Currently, there is no convenient way to see the info that the
ref_tracking infrastructure collects. Attempt to create a file in
debugfs when called from ref_tracker_dir_init().

The file is given the name "class@%px", as having the unmodified address
is helpful for debugging. This should be safe since this directory is only
accessible by root

While ref_tracker_dir_init() is generally called from a context where
sleeping is OK, ref_tracker_dir_exit() can be called from anywhere.
Thus, dentry cleanup must be handled asynchronously.

Add a new global xarray that has entries with the ref_tracker_dir
pointer as the index and the corresponding debugfs dentry pointer as the
value. Instead of removing the debugfs dentry, have
ref_tracker_dir_exit() set a mark on the xarray entry and schedule a
workqueue job. The workqueue job then walks the xarray looking for
marked entries, and removes their xarray entries and the debugfs
dentries.

Because of this, the debugfs dentry can outlive the corresponding
ref_tracker_dir. Have ref_tracker_debugfs_show() take extra care to
ensure that it's safe to dereference the dir pointer before using it.

Signed-off-by: Jeff Layton <jlayton@kernel.org>
---
 include/linux/ref_tracker.h |  17 +++++
 lib/ref_tracker.c           | 147 ++++++++++++++++++++++++++++++++++++++++++--
 2 files changed, 159 insertions(+), 5 deletions(-)

diff --git a/include/linux/ref_tracker.h b/include/linux/ref_tracker.h
index 3968f993db81e95c0d58c81454311841c1b9cd35..28bbf436a8f4646cfac181d618195a9460bda196 100644
--- a/include/linux/ref_tracker.h
+++ b/include/linux/ref_tracker.h
@@ -26,6 +26,18 @@ struct ref_tracker_dir {
 
 #ifdef CONFIG_REF_TRACKER
 
+#ifdef CONFIG_DEBUG_FS
+
+void ref_tracker_dir_debugfs(struct ref_tracker_dir *dir);
+
+#else /* CONFIG_DEBUG_FS */
+
+static inline void ref_tracker_dir_debugfs(struct ref_tracker_dir *dir)
+{
+}
+
+#endif /* CONFIG_DEBUG_FS */
+
 static inline void ref_tracker_dir_init(struct ref_tracker_dir *dir,
 					unsigned int quarantine_count,
 					const char *class,
@@ -40,6 +52,7 @@ static inline void ref_tracker_dir_init(struct ref_tracker_dir *dir,
 	refcount_set(&dir->no_tracker, 1);
 	dir->class = class;
 	strscpy(dir->name, name, sizeof(dir->name));
+	ref_tracker_dir_debugfs(dir);
 	stack_depot_init();
 }
 
@@ -68,6 +81,10 @@ static inline void ref_tracker_dir_init(struct ref_tracker_dir *dir,
 {
 }
 
+static inline void ref_tracker_dir_debugfs(struct ref_tracker_dir *dir)
+{
+}
+
 static inline void ref_tracker_dir_exit(struct ref_tracker_dir *dir)
 {
 }
diff --git a/lib/ref_tracker.c b/lib/ref_tracker.c
index 73b606570cce9e551d13e65365a87dc4ce748b13..4f1c4fe5e6b1274b6aeb733a3f8c06d1dff003f5 100644
--- a/lib/ref_tracker.c
+++ b/lib/ref_tracker.c
@@ -29,6 +29,35 @@ struct ref_tracker_dir_stats {
 	} stacks[];
 };
 
+#ifdef CONFIG_DEBUG_FS
+#include <linux/xarray.h>
+
+/*
+ * ref_tracker_dir_init() is usually called in allocation-safe contexts, but
+ * the same is not true of ref_tracker_dir_exit() which can be called from
+ * anywhere an object is freed. Removing debugfs dentries is a blocking
+ * operation, so we defer that work to the debugfs_reap_worker.
+ *
+ * Each dentry is tracked in the appropriate xarray.  When
+ * ref_tracker_dir_exit() is called, its entries in the xarrays are marked and
+ * the workqueue job is scheduled. The worker then runs and deletes any marked
+ * dentries asynchronously.
+ */
+static struct xarray		debugfs_dentries;
+static struct work_struct	debugfs_reap_worker;
+
+#define REF_TRACKER_DIR_DEAD	XA_MARK_0
+static inline void ref_tracker_debugfs_mark(struct ref_tracker_dir *dir)
+{
+	xa_set_mark(&debugfs_dentries, (unsigned long)dir, REF_TRACKER_DIR_DEAD);
+	schedule_work(&debugfs_reap_worker);
+}
+#else
+static inline void ref_tracker_debugfs_mark(struct ref_tracker_dir *dir)
+{
+}
+#endif
+
 static struct ref_tracker_dir_stats *
 ref_tracker_get_stats(struct ref_tracker_dir *dir, unsigned int limit)
 {
@@ -185,6 +214,11 @@ void ref_tracker_dir_exit(struct ref_tracker_dir *dir)
 	bool leak = false;
 
