Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [Critical] rcu-tasks: NULL pointer dereference in rcu_tasks_irq_resched_enter() during early boot --
commit ea4914f1671c6b6ff32f3cbc1cd74fa6dd51744d Author: Josef Bacik <[email protected]> rcu-tasks: Add a Tasks RCU implementation for reader-marked trampolines This commit introduces a Tasks RCU implementation for architectures that make their trampolines Tasks Trace RCU readers. It hooks into the generic irq entry code to track preemptions. The tracking utilizes a per-CPU list for tasks preempted during irq exit. > diff --git a/kernel/entry/common.c b/kernel/entry/common.c > index e4acd50bd81a1..94318519998c8 100644 > --- a/kernel/entry/common.c > +++ b/kernel/entry/common.c [ ... ] > @@ -141,8 +142,13 @@ void raw_irqentry_exit_cond_resched(struct pt_regs *regs) > rcu_irq_exit_check_preempt(); > if (IS_ENABLED(CONFIG_DEBUG_ENTRY)) > WARN_ON_ONCE(!on_thread_stack()); > - if (need_resched() && arch_irqentry_exit_need_resched()) > + if (need_resched() && arch_irqentry_exit_need_resched()) { > + if (IS_ENABLED(CONFIG_TASKS_RCU_TRAMPOLINE_READERS)) > + > rcu_tasks_irq_resched_enter(instruction_pointer(regs)); > preempt_schedule_irq(); > + if (IS_ENABLED(CONFIG_TASKS_RCU_TRAMPOLINE_READERS)) > + rcu_tasks_irq_resched_exit(); > + } > } > } > diff --git a/kernel/rcu/tasks.h b/kernel/rcu/tasks.h > index 627295396cd91..f03be742be48c 100644 > --- a/kernel/rcu/tasks.h > +++ b/kernel/rcu/tasks.h [ ... ] > +void rcu_tasks_irq_resched_enter(unsigned long ip) > +{ > + struct task_struct *t = current; > + struct rcu_tasks_percpu *rtpcp = this_cpu_ptr(rcu_tasks.rtpcpu); > + > + lockdep_assert_irqs_disabled(); > + WRITE_ONCE(t->rcu_tasks_irq_ip, ip); > + t->rcu_tasks_exit_cpu = smp_processor_id(); > + raw_spin_lock_rcu_node(rtpcp); > + list_add(&t->rcu_tasks_exit_list, &rtpcp->rtp_exit_list); [Severity: Critical] Could this cause a null pointer dereference regression during early boot? When the trampoline reader feature is selected, raw_irqentry_exit_cond_resched() hooks into the generic irq exit path to call rcu_tasks_irq_resched_enter(). During early boot, interrupts are enabled via local_irq_enable() in start_kernel(), meaning preemptions can begin occurring. However, the per-cpu rtp_exit_list list head cannot be statically initialized and is dynamically initialized via cblist_init_generic() from a core_initcall. Since core_initcalls are executed much later by the kernel_init thread, any preemption before that phase will attempt to list_add() to a zero-initialized (null) rtp_exit_list. Would this lead to a kernel panic when the list macros dereference the uninitialized head pointer? > + raw_spin_unlock_rcu_node(rtpcp); > + > + if (unlikely(rcu_tasks_trampoline_text(ip))) > + rcu_tasks_tramp_hold(t); > + else > + rcu_tasks_tramp_release(t); > +} -- Sashiko AI review ยท https://sashiko.dev/#/patchset/20260918-b4-rcu-tasks-preempt-qs-v4-0-63f0e9d69...@toxicpanda.com?part=2
