From nobody Fri Oct 2 01:13:03 2026 Received: from ZRAP278CU002.outbound.protection.outlook.com (mail-switzerlandnorthazon11020091.outbound.protection.outlook.com [52.101.186.91]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5678846D567 for ; Thu, 6 Aug 2026 11:37:17 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=52.101.186.91 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786016251; cv=fail; b=aIo3GR1FrsEKAhsRgWi0boFbJq8Bl94ONZZVSgWahL1p1P8xN2mdm35kVt3F9A0OhJZxzegYS8rT+hHjKI2GCDikokeoOC7tS8onKBLtqL9DkZBoAOcw20CYYnql1i0rFlLNDcUV5RLBhNsd2rd00buW2U7UqTCgnuHQFqD+3XA= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786016251; c=relaxed/simple; bh=2nuRaSFN1opb0CAdiDPltOWeXuFNb4W50h1BO1MJi70=; h=From:To:Cc:Subject:Date:Message-ID:Content-Type:MIME-Version; b=eHTLdSjOiBCKNI/atw99eJa3U19txsfHD35IEDHDreaTShS35RZuq2s0/tRBBWfJkldRDqQENW0pEy5VaGBKW6kOi8gqnr/6zvGkhsooTZFok10qxz0fXQEgFSSxGMAOOE6WW7ogM1944qxtgT31MISKWVlk3PhmOgTgrjtHrAE= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=ethz.ch; spf=pass smtp.mailfrom=student.ethz.ch; dkim=pass (2048-bit key) header.d=ethz.ch header.i=@ethz.ch header.b=EquN1iKO; arc=fail smtp.client-ip=52.101.186.91 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=ethz.ch Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=student.ethz.ch Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ethz.ch header.i=@ethz.ch header.b="EquN1iKO" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=bizvsxTVXva7guUtS3khpSA48cZjcKWPdrwABVNxpGSE0tNSeB5NowUVFcIwRufE+t9xw3vhYJp5/+QcTpxAM3U/E+AQoNeFCj0+K7wWBD3hlN0qwuTl8xBE/kRMAMp6XyvLP+lFApGjmcFSXAcJaRVfK/CcDKTtCtB2zjbDi8wFitfNNQgJh6qFDahnsEFIDRe7kKbtcBDMs2EPCyX2rdRwzETcB3PqfH9HFXL7OrAOATReuMHOnTYytLE23t5rNqTCZqAI5VfVcUmzVLXdng+vokUiItKaXQwN11SR+gNqYBlJ5YAJbErhcenkptmXkeOksPflNiUe/wMj2wL0JA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=BVWo+L/zsfrj8wgGyh6X/ZYWQf4ws1Ft6B3OlDQclbM=; b=FQrjx4N9+1/lfxwTuB4WymPk0rNNI83U8kbGBqN+kZIjBS/CWkG1xnIkIfUJZ0b5uJwvE5rL73r5g9mMms4TpgidK7rf1uB3xYLuRp8ZchKC3PT/QA991emzteD3aUuTRpc7D70vCCr0w137r2NkXxrir9MewnvalrvmumzX19Xmfh4K12b2gpDEzR9EHcLoyaxbY8ACVOcBlBnrLrRUPIKSpdnUYD5f/C43WaMAwAAxzLZ4U/7/gWouT1PMmFeRPzYuk9fClZgXm9XxuKf/zH+mPdH6QrIL+gnKAeFnY68UEsW6nhZHINN7CMJ02WghA5VPEf9HPWsp0nyQMA7IOA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=student.ethz.ch; dmarc=pass action=none header.from=ethz.ch; dkim=pass header.d=ethz.ch; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ethz.ch; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=BVWo+L/zsfrj8wgGyh6X/ZYWQf4ws1Ft6B3OlDQclbM=; b=EquN1iKO0H11jpiOloQPuQCKrrL7FIh6fTWIyYl9bAqz9kNrCl01kNbbNAueJtAuSMsanfrLlAf4qXIdQhVFP4TS/j26OBCKsa6M+kRG1wPA4XHdBFdNJlWcPc1DWVLtYPn6bcEeAlz1G4mX1N8WixcQ31MAgksWAJaJmegG71Zm5G5sBEfm8QrDN4yGSDNktR0aFPS322D99vS0f5UiUkC5i8rjbxkSG7rBWahBawFfdZw+ULSrmv5IFPU5kOTN4sedZGqDLQycjaCujMXrvx58+W8DTvyvR47NvWir9fgZkd0MaW0q6V0UQv3L1ZqTWMEMGIjCfrMtlVRzpJL0EA== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=ethz.ch; Received: from ZRAP278MB0079.CHEP278.PROD.OUTLOOK.COM (2603:10a6:910:12::11) by ZRH2PF7ECC368F5.CHEP278.PROD.OUTLOOK.COM (2603:10a6:918::218) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.292.20; Thu, 6 Aug 2026 11:37:12 +0000 Received: from ZRAP278MB0079.CHEP278.PROD.OUTLOOK.COM ([fe80::9bb9:c29a:8aae:520d]) by ZRAP278MB0079.CHEP278.PROD.OUTLOOK.COM ([fe80::9bb9:c29a:8aae:520d%3]) with mapi id 15.21.0292.019; Thu, 6 Aug 2026 11:37:12 +0000 From: Niels Pressel To: Peter Zijlstra , Thomas Gleixner , Andy Lutomirski , Mathieu Desnoyers , "Paul E . McKenney" , Boqun Feng Cc: linux-kernel@vger.kernel.org, Niels Pressel Subject: [PATCH v2] rseq: fix hard lockup on granted time slice extension Date: Thu, 6 Aug 2026 13:34:29 +0200 Message-ID: <20260806113429.38333-1-npressel@ethz.ch> X-Mailer: git-send-email 2.50.1 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: ZR0P278CA0089.CHEP278.PROD.OUTLOOK.COM (2603:10a6:910:22::22) To ZRAP278MB0079.CHEP278.PROD.OUTLOOK.COM (2603:10a6:910:12::11) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: ZRAP278MB0079:EE_|ZRH2PF7ECC368F5:EE_ X-MS-Office365-Filtering-Correlation-Id: a2917c5f-881f-4679-f285-08def3af0ead X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|366016|19092799006|1800799024|23010399003|10070799003|376014|786006|11063799006|56012099006|10067099003|6133799003|18002099003; X-Microsoft-Antispam-Message-Info: eh/Vf2fGwHbKadZYATUdcP2+LciyDw1rU2lvcgNE+sMYTeqEYmIQL8seT/lOZXHSfjW0JEXTu2bHGC1rgX27/lYUFPP904D86BTbX52dxjGZEi96wdZd+cYYp5YZXW8IvnA5wujNI15Pmr1+H0weejg27BKZjTTnZsXpbrnI1VSJr+Tds8buyBZ/BTcGCrbVwxa9JK/u2plAB5z5X1iBfcX/i5LdCWuPciqR7iL26/K5uR59oHXG75EEzRRQSVUC/4QUJxiVOo2H6A5YO4EjM4+UODEe0NtcMb2z9f1DnVtT0dwXgdU2Gad1mpAVhwW+otjRkm6mg1mCmAFBH9Th+RkuBjmwwYrXuuFy0VIYve2KL9uR6YoS1BNjIuPrcnuY1UHoLaAExbOpWQBcNld0ZFvx579tUsPu2R7V1sNxMNBQ9m0NWPBSaBeO074lEsXa7chRK3UFSGPY8Ka1AfE15EPOxyumTgxH+2KDbmVhnqtr5XiiBtJ4FgGXMXO3a+En6v8z7VjE/PjpRWjG6Ud4coYEUr5yy9P0Y70eHaU4oFw5RgNDNMH75wOB0dreaLw2hHS+WURXDmaH9jv8u5mKFl4yTmOOtpdnxpiBM6I02ZHG0ORXUPlP5yF89OF3tG2NrkdZaElOvDyACqkVLSHXIKMLJMZ+4BM/XCBYPiuV870= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:ZRAP278MB0079.CHEP278.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(366016)(19092799006)(1800799024)(23010399003)(10070799003)(376014)(786006)(11063799006)(56012099006)(10067099003)(6133799003)(18002099003);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?/ZoinDoIJtkKLH2zhZLhbyYPXiBDvO0uMBfrLmyBUgiH6Bq+VYUW7KcNjeMu?= =?us-ascii?Q?Y1kU7fQCUZB4SN47KUGcJ8zslQSV+jrq+GOnC5E+Xfm1e+GUPJetQKBmYqJl?= =?us-ascii?Q?r/vnwqI0MCpa3qgrEPAICQXsPSUosof7AVhkr0mWvGUwGpR7i0HSGwrK2D3l?= =?us-ascii?Q?Gqd4H84g2vRew/BwY9sdidF/Ghx2wphP0N0Wn3xQ7QPcJ4+5wiwEB6NaTPyg?= =?us-ascii?Q?T+jhGUmrWmXpA37i1OfoLgZJFqdW/q95bnsHVikMOL09B7pV844Humv98i4M?= =?us-ascii?Q?WwdNNBzXNDHSgw+XIkk3YlpRPMBquXAu29F2wEMq2V+UhudlohIZVJz8OWeh?= =?us-ascii?Q?q/H+oQ9oitoaHLV7IMeaJb02IosXEdhK8i0aQxZ68VUJoqk+WZjDQsVrq70C?= =?us-ascii?Q?UtFOwl6VbJxIy30SaG5jgGyblk4pqbLxPHL681L4NDMmd/JS6fg5UtJXSR/Y?= =?us-ascii?Q?FCdiVYEflCYJ4Pb8KsOhJgOlbJ4CTd0dEMV7qTuIQReDRYIB5PgTJuY48uKI?= =?us-ascii?Q?g8Rz4t9ISbE9E6ynIiRryAMELSi2iTur/BEVo4qk3SCGYrolEmrP3u1ztiig?= =?us-ascii?Q?fmdyALlwquhrq5AxsqQtjcYOMbY3D1ZoT6SFd+QY0lKi9pNSfuvc3MaJD6zo?