 	dir->dead = true;
+	/*
+	 * The xarray entries must be marked before the dir->lock is taken to
+	 * protect simultaneous debugfs readers.
+	 */
+	ref_tracker_debugfs_mark(dir);
 	spin_lock_irqsave(&dir->lock, flags);
 	list_for_each_entry_safe(tracker, n, &dir->quarantine, head) {
 		list_del(&tracker->head);
@@ -312,23 +346,126 @@ static void __ostream_printf pr_ostream_seq(struct ostream *stream, char *fmt, .
 	va_end(args);
 }
 
-static __maybe_unused int
-ref_tracker_dir_seq_print(struct ref_tracker_dir *dir, struct seq_file *seq)
+static int ref_tracker_dir_seq_print(struct ref_tracker_dir *dir, struct seq_file *seq)
 {
 	struct ostream os = { .func = pr_ostream_seq,
 			      .prefix = "",
 			      .seq = seq };
-	unsigned long flags;
 
-	spin_lock_irqsave(&dir->lock, flags);
 	__ref_tracker_dir_pr_ostream(dir, 16, &os);
-	spin_unlock_irqrestore(&dir->lock, flags);
 
 	return os.used;
 }
 
+static int ref_tracker_debugfs_show(struct seq_file *f, void *v)
+{
+	struct ref_tracker_dir *dir = f->private;
+	unsigned long index = (unsigned long)dir;
+	unsigned long flags;
+	int ret;
+
+	/*
+	 * "dir" may not exist at this point if ref_tracker_dir_exit() has
+	 * already been called. Take care not to dereference it until its
+	 * legitimacy is established.
+	 *
+	 * The xa_lock is necessary to ensure that "dir" doesn't disappear
+	 * before its lock can be taken. If it's in the hash and not marked
+	 * dead, then it's safe to take dir->lock which prevents
+	 * ref_tracker_dir_exit() from completing. Once the dir->lock is
+	 * acquired, the xa_lock can be released. All of this must be IRQ-safe.
+	 */
+	xa_lock_irqsave(&debugfs_dentries, flags);
+	if (!xa_load(&debugfs_dentries, index) ||
+	    xa_get_mark(&debugfs_dentries, index, REF_TRACKER_DIR_DEAD)) {
+		xa_unlock_irqrestore(&debugfs_dentries, flags);
+		return -ENODATA;
+	}
+
+	spin_lock(&dir->lock);
+	xa_unlock(&debugfs_dentries);
+	ret = ref_tracker_dir_seq_print(dir, f);
+	spin_unlock_irqrestore(&dir->lock, flags);
+	return ret;
+}
+
+static int ref_tracker_debugfs_open(struct inode *inode, struct file *filp)
+{
+	struct ref_tracker_dir *dir = inode->i_private;
+
+	return single_open(filp, ref_tracker_debugfs_show, dir);
+}
+
+static const struct file_operations ref_tracker_debugfs_fops = {
+	.owner		= THIS_MODULE,
+	.open		= ref_tracker_debugfs_open,
+	.read		= seq_read,
+	.llseek		= seq_lseek,
+	.release	= single_release,
+};
+
+/**
+ * ref_tracker_dir_debugfs - create debugfs file for ref_tracker_dir
+ * @dir: ref_tracker_dir to be associated with debugfs file
+ *
+ * In most cases, a debugfs file will be created automatically for every
+ * ref_tracker_dir. If the object was created before debugfs is brought up
+ * then that may fail. In those cases, it is safe to call this at a later
+ * time to create the file.
+ */
+void ref_tracker_dir_debugfs(struct ref_tracker_dir *dir)
+{
+	char name[NAME_MAX + 1];
+	struct dentry *dentry;
+	int ret;
+
+	/* No-op if already created */
+	dentry = xa_load(&debugfs_dentries, (unsigned long)dir);
+	if (dentry && !xa_is_err(dentry))
+		return;
+
+	ret = snprintf(name, sizeof(name), "%s@%px", dir->class, dir);
+	name[sizeof(name) - 1] = '\0';
+
+	if (ret < sizeof(name)) {
+		dentry = debugfs_create_file(name, S_IFREG | 0400,
+						  ref_tracker_debug_dir, dir,
+						  &ref_tracker_debugfs_fops);
+		if (!IS_ERR(dentry)) {
+			void *old;
+
+			old = xa_store(&debugfs_dentries, (unsigned long)dir,
+				       dentry, GFP_KERNEL);
+
+			if (xa_is_err(old))
+				debugfs_remove(dentry);
+			else
+				WARN_ON_ONCE(old);
+		}
+	}
+}
+EXPORT_SYMBOL(ref_tracker_dir_debugfs);
+
+static void debugfs_reap_work(struct work_struct *work)
+{
+	struct dentry *dentry;
+	unsigned long index;
+	bool reaped;
+
+	do {
+		reaped = false;
+		xa_for_each_marked(&debugfs_dentries, index, dentry, REF_TRACKER_DIR_DEAD) {
+			xa_erase(&debugfs_dentries, index);
+			debugfs_remove(dentry);
+			reaped = true;
+		}
+	} while (reaped);
+}
+
 static int __init ref_tracker_debugfs_init(void)
 {
+	INIT_WORK(&debugfs_reap_worker, debugfs_reap_work);
+	xa_init_flags(&debugfs_dentries, XA_FLAGS_LOCK_IRQ);
 	ref_tracker_debug_dir = debugfs_create_dir("ref_tracker", NULL);
 	return 0;
 }

