When seq_nr wraps around, the next reorder job with seq 0 is hashed to
the first CPU in padata_do_serial(). Correspondingly, need reset pd->cpu
to the first one when pd->processed wraps around. Otherwise, if the
number of used CPUs is not a power of 2, padata_find_next() will be
checking a wrong list, hence deadlock.

Fixes: 6fc4dbcf0276 ("padata: Replace delayed timer with immediate workqueue in padata_reorder")
Signed-off-by: Xiao Liang <shaw.leon@gmail.com>
---
 kernel/padata.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/kernel/padata.c b/kernel/padata.c
index 7eee94166357..ebb52c6db637 100644
--- a/kernel/padata.c
+++ b/kernel/padata.c
@@ -290,7 +290,11 @@ static struct padata_priv *padata_find_next(struct parallel_data *pd,
 	if (remove_object) {
 		list_del_init(&padata->list);
 		++pd->processed;
-		pd->cpu = cpumask_next_wrap(cpu, pd->cpumask.pcpu);
+		/* When sequence wraps around, reset to the first CPU. */
+		if (unlikely(pd->processed == 0))
+			pd->cpu = cpumask_first(pd->cpumask.pcpu);
+		else
+			pd->cpu = cpumask_next_wrap(cpu, pd->cpumask.pcpu);
 	}
 
 	spin_unlock(&reorder->lock);
-- 
2.50.0

On Tue, Jul 15, 2025 at 02:23:57PM +0800, Xiao Liang wrote:
> When seq_nr wraps around, the next reorder job with seq 0 is hashed to
> the first CPU in padata_do_serial(). Correspondingly, need reset pd->cpu
> to the first one when pd->processed wraps around. Otherwise, if the
> number of used CPUs is not a power of 2, padata_find_next() will be
> checking a wrong list, hence deadlock.
> 
> Fixes: 6fc4dbcf0276 ("padata: Replace delayed timer with immediate workqueue in padata_reorder")
> Signed-off-by: Xiao Liang <shaw.leon@gmail.com>
> ---
>  kernel/padata.c | 6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)
> 
> diff --git a/kernel/padata.c b/kernel/padata.c
> index 7eee94166357..ebb52c6db637 100644
> --- a/kernel/padata.c
> +++ b/kernel/padata.c
> @@ -290,7 +290,11 @@ static struct padata_priv *padata_find_next(struct parallel_data *pd,
>  	if (remove_object) {
>  		list_del_init(&padata->list);
>  		++pd->processed;
> -		pd->cpu = cpumask_next_wrap(cpu, pd->cpumask.pcpu);
> +		/* When sequence wraps around, reset to the first CPU. */
> +		if (unlikely(pd->processed == 0))
> +			pd->cpu = cpumask_first(pd->cpumask.pcpu);
> +		else
> +			pd->cpu = cpumask_next_wrap(cpu, pd->cpumask.pcpu);

This patch does not apply to the current mainline kernel.

Please check whether it is still needed.

Thanks,
-- 
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

> diff --git a/kernel/padata.c b/kernel/padata.c
> index 7eee94166357..ebb52c6db637 100644
> --- a/kernel/padata.c
> +++ b/kernel/padata.c
> @@ -290,7 +290,11 @@ static struct padata_priv *padata_find_next(struct parallel_data *pd,
>         if (remove_object) {
>                 list_del_init(&padata->list);
>                 ++pd->processed;
> -               pd->cpu = cpumask_next_wrap(cpu, pd->cpumask.pcpu);
> +               /* When sequence wraps around, reset to the first CPU. */
> +               if (unlikely(pd->processed == 0))
> +                       pd->cpu = cpumask_first(pd->cpumask.pcpu);
> +               else
> +                       pd->cpu = cpumask_next_wrap(cpu, pd->cpumask.pcpu);
>         }
>
>         spin_unlock(&reorder->lock);
> --
> 2.50.0
>

Another question:
Do we even need a per-CPU reorder_list? It's always used
with a remote CPU id and spin-lock. Would a plain array of
struct padata_list be sufficient?