[PATCH 0/9] rcu: Improve callback diagnostics and validation

[Kunwu Chan]

Hi,

This series improves callback diagnostics and validation across RCU,
SRCU, and RCU Tasks.

Patches 1-3 record callback registration stacks for KASAN in Tree
SRCU, Tiny SRCU, and Tiny RCU, matching the existing behavior in
Tree RCU.  This preserves the original registration site in KASAN
reports when callbacks are deferred through irq_work.

Patches 4-6 add rcu_head alignment and NULL callback-function
checks to SRCU, Tiny RCU, and RCU Tasks, consistent with the
existing checks in Tree RCU.

Patches 7-9 detect duplicate callback enqueue attempts at
registration time, report the callback address, function symbol,
and object information, and limit diagnostics to the first three
occurrences.  In Tree SRCU, moving the check from srcu_do_enqueue()
to __call_srcu() rejects detected duplicate registrations before
they reach the deferred-list enqueue path.

The duplicate-enqueue checks rely on the existing RCU head
debug-object mechanism and are effective only when
CONFIG_DEBUG_OBJECTS_RCU_HEAD is enabled.  They provide
diagnostics, not full protection against concurrent registration
of the same rcu_head, which violates the API contract.

Tested by rcutorture with KASAN enabled: SRCU-N, SRCU-P, SRCU-T,
SRCU-U, TINY01, TINY02, and TREE03, each for 3 minutes.  All
configurations completed with exitcode 0.

The KASAN aux stack was verified with a custom UAF module: the
"Last potentially related work creation" line in the KASAN report
identified the original __call_srcu() registration site.

A targeted Tree SRCU test module exercised duplicate enqueue
detection on both the direct and irqs-off deferred paths with
CONFIG_DEBUG_OBJECTS_RCU_HEAD=y.  Both paths rejected the
duplicate at __call_srcu() entry without list corruption or
hangs.

A targeted Tiny SRCU test module exercised NULL callback
rejection, duplicate enqueue detection, and post-callback
rcu_head reuse with CONFIG_DEBUG_OBJECTS_RCU_HEAD=y.  The
first two tests produced the expected diagnostics, and the
callback and reuse tests completed without hangs or stale
debug-object state.

RCU Tasks duplicate enqueue detection was verified by code
inspection; no targeted runtime test has been performed for
that path.
 
Kunwu Chan (9):
  srcu: Record callback registration stack for KASAN
  srcutiny: Record callback registration stack for KASAN
  rcu: Record callback registration stack for Tiny RCU
  srcu: Validate callback arguments
  rcu: Validate callback arguments in Tiny RCU
  rcu-tasks: Validate callback arguments
  srcu: Detect duplicate callback enqueue at registration
  srcutiny: Detect duplicate callback enqueue
  rcu-tasks: Detect duplicate callback enqueue

 kernel/rcu/srcutiny.c | 30 ++++++++++++++++++++++++++++++
 kernel/rcu/srcutree.c | 32 ++++++++++++++++++++++++++------
 kernel/rcu/tasks.h    | 22 ++++++++++++++++++++++
 kernel/rcu/tiny.c     | 11 +++++++++++
 4 files changed, 89 insertions(+), 6 deletions(-)


base-commit: 940793b926aa94bf65ec404043050888e3053188
-- 
2.43.0