Re: [linus:master] [rcu] b41642c877: BUG:kernel_hang_in_boot_stage

From: Neeraj Upadhyay
Date: Wed Aug 13 2025 - 00:41:55 EST


Hi kernel test robot,

> #syz test
>
> >From a3cc7624264743996d2ad1295741933103a8d63b Mon Sep 17 00:00:00 2001
> From: Frederic Weisbecker <frederic@xxxxxxxxxx>
> Date: Fri, 8 Aug 2025 19:03:22 +0200
> Subject: [PATCH] rcu: Fix racy re-initialization of irq_work causing hangs
>
> RCU re-initializes the deferred QS irq work everytime before attempting
> to queue it. However there are situations where the irq work is
> attempted to be queued even though it is already queued. In that case
> re-initializing messes-up with the irq work queue that is about to be
> handled.
>
> The chances for that to happen are higher when the architecture doesn't
> support self-IPIs and irq work are then all lazy, such as with the
> following sequence:
>
> 1) rcu_read_unlock() is called when IRQs are disabled and there is a
> grace period involving blocked tasks on the node. The irq work
> is then initialized and queued.
>
> 2) The related tasks are unblocked and the CPU quiescent state
> is reported. rdp->defer_qs_iw_pending is reset to DEFER_QS_IDLE,
> allowing the irq work to be requeued in the future (note the previous
> one hasn't fired yet).
>
> 3) A new grace period starts and the node has blocked tasks.
>
> 4) rcu_read_unlock() is called when IRQs are disabled again. The irq work
> is re-initialized (but it's queued! and its node is cleared) and
> requeued. Which means it's requeued to itself.
>
> 5) The irq work finally fires with the tick. But since it was requeued
> to itself, it loops and hangs.
>
> Fix this with initializing the irq work only once before the CPU boots.
>
> Fixes: b41642c87716 ("rcu: Fix rcu_read_unlock() deadloop due to IRQ work")
> Reported-by: kernel test robot <oliver.sang@xxxxxxxxx>
> Closes: https://lore.kernel.org/oe-lkp/202508071303.c1134cce-lkp@xxxxxxxxx
> Signed-off-by: Frederic Weisbecker <frederic@xxxxxxxxxx>
> ---

Can you please update testing results with the proposed fix?


- Neeraj