>
The scenario I can think of is that we missed the call to srcu_barrier()
before cleanup_srcu_struct():
loop_add()
->blk_mq_alloc_tag_set
init_srcu_struct(&set->tags_srcu)
blk_mq_alloc_set_map_and_rqs() {
->__blk_mq_alloc_rq_maps()
->__blk_mq_alloc_map_and_rqs() return error
goto out_unwind: __blk_mq_free_map_and_rqs()
->blk_mq_free_rq_map()
->blk_mq_free_tags()
->call_srcu(&set->tags_srcu, &tags->rcu_head,
blk_mq_free_tags_callback);
} return error
goto out_free_mq_map:
....
cleanup_srcu_struct(&set->tags_srcu)
-> trigger WARN_ON(timer_delete_sync(&sdp->delay_work)
Can you try the following patch?
diff --git a/block/blk-mq.c b/block/blk-mq.c
index 2c850330a32b..6eaea75d0363 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -4925,6 +4925,7 @@ int blk_mq_alloc_tag_set(struct blk_mq_tag_set *set)
kfree(set->tags);
set->tags = NULL;
out_cleanup_tags_srcu:
+ srcu_barrier(&set->tags_srcu);
cleanup_srcu_struct(&set->tags_srcu);
out_cleanup_srcu:
if (set->flags & BLK_MQ_F_BLOCKING)
Thanks
Zqiang
>
> 07:11:44 Invalid logical block size (65535)
> Invalid logical block size (256)
> 07:11:45 WARNING: kernel/rcu/srcutree.c:706 at
> cleanup_srcu_struct+0x408/0x7e8, CPU#50: stress-ng-loop/1233713
> ^[[36m[warn]^[[0m
> Modules linked in: sch_htb(E) cls_u32(E) cls_cgroup(E) cls_basic(E)
> act_police(E) act_mirred(E) act_bpf(E) sch_fq(E) br_netfilter(E) udp_diag(E) i
> CPU: 50 UID: 0 PID: 1233713 Comm: stress-ng-loop Kdump: loaded Tainted: G E
> 7.2.0-rc5-next-20260730upstream-baseline #1 PREEMPT(f
> Tainted: [E]=UNSIGNED_MODULE
> pstate: 03401009 (nzcv daif +PAN -UAO +TCO +DIT +SSBS BTYPE=--)
> pc : cleanup_srcu_struct+0x408/0x7e8
> lr : cleanup_srcu_struct+0x3dc/0x7e8
> sp : ffff800150357b30
> x29: ffff800150357b50 x28: fffffdffbdb51c40 x27: 0000000000000000
> x26: dfff800000000000 x25: 1fffe000202daa5f x24: ffff800083bbb010
> x23: ffff800083f67210 x22: ffff0001016d52f8 x21: 00007dc98b656c40
> x20: 1ffff000107ece42 x19: 0000000000000003 x18: 1fffe006d6db3f20
> x17: 0000000000000000 x16: ffff800083f67000 x15: 0000000000000001
> x14: 1fffe006d6db6388 x13: 0000000000000000 x12: 0000000000000000
> x11: 0000000000000003 x10: fffffdffbdb51e40 x9 : dfff800000000000
> x8 : 0000000100000000 x7 : 0000000000000000 x6 : ffff80008148f060
> x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000010
> x2 : ffff800150357a60 x1 : ffff80008036827c x0 : 0000000000000001
> Call trace:
> cleanup_srcu_struct+0x408/0x7e8 (P)
> blk_mq_free_tag_set+0x4b4/0x5f0
> loop_remove+0x50/0xd8 [loop]
> loop_control_ioctl+0x340/0x438 [loop]
> __arm64_sys_ioctl+0xc04/0x1310
> invoke_syscall+0x74/0x188
> do_el0_svc+0x10c/0x198
> el0_svc+0x64/0x260
> el0t_64_sync_handler+0x84/0x130
> el0t_64_sync+0x198/0x1a0
> irq event stamp: 0
> hardirqs last enabled at (0): [<0000000000000000>] 0x0
> hardirqs last disabled at (0): [<ffff800080100734>]
> copy_process+0x109c/0x31e8
> softirqs last enabled at (0): [<ffff800080100760>] copy_process+0x10c8/0x31e8
> softirqs last disabled at (0): [<0000000000000000>] 0x0
> ---[ end trace 0000000000000000 ]---
>
