rv/reactors: fix lockdep warning and add KUnit tests

The DEFINE_WAIT_OVERRIDE_MAP() macro creates a lockdep map with wait_type_inner = LD_WAIT_CONFIG, which inherits the outer context's wait type. When rv_react() is called from a LD_WAIT_FREE context (e.g., a KUnit test with busy-wait), and the reactor callback triggers a timer interrupt during the busy-loop,

the interrupt exit path attempts
to schedule (preempt_schedule_irq -> __schedule -> rq->__lock), which is LD_WAIT_SPIN. Lockdep then reports:

[ BUG: Invalid wait context ]
context-{5:5}
1 lock held by kunit_try_catch/209:
#0: rv_react_map-wait-type-override at rv_react+0x9d/0xf0

The wait_type_override map allowed the outer LD_WAIT_FREE to propagate inward, but scheduling from an interrupt is LD_WAIT_SPIN, violating the constraint.

Fix by explicitly setting wait_type_inner = LD_WAIT_SPIN, which is the tightest constraint rv_react() callbacks must satisfy: they may not sleep (LD_WAIT_SLEEP) or use mutexes, but can use spinlocks and be interrupted. This matches the documented LD_WAIT_FREE constraint.

From: Wen Yang <[email protected]>

The DEFINE_WAIT_OVERRIDE_MAP() macro creates a lockdep map with wait_type_inner = LD_WAIT_CONFIG, which inherits the outer context's wait type. When rv_react() is called from a LD_WAIT_FREE context (e.g., a KUnit test with busy-wait), and the reactor callback triggers a timer interrupt during the busy-loop, the interrupt exit path attempts to schedule (preempt_schedule_irq -> __schedule -> rq->__lock), which is LD_WAIT_SPIN. Lockdep then reports:

[ BUG: Invalid wait context ]
context-{5:5}
1 lock held by kunit_try_catch/209:
#0: rv_react_map-wait-type-override at rv_react+0x9d/0xf0

The wait_type_override map allowed the outer LD_WAIT_FREE to propagate inward, but scheduling from an interrupt is LD_WAIT_SPIN, violating the constraint.

Fix by explicitly setting wait_type_inner = LD_WAIT_SPIN, which is the tightest constraint rv_react() callbacks must satisfy: they may not sleep (LD_WAIT_SLEEP) or use mutexes, but can use spinlocks and be interrupted. This matches the documented LD_WAIT_FREE constraint.

Fixes 69d8895cb9a9 ("rv: Add explicit lockdep context for reactors")

Signed-off-by Wen Yang <[email protected]>

Cc Thomas Weißschuh <[email protected]>

---
 kernel/trace/rv/rv_reactors.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

kernel/trace/rv/rv_reactors.c +0 -0

index 460af07f7aba..423f843bbd68 100644
@@ -465,7 +465,13 @@ int init_rv_reactors(struct dentry *root_dir)
 

kernel/trace/rv/rv_reactors.c +0 -0

 	va_list args;
 
 	if (!rv_reacting_on() || !monitor->react)

Signature · 1 line

2.25.1

This now allows reactors to take (raw) spinlocks. The original idea was to not allow that as a reactor can be called from LD_WAIT_FREE context. So I am not sure this is the right fix. Not that I have a better one available right now.

Quoted 4 lines · Thomas Weißschuh

This now allows reactors to take (raw) spinlocks. The original idea was to not allow that as a reactor can be called from LD_WAIT_FREE context. So I am not sure this is the right fix. Not that I have a better one available right now.

As far as I understand it, LD_WAIT_FREE is fairly impossible to apply on preemptible code (here we see it hit by an interrupt).

Since we kind of have to allow raw spinlock to avoid this (even if we don't take them explicitly), why wouldn't a reactor ever be allowed to take raw spinlocks?

Technically it wouldn't be wrong to take locks from RV monitors, although most monitors don't do it explicitly.
If we ever happen to take the wrong lock explicitly from a reactor triggered by a nasty event (e.g. sched_switch), I believe lockdep would still be complaining down that path, so we probably don't need to be too strict in rv_react().

Obviously we don't want to disable interrutps for LD_WAIT_FREE to hold either.

Am I missing something?

Quoted 18 lines · Gabriele Monaco

Quoted 4 lines · Thomas Weißschuh

This now allows reactors to take (raw) spinlocks. The original idea was to not allow that as a reactor can be called from LD_WAIT_FREE context. So I am not sure this is the right fix. Not that I have a better one available right now.

As far as I understand it, LD_WAIT_FREE is fairly impossible to apply on preemptible code (here we see it hit by an interrupt).

Since we kind of have to allow raw spinlock to avoid this (even if we don't take them explicitly), why wouldn't a reactor ever be allowed to take raw spinlocks?

Technically it wouldn't be wrong to take locks from RV monitors, although most monitors don't do it explicitly.
If we ever happen to take the wrong lock explicitly from a reactor triggered by a nasty event (e.g. sched_switch), I believe lockdep would still be complaining down that path, so we probably don't need to be too strict in rv_react().

Quoted 3 lines

Obviously we don't want to disable interrutps for LD_WAIT_FREE to hold either.

Am I missing something?

No, I was just very confused.
Let's go ahead with this.

How about a context-sensitive approach, eg:

NMI/hardirq (interrupts masked, scheduler cannot run):
Keep LD_WAIT_FREE. The false positive cannot arise in this path, and the original constraint against raw spinlocks is preserved where it is meaningful.

task/softirq/PREEMPT_RT irq thread (preemptible):
Raise to LD_WAIT_SPIN. Raw spinlocks become permitted — as Gabriele note, this is a necessary consequence of any fix in this path.

Quoted 7 lines · Wen Yang

How about a context-sensitive approach, eg:

NMI/hardirq (interrupts masked, scheduler cannot run):
Keep LD_WAIT_FREE. The false positive cannot arise in this path, and the original constraint against raw spinlocks is preserved where it is meaningful.

Quoted 3 lines

task/softirq/PREEMPT_RT irq thread (preemptible):
Raise to LD_WAIT_SPIN. Raw spinlocks become permitted — as Gabriele note, this is a necessary consequence of any fix in this path.

I don't get the point. Unless the lock's type is also context-sensitive, the reactors still cannot use raw spin locks.

From: Wen Yang <[email protected]>

Add KUnit tests for the printk reactor covering:
- Reactor registration and unregistration lifecycle
- React callback invocation via rv_react()
- Double registration rejection
- Multiple register/unregister cycles

The mock callback calls vprintk_deferred() — the same path as the real reactor — then busy-waits to simulate I/O back-pressure, exercising the LD_WAIT_FREE constraint of rv_react() under load.

