Message-ID: <CAMRc=McDaipt85OHm0MksLkuf6E79dY1uNSqqbcJnoQTUs81Pw@mail.gmail.com>
Date: Wed, 21 Jan 2026 15:18:12 +0000
From: Bartosz Golaszewski <brgl@...nel.org>
To: Tzung-Bi Shih <tzungbi@...nel.org>
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>, "Rafael J. Wysocki" <rafael@...nel.org>, 
	Danilo Krummrich <dakr@...nel.org>, linux-kernel@...r.kernel.org, 
	Bartosz Golaszewski <brgl@...nel.org>
Subject: Re: [PATCH] revocable: Remove redundant synchronize_srcu() call

On Wed, 21 Jan 2026 13:34:15 +0100, Tzung-Bi Shih <tzungbi@...nel.org> said:
> On Wed, Jan 21, 2026 at 11:38:18AM +0100, Bartosz Golaszewski wrote:
>> On Wed, Jan 21, 2026 at 5:03 AM Tzung-Bi Shih <tzungbi@...nel.org> wrote:
>> >
>> > When allocating a revocable provider via revocable_provider_alloc(),
>> > there is no revocable consumers (i.e., RCU readers) yet.  Remove the
>> > redundant synchronize_srcu() call to save cycles.
>> >
>> > Signed-off-by: Tzung-Bi Shih <tzungbi@...nel.org>
>> > ---
>> > To address the performance impact reported in
>> > https://lore.kernel.org/linux-gpio/CAMRc=McrFa42mNWmZtD1HKKKZ+USUKpQAAME50wbfxPM7L72gA@mail.gmail.com/.
>> >
>> >  drivers/base/revocable.c | 1 -
>> >  1 file changed, 1 deletion(-)
>> >
>> > diff --git a/drivers/base/revocable.c b/drivers/base/revocable.c
>> > index f6cece275aac..b068e18a847d 100644
>> > --- a/drivers/base/revocable.c
>> > +++ b/drivers/base/revocable.c
>> > @@ -99,7 +99,6 @@ struct revocable_provider *revocable_provider_alloc(void *res)
>> >
>> >         init_srcu_struct(&rp->srcu);
>> >         rcu_assign_pointer(rp->res, res);
>> > -       synchronize_srcu(&rp->srcu);
>> >         kref_init(&rp->kref);
>> >
>> >         return rp;
>> > --
>> > 2.52.0.457.g6b5491de43-goog
>> >
>>
>> Do you have an up-to-date integration branch with all the series and
>> fixes you posted that I could use for testing with GPIO?
>
> Please use
> https://git.kernel.org/pub/scm/linux/kernel/git/tzungbi/chrome-platform.git/log/?h=gpio_rev
> for the purpose which is based on driver-core-next and gpio/for-current
> branches.
>

With this branch, I'm seeing the following KASAN splat when running libgpiod
tests:

==================================================================
BUG: KASAN: use-after-free in notifier_call_chain+0x222/0x270
Read of size 8 at addr ffff888103ce6490 by task gpiod-test/479

