From nobody Mon Jun 8 08:28:38 2026 Received: from mail-wm1-f51.google.com (mail-wm1-f51.google.com [209.85.128.51]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 54A7F380FE3 for ; Thu, 4 Jun 2026 18:24:29 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.51 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780597470; cv=none; b=bUB5Mt4lr8pPbK2ZfG5Q1AIkqYdio3D6CZnKYdckZvfECNyW6FV6OPY2J50Qg7qvNbG06EY3FCbuEo6Jlkzlrs4wMPBewrtTcjaYLMhZlU0PWybsUJo2HvNBZKRvuZMnWImBUF/En6RGh/iNvJrTg5BtAeNub6MrHwZLj4cYqqQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780597470; c=relaxed/simple; bh=90O4xwaiOrLK9AQmOIsYex+cu6SToyEyb6ORubBfVgo=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=cowy8+47PgzMOGm5cVjZ7E3CT0a/S3c+GLeVGooQQiFWEXnJ0vTaCXZx0PiRslmbpNhlQKP1+n6Oa0SOgMg/Ok6veewn+QIGi7gypC4Hc/SC7vZIgEmbzNMElMe105Vj/h60Jvu+2rajF2+c6NVspVTuNey1cmedtF1h+Is/KMM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=cOew3Jia; arc=none smtp.client-ip=209.85.128.51 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="cOew3Jia" Received: by mail-wm1-f51.google.com with SMTP id 5b1f17b1804b1-490b1bbcf3aso8707515e9.1 for ; Thu, 04 Jun 2026 11:24:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1780597468; x=1781202268; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=KY7xVSejKqSeN27Js6FROD/NEXBGbGSvmQ/6Y7FcvD0=; b=cOew3Jiali9TKED0UdpwQVTABHiMihZLrieGauZRMSt5KnnHLAVAavl3+jXduKUhdp pK58SbF1YvVy2fNa1DNUOQ/Or5ANVKSF1QgME8tBf9e8EXQ+xBfqSdpcCQLrNp4RRQLf NlH12Pn1WX9Z84OhAsL0CTViSoZLubxvm++rJc42z91UGz7/TqpTQW/Q0Rj08k8p2VrB tX73NaPAFAB68yW5mj98PuysdyYkg0Lepj1A6oF4IXANGnDrUM0VHrCevA29CVFqN5Ut ES2YJMvJnbtnYF7iMuKkdCF7Fb1gqcpbyjWy6yD5sfLfkJIYi07JMHQ5Rq1bf/UCDuTW q7Ng== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780597468; x=1781202268; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=KY7xVSejKqSeN27Js6FROD/NEXBGbGSvmQ/6Y7FcvD0=; b=SUwAof3yFA9rr8QTR7TcGz60lpEfFwTNMXlwqE8SgeAqLWTVlprbauLs0Ap7TjehQG ekEqoD1Ir6TYKtXd1BI+yZDk14d4EBGRE90CKvKWxopfwZ3qrFfhpHb9A+NckJIZLebO L7fy0rcciUF9+kh/Z/d1walabRmfei/kICDX91qu0I0JfPYEchQ/3XculbBHVSnpH1ku NfZv+O+4iGcufwGOHpfLor1hsW/vyS1N+wBPngkmuurO0rnLRrlI0DLYLEpPotVL13Gr xXWEhJTfjFM4RuJWLrrf5qw0taOJzfmDTLlvKEos8Z33kQygLIqeu6zUR33VnzLdYAyg SaDw== X-Forwarded-Encrypted: i=1; AFNElJ9O8Yyvl56g/NkBaXyCukqgANtQQSqQjAFPcCxSHeUGHaOOXx7zqzsXt05io8CvDH2duf7XhpiTeDjdyQ0=@vger.kernel.org X-Gm-Message-State: AOJu0Yz0ulC3jAiR+UEoYa8sWBlQIoo/9ER48DS918oivbxlOXJR93aj IQll13zOHgV3U7kY3mo10ShMHNgRWcRoVhxdEKIJVCdCIh8h+BAqSuYf X-Gm-Gg: Acq92OEAFhhwpAhef1kNehV6jCK2M03L6HftX1dwSelDlMQ7ndVe38C5HLzxbmvD0M7 rqwEoo8tEfdqfoSDqXxUhsigjuIeGY0eA0qNV9KUyoLUQCHmifmLIq1mDcFTGwxb6HhwbkYup39 1pSvEMIMw5pDxg5rMmmPegsYq3b6gCwrOAOa3imaESL3rZsCUgRcHRp0VOYj2xl3PqvFH5V7s3L J70slzB+XMck0zYsoUlrObd3sX8pPs5tVYUpN6RmucuWpOGsrtmkOIxClZP0Udxf+lASMxFGSQZ eTz+xhssyPUtAzsWQIyEkUFiP9mpZ/wcNS5oN+MaHaMQYUvWKxZFG4v39i6yK/OkTTBGcDY9SRs auRW4FZxN6rQhgEIGHCilXUKIIYPrQMmH9heqwuXOObqbaRWPOBAyaiQduUvCN2myo6rA4Sq2wG vZalQNjzwHGeQlrTtxvAlIMYFvQl9H98RqluxaqAFI9a3nYEc= X-Received: by 2002:a05:600c:1f96:b0:490:53d3:47a9 with SMTP id 