-- 
2.49.0

Hello,

kernel test robot noticed "BUG:spinlock_trylock_failure_on_UP_on_CPU" on:

commit: 1d67742f4a90af28c0f655a9ed8d730459b1f220 ("[PATCH v14 6/9] ref_tracker: automatically register a file in debugfs for a ref_tracker_dir")
url: https://github.com/intel-lab-lkp/linux/commits/Jeff-Layton/ref_tracker-don-t-use-pK-in-pr_ostream-output/20250610-230236
patch link: https://lore.kernel.org/all/20250610-reftrack-dbgfs-v14-6-efb532861428@kernel.org/
patch subject: [PATCH v14 6/9] ref_tracker: automatically register a file in debugfs for a ref_tracker_dir

in testcase: boot

config: i386-randconfig-051-20250611
compiler: clang-20
test machine: qemu-system-i386 -enable-kvm -cpu SandyBridge -smp 2 -m 4G

(please refer to attached dmesg/kmsg for entire log/backtrace)


+---------------------------------------------+------------+------------+
|                                             | ac254e0747 | 1d67742f4a |
+---------------------------------------------+------------+------------+
| BUG:spinlock_trylock_failure_on_UP_on_CPU   | 0          | 12         |
| WARNING:at_kernel/workqueue.c:#__queue_work | 0          | 12         |
| EIP:__queue_work                            | 0          | 12         |
+---------------------------------------------+------------+------------+


If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <oliver.sang@intel.com>
| Closes: https://lore.kernel.org/oe-lkp/202506171517.a1e85b6f-lkp@intel.com