Signed-off-by Wen Yang <[email protected]>

---
 kernel/trace/rv/Kconfig                |  10 ++
 kernel/trace/rv/Makefile               |   1 +
 kernel/trace/rv/reactor_printk_kunit.c | 123 +++++++++++++++++++++++++
 3 files changed, 134 insertions(+)
 create mode 100644 kernel/trace/rv/reactor_printk_kunit.c

kernel/trace/rv/Kconfig +0 -0

index 3884b14df375..ff47895c897f 100644

kernel/trace/rv/Kconfig +7 -0

+	default KUNIT_ALL_TESTS
+	help
+	  This builds KUnit tests for the printk reactor. These are only
+	  for development and testing, not for regular kernel use cases.
+
+	  If unsure, say N.
+
 config RV_REACT_PANIC
 	bool "Panic reactor"
 	depends on RV_REACTORS

kernel/trace/rv/Makefile +1 -0

index 94498da35b37..ef0a2dcb927c 100644
@@ -23,4 +23,5 @@ obj-$(CONFIG_RV_MON_NOMISS) += monitors/nomiss/nomiss.o
 # Add new monitors here
 obj-$(CONFIG_RV_REACTORS) += rv_reactors.o
 obj-$(CONFIG_RV_REACT_PRINTK) += reactor_printk.o
+obj-$(CONFIG_RV_REACT_PRINTK_KUNIT) += reactor_printk_kunit.o
 obj-$(CONFIG_RV_REACT_PANIC) += reactor_panic.o

kernel/trace/rv/reactor_printk_kunit.c new file +23 -0

new file mode 100644
index 000000000000..933aa5602226
@@ -0,0 +1,123 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * KUnit tests for reactor_printk
+ *
+ */
+
+#include <kunit/test.h>
+#include <linux/rv.h>
+#include <linux/printk.h>
+#include <linux/sched/clock.h>
+#include <linux/processor.h>
+
+/*
+ * Simulated execution time for mock_printk_react (sched_clock units,
+ * nanoseconds).  Models the time a real printk reactor callback may consume
+ * under I/O pressure, exercising the LD_WAIT_FREE constraint of rv_react().
+ */
+#define MOCK_REACT_DURATION_NS	5000000ULL
+
+/*
+ * Mock react callback mirroring rv_printk_reaction().
+ *
+ * Calls vprintk_deferred() — the same path as the real reactor — then holds

kernel/trace/rv/reactor_printk_kunit.c new file +8 -0

+
+	rv_unregister_reactor(&mock_printk_reactor);
+}
+
+/* Test 2: react callback is invoked via rv_react() */
+static void test_printk_react_called(struct kunit *test)
+{
+	struct rv_reactor reactor = {

kernel/trace/rv/reactor_printk_kunit.c new file +11 -0

+
+	rv_unregister_reactor(&mock_printk_reactor);
+}
+
+/* Test 4: register/unregister cycle */
+static void test_printk_register_cycle(struct kunit *test)
+{
+	int ret, i;
+
+	for (i = 0; i < 5; i++) {
+		ret = rv_register_reactor(&mock_printk_reactor);

kernel/trace/rv/reactor_printk_kunit.c new file +12 -0

+	{}
+};
+
+static struct kunit_suite reactor_printk_kunit_suite = {
+	.name		= "rv_reactor_printk",
+	.test_cases	= reactor_printk_kunit_cases,
+};
+
+kunit_test_suite(reactor_printk_kunit_suite);
+
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("KUnit tests for reactor_printk");

Signature · 1 line

2.25.1

From: Wen Yang <[email protected]>

Add KUnit tests for the printk reactor covering:
- Reactor registration and unregistration lifecycle
- React callback invocation via rv_react()
- Double registration rejection
- Multiple register/unregister cycles

The mock callback calls vprintk_deferred() — the same path as the real reactor — then busy-waits to simulate I/O back-pressure, exercising the LD_WAIT_FREE constraint of rv_react() under load.

Signed-off-by Wen Yang <[email protected]>

---
 kernel/trace/rv/Kconfig                |  10 ++ kernel/trace/rv/Makefile               |   1 + kernel/trace/rv/reactor_printk_kunit.c | 123 +++++++++++++++++++++++++

 3 files changed, 134 insertions(+)

 create mode 100644 kernel/trace/rv/reactor_printk_kunit.c

kernel/trace/rv/Kconfig +0 -0

index 3884b14df375..ff47895c897f 100644
@@ -104,6 +104,16 @@ config RV_REACT_PRINTK
  	  Enables the printk reactor. The printk reactor emits a printk()

    message if an exception is found.

kernel/trace/rv/Kconfig +10 -0

+config RV_REACT_PRINTK_KUNIT
+	bool "KUnit tests for reactor_printk" if !KUNIT_ALL_TESTS
+	depends on RV_REACT_PRINTK && KUNIT
+	default KUNIT_ALL_TESTS
+	help
+	  This builds KUnit tests for the printk reactor. These are only
+	  for development and testing, not for regular kernel use cases.
+
+	  If unsure, say N.
+

 config RV_REACT_PANIC
  bool "Panic reactor"
  depends on RV_REACTORS

kernel/trace/rv/Makefile +0 -0

index 94498da35b37..ef0a2dcb927c 100644
@@ -23,4 +23,5 @@ obj-$(CONFIG_RV_MON_NOMISS) += monitors/nomiss/nomiss.o
  # Add new monitors here

 obj-$(CONFIG_RV_REACTORS) += rv_reactors.o obj-$(CONFIG_RV_REACT_PRINTK) += reactor_printk.o +obj-$(CONFIG_RV_REACT_PRINTK_KUNIT) += reactor_printk_kunit.o obj-$(CONFIG_RV_REACT_PANIC) += reactor_panic.o

kernel/trace/rv/reactor_printk_kunit.c new file +22 -0

new file mode 100644
index 000000000000..933aa5602226
@@ -0,0 +1,123 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * KUnit tests for reactor_printk
+ *
+ */
+
+#include <kunit/test.h>
+#include <linux/rv.h>
+#include <linux/printk.h>
+#include <linux/sched/clock.h>
+#include <linux/processor.h>
+
+/*
+ * Simulated execution time for mock_printk_react (sched_clock units,
+ * nanoseconds).  Models the time a real printk reactor callback may consume
+ * under I/O pressure, exercising the LD_WAIT_FREE constraint of rv_react().
+ */
+#define MOCK_REACT_DURATION_NS	5000000ULL
+
+/*
+ * Mock react callback mirroring rv_printk_reaction().
+ *

kernel/trace/rv/reactor_printk_kunit.c new file +9 -0

+	vprintk_deferred(msg, args);
+
+	while (sched_clock() - start < MOCK_REACT_DURATION_NS)
+		cpu_relax();
+}
+
+static struct rv_reactor mock_printk_reactor = {
+	.name		= "test_printk",
+	.description	= "test printk reactor",