= =?us-ascii?Q?qR1GpWheeAU7tgpPUzHn+fDVFLOFZyNxLdXUWC8Gk7QFE2F/OgVXcVSCTX2x?= =?us-ascii?Q?dH97J8Gvs+fi+68WTxUxPN4i5H0wVo0Tozb4IkedqVFhliXFn1MQ7B1b8qac?= =?us-ascii?Q?yP0I1mZsGXoEi4Muk9axz9akfdjkFz7qTw0qaUFkAbR9y4obu8NBfI6PkAsV?= =?us-ascii?Q?DtwXSji4xzD/zAYWFbzijiZB23uJby4vLXnLgOJlDLEoZtFqtg0N3Gxn1vwK?= =?us-ascii?Q?K114j5EbsvngtG+PAEeJ9rQnPCIJ62SLA/Rj38GefbfV4PKSbJZ2rl86Apnw?= =?us-ascii?Q?Ex2CAiVkAzD2jeRNLzgZSHCU+pxw8UUeFmDoI8Ox5rEZQJXKpPO83G8mZpSl?= =?us-ascii?Q?mCHBXr7crJEv/9UMqlpM4/2CeZYM4jD2R5fmITEkwRg57nY3+D2x5LQKmZg6?= =?us-ascii?Q?vou1/nLjAZtgxN2iWlkg97uShQ/eysD7Q7oceybJ/Pm6+Gp9GHRNBiP/M8+H?= =?us-ascii?Q?PHsuEuIdmNCCf8D+5lLBKFJ1EOFKY9+P0SVyL+pw3K8RxdV/GXoyWimAb7WC?= =?us-ascii?Q?7FAMiMEyVms6LXhUfUCy5SJAJ1qG32nJVTyWm0YkuG3O98e9K6RIZv9o9Idr?= =?us-ascii?Q?TpnVOBrZQmh9dT8gdHnz1nM0mdbCfMNEfRSCmK2Uh6Ps+XO4z6rq0Y9h5gJ4?= =?us-ascii?Q?Y/rR9PXA5mH8ZNcvgEhzbWDifsKBdDSvPBJfVdeFrwqCIxy18Yo8QNlDsluB?= =?us-ascii?Q?oN6lHXtaVZYeyaa5NrMUXDmSuUh/5pl0gCh4GfcSxZDT2KImV3ZXHS4FZB96?= =?us-ascii?Q?boulyYEzeG0ASHwTjghvIJ7m5HZlm+UqWaG2y8GfE7muAykQ1F0YPWm3Ju65?= =?us-ascii?Q?qapAB+au1NOJGd8IzebGQ+a6Nk53x8SAfgImHbAvpOlxr+uoMdmMoaCWKxdu?= =?us-ascii?Q?kbPW40vk4rVS/Tl7kaIL4Hy1Jiqakl2bmhgcSyj+6+uWufVEUTA6MWzLcsGa?= =?us-ascii?Q?RUTgeGxQhsFV0ix1JeGOxQgy3rAGWEcAb8CAWBvLJeQeaR/40LhhtnsQfWR6?= =?us-ascii?Q?NpJrP5mwkAPeVnkACodJL3VSQpd0OlUZvdou6A+Ou1DrmuWq9+39TI034RB/?= =?us-ascii?Q?wVPTMUTmm0Aputh0YTlJ8ZtygQ/RPng=3D?= X-OriginatorOrg: ethz.ch X-MS-Exchange-CrossTenant-Network-Message-Id: a2917c5f-881f-4679-f285-08def3af0ead X-MS-Exchange-CrossTenant-AuthSource: ZRAP278MB0079.CHEP278.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 06 Aug 2026 11:37:12.5827 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 9634a6ec-a266-45a3-ab14-74c4211fc582 X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: ySj9wbVGd0GnLtaqTtfHTQk1g1aR5SYlyFXeY/zck6UmXFFLWSyYgwMQekSTH1rDgoHdFIgcZP6tB983aj5IDA== X-MS-Exchange-Transport-CrossTenantHeadersStamped: ZRH2PF7ECC368F5 Content-Type: text/plain; charset="utf-8" In __exit_to_user_mode_loop(), TSE eligibility is checked while IRQs are enabled. Granting a TSE might involve rearming the hrtimers. However, hrtimer_rearm_deferred_tif() is expected to be called with IRQs disabled (see include/linux/hrtimer_rearm.h:17). Calling the function with IRQs enabled can lead to a hard lockup because __hrtimer_rearm_deferred() acquires a raw spinlock (without disabling IRQs) that is also acquired in hard IRQ context within hrtimer_run_queues(). Lockdep flags the issue when running the rseq selftests on the 7.2-rc5 release: WARNING: ./include/linux/hrtimer_rearm.h:17 at irqentry_exit, CPU#1: sl= ice_test =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D WARNING: inconsistent lock state 7.2.0-rc5 #1 Tainted: G W -------------------------------- inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W} usage. slice_test [HC0[0]:SC0[0]:HE1:SE1] takes: ffff95b82ec5c698 (hrtimer_bases.lock){?.-.