CPU: 2 UID: 0 PID: 479 Comm: gpiod-test Not tainted
6.19.0-rc6-yocto-standard+ #2 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS
rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014
Call Trace:
 <TASK>
 dump_stack_lvl+0x63/0x90
 print_report+0x153/0x4c7
 ? __virt_addr_valid+0x225/0x4c0
 ? kasan_addr_to_slab+0x11/0x80
 kasan_report+0x103/0x140
 ? notifier_call_chain+0x222/0x270
 ? notifier_call_chain+0x222/0x270
 __asan_report_load8_noabort+0x18/0x20
 notifier_call_chain+0x222/0x270
 blocking_notifier_call_chain+0x70/0xb0
 gpiolib_cdev_unregister+0x5a/0x70
 gpiochip_remove+0x48e/0x5a0
 ? __kasan_slab_free+0x84/0xa0
 devm_gpio_chip_release+0x12/0x20
 devm_action_release+0x4f/0x80
 ? __kasan_check_read+0x15/0x20
 release_nodes+0xb6/0x320
 ? trace_hardirqs_on+0x8c/0x160
 devres_release_all+0x111/0x190
 ? __pfx_devres_release_all+0x10/0x10
 ? sysfs_remove_file_ns+0x56/0xa0
 device_unbind_cleanup+0x1b/0x1f0
 device_release_driver_internal+0x3e3/0x530
 ? klist_devices_put+0x38/0x50
 device_release_driver+0x16/0x20
 bus_remove_device+0x1f3/0x300
 device_del+0x3d3/0xdd0
 ? __pfx_device_del+0x10/0x10
 platform_device_del+0x3c/0x210
 platform_device_unregister+0x16/0x40
 dev_sync_probe_unregister+0x30/0xa0 [dev_sync_probe]
 gpio_sim_device_deactivate+0x75/0xf0 [gpio_sim]
 gpio_sim_device_config_live_store+0x4cf/0x11a0 [gpio_sim]
 ? lock_release+0xdd/0x2b0
 ? configfs_write_iter+0x1e4/0x460 [configfs]
 ? __pfx_gpio_sim_device_config_live_store+0x10/0x10 [gpio_sim]
 ? __kasan_check_write+0x18/0x20
 ? down_read+0x1a8/0x4a0
 ? __pfx_down_read+0x10/0x10
 configfs_write_iter+0x2b8/0x460 [configfs]
 vfs_write+0x53e/0x1120
 ? fd_install+0x17b/0x360
 ? putname+0xc1/0x140
 ? __pfx_vfs_write+0x10/0x10
 ? do_sys_openat2+0x127/0x1a0
 ? __fput+0x534/0xa70
 ksys_write+0x105/0x230
 ? __pfx_ksys_write+0x10/0x10
 ? __pfx_fput_close_sync+0x10/0x10
 ? __pfx___x64_sys_openat+0x10/0x10
 __x64_sys_write+0x76/0xd0
 ? trace_hardirqs_on+0x8c/0x160
 x64_sys_call+0x7d/0x1da0
 do_syscall_64+0x74/0x3c0
 entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7fb4bbbb8dda
Code: 08 03 00 00 59 5e 48 83 f8 fc 75 1e 83 e2 39 83 fa 08 75 16 e8
27 ff ff ff 0f 1f 80 00 00 00 00 49 89 ca 48 8b 44 24 20 0f 05 <48> 83
c4 18 c3 90 f3 0f 1e fa 48 83 ec 10 ff 74 24 18 e8 5f ff ff
RSP: 002b:00007ffcbfc5be40 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007fb4bc0ce07f RCX: 00007fb4bbbb8dda
RDX: 0000000000000002 RSI: 00007fb4bc0ce07f RDI: 0000000000000008
RBP: 0000000000000008 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000002
R13: 0000563121bd6630 R14: 0000000000000001 R15: 0000000000000000
 </TASK>

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x103ce6
flags: 0x8000000000000000(zone=2)
raw: 8000000000000000 0000000000000000 ffffea00040f3990 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff888103ce6380: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff888103ce6400: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888103ce6480: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                         ^
 ffff888103ce6500: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff888103ce6580: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
Disabling lock debugging due to kernel taint
------------[ cut here ]------------
refcount_t: addition on 0; use-after-free.
WARNING: lib/refcount.c:25 at refcount_warn_saturate+0xd4/0xf0, CPU#6:
gpio-manager/320
Modules linked in: gpio_sim dev_sync_probe cfg80211 parport_pc parport
nfsd sch_fq_codel fuse configfs
CPU: 6 UID: 996 PID: 320 Comm: gpio-manager Tainted: G    B
   6.19.0-rc6-yocto-standard+ #2 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS
rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014
RIP: 0010:refcount_warn_saturate+0xd4/0xf0
Code: 67 48 0f b9 3a 5b 41 5c 5d c3 cc cc cc cc 48 8d 3d 11 ef 7a 03
67 48 0f b9 3a 5b 41 5c 5d c3 cc cc cc cc 48 8d 3d 0c ef 7a 03 <67> 48
0f b9 3a 5b 41 5c 5d e9 ce 84 f5 01 48 89 df e8 06 b8 1c ff
RSP: 0018:ffff88810a877858 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff888103d13c50 RCX: 0000000000000000
RDX: 0000000000000001 RSI: ffffffffae5f485a RDI: ffffffffb1da3750
RBP: ffff88810a877868 R08: 0000000000000292 R09: ffffed10207a278a
R10: 0000000000000003 R11: 0000000000000011 R12: 0000000000000002
R13: ffff888107b4e220 R14: ffffffffb0915660 R15: ffff88810148c000
FS:  00007ffa8c165c80(0000) GS:ffff8881a8a83000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000556be771dae0 CR3: 0000000117240005 CR4: 00000000003706f0
Call Trace:
 <TASK>
 revocable_alloc+0xc8/0xf0
 gpio_chrdev_open+0x93/0x510
 ? __kasan_check_read+0x15/0x20
 ? do_raw_spin_unlock+0x5d/0x250
 chrdev_open+0x1f3/0x620
 ? __pfx_chrdev_open+0x10/0x10
 ? do_raw_spin_unlock+0x5d/0x250
 do_dentry_open+0x469/0x11a0
 ? devcgroup_check_permission+0x171/0x360
 ? __pfx_chrdev_open+0x10/0x10
 vfs_open+0x7a/0x440
 ? may_open+0xec/0x340
 ? complete_walk+0xdd/0x2a0
 path_openat+0x196f/0x3000
 ? arch_stack_walk+0xb7/0x100
 ? __pfx_path_openat+0x10/0x10
 ? stack_trace_save+0x96/0xd0
 ? __pfx_stack_trace_save+0x10/0x10
 ? stack_depot_save_flags+0x2c/0xa20
 do_filp_open+0x1c5/0x460
 ? __kasan_check_write+0x18/0x20
 ? do_raw_spin_lock+0x125/0x270
 ? __pfx_do_filp_open+0x10/0x10
 ? strncpy_from_user+0x3f/0x210
 do_sys_openat2+0x102/0x1a0
 ? __pfx_do_sys_openat2+0x10/0x10
 ? __seccomp_filter+0x2a6/0xc40
 ? __pfx___seccomp_filter+0x10/0x10
 __x64_sys_openat+0x10c/0x240
 ? __pfx_do_readlinkat+0x10/0x10
 ? __pfx___x64_sys_openat+0x10/0x10
 ? __secure_computing+0x157/0x250
 ? __kasan_check_read+0x15/0x20
 x64_sys_call+0x1283/0x1da0
 do_syscall_64+0x74/0x3c0
 entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7ffa8c4c6142
Code: 08 0f 85 d1 4b ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89
c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 66
2e 0f 1f 84 00 00 00 00 00 66 2e 0f 1f 84 00 00 00 00 00 66
RSP: 002b:00007ffc1c0e8fd8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 0000560fd4f96140 RCX: 00007ffa8c4c6142
RDX: 0000000000080002 RSI: 0000560fd4f96140 RDI: ffffffffffffff9c
RBP: 0000560fd4f96c30 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 0000000000000000 R14: 0000560fd4f83940 R15: 00007ffc1c0e9280
 </TASK>
irq event stamp: 169812
