From nobody Sat Jul 25 05:27:14 2026 Received: from out-178.mta1.migadu.com (out-178.mta1.migadu.com [95.215.58.178]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 206A039CD17 for ; Fri, 17 Jul 2026 09:14:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=95.215.58.178 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784279698; cv=none; b=rwQSBsp5z78cYS5fsTpj3lBGAFaN7yF51CjemsdkxwoFjJpFCDPO9uy3lJT92yUhvq46ap/8n9Dn7/BGPAlJ8u2RG9iIf2wtNBFVxYLCsjd96VoC5I4Tx4/Q6NYDOssj/wfvVhgrAEcH6zm/f2yFPtTbXkJFAID+H3aATwiAaj4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784279698; c=relaxed/simple; bh=kVUKpeBRtsdch+hQzClxTajr7mmnk0DoesrrlvK9Kdk=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Gq17Coc+O83rvI7mWBNbUd/wOP6A7FqSiPJLk2p+OFiaOQTLnC3HXKkH1CYVqvTRWqNOlvp4aIEHwwBGuQIEADeVR9X3r2QMuJaB2TNgLRWzE+45orXb791+jdKNT219oaLTCCoB3IRPmK/DJdAEpfGo/QNpH0fx7PHZbUysc10= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=jLHGoe1z; arc=none smtp.client-ip=95.215.58.178 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="jLHGoe1z" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1784279691; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=4VyiXxFkgj75j7iNSsAohpghmXRFWS3nrpypC335+7M=; b=jLHGoe1zJZpX4zyGf8wJWpEv+t6RrBXgWUp4mVXe7jnDct35+r8f7PuHl2+u66AOTl5uBE kpf8CfVgGOLPb7w6GpLzyO5/TvFELjDuZH7Vd2s+wQ9MBc6g/BUPNwdXGgNXFD1aKrcqJe 7OQkbRknXOg/THcfGi/PgygCWC2XKkY= From: Guopeng Zhang To: Johannes Weiner , Suren Baghdasaryan Cc: Peter Zijlstra , Ingo Molnar , Juri Lelli , Vincent Guittot , Dietmar Eggemann , Steven Rostedt , Ben Segall , Mel Gorman , Valentin Schneider , K Prateek Nayak , Tejun Heo , Zhaoyang Huang , "ziwei.dai" , Chengming Zhou , linux-kernel@vger.kernel.org Subject: [PATCH 1/3] sched/psi: Avoid losing wakeups during rtpoll worker replacement Date: Fri, 17 Jul 2026 17:14:12 +0800 Message-ID: In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Migadu-Flow: FLOW_OUT Content-Type: text/plain; charset="utf-8" From: Guopeng Zhang psi_trigger_destroy() clears rtpoll_task while holding the trigger lock, but has to drop the lock before stopping the worker because psi_rtpoll_work() takes the same lock. A new trigger can therefore install a replacement worker before the old one exits. rtpoll_wakeup is shared by both workers. The wait condition currently consumes it before checking whether the worker should stop. If the replacement timer sets the wakeup while the old worker is being stopped, the old worker can consume it and then exit. Since the one-shot timer has already fired and rtpoll_scheduled remains set, the replacement can stay asleep and rtpolling can stall. Make the wait condition only observe the wakeup. Check for stop before consuming it and, once consumed, always process the work. Fixes: 461daba06bdc ("psi: eliminate kthread_worker from psi trigger schedu= ling mechanism") Signed-off-by: Guopeng Zhang --- kernel/sched/psi.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/kernel/sched/psi.c b/kernel/sched/psi.c index 4e152410653d..b9e2a93a757b 100644 --- a/kernel/sched/psi.c +++ b/kernel/sched/psi.c @@ -743,10 +743,16 @@ static int psi_rtpoll_worker(void *data) =20 while (true) { wait_event_interruptible(group->rtpoll_wait, - atomic_cmpxchg(&group->rtpoll_wakeup, 1, 0) || + atomic_read(&group->rtpoll_wakeup) || kthread_should_stop()); if (kthread_should_stop()) break; + /* + * Consume the wakeup only after checking for stop. Once consumed, + * always run the work so a replacement worker cannot lose it. + */ + if (atomic_cmpxchg(&group->rtpoll_wakeup, 1, 0) !