[   13.649422][    T1] BUG: spinlock trylock failure on UP on CPU#0, swapper/1
[ 13.650195][ T1] lock: debugfs_dentries+0x0/0x34, .magic: 00000000, .owner: <none>/-1, .owner_cpu: 0 
[   13.651211][    T1] CPU: 0 UID: 0 PID: 1 Comm: swapper Not tainted 6.15.0-13749-g1d67742f4a90 #1 PREEMPT(undef)
[   13.652340][    T1] Call Trace:
[ 13.652705][ T1] __dump_stack (lib/dump_stack.c:95) 
[ 13.653206][ T1] dump_stack_lvl (lib/dump_stack.c:123) 
[ 13.653363][ T1] dump_stack (lib/dump_stack.c:129) 
[ 13.653363][ T1] spin_dump (kernel/locking/spinlock_debug.c:71) 
[ 13.653363][ T1] do_raw_spin_trylock (kernel/locking/spinlock_debug.c:?) 
[ 13.653363][ T1] ? xa_set_mark (lib/xarray.c:2075 lib/xarray.c:2146) 
[ 13.653363][ T1] _raw_spin_lock (include/linux/spinlock_api_smp.h:134 kernel/locking/spinlock.c:154) 
[ 13.653363][ T1] xa_set_mark (lib/xarray.c:2075 lib/xarray.c:2146) 
[ 13.653363][ T1] ref_tracker_dir_exit (include/linux/workqueue.h:723 lib/ref_tracker.c:53 lib/ref_tracker.c:221) 
[ 13.653363][ T1] ? kvfree (mm/slub.c:5059) 
[ 13.653363][ T1] free_netdev (net/core/dev.c:11880) 
[ 13.653363][ T1] free_arcdev (drivers/net/arcnet/arcnet.c:503) 
[ 13.653363][ T1] com90io_init (drivers/net/arcnet/com90io.c:401) 
[ 13.653363][ T1] do_one_initcall (init/main.c:1273) 
[ 13.653363][ T1] ? com90io_setup (drivers/net/arcnet/com90io.c:384) 
[ 13.653363][ T1] ? __lock_acquire (kernel/locking/lockdep.c:4677) 
[ 13.653363][ T1] ? kvm_sched_clock_read (arch/x86/kernel/kvmclock.c:91) 
[ 13.653363][ T1] ? sched_clock_noinstr (arch/x86/kernel/tsc.c:271) 
[ 13.653363][ T1] ? local_clock_noinstr (kernel/sched/clock.c:269 kernel/sched/clock.c:306) 
[ 13.653363][ T1] ? __lock_acquire (kernel/locking/lockdep.c:4677) 
[ 13.653363][ T1] ? local_clock_noinstr (kernel/sched/clock.c:269 kernel/sched/clock.c:306) 
[ 13.653363][ T1] ? __this_cpu_preempt_check (lib/smp_processor_id.c:67) 
[ 13.653363][ T1] ? kvm_sched_clock_read (arch/x86/kernel/kvmclock.c:91) 
[ 13.653363][ T1] ? sched_clock_noinstr (arch/x86/kernel/tsc.c:271) 
[ 13.653363][ T1] ? local_clock_noinstr (kernel/sched/clock.c:269 kernel/sched/clock.c:306) 
[ 13.653363][ T1] ? __this_cpu_preempt_check (lib/smp_processor_id.c:67) 
[ 13.653363][ T1] ? irqtime_account_irq (kernel/sched/cputime.c:?) 
[ 13.653363][ T1] ? __this_cpu_preempt_check (lib/smp_processor_id.c:67) 
[ 13.653363][ T1] ? lockdep_hardirqs_on (kernel/locking/lockdep.c:4475) 
[ 13.653363][ T1] ? trace_hardirqs_on (kernel/trace/trace_preemptirq.c:80) 
[ 13.653363][ T1] ? irqentry_exit (kernel/entry/common.c:?) 
[ 13.653363][ T1] ? vmware_sched_clock (arch/x86/kernel/apic/apic.c:1050) 
[ 13.653363][ T1] ? sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1050) 