kernel/trace/rv/reactor_printk_kunit.c new file +42 -0

+	KUNIT_EXPECT_STREQ(test, mock_printk_reactor.name, "test_printk");
+
+	rv_unregister_reactor(&mock_printk_reactor);
+}
+
+/* Test 2: react callback is invoked via rv_react() */
+static void test_printk_react_called(struct kunit *test)
+{
+	struct rv_reactor reactor = {
+		.name	= "printk_cb_test",
+		.react	= mock_printk_react,
+	};
+	struct rv_monitor monitor = {
+		.name	= "test_monitor",
+		.reactor = &reactor,
+		.react	= mock_printk_react,
+	};
+
+	rv_react(&monitor, "printk violation message");
+}
+
+/* Test 3: double registration should fail */
+static void test_printk_double_register(struct kunit *test)
+{
+	int ret;
+
+	ret = rv_register_reactor(&mock_printk_reactor);
+	KUNIT_ASSERT_EQ(test, ret, 0);
+
+	ret = rv_register_reactor(&mock_printk_reactor);
+	KUNIT_EXPECT_NE(test, ret, 0);
+
+	rv_unregister_reactor(&mock_printk_reactor);
+}
+
+/* Test 4: register/unregister cycle */
+static void test_printk_register_cycle(struct kunit *test)
+{
+	int ret, i;
+
+	for (i = 0; i < 5; i++) {
+		ret = rv_register_reactor(&mock_printk_reactor);

kernel/trace/rv/reactor_printk_kunit.c new file +20 -0

+}
+
+static struct kunit_case reactor_printk_kunit_cases[] = {
+	KUNIT_CASE(test_printk_register_unregister),
+	KUNIT_CASE(test_printk_react_called),
+	KUNIT_CASE(test_printk_double_register),
+	KUNIT_CASE(test_printk_register_cycle),
+	KUNIT_CASE(test_printk_react_not_null),
+	{}
+};
+
+static struct kunit_suite reactor_printk_kunit_suite = {
+	.name		= "rv_reactor_printk",
+	.test_cases	= reactor_printk_kunit_cases,
+};
+
+kunit_test_suite(reactor_printk_kunit_suite);
+
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("KUnit tests for reactor_printk");

Quoted 80 lines · On Tue, 2026-06-16 at 00:44 +0800, [email protected] wrote:

From: Wen Yang <[email protected]>

Add KUnit tests for the printk reactor covering:
- Reactor registration and unregistration lifecycle
- React callback invocation via rv_react()
- Double registration rejection
- Multiple register/unregister cycles

The mock callback calls vprintk_deferred() — the same path as the real reactor — then busy-waits to simulate I/O back-pressure, exercising the LD_WAIT_FREE constraint of rv_react() under load.

Signed-off-by Wen Yang <[email protected]>

---
  kernel/trace/rv/Kconfig                |  10 ++
  kernel/trace/rv/Makefile               |   1 +
  kernel/trace/rv/reactor_printk_kunit.c | 123 +++++++++++++++++++++++++
  3 files changed, 134 insertions(+)

 create mode 100644 kernel/trace/rv/reactor_printk_kunit.c

kernel/trace/rv/Kconfig +10 -0

index 3884b14df375..ff47895c897f 100644
@@ -104,6 +104,16 @@ config RV_REACT_PRINTK
  	  Enables the printk reactor. The printk reactor emits a printk()
  	  message if an exception is found.
 
+config RV_REACT_PRINTK_KUNIT
+	bool "KUnit tests for reactor_printk" if !KUNIT_ALL_TESTS
+	depends on RV_REACT_PRINTK && KUNIT
+	default KUNIT_ALL_TESTS
+	help
+	  This builds KUnit tests for the printk reactor. These are only
+	  for development and testing, not for regular kernel use cases.
+
+	  If unsure, say N.
+
  config RV_REACT_PANIC
  	bool "Panic reactor"
  	depends on RV_REACTORS

kernel/trace/rv/Makefile +1 -0

index 94498da35b37..ef0a2dcb927c 100644
@@ -23,4 +23,5 @@ obj-$(CONFIG_RV_MON_NOMISS) += monitors/nomiss/nomiss.o
  # Add new monitors here
  obj-$(CONFIG_RV_REACTORS) += rv_reactors.o
  obj-$(CONFIG_RV_REACT_PRINTK) += reactor_printk.o
+obj-$(CONFIG_RV_REACT_PRINTK_KUNIT) += reactor_printk_kunit.o
  obj-$(CONFIG_RV_REACT_PANIC) += reactor_panic.o

kernel/trace/rv/reactor_printk_kunit.c new file +22 -0

new file mode 100644
index 000000000000..933aa5602226
@@ -0,0 +1,123 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * KUnit tests for reactor_printk
+ *
+ */
+
+#include <kunit/test.h>
+#include <linux/rv.h>
+#include <linux/printk.h>
+#include <linux/sched/clock.h>
+#include <linux/processor.h>
+
+/*
+ * Simulated execution time for mock_printk_react (sched_clock units,
+ * nanoseconds).  Models the time a real printk reactor callback may consume
+ * under I/O pressure, exercising the LD_WAIT_FREE constraint of rv_react().
+ */
+#define MOCK_REACT_DURATION_NS	5000000ULL
+
+/*
+ * Mock react callback mirroring rv_printk_reaction().
+ *

kernel/trace/rv/reactor_printk_kunit.c line 32

Quoted 10 lines

kernel/trace/rv/reactor_printk_kunit.c new file +10 -0

+ * Calls vprintk_deferred() — the same path as the real reactor — then holds
+ * the CPU for MOCK_REACT_DURATION_NS via a sched_clock() timed busy-loop,
+ * simulating a callback that is slow due to I/O back-pressure.
+ * sched_clock() is notrace and lock-free; no sleep or lock acquisition is
+ * performed, satisfying the LD_WAIT_FREE constraint of rv_react().
+ */
+__printf(1, 0) static void mock_printk_react(const char *msg, va_list args)
+{
+	u64 start = sched_clock();
+

I'm fine testing something that looks like the printk reactor rather than the real thing, but here sched_clock() is playing with preemption and could trigger one, this isn't accurate.

I'm not sure all implementations are free from this problem, but why don't you just use mdelay() here?

Add KUnit tests for the panic reactor covering:
- Reactor registration and unregistration lifecycle
- Panic notifier chain reachability

Hi Wen,

I came across a Sashiko AI code review [1] that flagged a potential NULL pointer dereference in the test_panic_register_unregister() test case added by this patch (commit 8655782285e2).  The review's analysis seemed plausible, so I spun up a QEMU environment to see whether it could be reproduced in practice.

The short version: yes, it triggers a real kernel BUG + Oops.  See below for the crash log and the reproduction approach.