5b1f17b1804b1-490b5e7962dmr143876325e9.3.1780597467554; Thu, 04 Jun 2026 11:24:27 -0700 (PDT) Received: from builder ([2001:9e8:f12d:8916:be24:11ff:fe30:5d85]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-490bc3fd663sm100702395e9.10.2026.06.04.11.24.26 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 04 Jun 2026 11:24:27 -0700 (PDT) From: Jonas Jelonek To: Thomas Bogendoerfer , linux-mips@vger.kernel.org Cc: Sebastian Andrzej Siewior , Clark Williams , Steven Rostedt , Thomas Gleixner , Jiayuan Chen , linux-rt-devel@lists.linux.dev, linux-kernel@vger.kernel.org, Jonas Jelonek , stable@vger.kernel.org Subject: [PATCH] MIPS: smp: report dying CPU to RCU in stop_this_cpu() Date: Thu, 4 Jun 2026 18:24:07 +0000 Message-ID: <20260604182407.3109536-1-jelonek.jonas@gmail.com> X-Mailer: git-send-email 2.51.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" smp_send_stop() parks all secondary CPUs in stop_this_cpu(). The function marks the CPU offline for the scheduler via set_cpu_online(false) but never informs RCU, so RCU keeps expecting a quiescent state from CPUs that are now spinning forever with interrupts disabled. As long as nothing waits for an RCU grace period after smp_send_stop() this is harmless, which is why it went unnoticed. Since commit 91840be8f710 ("irq_work: Fix use-after-free in irq_work_single() on PREEMPT= _RT") however, irq_work_sync() calls synchronize_rcu() on architectures without an irq_work self-IPI, i.e. where arch_irq_work_has_interrupt() returns false. That is the asm-generic default used by MIPS. Any irq_work_sync() issued in the reboot/shutdown path after smp_send_stop() then blocks on a grace period that can never complete, hanging the reboot: WARNING: CPU: 0 PID: 15 at kernel/irq_work.c:144 irq_work_queue_on ... rcu: INFO: rcu_sched detected stalls on CPUs/tasks: rcu: Offline CPU 1 blocking current GP. rcu: Offline CPU 2 blocking current GP. rcu: Offline CPU 3 blocking current GP. This issue popped up during kernel bump downstream in OpenWrt from 6.18.33 to 6.18.34, since the suspected change has been backported to 6.18 stable branch [1]. Call rcutree_report_cpu_dead() once interrupts are disabled, mirroring the generic CPU-hotplug offline path (and arm64's stop handling), so RCU stops waiting on the parked CPUs and grace periods can still complete. [1] https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit= /?h=3Dlinux-6.18.y&id=3D18c0456ea2615b1a743a6db739c74411c3b42bc6 Fixes: 91840be8f710 ("irq_work: Fix use-after-free in irq_work_single() on = PREEMPT_RT") CC: stable@vger.kernel.org Signed-off-by: Jonas Jelonek diff --git a/arch/mips/kernel/smp.c b/arch/mips/kernel/smp.c index 4868e79f3b30..0f28b4a62e72 100644 --- a/arch/mips/kernel/smp.c +++ b/arch/mips/kernel/smp.c @@ -20,6 +20,7 @@ #include #include #include +#include #include #include #include @@ -422,6 +423,7 @@ static void stop_this_cpu(void *dummy) set_cpu_online(smp_processor_id(), false); calculate_cpu_foreign_map(); local_irq_disable(); + rcutree_report_cpu_dead(); while (1); } =20 --=20 2.51.0