hardirqs last  enabled at (169811): [<ffffffffb054880b>]
_raw_spin_unlock_irqrestore+0x4b/0x60
hardirqs last disabled at (169812): [<ffffffffb0525ed5>]
__schedule+0x1395/0x4140
softirqs last  enabled at (169688): [<ffffffffaf854784>] __alloc_skb+0x2c4/0x3a0
softirqs last disabled at (169686): [<ffffffffaf854784>] __alloc_skb+0x2c4/0x3a0
---[ end trace 0000000000000000 ]---
Oops: general protection fault, probably for non-canonical address
0xe019ad6c7515063f: 0000 [#1] SMP KASAN PTI
KASAN: maybe wild-memory-access in range [0x00cd8b63a8a831f8-0x00cd8b63a8a831ff]
CPU: 6 UID: 996 PID: 320 Comm: gpio-manager Tainted: G    B   W
   6.19.0-rc6-yocto-standard+ #2 PREEMPT(full)
Tainted: [B]=BAD_PAGE, [W]=WARN
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS
rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014
RIP: 0010:__srcu_check_read_flavor+0x74/0x220
Code: 48 89 fe 48 c1 ee 03 80 3c 06 00 0f 85 9b 01 00 00 48 b8 00 00
00 00 00 fc ff df 49 03 50 08 4c 8d 4a 20 4c 89 ce 48 c1 ee 03 <0f> b6
34 06 4c 89 c8 83 e0 07 83 c0 03 40 38 f0 7c 09 40 84 f6 0f
RSP: 0018:ffff88810a877ce8 EFLAGS: 00010207
RAX: dffffc0000000000 RBX: ffff888103d13c00 RCX: 0000000000000001
RDX: 00cd8b63a8a831df RSI: 0019b16c7515063f RDI: ffff88810a877ca0
RBP: ffff88810a877d10 R08: ffff888103d13c00 R09: 00cd8b63a8a831ff
R10: ffff888110e6c700 R11: ffff888107b4e220 R12: ffff888102756320
R13: ffff888103d13c18 R14: 000000008044b401 R15: ffff88810148c000
FS:  00007ffa8c165c80(0000) GS:ffff8881a8a83000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000556be771dae0 CR3: 0000000117240005 CR4: 00000000003706f0
Call Trace:
 <TASK>
 revocable_try_access+0x47/0x150
 gpio_ioctl+0xdd/0xc20
 ? __pfx_do_vfs_ioctl+0x10/0x10
 ? lock_release+0x1d6/0x2b0
 ? __pfx_gpio_ioctl+0x10/0x10
 ? __kasan_check_read+0x15/0x20
 ? lock_acquire+0x223/0x2b0
 ? lock_release+0x1d6/0x2b0
 ? __fget_files+0x1b8/0x320
 __x64_sys_ioctl+0x143/0x1d0
 ? __secure_computing+0x157/0x250
 x64_sys_call+0xf3c/0x1da0
 do_syscall_64+0x74/0x3c0
 entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7ffa8c5381ac
Code: 1e fa 48 8d 44 24 08 48 89 54 24 e0 48 89 44 24 c0 48 8d 44 24
d0 48 89 44 24 c8 b8 10 00 00 00 c7 44 24 b8 10 00 00 00 0f 05 <89> c2
3d 00 f0 ff ff 77 0b 89 d0 c3 0f 1f 84 00 00 00 00 00 48 8b
RSP: 002b:00007ffc1c0e9578 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000560fd4f96c30 RCX: 00007ffa8c5381ac
RDX: 00007ffc1c0e9590 RSI: 000000008044b401 RDI: 000000000000000a
RBP: 00007ffc1c0e95f0 R08: 00007ffc1c0e9438 R09: 0000000000000000
R10: 00000000ffffffff R11: 0000000000000246 R12: 0000560fd4f96c30
R13: 0000560fd4f787e0 R14: 00007ffc1c0e96a8 R15: 00007ffc1c0e9640
 </TASK>
Modules linked in: gpio_sim dev_sync_probe cfg80211 parport_pc parport
nfsd sch_fq_codel fuse configfs
---[ end trace 0000000000000000 ]---
RIP: 0010:__srcu_check_read_flavor+0x74/0x220
Code: 48 89 fe 48 c1 ee 03 80 3c 06 00 0f 85 9b 01 00 00 48 b8 00 00
00 00 00 fc ff df 49 03 50 08 4c 8d 4a 20 4c 89 ce 48 c1 ee 03 <0f> b6
34 06 4c 89 c8 83 e0 07 83 c0 03 40 38 f0 7c 09 40 84 f6 0f
RSP: 0018:ffff88810a877ce8 EFLAGS: 00010207
RAX: dffffc0000000000 RBX: ffff888103d13c00 RCX: 0000000000000001
RDX: 00cd8b63a8a831df RSI: 0019b16c7515063f RDI: ffff88810a877ca0
RBP: ffff88810a877d10 R08: ffff888103d13c00 R09: 00cd8b63a8a831ff
R10: ffff888110e6c700 R11: ffff888107b4e220 R12: ffff888102756320
R13: ffff888103d13c18 R14: 000000008044b401 R15: ffff88810148c000
FS:  00007ffa8c165c80(0000) GS:ffff8881a8a83000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000556be771dae0 CR3: 0000000117240005 CR4: 00000000003706f0

Thanks,
Bartosz

Powered by blists - more mailing lists