Quoted 3 lines · Wen Yang

Add KUnit tests for the panic reactor covering:
- Reactor registration and unregistration lifecycle
- Panic notifier chain reachability

...

kernel/trace/rv/reactor_panic_kunit.c line 71

Quoted 9 lines

kernel/trace/rv/reactor_panic_kunit.c new file +9 -0

+static void test_panic_register_unregister(struct kunit *test)
+{
+    int ret;
+
+    ret = rv_register_reactor(&mock_panic_reactor);
+    KUNIT_EXPECT_EQ(test, ret, 0);
+    KUNIT_EXPECT_STREQ(test, mock_panic_reactor.name, "test_panic");
+
+    rv_unregister_reactor(&mock_panic_reactor);

This is the function the review highlighted.  The issue is:

  - KUNIT_EXPECT_EQ() does *not* abort the test on failure.
  - If rv_register_reactor() fails (e.g. because another reactor named "test_panic" was already registered), the .list node of the statically-allocated mock_panic_reactor is never added to any list — it remains zero-initialized (prev = NULL, next = NULL).
  - rv_unregister_reactor() then unconditionally calls list_del() on this uninitialized list_head, which hits the NULL pointers.

I was able to reproduce this reliably.  The trigger condition is surprisingly simple: if any code path registers a reactor named "test_panic" before the KUnit suite runs, the test crashes the kernel.

[Reproduction approach]

I rebuilt the kernel with a small late_initcall in rv_reactors.c that pre-registers "test_panic" (simulating what would happen if, say, a kernel module or another subsystem registered a reactor with the same name before the KUnit tests execute):

  static int __init prereg_test_panic(void)
  {
      static struct rv_reactor prereg = {
          .name = "test_panic",
          .description = "pre-registered to simulate name collision", };
      return rv_register_reactor(&prereg);
  }
  late_initcall(prereg_test_panic);

The KUnit tests then auto-run at boot (kunit_run_all_tests).  The test_panic_register_unregister case fails registration with -EINVAL due to the duplicate name, the KUNIT_EXPECT_EQ does not abort, and rv_unregister_reactor() crashes on the uninitialized list.

[Crash log — kernel 7.1.0-next-20260615, CONFIG_DEBUG_LIST=y]

  Reactor test_panic is already registered
      # test_panic_register_unregister: EXPECTATION FAILED at
kernel/trace/rv/reactor_panic_kunit.c:68
      Expected ret == 0, but
          ret == -22 (0xffffffffffffffea)
  list_del corruption, ffffffff8ecce2f8->next is NULL

   ------------[ cut here ]------------
   kernel BUG at lib/list_debug.c:52!
   Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
   CPU: 1 UID: 0 PID: 5028 Comm: kunit_try_catch Tainted: G   N
   RIP: 0010:__list_del_entry_valid_or_report+0xf2/0x200
   Call Trace:
    <TASK>
    rv_unregister_reactor+0x37/0x190
    test_panic_register_unregister+0x1de/0x2e0
    kunit_try_run_case+0x1d2/0x520
    kunit_generic_run_threadfn_adapter+0x89/0x100
    kthread+0x387/0x4a0
    ret_from_fork+0xb2c/0xdd0
    </TASK>
   Kernel panic - not syncing: Fatal exception

The crash is in rv_unregister_reactor(), called from test_panic_register_unregister().  The list_del() in rv_unregister_reactor() has no guard against a list node that was never added to any list.  With CONFIG_DEBUG_LIST=y the corruption is caught explicitly; without it this would be a silent NULL dereference.

[Suggested fix]

The most straightforward fix is to use KUNIT_ASSERT_EQ() instead of KUNIT_EXPECT_EQ() for the registration result, so the test aborts before reaching rv_unregister_reactor() on a failed registration:

  static void test_panic_register_unregister(struct kunit *test) {
      int ret;

      ret = rv_register_reactor(&mock_panic_reactor);
-     KUNIT_EXPECT_EQ(test, ret, 0);
+     KUNIT_ASSERT_EQ(test, ret, 0);
      KUNIT_EXPECT_STREQ(test, mock_panic_reactor.name, "test_panic");

      rv_unregister_reactor(&mock_panic_reactor); }

An alternative (or complementary) approach would be to add a guard in rv_unregister_reactor() itself — e.g. checking whether the reactor is actually on the list before calling list_del().  That would make the API more robust against future callers making the same mistake.

The same pattern likely applies to the printk reactor tests in patch 2/3, though I haven't tested those.

Full PoC code follows.

[PoC part 1 — Kernel-space: late_initcall to create the name collision]

This is what was added to kernel/trace/rv/rv_reactors.c (or could be built as a standalone kernel module — see preregister.c below).  It pre-registers "test_panic" before KUnit auto-runs, so the test's own rv_register_reactor() fails with -EINVAL:

  static int __init prereg_test_panic(void)
  {
      static struct rv_reactor prereg = {
          .name = "test_panic",
          .description = "pre-registered to simulate name collision", };
      return rv_register_reactor(&prereg);
  }
  late_initcall(prereg_test_panic);

[PoC part 2 — Userspace: trigger the KUnit test via debugfs]

poc.c:
---8<---------------------------------------------------------------- /*
 * POC: NULL pointer dereference in rv_unregister_reactor()
 *
 * Bug location: kernel/trace/rv/reactor_panic_kunit.c
 *   test_panic_register_unregister()
 *
 * Bug: When rv_register_reactor() fails (because "test_panic" is already
 * registered), the test calls rv_unregister_reactor() unconditionally.
 * This performs list_del() on a zero-initialized list_head (never added
 * to any list), causing a NULL pointer dereference crash.
 *
 * Trigger: With a kernel that has pre-registered "test_panic" reactor,
 * simply trigger the KUnit test via debugfs "run" file. The test's
 * rv_register_reactor() fails with -EINVAL (duplicate), and the
subsequent
 * rv_unregister_reactor() crashes on the uninitialized list. */

#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <errno.h>

#define KUNIT_RUN_PATH "/sys/kernel/debug/kunit/rv_reactor_panic/run"

int main(int argc, char **argv)
{
    int fd, ret;

    setbuf(stdout, NULL);

    printf("[+] POC: Triggering NULL deref in rv_unregister_reactor\n"); printf("[+] Target: %s\n\n", KUNIT_RUN_PATH);

    /* Mount debugfs if needed */
    if (access("/sys/kernel/debug", F_OK) != 0) { printf("[*] Mounting debugfs...\n");
        ret = system("mount -t debugfs none /sys/kernel/debug/
2>/dev/null");
        (void)ret;
    }

    /* Verify KUnit path exists */
    if (access(KUNIT_RUN_PATH, W_OK) != 0) { printf("[-] Cannot access %s: %m\n", KUNIT_RUN_PATH); printf("[*] Available KUnit suites:\n"); fflush(stdout);
        system("ls -la /sys/kernel/debug/kunit/ 2>&1"); return 1;
    }

    printf("[*] Test_panic reactor should be pre-registered at boot\n"); printf("[*] Triggering KUnit test suite...\n\n");

    /*
     * Write to the KUnit run file. This executes
     * __kunit_test_suites_init() -> kunit_run_tests() which
     * runs the reactor_panic_kunit test cases including
     * test_panic_register_unregister.
     *
     * With "test_panic" pre-registered:
     * 1. rv_register_reactor() returns -EINVAL (duplicate)
     * 2. KUNIT_EXPECT_EQ doesn't abort
     * 3. rv_unregister_reactor() calls list_del() on NULL list
     * 4. BOOM: list corruption / NULL deref / kernel crash */
    fd = open(KUNIT_RUN_PATH, O_WRONLY);
    if (fd < 0) {
        printf("[-] open failed: %m\n");
        return 1;
    }

    printf("[!] Writing to %s - triggering the crash now...\n",
KUNIT_RUN_PATH);
    fflush(stdout);

    ret = write(fd, "1", 1);
    if (ret < 0) {
        printf("[-] write failed: %m\n");
    } else {
        printf("[+] Write succeeded (ret=%d)\n", ret); }

    close(fd);

    /*
     * If we reach here without crashing, let the user know */
    printf("\n[*] If the system is still alive, check dmesg:\n"); printf("    dmesg | grep -i -E
'list_del|list_add|list_corrupt|NULL|BUG|oops\n");
    printf("\n[*] dmesg output:\n");
    fflush(stdout);
    system("dmesg | tail -60");

    printf("\n[+] POC completed.\n");

    return 0;
} ---8<----------------------------------------------------------------

Compile with:
  gcc -o poc poc.c -static

[PoC part 3 — Kernel module alternative (standalone)]

If you prefer not to modify rv_reactors.c directly, the same name collision can be created by loading this module before running the KUnit test.  Note: this requires rv_register_reactor() to be exported (or resolved via kallsyms), which it may not be in the current tree. In that case the late_initcall approach above is the way to go.

preregister.c:
---8<---------------------------------------------------------------- #include <linux/module.h>
#include <linux/kernel.h>
#include <linux/rv.h>

static struct rv_reactor prereg_reactor = {
    .name = "test_panic",
    .description = "pre-registered to trigger KUnit bug",
};

static int __init prereg_init(void)
{
    int ret;
    ret = rv_register_reactor(&prereg_reactor);
    if (ret < 0) {
        pr_err("preregister: rv_register_reactor failed: %d\n", ret); return ret;
    }
    pr_info("preregister: registered 'test_panic' reactor\n"); return 0;
}

static void __exit prereg_exit(void)
{
    rv_unregister_reactor(&prereg_reactor); pr_info("preregister: unregistered 'test_panic' reactor\n");
}

module_init(prereg_init);
module_exit(prereg_exit);
MODULE_LICENSE("GPL"); ---8<----------------------------------------------------------------

[1] https://sashiko.dev/#/patchset/cover.1781541556.git.wen.yang%40linux.dev
    (Sashiko AI code review — "Null Pointer Dereference", Severity: High)

Thanks,
XIAO

From: Wen Yang <[email protected]>

Add KUnit tests for the panic reactor covering:
- Reactor registration and unregistration lifecycle
- Panic notifier chain reachability

The real rv_panic_reaction() calls vpanic(), which is __noreturn and halts the system. KUnit cannot test across that boundary. Instead, the test drives atomic_notifier_call_chain(&panic_notifier_list, ...) directly with a high-priority mock notifier that returns NOTIFY_STOP, verifying that the panic notification propagates without triggering real handlers (kdump, watchdog, reboot).

The mock notifier busy-waits to simulate real handler execution time (e.g., crash_save_vmcoreinfo, emergency_restart preamble) under the panic context constraints.

Signed-off-by Wen Yang <[email protected]>

---
 kernel/trace/rv/Kconfig               |  10 +++ kernel/trace/rv/Makefile              |   1 + kernel/trace/rv/reactor_panic_kunit.c | 106 ++++++++++++++++++++++++++

 3 files changed, 117 insertions(+)

 create mode 100644 kernel/trace/rv/reactor_panic_kunit.c

kernel/trace/rv/Kconfig +0 -0

index ff47895c897f..6c6c43c5f86c 100644
@@ -121,3 +121,13 @@ config RV_REACT_PANIC

  help
    Enables the panic reactor. The panic reactor emits a printk() message if an exception is found and panic()s the system.

kernel/trace/rv/Kconfig +10 -0

+
+config RV_REACT_PANIC_KUNIT
+	bool "KUnit tests for reactor_panic" if !KUNIT_ALL_TESTS
+	depends on RV_REACT_PANIC && KUNIT
+	default KUNIT_ALL_TESTS
+	help
+	  This builds KUnit tests for the panic reactor. These are only
+	  for development and testing, not for regular kernel use cases.
+
+	  If unsure, say N.

kernel/trace/rv/Makefile +0 -0

index ef0a2dcb927c..2ebfe5e5068c 100644
@@ -25,3 +25,4 @@ obj-$(CONFIG_RV_REACTORS) += rv_reactors.o

 obj-$(CONFIG_RV_REACT_PRINTK) += reactor_printk.o obj-$(CONFIG_RV_REACT_PRINTK_KUNIT) += reactor_printk_kunit.o obj-$(CONFIG_RV_REACT_PANIC) += reactor_panic.o

kernel/trace/rv/Makefile +1 -0

+obj-$(CONFIG_RV_REACT_PANIC_KUNIT) += reactor_panic_kunit.o

kernel/trace/rv/reactor_panic_kunit.c new file +11 -0

new file mode 100644
index 000000000000..f9a09ae7aaad
@@ -0,0 +1,106 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * KUnit tests for reactor_panic
+ *
+ */
+
+#include <kunit/test.h>
+#include <linux/rv.h>
+#include <linux/panic_notifier.h>
+#include <linux/notifier.h>
+#include <linux/limits.h>

kernel/trace/rv/reactor_panic_kunit.c new file +16 -0

+
+/*
+ * Mock panic notifier callback.
+ *
+ * Runs at INT_MAX priority and returns NOTIFY_STOP to prevent real panic
+ * handlers (kdump, watchdog) from executing during the test.  Busy-waits
+ * RV_PANIC_NOTIFIER_EXEC_NS to simulate a real handler's execution time.
+ */
+static int mock_panic_notifier_fn(struct notifier_block *nb,
+				  unsigned long action, void *data)
+{
+	char *msg = data;
+	u64 start = sched_clock();
+
+	panic_test_state.notifier_called = true;
+	pr_emerg("KUnit: reactor_panic test intercepted panic notifier:

%s\n",

kernel/trace/rv/reactor_panic_kunit.c new file +40 -0

+
+	while (sched_clock() - start < RV_PANIC_NOTIFIER_EXEC_NS)
+		cpu_relax();
+
+	return NOTIFY_STOP;
+}
+
+static struct notifier_block mock_panic_nb = {
+	.notifier_call	= mock_panic_notifier_fn,
+	.priority	= INT_MAX,
+};
+
+static struct rv_reactor mock_panic_reactor = {
+	.name		= "test_panic",
+	.description	= "test panic reactor",
+};
+
+static int reactor_panic_kunit_init(struct kunit *test)
+{
+	panic_test_state.notifier_called = false;
+	return 0;
+}
+
+/* Test 1: register and unregister reactor */
+static void test_panic_register_unregister(struct kunit *test)
+{
+	int ret;
+
+	ret = rv_register_reactor(&mock_panic_reactor);
+	KUNIT_EXPECT_EQ(test, ret, 0);
+	KUNIT_EXPECT_STREQ(test, mock_panic_reactor.name, "test_panic");
+
+	rv_unregister_reactor(&mock_panic_reactor);
+}
+
+/*
+ * Test 2: panic notifier chain is reachable.
+ *
+ * vpanic() calls atomic_notifier_call_chain(&panic_notifier_list, ...).
+ * Drive the chain directly to verify panic notifiers receive the

notification —
+ * the observable side-effect of reactor_panic without halting the system.
+ */

kernel/trace/rv/reactor_panic_kunit.c new file +6 -0

+static void test_panic_notifier_called(struct kunit *test)
+{
+	atomic_notifier_chain_register(&panic_notifier_list, &mock_panic_nb);
+	atomic_notifier_call_chain(&panic_notifier_list, 0,
+				   "panic violation message");
+	atomic_notifier_chain_unregister(&panic_notifier_list,

&mock_panic_nb);

kernel/trace/rv/reactor_panic_kunit.c new file +20 -0

+
+	KUNIT_EXPECT_TRUE(test, panic_test_state.notifier_called);
+}
+
+static struct kunit_case reactor_panic_kunit_cases[] = {
+	KUNIT_CASE(test_panic_register_unregister),
+	KUNIT_CASE(test_panic_notifier_called),
+	{}
+};
+
+static struct kunit_suite reactor_panic_kunit_suite = {
+	.name		= "rv_reactor_panic",
+	.init		= reactor_panic_kunit_init,
+	.test_cases	= reactor_panic_kunit_cases,
+};
+
+kunit_test_suite(reactor_panic_kunit_suite);
+
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("KUnit tests for reactor_panic");

+/*
+ * Test 2: panic notifier chain is reachable.
+ *
+ * vpanic() calls atomic_notifier_call_chain(&panic_notifier_list, ...).
+ * Drive the chain directly to verify panic notifiers receive the notification —
+ * the observable side-effect of reactor_panic without halting the system.
+ */

kernel/trace/rv/reactor_panic_kunit.c new file +6 -0

+static void test_panic_notifier_called(struct kunit *test)
+{
+	atomic_notifier_chain_register(&panic_notifier_list, &mock_panic_nb);
+	atomic_notifier_call_chain(&panic_notifier_list, 0,
+				   "panic violation message");
+	atomic_notifier_chain_unregister(&panic_notifier_list,

&mock_panic_nb);

kernel/trace/rv/reactor_panic_kunit.c new file +20 -0

+
+	KUNIT_EXPECT_TRUE(test, panic_test_state.notifier_called);
+}
+
+static struct kunit_case reactor_panic_kunit_cases[] = {
+	KUNIT_CASE(test_panic_register_unregister),
+	KUNIT_CASE(test_panic_notifier_called),
+	{}
+};
+
+static struct kunit_suite reactor_panic_kunit_suite = {
+	.name		= "rv_reactor_panic",
+	.init		= reactor_panic_kunit_init,
+	.test_cases	= reactor_panic_kunit_cases,
+};
+
+kunit_test_suite(reactor_panic_kunit_suite);
+
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("KUnit tests for reactor_panic");

Quoted 11 lines · On Tue, 2026-06-16 at 00:44 +0800, [email protected] wrote:

+/*
+ * Test 2: panic notifier chain is reachable.
+ *
+ * vpanic() calls atomic_notifier_call_chain(&panic_notifier_list, ...).
+ * Drive the chain directly to verify panic notifiers receive the notification —
+ * the observable side-effect of reactor_panic without halting the system.
+ */

kernel/trace/rv/reactor_panic_kunit.c new file +3 -0

+static void test_panic_notifier_called(struct kunit *test)
+{
+	atomic_notifier_chain_register(&panic_notifier_list, &mock_panic_nb);

Quoted 4 lines

kernel/trace/rv/reactor_panic_kunit.c new file +3 -0

+	atomic_notifier_call_chain(&panic_notifier_list, 0,
+				   "panic violation message");
+	atomic_notifier_chain_unregister(&panic_notifier_list,

&mock_panic_nb);

I just realised this isn't even testing the reactor, it's testing the notifier_chain thing, I don't think we really need this here or am I missing something?

Since rv_panic_reaction calls vpanic() which is __noreturn, direct testing is not feasible in KUnit.

A preparatory v2 drops reactor_printk_kunit.c and reactor_panic_kunit.c entirely, replacing them with a single rv_reactors_kunit.c containing two suites:

   rv_reactor_registration: register/unregister lifecycle, duplicate rejection (-EINVAL), name-too-long rejection, and safe unregister of a never-registered reactor.

   rv_react_dispatch: null-callback guard, callback invocation check, and the mdelay lockdep stress test.

v2 also adds EXPORT_SYMBOL_GPL for rv_react(), rv_register_reactor(), and rv_unregister_reactor(), and the Kconfig entry is tristate.

Additional fix: rv_unregister_reactor()

Testing exposed a real bug: rv_unregister_reactor() called list_del() unconditionally.  On a never-registered reactor the list_head is zero-initialised, so list_del() dereferences NULL->prev and crashes. v2 adds a patch that iterates rv_reactors_list first and only calls list_del() when the reactor is found.  test_unregister_nonexistent documents and guards this behaviour.

From: Wen Yang <[email protected]>

We occasionally hit a lockdep "Invalid wait context" warning in production
environments when rv_react() callbacks are interrupted.