[ 13.653363][ T1] ? handle_exception (arch/x86/entry/entry_32.S:1048) 
[ 13.653363][ T1] ? strlen (arch/x86/lib/string_32.c:?) 
[ 13.653363][ T1] ? next_arg (lib/cmdline.c:273) 
[ 13.653363][ T1] ? parameq (kernel/params.c:90 kernel/params.c:99) 
[ 13.653363][ T1] ? parse_args (kernel/params.c:153) 
[ 13.653363][ T1] do_initcall_level (init/main.c:1334) 
[ 13.653363][ T1] do_initcalls (init/main.c:1348) 
[ 13.653363][ T1] do_basic_setup (init/main.c:1371) 
[ 13.653363][ T1] kernel_init_freeable (init/main.c:1585) 
[ 13.653363][ T1] ? rest_init (init/main.c:1465) 
[ 13.653363][ T1] kernel_init (init/main.c:1475) 
[ 13.653363][ T1] ret_from_fork (arch/x86/kernel/process.c:154) 
[ 13.653363][ T1] ? debug_smp_processor_id (lib/smp_processor_id.c:60) 
[ 13.653363][ T1] ? rest_init (init/main.c:1465) 
[ 13.653363][ T1] ret_from_fork_asm (arch/x86/entry/entry_32.S:737) 
[ 13.653363][ T1] entry_INT80_32 (arch/x86/entry/entry_32.S:945) 
[   13.679093][    T1] ------------[ cut here ]------------
[ 13.679700][ T1] WARNING: CPU: 0 PID: 1 at kernel/workqueue.c:2325 __queue_work (kernel/workqueue.c:2325) 
[   13.680616][    T1] Modules linked in:
[   13.681057][    T1] CPU: 0 UID: 0 PID: 1 Comm: swapper Not tainted 6.15.0-13749-g1d67742f4a90 #1 PREEMPT(undef)
[ 13.682176][ T1] EIP: __queue_work (kernel/workqueue.c:2325) 
[ 13.682700][ T1] Code: 4d ec 8b 40 04 89 45 f0 31 db 39 c8 0f 95 c3 b8 98 9f dd d5 89 da 31 c9 6a 00 e8 d4 de 11 00 83 c4 04 8b 45 ec 39 45 f0 74 1a <0f> 0b b8 b0 9f dd d5 89 da 31 c9 6a 00 e8 b7 de 11 00 83 c4 04 e9
All code
========
   0:	4d ec                	rex.WRB in (%dx),%al
   2:	8b 40 04             	mov    0x4(%rax),%eax
   5:	89 45 f0             	mov    %eax,-0x10(%rbp)
   8:	31 db                	xor    %ebx,%ebx
   a:	39 c8                	cmp    %ecx,%eax
   c:	0f 95 c3             	setne  %bl
   f:	b8 98 9f dd d5       	mov    $0xd5dd9f98,%eax
  14:	89 da                	mov    %ebx,%edx
  16:	31 c9                	xor    %ecx,%ecx
  18:	6a 00                	push   $0x0
  1a:	e8 d4 de 11 00       	call   0x11def3
  1f:	83 c4 04             	add    $0x4,%esp
  22:	8b 45 ec             	mov    -0x14(%rbp),%eax
  25:	39 45 f0             	cmp    %eax,-0x10(%rbp)
  28:	74 1a                	je     0x44
  2a:*	0f 0b                	ud2		<-- trapping instruction
  2c:	b8 b0 9f dd d5       	mov    $0xd5dd9fb0,%eax
  31:	89 da                	mov    %ebx,%edx
  33:	31 c9                	xor    %ecx,%ecx
  35:	6a 00                	push   $0x0
  37:	e8 b7 de 11 00       	call   0x11def3
  3c:	83 c4 04             	add    $0x4,%esp
  3f:	e9                   	.byte 0xe9

