Technical Root Cause and Crash Mechanism

1. Context and Involved Components

• Source Files & Functions:
  • net/batman-adv/distributed-arp-table.c: batadv_dat_purge(), __batadv_dat_purge()
  • include/linux/spinlock_rt.h: spin_unlock_bh()
  • kernel/softirq.c: __local_bh_enable_ip(), __local_bh_disable_ip(), __local_bh_enable()
  • include/linux/lockdep.h: lockdep_assert_irqs_enabled()
• Configuration: CONFIG_PREEMPT_RT enabled with CONFIG_LOCKDEP and CONFIG_PROVE_LOCKING enabled (CONFIG_PREEMPT_RT_NEEDS_BH_LOCK is not set).

2. Triggering Sequence and Violation

1. In batadv_dat_purge() (invoked as a delayed work item in the bat_events workqueue), __batadv_dat_purge() iterates over the hash table buckets of bat_priv->dat.hash:

   for (i = 0; i < bat_priv->dat.hash->size; i++) {
       head = &bat_priv->dat.hash->table[i];
       list_lock = &bat_priv->dat.hash->list_locks[i];
   
       spin_lock_bh(list_lock);
       hlist_for_each_entry_safe(dat_entry, node_tmp, head, hash_entry) {
           if (to_purge && !to_purge(dat_entry))
               continue;
   
           hlist_del_rcu(&dat_entry->hash_entry);
           batadv_dat_entry_put(dat_entry);
       }
       spin_unlock_bh(list_lock);
   }
   

2. Under PREEMPT_RT, spin_unlock_bh(list_lock) in include/linux/spinlock_rt.h expands to:

   static __always_inline void spin_unlock_bh(spinlock_t *lock)
   {
       rt_spin_unlock(lock);
       local_bh_enable();
   }
   

3. local_bh_enable() calls __local_bh_enable_ip(_THIS_IP_, SOFTIRQ_DISABLE_OFFSET). At the entry of __local_bh_enable_ip() (kernel/softirq.c:289):

   void __local_bh_enable_ip(unsigned long ip, unsigned int cnt)
   {
       bool preempt_on = preemptible();
       unsigned long flags;
       u32 pending;
       int curcnt;
   
       WARN_ON_ONCE(in_hardirq());
       lockdep_assert_irqs_enabled();
   

   where lockdep_assert_irqs_enabled() evaluates:

   WARN_ON_ONCE(__lockdep_enabled && !this_cpu_read(hardirqs_enabled));
   

4. As revealed in the crash register dump, EFLAGS: 00010246 has bit 9 (IF, Interrupt Flag) set to 1, meaning hardware interrupts are indeed active on the CPU. However, lockdep's per-CPU tracking variable hardirqs_enabled read 0 (!this_cpu_read(hardirqs_enabled) was true), triggering the WARN_ON_ONCE.

3. Subsystem and Object Verification

• In __batadv_dat_purge(), spin_lock_bh() and spin_unlock_bh() are strictly paired around each bucket.
• Any purged entries invoke batadv_dat_entry_put(), which queues the object via kref_put() and kfree_rcu() (mm/slab_common.c:kvfree_call_rcu()), which uses raw_spin_unlock_irqrestore() and correctly maintains IRQ state flags.
• Neither __batadv_dat_purge() nor batadv_dat_entry_put() disables hard IRQs. The assertion warning at kernel/softirq.c:289 is caused by lockdep's per-CPU hardirqs_enabled tracker becoming desynchronized from the CPU's hardware interrupt state prior to or concurrently with the bottom-half re-enabling in spin_unlock_bh().