The bug is intermittent in production. KUnit tests with busy-wait callbacks
can reproduce it by holding the CPU long enough for a timer interrupt to fire
during rv_react(), exposing the lockdep constraint violation:

[   44.820913] =============================
[   44.820923] [ BUG: Invalid wait context ]
[   44.821137] 7.1.0-rc7-next-20260612-virtme #6 Tainted:
G                 N
[   44.821203] -----------------------------

[   44.821211] kunit_try_catch/209 is trying to lock:
[   44.821244] ffff8a743ed3e8a0 (&rq->__lock){-...}-{2:2}, at:
__schedule+0x102/0x13d0
[   44.821688] other info that might help us debug this:
[   44.821708] context-{5:5}
[   44.821730] 1 lock held by kunit_try_catch/209:
[   44.821745]  #0: ffffffffb6ba62c0 (rv_react_map-wait-type- override){+.+.}-{1:1}, at: rv_react+0x9d/0xf0
[   44.821803] stack backtrace:
[   44.822110] CPU: 10 UID: 0 PID: 209 Comm: kunit_try_catch Tainted:
G                 N  7.1.0-rc7-next-20260612-virtme #6 PREEMPT_{RT,(full)}
[   44.822197] Tainted: [N]=TEST
[   44.822210] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [   44.822328] Call Trace:
[   44.822377]  <TASK>
[   44.822806]  dump_stack_lvl+0x78/0xe0
[   44.822860]  __lock_acquire+0x926/0x1c90
[   44.822888]  lock_acquire+0xd3/0x310
[   44.822901]  ? __schedule+0x102/0x13d0
[   44.822919]  ? rcu_qs+0x2d/0x1a0
[   44.822954]  _raw_spin_lock_nested+0x36/0x50
[   44.822966]  ? __schedule+0x102/0x13d0
[   44.822979]  __schedule+0x102/0x13d0
[   44.822993]  ? mark_held_locks+0x40/0x70
[   44.823009]  preempt_schedule_irq+0x37/0x70
[   44.823018]  irqentry_exit+0x1da/0x8c0
[   44.823032]  asm_sysvec_apic_timer_interrupt+0x1a/0x20 [   44.823093] RIP: 0010:mock_printk_react+0x2a/0x50
[   44.823250] Code: f3 0f 1e fa 0f 1f 44 00 00 41 54 49 89 f4 55 48 89 fd 53 e8 18 8b db ff 4c 89 e6 48 89 ef 48 89 c3 e8 fa 8e ed ff eb 02 f3 90 <e8> 01 8b db ff 48 29 d8 48 3d 3f 4b 4c 00 76 ee 5b 5d 41 5c c3 cc
[   44.823303] RSP: 0018:ffffd1c3c0733d38 EFLAGS: 00000297 [   44.823332] RAX: 00000000000119f3 RBX: 0000000a74e60d1c RCX:
000000000000001f
[   44.823342] RDX: 0000000000000000 RSI: 000000003348c8a2 RDI:
ffffffffc1abbfd9
[   44.823351] RBP: ffffffffb671b613 R08: 0000000000000002 R09:
0000000000000000
[   44.823359] R10: 0000000000000001 R11: 0000000000000000 R12:
ffffd1c3c0733d60
[   44.823367] R13: ffffffffb575a5fd R14: ffffd1c3c0017be8 R15:
ffffd1c3c00179f8
[   44.823397]  ? rv_react+0x9d/0xf0
[   44.823437]  ? mock_printk_react+0x2f/0x50
[   44.823448]  rv_react+0xb4/0xf0
[   44.823455]  ? rv_react+0x9d/0xf0
[   44.823476]  test_printk_react_called+0x83/0xb0
[   44.823486]  ? __pfx_mock_printk_react+0x10/0x10
[   44.823502]  ? __pfx_mock_printk_react+0x10/0x10
[   44.823513]  kunit_try_run_case+0x97/0x190
[   44.823534]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [   44.823544]  kunit_generic_run_threadfn_adapter+0x21/0x40 [   44.823551]  kthread+0x124/0x160
[   44.823562]  ? __pfx_kthread+0x10/0x10
[   44.823574]  ret_from_fork+0x291/0x3b0
[   44.823585]  ? __pfx_kthread+0x10/0x10
[   44.823595]  ret_from_fork_asm+0x1a/0x30
[   44.823641]  </TASK>

Patch 1 fixes the lockdep bug by correcting rv_react()'s wait_type_inner
from LD_WAIT_CONFIG (which inherits the outer context) to LD_WAIT_SPIN
(the tightest constraint callbacks must satisfy).

Patch 2 adds KUnit tests for reactor_printk. The busy-wait in the mock
callback reproduces the timer interrupt scenario that exposes the bug.

Patch 3 adds KUnit tests for reactor_panic, exercising the panic notifier
chain without halting the system.

Tested with CONFIG_PROVE_LOCKING=y and CONFIG_KUNIT=y.

Wen Yang (3):
  rv/reactors: fix lockdep "Invalid wait context" in rv_react() rv/reactors: add KUnit tests for reactor_printk rv/reactors: add KUnit tests for reactor_panic

 kernel/trace/rv/Kconfig                |  20 ++++ kernel/trace/rv/Makefile               |   2 + kernel/trace/rv/reactor_panic_kunit.c  | 106 +++++++++++++++++++++ kernel/trace/rv/reactor_printk_kunit.c | 123
+++++++++++++++++++++++++
 kernel/trace/rv/rv_reactors.c          |   8 +-

 5 files changed, 258 insertions(+), 1 deletion(-)

 create mode 100644 kernel/trace/rv/reactor_panic_kunit.c create mode 100644 kernel/trace/rv/reactor_printk_kunit.c

Are those tests supposed to trigger this issue though? Under what configuration?

I reverted the lockdep fix and run the tests in vng on both x86_64 and arm64, both preempt_rt and not but I see no splat. Repeating the tests multiple times from debugfs also didn't seem to help. Both machines were relatively large (128 and 48 CPUs).

The config was the bare vng one with kunit built-in, lockdep and the reactors tests.

What am I missing?

Quoted 8 lines · Gabriele Monaco

Are those tests supposed to trigger this issue though? Under what configuration?

I reverted the lockdep fix and run the tests in vng on both x86_64 and arm64, both preempt_rt and not but I see no splat. Repeating the tests multiple times from debugfs also didn't seem to help. Both machines were relatively large (128 and 48 CPUs).

Quoted 4 lines

The config was the bare vng one with kunit built-in, lockdep and the reactors tests.

What am I missing?

I haven't tried to reproduce it, but seems quite rare. From the look of it, adding some delay into the reactor function should make the issue more easily reproducible.

Quoted 12 lines · On Tue, 2026-06-16 at 00:44 +0800, [email protected] wrote:

From: Wen Yang <[email protected]>

We occasionally hit a lockdep "Invalid wait context" warning in production
environments when rv_react() callbacks are interrupted.

The bug is intermittent in production. KUnit tests with busy-wait callbacks
can reproduce it by holding the CPU long enough for a timer interrupt to fire
during rv_react(), exposing the lockdep constraint violation:

Quoted 5 lines

[   44.820913] =============================
[   44.820923] [ BUG: Invalid wait context ]
[   44.821137] 7.1.0-rc7-next-20260612-virtme #6 Tainted:
G                 N
[   44.821203] -----------------------------

It's nice to have reactors kunit coverage, I need to go through them more carefully but I like the idea.

Are those tests supposed to trigger this issue though? Under what configuration?

I reverted the lockdep fix and run the tests in vng on both x86_64 and arm64, both preempt_rt and not but I see no splat. Repeating the tests multiple times from debugfs also didn't seem to help. Both machines were relatively large (128 and 48 CPUs).

The config was the bare vng one with kunit built-in, lockdep and the reactors tests.

What am I missing?

Thanks,
Gabriele

Quoted 95 lines

[   44.821211] kunit_try_catch/209 is trying to lock:
[   44.821244] ffff8a743ed3e8a0 (&rq->__lock){-...}-{2:2}, at:
__schedule+0x102/0x13d0
[   44.821688] other info that might help us debug this:
[   44.821708] context-{5:5}
[   44.821730] 1 lock held by kunit_try_catch/209:
[   44.821745]  #0: ffffffffb6ba62c0 (rv_react_map-wait-type- override){+.+.}-{1:1}, at: rv_react+0x9d/0xf0
[   44.821803] stack backtrace:
[   44.822110] CPU: 10 UID: 0 PID: 209 Comm: kunit_try_catch Tainted:
G                 N  7.1.0-rc7-next-20260612-virtme #6 PREEMPT_{RT,(full)}
[   44.822197] Tainted: [N]=TEST
[   44.822210] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [   44.822328] Call Trace:
[   44.822377]  <TASK>
[   44.822806]  dump_stack_lvl+0x78/0xe0
[   44.822860]  __lock_acquire+0x926/0x1c90
[   44.822888]  lock_acquire+0xd3/0x310
[   44.822901]  ? __schedule+0x102/0x13d0
[   44.822919]  ? rcu_qs+0x2d/0x1a0
[   44.822954]  _raw_spin_lock_nested+0x36/0x50
[   44.822966]  ? __schedule+0x102/0x13d0
[   44.822979]  __schedule+0x102/0x13d0
[   44.822993]  ? mark_held_locks+0x40/0x70
[   44.823009]  preempt_schedule_irq+0x37/0x70
[   44.823018]  irqentry_exit+0x1da/0x8c0
[   44.823032]  asm_sysvec_apic_timer_interrupt+0x1a/0x20 [   44.823093] RIP: 0010:mock_printk_react+0x2a/0x50
[   44.823250] Code: f3 0f 1e fa 0f 1f 44 00 00 41 54 49 89 f4 55 48 89 fd 53 e8 18 8b db ff 4c 89 e6 48 89 ef 48 89 c3 e8 fa 8e ed ff eb 02 f3 90 <e8> 01 8b db ff 48 29 d8 48 3d 3f 4b 4c 00 76 ee 5b 5d 41 5c c3 cc
[   44.823303] RSP: 0018:ffffd1c3c0733d38 EFLAGS: 00000297 [   44.823332] RAX: 00000000000119f3 RBX: 0000000a74e60d1c RCX:
000000000000001f
[   44.823342] RDX: 0000000000000000 RSI: 000000003348c8a2 RDI:
ffffffffc1abbfd9
[   44.823351] RBP: ffffffffb671b613 R08: 0000000000000002 R09:
0000000000000000
[   44.823359] R10: 0000000000000001 R11: 0000000000000000 R12:
ffffd1c3c0733d60
[   44.823367] R13: ffffffffb575a5fd R14: ffffd1c3c0017be8 R15:
ffffd1c3c00179f8
[   44.823397]  ? rv_react+0x9d/0xf0
[   44.823437]  ? mock_printk_react+0x2f/0x50
[   44.823448]  rv_react+0xb4/0xf0
[   44.823455]  ? rv_react+0x9d/0xf0
[   44.823476]  test_printk_react_called+0x83/0xb0
[   44.823486]  ? __pfx_mock_printk_react+0x10/0x10
[   44.823502]  ? __pfx_mock_printk_react+0x10/0x10
[   44.823513]  kunit_try_run_case+0x97/0x190
[   44.823534]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [   44.823544]  kunit_generic_run_threadfn_adapter+0x21/0x40 [   44.823551]  kthread+0x124/0x160
[   44.823562]  ? __pfx_kthread+0x10/0x10
[   44.823574]  ret_from_fork+0x291/0x3b0
[   44.823585]  ? __pfx_kthread+0x10/0x10
[   44.823595]  ret_from_fork_asm+0x1a/0x30
[   44.823641]  </TASK>

Patch 1 fixes the lockdep bug by correcting rv_react()'s wait_type_inner
from LD_WAIT_CONFIG (which inherits the outer context) to LD_WAIT_SPIN
(the tightest constraint callbacks must satisfy).

Patch 2 adds KUnit tests for reactor_printk. The busy-wait in the mock
callback reproduces the timer interrupt scenario that exposes the bug.

Patch 3 adds KUnit tests for reactor_panic, exercising the panic notifier
chain without halting the system.

Tested with CONFIG_PROVE_LOCKING=y and CONFIG_KUNIT=y.

Wen Yang (3):
  rv/reactors: fix lockdep "Invalid wait context" in rv_react() rv/reactors: add KUnit tests for reactor_printk rv/reactors: add KUnit tests for reactor_panic

  kernel/trace/rv/Kconfig                |  20 ++++
  kernel/trace/rv/Makefile               |   2 +
  kernel/trace/rv/reactor_panic_kunit.c  | 106 +++++++++++++++++++++
  kernel/trace/rv/reactor_printk_kunit.c | 123
+++++++++++++++++++++++++
  kernel/trace/rv/rv_reactors.c          |   8 +-
  5 files changed, 258 insertions(+), 1 deletion(-)

 create mode 100644 kernel/trace/rv/reactor_panic_kunit.c create mode 100644 kernel/trace/rv/reactor_printk_kunit.c

Thank you for your feedback.
I am using a WSL dev environment with 12 cores and 16GB. The config of the tested kernel code is as follows:

And then, using vng to build and run kselftests (since kunit is already
built-in) can reproduce this issue:

$ vng --build

$ vng -v --run arch/x86/boot/bzImage --user root -- 
tools/testing/selftests/verification/verificationtest-ktap

Quoted 3 lines · Wen Yang

Thank you for your feedback.
I am using a WSL dev environment with 12 cores and 16GB. The config of the tested kernel code is as follows:

Uhm that's a strange one, I cannot get a machine like that.. The closest is a 16 CPUs where I can limit the resources in vng.