=3D 1) + continue; =20 psi_rtpoll_work(group); } --=20 2.43.0 From nobody Sat Jul 25 05:27:14 2026 Received: from out-174.mta1.migadu.com (out-174.mta1.migadu.com [95.215.58.174]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0DD34399359 for ; Fri, 17 Jul 2026 09:15:00 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=95.215.58.174 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784279706; cv=none; b=thugLbIHNhCpf5XRGmq3bzBT7Lxllfuo/L9m5CNww/WRACqOh/leOjAeOiD1w/Q6qlONeqrJbDORe23F/w0i5ubvghy191ZGkIAkY0neohqEYpVoXhEv36+XP3sHjLTjnjm8LfwBYqHsz9PNwIxrIfB8I8hcCyeV77G3q1XkvKA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784279706; c=relaxed/simple; bh=EYHQKbSZ6tGZmdhOOaiYICl+MF7FyRwroZU9G92hcLU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=U5CODk42rl8hHOSrHEodxVu6+T94fRqE+0TMAmtBt/e2sof8w0NYNWeEzhXBpkA7aujWFRptZEw/SxCd09d20K17tuKZTe4CkWwqIiGoElOKEWJsUd5HWFixh+fQOew7+BKUHl+znandBkrwEKm/fpTcyWDuJhuvoh3+OszoCeQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=c8AIRIoJ; arc=none smtp.client-ip=95.215.58.174 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="c8AIRIoJ" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1784279698; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=4VlvDmyufipqOUEQJ+h4QH2vk/AR0LTNiO7AQrF4wbo=; b=c8AIRIoJdXWqeHurd1YuQ9DFgRFfAhnXifrsu1Rs0bDty3vpDoEMRQihHWaZcbHtp2jJRR JugQYTg89K1BRcM8l20RwLHgCituhwbg6khfvXO73mhHUN3fPexb71QyPxxpFALMuawvo5 5oxNchm4nGWO5Im9ZL9ZPDFaVbztEt0= From: Guopeng Zhang To: Johannes Weiner , Suren Baghdasaryan Cc: Peter Zijlstra , Ingo Molnar , Juri Lelli , Vincent Guittot , Dietmar Eggemann , Steven Rostedt , Ben Segall , Mel Gorman , Valentin Schneider , K Prateek Nayak , Tejun Heo , Zhaoyang Huang , "ziwei.dai" , Chengming Zhou , linux-kernel@vger.kernel.org Subject: [PATCH 2/3] sched/psi: Prevent stale timer rearm after rtpoll teardown Date: Fri, 17 Jul 2026 17:14:13 +0800 Message-ID: <70eeb3ebd144b74aaa406d732589a05f6299cf05.1784277342.git.zhangguopeng@kylinos.cn> In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Migadu-Flow: FLOW_OUT Content-Type: text/plain; charset="utf-8" From: Guopeng Zhang psi_schedule_rtpoll_work() reads rtpoll_task under RCU before calling mod_timer(). Last-trigger teardown clears the pointer and deletes the timer before waiting for existing readers. A reader that saw the old task can therefore rearm the timer after timer_delete(), leaving a stale timer pending after trigger teardown. psi_cgroup_free() shuts down rtpoll_timer before freeing the group, so the pending timer cannot outlive the psi_group. It can still fire after the last trigger has been removed and wake the waitqueue when no worker is published, and trigger teardown does not leave the timer quiesced. After publishing NULL, wait for existing readers while holding rtpoll_trigger_lock, then use timer_delete_sync() to drain the callback. Holding the lock also prevents a new trigger from reusing the timer until teardown has finished with it. Fixes: 8f91efd870ea ("psi: Fix race between psi_trigger_create/destroy") Signed-off-by: Guopeng Zhang --- kernel/sched/psi.c | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) diff --git a/kernel/sched/psi.c b/kernel/sched/psi.c index b9e2a93a757b..db9c56fa8923 100644 --- a/kernel/sched/psi.c +++ b/kernel/sched/psi.c @@ -1488,18 +1488,22 @@ void psi_trigger_destroy(struct psi_trigger *t) group->rtpoll_task, lockdep_is_held(&group->rtpoll_trigger_lock)); rcu_assign_pointer(group->rtpoll_task, NULL); - timer_delete(&group->rtpoll_timer); + /* + * Wait for psi_schedule_rtpoll_work() to either + * observe the NULL task or finish rearming the timer. + * Keeping the mutex held also prevents a new trigger + * from installing a task before the old timer is gone. + */ + synchronize_rcu(); + timer_delete_sync(&group->rtpoll_timer); } } mutex_unlock(&group->rtpoll_trigger_lock); } =20 - /* - * Wait for psi_schedule_rtpoll_work RCU to complete its read-side - * critical section before destroying the trigger and optionally the - * rtpoll_task. - */ - synchronize_rcu(); + /* The last-trigger path has already waited for RCU readers above. */ + if (!task_to_destroy) + synchronize_rcu(); /* * Stop kthread 'psimon' after releasing rtpoll_trigger_lock to prevent * a deadlock while waiting for psi_rtpoll_work to acquire --=20 2.43.0 From nobody Sat Jul 25 05:27:14 2026 Received: from out-183.mta1.migadu.com (out-183.mta1.migadu.com [95.215.58.183]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5B36E39AD34 for ; Fri, 17 Jul 2026 09:15:11 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=95.215.58.183 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784279718; cv=none; b=k8cHi5O4X70noWoH5waGDplCFz6nz8fqv6y90hv+E/5PcRfDnf3Pt6keVPw78cl3ei81aPKVku6Z2U8qNI1kU+vKVes0pWo/9L0lsUbBrj3B6FpbK0t8KbsVQYG0QlFo47yUe5JG7K3cYZjm7R8ypOwrsAZVeXcStLMMprahpzg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784279718; c=relaxed/simple; bh=WvQoaQkwSjkSgqJqK5Iy3EvTKQuSRgb4T9YLw8QpCdo=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=SfDVfcoNiH24kxWw+xmO09OjBZojvWqv4DUpI1pScSxX3x28vfAU/1mHmZvXfKZnM+gU8Uy8kFjCVJzIN10/6IZEnVwfIYIyfYz/jqxpkJNKuvNOoUceINrM6p0Ou42kIQPBvZkrrwQ2e8mhgcdYBnVLsyDlF+WJynYtRAbRvEA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=SYIRK6zA; arc=none smtp.client-ip=95.215.58.183 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="SYIRK6zA" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1784279707; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=/fQcLzZfqBiQqyZwas2xeirmmqHP5ZqfMBuksdFe4gU=; b=SYIRK6zAHfdO/x4/viVS5fPI09XjNmcPVOsLOidXOFi3Oc9CuGdtHqc5x19PQFbca6vTgt USps4GYf1/dn+YZXWoI8xNvjTds+ujbrwlirfhhOEi9gzUtUCG9BgWNl7vdNsFSjVAOIIa +GPun/X8djBJOFzI1NEs2QhRA3jpEds= From: Guopeng Zhang To: Johannes Weiner , Suren Baghdasaryan Cc: Peter Zijlstra , Ingo Molnar , Juri Lelli , Vincent Guittot , Dietmar Eggemann , Steven Rostedt , Ben Segall , Mel Gorman , Valentin Schneider , K Prateek Nayak , Tejun Heo , Zhaoyang Huang , "ziwei.dai" , Chengming Zhou , linux-kernel@vger.kernel.org Subject: [PATCH 3/3] sched/psi: Avoid clobbering rtpoll_scheduled during teardown Date: Fri, 17 Jul 2026 17:14:14 +0800 Message-ID: <684a38b47882c787129442c78930f0dc9a448fcd.1784277342.git.zhangguopeng@kylinos.cn> In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Migadu-Flow: FLOW_OUT Content-Type: text/plain; charset="utf-8" From: Guopeng Zhang Last-trigger teardown has to drop rtpoll_trigger_lock before calling kthread_stop() because the worker takes the same lock. A new trigger can therefore install a replacement worker and schedule its timer before the old worker has stopped. Teardown currently clears rtpoll_scheduled only after kthread_stop() returns. That late clear can overwrite state installed for the replacement, leaving rtpoll_scheduled clear while its timer is pending. The next task change can then rearm the timer unnecessarily. Reset the flag after draining the old timer while still holding rtpoll_trigger_lock, before a replacement can be published, and leave it untouched after unlocking. Fixes: 710ffe671e01 ("sched/psi: Stop relying on timer_pending() for poll_w= ork rescheduling") Signed-off-by: Guopeng Zhang --- kernel/sched/psi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/sched/psi.c b/kernel/sched/psi.c index db9c56fa8923..bec329fafb4d 100644 --- a/kernel/sched/psi.c +++ b/kernel/sched/psi.c @@ -1496,6 +1496,7 @@ void psi_trigger_destroy(struct psi_trigger *t) */ synchronize_rcu(); timer_delete_sync(&group->rtpoll_timer); + atomic_set(&group->rtpoll_scheduled, 0); } } mutex_unlock(&group->rtpoll_trigger_lock); @@ -1515,7 +1516,6 @@ void psi_trigger_destroy(struct psi_trigger *t) * can no longer be found through group->rtpoll_task. */ kthread_stop(task_to_destroy); - atomic_set(&group->rtpoll_scheduled, 0); } kfree(t); } --=20 2.43.0