linux-toradex.git/kernel/rcu, branch master

Merge branches 'misc.2026.10.06a' and 'torture.2026.10.12a' into HEAD

2026-10-12T23:53:20+00:00

misc.2026.10.06a: Miscellaneous fixes.
torture.2026.10.12a: Make call_{s,}rcu() invocable from any environment,
	add atomic SRCU, additional SRCU updates, and torture-test updates.

rcutorture: Add atomic SRCU cross-CPU IRQ context mismatch test

2026-10-12T23:51:52+00:00

Add testtype 7 to verify that lockdep detects an IRQ-context
mismatch when an atomic SRCU read-side critical section is held
with IRQs enabled on one CPU and synchronize_srcu_atomic() is
called from an IPI handler on another CPU.

This covers the cross-CPU case that cannot be detected by
checking the current task's held locks.

Co-developed-by: Zqiang 
Signed-off-by: Zqiang 
Signed-off-by: Kunwu Chan 
Acked-by: Boqun Feng 
Signed-off-by: Paul E. McKenney

rcutorture: Add atomic SRCU lockdep support

2026-10-12T23:51:52+00:00

Add three testtypes covering atomic SRCU lockdep behavior:

  testtype 4: atomic SRCU same-type deadlock
  testtype 5: atomic SRCU + raw spinlock dependency cycle
  testtype 6: synchronize_srcu_atomic() inside rcu_read_lock()

Co-developed-by: Zqiang 
Signed-off-by: Zqiang 
Signed-off-by: Kunwu Chan 
Acked-by: Boqun Feng 
Reviewed-by: Joel Fernandes 
Signed-off-by: Paul E. McKenney

rcutorture: Synchronously wait for all rcu_torture_irq() callbacks to complete

2026-10-12T23:51:51+00:00

The rcu_torture_reader() drives RCU readers from interrupt context via
smp_call_function_single(cpu, rcu_torture_irq, NULL, 0) with wait=0, to
runs rcu_torture_irq() on a remote CPU. this is async, nothing waits for
the remote handler to run.

On shutdown, torture_stop_kthread() only waits for each reader kthread to
return, and the reader's timer_delete_sync() only drains its timer. Neither
waits for a rcu_torture_irq() which still pending or executing on a remote
CPU, so it can run after all readers have exited and rcu_torture_cleanup()
has already advanced.

1. rcu_torture_irq() may issue cur_ops->call(rhp, rcu_torture_timer_cb)
   after cur_ops->cb_barrier() has been waiting for all outstanding
   callbacks complete. once the module is unloaded, fires into freed
   module text, a use-after-free happen.

2. rcu_torture_irq() may still be inside rcu_torture_one_read(), holding
   a read-side critical section, when cur_ops->cleanup() tears the flavor
   down (e.g. cleanup_srcu_struct()), triggering an active-reader warning
   or use-after-free of the torn-down structure.

This commit therefore issue a kick_all_cpus_sync() after all readers
kthread have returned and before cur_ops->cb_barrier(), synchronous IPI
round trip to every CPU guarantees that every rcu_torture_irq() which
previously issued by any reader has completed.

Signed-off-by: Zqiang 
Signed-off-by: Paul E. McKenney

rcutorture: Fix divide-by-zero with fwd_progress_div=1

2026-10-12T23:51:51+00:00

When fwd_progress_div=1, the forward-progress test computes:
  sd4 = (sd + div - 1) / div = sd
  dur = sd4 + torture_random(&trs) % (sd - sd4) = sd4 + % 0

The modulo operation with a zero divisor triggers an integer
division by zero (undefined behavior at the C level, #DE trap on x86),
causing a kernel Oops and panic. On x86_64, this manifests as:

  rcu_torture_fwd_prog_nr: Starting forward-progress test 0
  Oops: divide error: 0000 [#1] SMP PTI
  RIP: 0010:rcu_torture_fwd_prog+0x90b/0x1160
  R12: 0000000000000000

The existing guard only handles non-positive values. However,
fwd_progress_div=1 also makes the random range empty because
sd4 == sd.

Change the guard to reject values below 2. The forward-progress test
only reaches this calculation when stall_dur() is positive, so
sd = stall_dur() + 1 >= 2. For fwd_progress_div >= 2, sd4 < sd,
ensuring that sd - sd4 is at least 1.

Keep the existing fallback to the default value of 4 for invalid
values.

Verified with QEMU/KVM: a 138-second run with fwd_progress_div=1
completed 81 forward-progress test cycles without a crash.

Fixes: 1b27291b1ea4f ("rcutorture: Add forward-progress tests for RCU grace periods")
Signed-off-by: Kunwu Chan 
Signed-off-by: Paul E. McKenney

srcutree: Preserve IRQ state in synchronize_srcu_atomic() callchain

2026-10-12T23:50:40+00:00

synchronize_srcu_atomic() may be called with interrupts disabled, but
its callchain uses raw_spin_lock_irq_rcu_node() /
raw_spin_unlock_irq_rcu_node(), which unconditionally enables
interrupts on unlock. This can incorrectly change the caller's IRQ
state.

Use the irqsave/irqrestore variants for the locks in this callchain
so that the caller's IRQ state is preserved.

Co-developed-by: Zqiang 
Signed-off-by: Zqiang 
Signed-off-by: Kunwu Chan 
Acked-by: Boqun Feng 
Signed-off-by: Paul E. McKenney

srcutiny: Add lockdep and early-boot checks to synchronize_srcu_atomic()

2026-10-12T23:50:40+00:00

Add the RCU_LOCKDEP_WARN and early-boot check that the Tree version
gained, srcu_lock_sync() was already present.

Suggested-by: Zqiang 
Signed-off-by: Kunwu Chan 
Reviewed-by: Bradley Morgan 
Reviewed-by: Joel Fernandes 
Signed-off-by: Paul E. McKenney

srcutree: Add lockdep and early-boot checks to synchronize_srcu_atomic()

2026-10-12T23:50:40+00:00

Add the lockdep annotation, same-type SRCU nesting warning, and
early-boot check used by __synchronize_srcu().

Suggested-by: Zqiang 
Signed-off-by: Kunwu Chan 
Reviewed-by: Joel Fernandes 
Signed-off-by: Paul E. McKenney

srcutree: Skip torture to-big transition for atomic SRCU

2026-10-12T23:50:40+00:00

Atomic SRCU does not use the srcu_node combining tree. Exclude it
from the SRCU_SIZING_IS_TORTURE() transition in
srcu_torture_stats_print(), and warn if such a transition is requested.

Signed-off-by: Kunwu Chan 
Signed-off-by: Paul E. McKenney

srcutree: Don't transition atomic SRCU to big in srcu_gp_end()

2026-10-12T23:50:40+00:00

Atomic SRCU must remain in the small size state. Warn if this
invariant is violated and avoid transitioning to big in that case.

[ paulmck: Folded "if" onto one line for 100-character limit. ]

Signed-off-by: Kunwu Chan 
Signed-off-by: Paul E. McKenney 
Reviewed-by: Bradley Morgan