Code starting with the faulting instruction
===========================================
   0:	0f 0b                	ud2
   2:	b8 b0 9f dd d5       	mov    $0xd5dd9fb0,%eax
   7:	89 da                	mov    %ebx,%edx
   9:	31 c9                	xor    %ecx,%ecx
   b:	6a 00                	push   $0x0
   d:	e8 b7 de 11 00       	call   0x11dec9
  12:	83 c4 04             	add    $0x4,%esp
  15:	e9                   	.byte 0xe9
[   13.683052][    T1] EAX: d67dc32c EBX: 00000001 ECX: 00000000 EDX: 00000000
[   13.683052][    T1] ESI: c0321000 EDI: d576af44 EBP: c03a7b9c ESP: c03a7b7c
[   13.683052][    T1] DS: 007b ES: 007b FS: 0000 GS: 0000 SS: 0068 EFLAGS: 00010017
[   13.683052][    T1] CR0: 80050033 CR2: b7ded3d5 CR3: 16086000 CR4: 000406d0
[   13.683052][    T1] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
[   13.683052][    T1] DR6: fffe0ff0 DR7: 00000400
[   13.683052][    T1] Call Trace:
[ 13.683052][ T1] queue_work_on (kernel/workqueue.c:2392) 
[ 13.683052][ T1] ref_tracker_dir_exit (lib/ref_tracker.c:222) 
[ 13.683052][ T1] ? kvfree (mm/slub.c:5059) 
[ 13.683052][ T1] free_netdev (net/core/dev.c:11880) 
[ 13.683052][ T1] free_arcdev (drivers/net/arcnet/arcnet.c:503) 
[ 13.683052][ T1] com90io_init (drivers/net/arcnet/com90io.c:401) 
[ 13.683052][ T1] do_one_initcall (init/main.c:1273) 
[ 13.683052][ T1] ? com90io_setup (drivers/net/arcnet/com90io.c:384) 
[ 13.683052][ T1] ? __lock_acquire (kernel/locking/lockdep.c:4677) 
[ 13.683052][ T1] ? kvm_sched_clock_read (arch/x86/kernel/kvmclock.c:91) 
[ 13.683052][ T1] ? sched_clock_noinstr (arch/x86/kernel/tsc.c:271) 
[ 13.683052][ T1] ? local_clock_noinstr (kernel/sched/clock.c:269 kernel/sched/clock.c:306) 
[ 13.683052][ T1] ? __lock_acquire (kernel/locking/lockdep.c:4677) 
[ 13.683052][ T1] ? local_clock_noinstr (kernel/sched/clock.c:269 kernel/sched/clock.c:306) 
[ 13.683052][ T1] ? __this_cpu_preempt_check (lib/smp_processor_id.c:67) 
[ 13.683052][ T1] ? kvm_sched_clock_read (arch/x86/kernel/kvmclock.c:91) 
[ 13.683052][ T1] ? sched_clock_noinstr (arch/x86/kernel/tsc.c:271) 
[ 13.683052][ T1] ? local_clock_noinstr (kernel/sched/clock.c:269 kernel/sched/clock.c:306) 
[ 13.683052][ T1] ? __this_cpu_preempt_check (lib/smp_processor_id.c:67) 
[ 13.683052][ T1] ? irqtime_account_irq (kernel/sched/cputime.c:?) 
[ 13.683052][ T1] ? __this_cpu_preempt_check (lib/smp_processor_id.c:67) 
[ 13.683052][ T1] ? lockdep_hardirqs_on (kernel/locking/lockdep.c:4475) 
[ 13.683052][ T1] ? trace_hardirqs_on (kernel/trace/trace_preemptirq.c:80) 
[ 13.683052][ T1] ? irqentry_exit (kernel/entry/common.c:?) 
[ 13.683052][ T1] ? vmware_sched_clock (arch/x86/kernel/apic/apic.c:1050) 
[ 13.683052][ T1] ? sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1050) 
[ 13.683052][ T1] ? handle_exception (arch/x86/entry/entry_32.S:1048) 
[ 13.683052][ T1] ? strlen (arch/x86/lib/string_32.c:?) 
[ 13.683052][ T1] ? next_arg (lib/cmdline.c:273) 
[ 13.683052][ T1] ? parameq (kernel/params.c:90 kernel/params.c:99) 
[ 13.683052][ T1] ? parse_args (kernel/params.c:153) 
[ 13.683052][ T1] do_initcall_level (init/main.c:1334) 
[ 13.683052][ T1] do_initcalls (init/main.c:1348) 
[ 13.683052][ T1] do_basic_setup (init/main.c:1371) 
[ 13.683052][ T1] kernel_init_freeable (init/main.c:1585) 
[ 13.683052][ T1] ? rest_init (init/main.c:1465) 
[ 13.683052][ T1] kernel_init (init/main.c:1475) 
[ 13.683052][ T1] ret_from_fork (arch/x86/kernel/process.c:154) 
[ 13.683052][ T1] ? debug_smp_processor_id (lib/smp_processor_id.c:60) 
[ 13.683052][ T1] ? rest_init (init/main.c:1465) 
[ 13.683052][ T1] ret_from_fork_asm (arch/x86/entry/entry_32.S:737) 
[ 13.683052][ T1] entry_INT80_32 (arch/x86/entry/entry_32.S:945) 
[   13.683052][    T1] irq event stamp: 81333
[ 13.683052][ T1] hardirqs last enabled at (81333): _raw_spin_unlock_irqrestore (arch/x86/include/asm/irqflags.h:19 arch/x86/include/asm/irqflags.h:109 arch/x86/include/asm/irqflags.h:151 include/linux/spinlock_api_smp.h:151 kernel/locking/spinlock.c:194) 
[ 13.683052][ T1] hardirqs last disabled at (81332): kvfree_call_rcu (mm/slab_common.c:1443 mm/slab_common.c:1834 mm/slab_common.c:1963) 
[ 13.683052][ T1] softirqs last enabled at (80274): handle_softirqs (arch/x86/include/asm/preempt.h:27 kernel/softirq.c:426 kernel/softirq.c:607) 
[ 13.683052][ T1] softirqs last disabled at (80265): __do_softirq (kernel/softirq.c:614) 
[   13.683052][    T1] ---[ end trace 0000000000000000 ]---


The kernel config and materials to reproduce are available at:
https://download.01.org/0day-ci/archive/20250617/202506171517.a1e85b6f-lkp@intel.com



-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki