On Thu, Nov 07, 2024 at 12:21:07PM +0100, Sebastian Andrzej Siewior wrote: > On 2024-11-04 17:00:19 [-0800], Boqun Feng wrote: > > Hi Sebastian, > Hi Boqun, > > … > > I think this needs to be: > > > > scf_cleanup_free_list(cpu); > > > > or > > > > scf_cleanup_free_list(curcpu); > > > > because scfp->cpu is actually the thread number, and I got a NULL > > dereference: > > > > [ 14.219225] BUG: unable to handle page fault for address: ffffffffb2ff7210 > > Right. Replaced with cpu. > … > > > > Another thing is, how do we guarantee that we don't exit the loop > > eariler (i.e. while there are still callbacks on the list)? After the > > following scftorture_invoke_one(), there could an IPI pending somewhere, > > and we may exit this loop if torture_must_stop() is true. And that IPI > > might add its scf_check to the list but no scf_cleanup_free_list() is > > going to handle that, right? > > Okay. Assuming that IPIs are done by the time scf_torture_cleanup is > invoked, I added scf_cleanup_free_list() for all CPUs there. This statement in scf_torture_cleanup() is supposed to wait for all outstanding IPIs: smp_call_function(scf_cleanup_handler, NULL, 0); And the scf_cleanup_handler() function is as follows: static void scf_cleanup_handler(void *unused) { } Does that work, or am I yet again being overly naive? > Reposted at > https://lore.kernel.org/20241107111821.3417762-1-bigeasy@xxxxxxxxxxxxx Thank you! I will do some testing on this later today. Thanx, Paul