From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx0a-0031df01.pphosted.com (mx0a-0031df01.pphosted.com [205.220.168.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 03D8623393C for ; Mon, 13 Jul 2026 03:07:31 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.168.131 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783912053; cv=none; b=upCXc0FaZ+sI/8ewBS4Cyr8KFroVuSBAjw2CYRzNvMiinPkYgDsk7gMMvZ2KT9Vut8ZQJbGSgBFq4f9KxVwdxgoqkPN3guRRcIszKCx072GmhuFkUjqtc4YWkwFC95y8Dt20DXag30Mtk9KjsSOCv9R2v7mBBKMPhgwEG+1GPpk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783912053; c=relaxed/simple; bh=DmpDiX22ksbPEucxROJWm5xeUeLy/s/h2aCs1IPYAnM=; h=Message-ID:Date:MIME-Version:Subject:To:References:From: In-Reply-To:Content-Type; b=dgtoaBLHHsxetV9Q9+ZDmgX2Iqz7EtxQcio6sQ5WRoQvcJPslrny5A2DTQbGpw6p2KnvhrXZc0kJ3DVJDbNR0OBGFe0mThxjnAcr9HUiw0ERxbDzp7hywuaDpwxfEizqBJqEJTWxhdQl/vrvvIYh5YQGaIhdH0ROLXbSJ3eBg4w= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=fRsEJX7b; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=Jj0h8VdG; arc=none smtp.client-ip=205.220.168.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="fRsEJX7b"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="Jj0h8VdG" Received: from pps.filterd (m0279862.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66D29bIt4140592 for ; Mon, 13 Jul 2026 03:07:31 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=qcppdkim1; bh= OVXyH/TwSzdCUV+a7THlnl3JNi6YLAM042pC5ymDPyM=; b=fRsEJX7bZx4r/kpP B62dvhxpExLKtOUpw/96+r8FV7xFcaKFHJUrJ0Mxklu3hOqukq5VhiUujYlsemtg d+c0MQUDkgy31tnW1cTarp9jEoyIVA01UXWpqlYugQGXvh2KIf3YM5GiecsI7+LI plV5OTmJWiRP1wir3tAzhaGvq4lUnk34/LOAaQdpUBfGuDiJ1AYLBpCMylK1UwhC vX2KXZHALhF60BuKeEyIWWNfMDQaS926UXCuI4Z6voPuvU258soonpLaCMv2rIqx hgYcFIBhxbPMxc4R8rvrriYw3KNAbxc5/un2irJpufLUqBeSXDzcmCBokp85ju/1 P6qQVQ== Received: from mail-pf1-f197.google.com (mail-pf1-f197.google.com [209.85.210.197]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4fbekcm2xp-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Mon, 13 Jul 2026 03:07:30 +0000 (GMT) Received: by mail-pf1-f197.google.com with SMTP id d2e1a72fcca58-8485d853b08so6544734b3a.1 for ; Sun, 12 Jul 2026 20:07:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1783912050; x=1784516850; darn=vger.kernel.org; h=content-transfer-encoding:content-type:in-reply-to:from :content-language:references:to:subject:user-agent:mime-version:date :message-id:from:to:cc:subject:date:message-id:reply-to:content-type; bh=OVXyH/TwSzdCUV+a7THlnl3JNi6YLAM042pC5ymDPyM=; b=Jj0h8VdGbQ/lEwCCXjEf0xH8KVNGDJOTDP9ftrSKvpnh+MBImsVZnjGSO2ILOkdKFm ECngCriJ+dpz4SM9NiYz+bCikhyzYwDxjZkLcQPsfabUKtLnaS5s4izdd8Wqnaid3G5S mQHK2cykzM1uQx7en5TYh9PZZ2w3LLjY5iW51wTZCR/86/0+EQ6Huj5NGCAQWyimu9FQ E7UzWVtD9hAC8ZPzovoP6OFHFkd1qzSGtVVFlZGDV+0CSMM+Kh3OaS9VMBGGc8jve8Oh QOSaTmwQMpbhuv/C3qTaf1aPtJ09i75a28atP5DKJcewpB9M+C5mv6U9JbQ2zdh/4AE2 avqw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783912050; x=1784516850; h=content-transfer-encoding:content-type:in-reply-to:from :content-language:references:to:subject:user-agent:mime-version:date :message-id:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=OVXyH/TwSzdCUV+a7THlnl3JNi6YLAM042pC5ymDPyM=; b=hPm1uv4QkQiDobNsArFJvTotNNr9dVMFJy6ZI0bjnjOBQEw2J74PAkG2hkEoHQRrx1 