From nobody Fri Oct 2 10:08:34 2026 Received: from ZR1P278CU001.outbound.protection.outlook.com (mail-switzerlandnorthazon11022088.outbound.protection.outlook.com [40.107.168.88]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D321E391E44 for ; Sun, 2 Aug 2026 12:44:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=40.107.168.88 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785674703; cv=fail; b=bJR3B2Ea7+qV62Lzx9G+o48bPSAi+RxqiweKr10AhV5+Lc5o95Rj80yA2td5JOLMtsXuQM1PWOy/vkSziLftkidnUJwDYL62Bgu3TaIx8S/s0eLi+5MnLy/SRoVPqVk29YSgjINReEdYDZvn16RDfo8KBK3o209zWqsOunv5vvU= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785674703; c=relaxed/simple; bh=f2rONKDGjJY4DkkPzzYAX1rIgACyoAnm6gbhXSw6GzY=; h=From:To:Cc:Subject:Date:Message-ID:Content-Type:MIME-Version; b=Md7jYcKk1XrGWmpgOdYcf2ICwObnL3RZr31wHRE7RHjSb3DOg7kxyvx5d5xbiv3U5c9SpdWMLS+4f2tAX8o3hiLm+NGKBAV+8vjdJfCCUZ+HA930pZprn4YAsVAtGDUNcWVrtQzxGVgwSoA5Bl9rxmgiFYvC37b8xbEgDnmtPFI= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=ethz.ch; spf=pass smtp.mailfrom=student.ethz.ch; dkim=pass (2048-bit key) header.d=ethz.ch header.i=@ethz.ch header.b=ee3I2iuh; arc=fail smtp.client-ip=40.107.168.88 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=ethz.ch Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=student.ethz.ch Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ethz.ch header.i=@ethz.ch header.b="ee3I2iuh" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=RxUrPX8GkXHjubuih1kiNr6XARWCzudxeifZA4ccnko9djvhs3iI5j2IO7e7X8t814ynwAgnnpkumujhTyNpqQGgf40/yatnRwxdQK0kzi3YuoyoQkEykusNMGeML/c5aG2XkzecuPdFzv8DwK8hbvBfn7Z7OZc0stjBIeBg6aVAf2Vf+uFqP6hO4YYGXwR/7wOiQnsVvTLQ0WXuhuJcB+TlzLgzT6OGyT9qHmQxF8XIs53dy+bV36KHY30NeDZ1dD0oEtvrTEwVi9G4yKbGB2jvn0Cl3gtkE7TP5ywZ1HYocJhq6Gmgb0ma+NWTQOJyDiu18mY0hNhLgccTZ33AjA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=yEBC3XETY0lTsT3LTwbuv/P6duLWcO8ZHaf8YO6LpQs=; b=l0GtqimpdPdfETaganLuBgGw8+YhTThppeA+zbkXVqBVRw5kA1zWZaigi9b1l5SDqI5rRIhRKQDQx0peUza3TWeK8kyDK0szBb4aVKsoBdacmjs6ttjF4Cg2pVXyJGABgUCPAiepS9NOpGbpfedhsTRG0zZLQZxm1At1KJupq1DDyos85inIJnacusGLUVwEmY588UVUATm4U/1fplQqftnizHWDJ6FQ/50hiinQKjnb/8CUpJtNu6CEoAwoOrdNI3SJGsc25/JEQiiJQNQGO/tHaZEGHrkNgjcF8KCC5ak4tvpQ0wL6XVeXK0C2Dc4wL8q34ffP3UyyE/vbvC8yvQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=student.ethz.ch; dmarc=pass action=none header.from=ethz.ch; dkim=pass header.d=ethz.ch; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ethz.ch; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=yEBC3XETY0lTsT3LTwbuv/P6duLWcO8ZHaf8YO6LpQs=; b=ee3I2iuhCGzrXlMEJQZB0tN7HH2n8vJDvOjH7GjUS2bJMYUiIt8a54jcrUGGS/BxfcN8wi/aRTMGNTwSjWZfI7l3CsovNF8lak5HNo1Hn1NudIL/GZsOLrabd6ENjll48TvbKFiz0DeDFd2liI0UR6VaIgIgXlyp3cKKA4ecVeET/lf7q0706ANgQiucZeWqJQG94U8dHFCsabNLmQIvLvwni9hkijwO9j/fels3WM1MvZNeu4+hkZCuwM3EL+7jRrxIxr8sT23Nklx6jIdI8SaC9wtW5RXqub77jclSudTsf52RhqP1ARFc5k61dAXADffVkASdM0/u8y7cy4yqpQ== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=ethz.ch; Received: from ZRAP278MB0079.CHEP278.PROD.OUTLOOK.COM (2603:10a6:910:12::11) by ZR5P278MB2053.CHEP278.PROD.OUTLOOK.COM (2603:10a6:910:af::10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.270.17; Sun, 2 Aug 2026 12:44:52 +0000 Received: from ZRAP278MB0079.CHEP278.PROD.OUTLOOK.COM ([fe80::9bb9:c29a:8aae:520d]) by ZRAP278MB0079.CHEP278.PROD.OUTLOOK.COM ([fe80::9bb9:c29a:8aae:520d%3]) with mapi id 15.21.0270.016; Sun, 2 Aug 2026 12:44:52 +0000 From: Niels Pressel To: Mathieu Desnoyers , Peter Zijlstra , "Paul E . McKenney" , Boqun Feng Cc: linux-kernel@vger.kernel.org, Niels Pressel Subject: [PATCH] rseq: fix hard lockup on granted time slice extension Date: Sun, 2 Aug 2026 14:44:23 +0200 Message-ID: <20260802124423.51616-1-npressel@ethz.ch> X-Mailer: git-send-email 2.50.1 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: ZR0P278CA0015.CHEP278.PROD.OUTLOOK.COM (2603:10a6:910:16::25) To ZRAP278MB0079.CHEP278.PROD.OUTLOOK.COM (2603:10a6:910:12::11) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: ZRAP278MB0079:EE_|ZR5P278MB2053:EE_ X-MS-Office365-Filtering-Correlation-Id: bd4cbbca-144d-4dbe-adc1-08def093d8d9 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|366016|1800799024|786006|23010399003|19092799006|10070799003|376014|18002099003|11063799006|56012099006|6133799003|10067099003; X-Microsoft-Antispam-Message-Info: sHylh8qaY9z6iKorZVrO9AX0/QQidiFy/KjLa0tUWYndxvRc/4BgxPrLKCOZsyVSl/fhWtbK2zzceMccbhIP1xnqDjZsjstgwx0Du8sqXizCRR5joeWZnYlPFwW5dyX1f3hmBDupCM7c/b/am9QivZ4HcSd1nCZd6pxOjf33xmCN4LLsuGrON2zeaq4bAaUtVikRDGOq7D9zu/lYcuv8ZU0RAj4WAsFHFz2XYshkZwDT5/aHXmZf+YYvBatjIa4zo/glS4bkWvxWw3bbZALqtjhDmvVwEWCfTNF8WDDG9abjZC964MMK3JTpKUA88y2iJCxCoQNTCjAIMbKuGmjZh+BgRcdZEDJZToK26PLqHk2Kays3m5r9HirkMDFzCjb8yO1LdUFkkfMAb6K1WfFZ7yGN3uKBaQl61YD1/2+N8Abxdo9B5xR8KU/FDr0fhr/JEWQR9bYg8Uw2IEOjVkbvWu5NL3CN+WjAySfq7fIWhVq+HWRH8J/KwYDeSqr0fBCI+EEwFm630LwxCcywawJTocQ4u37fXUs1WQdn9no1E3DvMHjga7EkEAQpeGbI/LV7YwqhvaWvvNxfpwPNVO5HCix4c15zsf/g70QzyPrERYOzJcbUW3OIsUbUP5mZiGwQiR3CO5kJPX5fSVuZAIv/FAOsljXJQ57ZYC00riIPHO8= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:ZRAP278MB0079.CHEP278.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(366016)(1800799024)(786006)(23010399003)(19092799006)(10070799003)(376014)(18002099003)(11063799006)(56012099006)(6133799003)(10067099003);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?XwVZ6AhGOEz0GgPRYrkQyLjqvOImDoDPScvumiOCHZ1fJenpC5Qg6lzttoU1?= =?us-ascii?Q?mv8xLF798VEKWvo/FEkxyHPtP4Fb2eIEZAECqt8I/ysQVSdCd0YLrH7UfW6w?