}-{2:2}, at: __hrtimer_rearm_= deferred {IN-HARDIRQ-W} state was registered at: lock_acquire _raw_spin_lock_irqsave hrtimer_run_queues update_process_times tick_periodic tick_handle_periodic timer_interrupt __handle_irq_event_percpu handle_irq_event_percpu handle_irq_event handle_level_irq __common_interrupt common_interrupt asm_common_interrupt _raw_spin_unlock_irqrestore __setup_irq request_threaded_irq hpet_time_init x86_late_time_init start_kernel x86_64_start_reservations x86_64_start_kernel common_startup_64 Possible unsafe locking scenario: CPU0 ---- lock(hrtimer_bases.lock); lock(hrtimer_bases.lock); *** DEADLOCK *** Call Trace: dump_stack_lvl print_usage_bug mark_lock.part.0 __lock_acquire lock_acquire _raw_spin_lock __hrtimer_rearm_deferred irqentry_exit asm_sysvec_apic_timer_interrupt Originally, the issue was discovered because of intermittent lockups when heavily using rseq TSEs. Following the suggestion from Peter Zijlstra, fix this potential lockup by reflowing __exit_to_user_mode_loop() to only enable IRQs after the TSE check. Fixes: 15dd3a948855 ("hrtimer: Push reprogramming timers into the interrupt= return path") Signed-off-by: Niels Pressel --- Changes in v2: - Move to enabling IRQS in __exit_to_user_mode_loop() after the rseq=20 TSE check - Remove IRQ disable in __rseq_grant_slice_extension() - Rebased on core/entry - Link to v1: https://lore.kernel.org/all/20260802124423.51616-1-npressel@e= thz.ch/ include/linux/rseq_entry.h | 8 ++++---- kernel/entry/common.c | 10 +++++----- 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/include/linux/rseq_entry.h b/include/linux/rseq_entry.h index ed9da6e41a2a..cb41b30c9cb9 100644 --- a/include/linux/rseq_entry.h +++ b/include/linux/rseq_entry.h @@ -127,6 +127,8 @@ do { \ =20 static __always_inline bool __rseq_grant_slice_extension(bool work_pending) { + lockdep_assert_irqs_disabled(); + struct task_struct *curr =3D current; struct rseq_slice_ctrl usr_ctrl; union rseq_slice_state state; @@ -219,10 +221,8 @@ static __always_inline bool __rseq_grant_slice_extensi= on(bool work_pending) * * which would be inconsistent state. */ - scoped_guard(irq) { - clear_tsk_need_resched(curr); - clear_preempt_need_resched(); - } + clear_tsk_need_resched(curr); + clear_preempt_need_resched(); return true; =20 efault: diff --git a/kernel/entry/common.c b/kernel/entry/common.c index e3d381fd3d25..9cefb37f4dd4 100644 --- a/kernel/entry/common.c +++ b/kernel/entry/common.c @@ -47,13 +47,13 @@ static __always_inline unsigned long __exit_to_user_mod= e_loop(struct pt_regs *re * items have been completed. */ while (ti_work & EXIT_TO_USER_MODE_WORK_LOOP) { - + /* Check rseq slice extensions with IRQs disabled */ + bool sched =3D (ti_work & (_TIF_NEED_RESCHED | _TIF_NEED_RESCHED_LAZY)) = && + !rseq_grant_slice_extension(ti_work, TIF_SLICE_EXT_DENY); local_irq_enable(); =20 - if (ti_work & (_TIF_NEED_RESCHED | _TIF_NEED_RESCHED_LAZY)) { - if (!rseq_grant_slice_extension(ti_work, TIF_SLICE_EXT_DENY)) - schedule(); - } + if (sched) + schedule(); =20 if (ti_work & _TIF_UPROBE) uprobe_notify_resume(regs); base-commit: 05c033db7e9ad3c34f6968ec568cb6ee01051c57 --=20 2.50.1 (Apple Git-155)