= =?us-ascii?Q?/aMxIiyIBFOh+g4sernrBA8makBS4ubQVKG+q8aQwsGmhxTdjX4xjDfI+3QR?= =?us-ascii?Q?gmtVH2vyGFyx/vOkLgZmkTaP+GjjhteVW5Tf2XpoBt7S3lxW5JHOkADdhdsP?= =?us-ascii?Q?i2TnHTPB8TVYDR0aKJJmupy2AVbYEbKkuHHcwhd6CjxD6Ob7+0evzjz9tJ1h?= =?us-ascii?Q?FWmmbr+aiky+wiElPqXRfkuRWfi9WTmp3jzxbdmsTEYUWJCpUt7O5ycn4MpF?= =?us-ascii?Q?j79hTgkzm/NT3bXkc6xS8BXqj72m+h0jGRCDXg5E5tpRvMMEQYsOS86RHlny?= =?us-ascii?Q?1wTwpQst4E4huqolbr64dKPafjK578cY3t8q3Ode6p/UWsxV4A5K3Lao4a3O?= =?us-ascii?Q?sf9ZvCrm691H7gvaz6mNRS29hMJqLG1OMQ4/GSoPJU6cQ2OQY0vBpt9XGIqp?= =?us-ascii?Q?muarZ3xx7jOJjklEkIz/bfY4gg/F8G5GFnv08Af0f5b86Y8nKyxVxL9GzbdK?= =?us-ascii?Q?mwB/xOXRIyIiATYPFBhbDpGduLMW8U1EiE4v0RTTuI3cckGjN/BeWDJpnzY8?= =?us-ascii?Q?FC/7R+76c5pKv1mt5qmxZTZMWefWnhTQvnLtFFoS6lTf0CCmD0T2v2eeFXaq?= =?us-ascii?Q?bBk9HB6WZ9tyepUxjxJXpQvl4x7MpmODahrfLB5CtHnB0mXUQNuTxGzLT63+?= =?us-ascii?Q?xUFHVY+t9WU0KezAVVu1FEbLOALIq+ttRzcufJ+dxacnt7DpGkzkl3lndXBb?= =?us-ascii?Q?DxE6C+ReZivcmC1yGjwSMpLost9l1F6gzJOWTkghGHECebgNR4hTBVMUphuf?= =?us-ascii?Q?zw1j3jEtcLWwNTVCVt9Avhm/SAKlIecSsDpMFjmMUERJSdwBmAVmbLvJel2E?= =?us-ascii?Q?BzsFlGjFVuQhkwtcqnGrQcgvgZsooiexY6Q+7Koso5T7ugvHX4eeP+lI6OAI?= =?us-ascii?Q?5Kg7gyN0OPYCOZ9JvpyZy8282SEE5SCQbCFj0E0s4LfoHmB+iJLK+t3qptnb?= =?us-ascii?Q?Kzy+GxS/pvWCYLSkxxCBAZPQ2IcmvoHHCHN7pB+DqSSGeWVE31udHwPe4Tdo?= =?us-ascii?Q?LAKdKByysgtCKuV+0mVQ9OixgvSaGMHrMI2ZYWyZnQ/7jPinAqjLfh7T6ZAH?= =?us-ascii?Q?MjZzf1mr9JLuExNR5DgT349K7/utuFRR91lBIEHpl4ljz3RKwRTdewpc8Uoh?= =?us-ascii?Q?PzbzB0A8xtM2f6r9YPP6a1jMH/M66irFurJC0Q6Ls/fQvuSu6Vlvp9eACfin?= =?us-ascii?Q?YoQWXLPUztyEJk5fQAF82XvAgSFTSpA0MnSilji0zoYFheAfMTpOdY0G3JyP?= =?us-ascii?Q?5PXu9il4KWY4VxP+xSGX16xq9iF+xsKGlcrz0EbhkSHB9oZ1p28mw4jOYboh?= =?us-ascii?Q?LRzmMx8PDpnk1opfAtEqiJaD+lfE5tjBXE5bAqnqNWEsUZFQLaMaXA5b7UXI?= =?us-ascii?Q?5BgXhgvfVdRAQ0aAgoFiWd8oMchjNYxxvOTmuTSVoH0UCJVV2KqqC1FEGHmR?= =?us-ascii?Q?2yEz0Re/Sgai/+aq1EqCTMa7LX7wB5CnWeayWkQBh96DXyRpbYr/F6wHRupy?= =?us-ascii?Q?9q/Lww/PyfDu2BC+bvmuath+QEvODoPneCjPPbdhJwon8BwecuxNfO6Yl6li?= =?us-ascii?Q?l/OlE4KsdmKulq93nQ01ntlH65em192K7ItAdY49b2BeRwj8gBhwIqcifOgW?= =?us-ascii?Q?PRFKbunu+wDzzxslluvgGzcJQc2S/wA=3D?= X-OriginatorOrg: ethz.ch X-MS-Exchange-CrossTenant-Network-Message-Id: bd4cbbca-144d-4dbe-adc1-08def093d8d9 X-MS-Exchange-CrossTenant-AuthSource: ZRAP278MB0079.CHEP278.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 02 Aug 2026 12:44:52.3169 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 9634a6ec-a266-45a3-ab14-74c4211fc582 X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: 0a8IvYO8A6/9cvBikuanab6zeu2/pY45vIUUmzeCW40ypxgC6YSnr0eqmZorXy3Tz7Rfk+/2tJYJnLSvdpbtkw== X-MS-Exchange-Transport-CrossTenantHeadersStamped: ZR5P278MB2053 Content-Type: text/plain; charset="utf-8" In __exit_to_user_mode_loop, TSE eligibility is checked while IRQs are enabled. Granting a TSE might involve rearming the hrtimers. However, hrtimer_rearm_deferred_tif is expected to be called with IRQs disabled (see include/linux/hrtimer_rearm.h:17). Calling the function with IRQs enabled can lead to a hard lockup because __hrtimer_rearm_deferred acquires a raw spinlock (without disabling IRQs) that is also acquired in hard IRQ context within hrtimer_run_queues. Lockdep flags the issue when running the rseq selftests on the 7.2-rc5 release: WARNING: ./include/linux/hrtimer_rearm.h:17 at irqentry_exit, CPU#1: sl= ice_test =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D WARNING: inconsistent lock state 7.2.0-rc5 #1 Tainted: G W -------------------------------- inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W} usage. slice_test [HC0[0]:SC0[0]:HE1:SE1] takes: ffff95b82ec5c698 (hrtimer_bases.lock){?.-.}-{2:2}, at: __hrtimer_rearm_= deferred {IN-HARDIRQ-W} state was registered at: lock_acquire _raw_spin_lock_irqsave hrtimer_run_queues update_process_times tick_periodic tick_handle_periodic timer_interrupt __handle_irq_event_percpu handle_irq_event_percpu handle_irq_event handle_level_irq __common_interrupt common_interrupt asm_common_interrupt _raw_spin_unlock_irqrestore __setup_irq request_threaded_irq hpet_time_init x86_late_time_init start_kernel x86_64_start_reservations x86_64_start_kernel common_startup_64 Possible unsafe locking scenario: CPU0 ---- lock(hrtimer_bases.lock); lock(hrtimer_bases.lock); *** DEADLOCK *** Call Trace: dump_stack_lvl print_usage_bug mark_lock.part.0 __lock_acquire lock_acquire _raw_spin_lock __hrtimer_rearm_deferred irqentry_exit asm_sysvec_apic_timer_interrupt Originally, the issue was discovered because of intermittent lockups when heavily using rseq TSEs. Fix this potential lockup by disabling IRQs around the timer rearm function call. Tested the fix using the rseq selftests. Fixes: 15dd3a948855 ("hrtimer: Push reprogramming timers into the interrupt= return path") Signed-off-by: Niels Pressel --- include/linux/rseq_entry.h | 1 + 1 file changed, 1 insertion(+) diff --git a/include/linux/rseq_entry.h b/include/linux/rseq_entry.h index ed9da6e41a2a..31ce349ed42c 100644 --- a/include/linux/rseq_entry.h +++ b/include/linux/rseq_entry.h @@ -233,6 +233,7 @@ static __always_inline bool __rseq_grant_slice_extensio= n(bool work_pending) static __always_inline bool rseq_grant_slice_extension(unsigned long ti_wo= rk, unsigned long mask) { if (unlikely(__rseq_grant_slice_extension(ti_work & mask))) { + guard(irq)(); hrtimer_rearm_deferred_tif(ti_work); return true; } base-commit: f5098b6bae761e346ebcd9da7f95622c04733cff --=20 2.50.1 (Apple Git-155)