iWbKae7jzEhNAdFkhVfBqjYPe6INc8SqCpHj248/HfX4uTi1xbpNmJCwmiFQ6ZyBbn9j prqAg3LAtszhpHR0ZiiIDY+iwVRrYYA5PDoAGoesv0c4ARVAr8yIW3Wgsab8iu6qJEt3 355kjvi+LyjiRcRn6AZMR8HqRM2qJQ4SUL4dPxdpXoDp/SDfIpv7r1tm5UHFxfUcz/Kv Wb4r9NWkjJtiIM+n4y/0kHhfbscL0MOBbW89FUx4ePpo7YtrMr2t0sEOluhCJ/ssyqbE vT+A== X-Forwarded-Encrypted: i=1; AHgh+RorMB3hZxI/lsVWKs7z0t6LefC2FQkhSxZClwqtU6WDOTEGdRvUG59svo+KpM1ngAXPF+wNaGMBzTsqXx4=@vger.kernel.org X-Gm-Message-State: AOJu0Yw98p4KBOqNep5IOtGDjBE97d3wrWiaBmfgv2jky/b0TrGdX9+Y eJUEgKs6xn/WIvPkGosLN+ruhnjav3gEydeBH/+F965Zgt1vdQiYRAe2UgM59WVNMdToJ9gh4fq 4msI59KzG4+Tcrv29wFiTQNmnTVzGhd+t/BBd58o/COUfjsZblk0EPLuxHCpRwEi2izE= X-Gm-Gg: AfdE7cmIWK1tQXMtfX9Q5AwpqhigkNcZp8PsPTRabafrJ/wQiosAqNcnxAtEfcg6Te7 uz5to7HMKbhrIN2VFKIagYKTmm1mGAEt3GYpm4nbk4FF8+dYth3wj/xVM/VBNTH0YPbTmLt0PWk EUIMLk0vr1JzSVTIYQlgttRuee8F6ScCfi9TClqYhKEErRggMjDTClI903E1pju5NoNHbgMRmsV EFePTZgeuHXf44uTlkonVkYtIagoMsV0OVBI6lHzn89bx8RSD+OwEaLpKpezvH3F8pLNSGzbMT4 YWaZKW7leLiBKFIlNunz2s4xSoIYm4/N5bTaPEYvu0rwT/lGjwK7ihUDFiO1ktp1DzjUYyDz03H USneW132qE7BbRxRB7mkDvIoxcZx2If90h+22hI2br0irbYLW+YImMFt6BXwsNviyJHzrmMBkru JP X-Received: by 2002:a05:6a20:3d8b:b0:3b3:f46:1ef3 with SMTP id adf61e73a8af0-3c110b43746mr9251127637.41.1783912050136; Sun, 12 Jul 2026 20:07:30 -0700 (PDT) X-Received: by 2002:a05:6a20:3d8b:b0:3b3:f46:1ef3 with SMTP id adf61e73a8af0-3c110b43746mr9251095637.41.1783912049636; Sun, 12 Jul 2026 20:07:29 -0700 (PDT) Received: from [10.133.33.216] (tpe-colo-wan-fw-bordernet.qualcomm.com. [103.229.16.4]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-ca79aff904dsm5950477a12.6.2026.07.12.20.07.25 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Sun, 12 Jul 2026 20:07:29 -0700 (PDT) Message-ID: <03d9499c-4566-423d-9bdc-ef3efd4f0119@oss.qualcomm.com> Date: Mon, 13 Jul 2026 11:07:24 +0800 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH] coresight: Fix scheduling while atomic in coresight_device_release() To: Mohamed Ayman , Suzuki K Poulose , Mike Leach , James Clark , Leo Yan , Alexander Shishkin , Sebastian Andrzej Siewior , Clark Williams , Steven Rostedt , "moderated list:ARM/CORESIGHT FRAMEWORK AND DRIVERS" , "moderated list:ARM/CORESIGHT FRAMEWORK AND DRIVERS" , open list , "open list:Real-time Linux (PREEMPT_RT):Keyword:PREEMPT_RT" References: <20260712210446.14290-1-mohamedaymanworkspace@gmail.com> Content-Language: en-US From: Jie Gan In-Reply-To: <20260712210446.14290-1-mohamedaymanworkspace@gmail.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzEzMDAyOCBTYWx0ZWRfX9/7DTX0ms6j2 20YPc2xj8RtcWQ9J4WTIKM24TNV81K8skPYJx5yLbsdE5ZmC92/oU3JXTHNdGNbhdqchXgVEgtR Z0NX9x+/M1K0pmWWwoOZCHOiZ8ZuEcJNAseQZZSOREmir0jd8MOOlGE1uwbeixunRZ0OyIeo5GB bAdJtIV1szsoQstV4Ah28zpUwcR7vhIAE9v84jqm9zb+OZzZboxS03mAxG/F/k8RGHPHphLkwCW AhygExLotjvGJZI8UUkPR9M2poaUbmwnVXvm3PWQLkS31w8ta7koBWSQiK7gV6bKnxNniEnHgAR xzJeqnuA9WPGPc8wculVjUu5iGOQu1fpc60xc0EUZ5ke3MwkUvC0mywdPJCOeU6ucrsI1pZTJ6w qYNnBtiyq1nJ0PKTehmv62mafCPjc+bY/klMAh3X2683TQOP4wLC8PiG5nmRkm3PqK8Dl5hn+wz 3xNTn1MXo4GUBT1/HCw== X-Proofpoint-Spam-Info: AW1haW4tMjYwNzEzMDAyOCBTYWx0ZWRfX2+9EcYsBI92o 7K4+NSFgcXaWyhkGXGLn+RXojIhJ1mJ41Rqdhfe/IQsrTmdzDxGKKnrQI/9x0jsbNqTPoTeOqWp 1GQIIut9JVnwrwYvAzNgZ2Pn5tCcD1A= X-Proofpoint-GUID: pqgqITOzzGmiUD2acXDF3ffBSOj7cu-q X-Authority-Analysis: v=2.4 cv=XNsAjwhE c=1 sm=1 tr=0 ts=6a545672 cx=c_pps a=rEQLjTOiSrHUhVqRoksmgQ==:117 a=nuhDOHQX5FNHPW3J6Bj6AA==:17 a=IkcTkHD0fZMA:10 a=RAioF0-LDSMA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=_K5XuSEh1TEqbUxoQ0s3:22 a=pGLkceISAAAA:8 a=bKUmyqtfEAg2hwmyn8cA:9 a=3ZKOabzyN94A:10 a=QEXdDO2ut3YA:10 a=2VI0MkxyNR6bbpdq8BZq:22 X-Proofpoint-ORIG-GUID: pqgqITOzzGmiUD2acXDF3ffBSOj7cu-q X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-12_08,2026-07-10_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 clxscore=1015 adultscore=0 bulkscore=0 lowpriorityscore=0 malwarescore=0 suspectscore=0 phishscore=0 spamscore=0 impostorscore=0 priorityscore=1501 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607130028 On 7/13/2026 5:04 AM, Mohamed Ayman wrote: > Dropping the last reference to a coresight_device can trigger a kernel > panic on PREEMPT_RT builds due to a "scheduling while atomic" violation. > > When the CPU enters an idle state, coresight_cpu_pm_notify() is invoked > with local interrupts disabled (atomic context). This function eventually > calls coresight_put_percpu_source_ref(), which drops the device reference > via put_device(). If this is the last reference, it triggers the release > chain: > > coresight_cpu_pm_notify() (IRQs off) > -> coresight_put_percpu_source_ref() > -> put_device() > -> coresight_device_release() > -> free_percpu() > > On a PREEMPT_RT kernel, free_percpu() acquires pcpu_lock, which is > implemented as a sleeping rt-mutex. Sleeping while in an atomic context > causes a system crash. > > Fix this by deferring the teardown of the coresight_device to process > context. Add a work_struct to `struct coresight_device` and use > schedule_work() inside coresight_device_release() to safely execute > free_percpu() and kfree() in a worker thread, away from the atomic PM > notifier path. > > Additionally, remove the redundant raw_spinlock_irqsave guard in The code diff doesnt include this description. > coresight_put_percpu_source_ref(). The lock was originally intended to > protect the per-CPU pointer table, but dropping a reference does not > touch this table. > > Signed-off-by: Mohamed Ayman > --- > drivers/hwtracing/coresight/coresight-core.c | 28 +++++++++++++------- > include/linux/coresight.h | 2 ++ > 2 files changed, 21 insertions(+), 9 deletions(-) > > diff --git a/drivers/hwtracing/coresight/coresight-core.c b/drivers/hwtracing/coresight/coresight-core.c > index 6d65c43d5..9dbdb2977 100644 > --- a/drivers/hwtracing/coresight/coresight-core.c > +++ b/drivers/hwtracing/coresight/coresight-core.c > @@ -165,13 +165,6 @@ void coresight_put_percpu_source_ref(struct coresight_device *csdev) > > guard(raw_spinlock_irqsave)(&coresight_dev_lock); > > - /* > - * TODO: coresight_device_release() is invoked to release resources when > - * the device's refcount reaches zero. It then calls free_percpu(), > - * which acquires pcpu_lock — a sleepable lock when PREEMPT_RT is > - * enabled. Since the raw spinlock coresight_dev_lock is held, this can > - * lead to a potential "scheduling while atomic" issue. > - */ > put_device(&csdev->dev); > } > > @@ -1257,13 +1250,30 @@ static void coresight_clear_default_sink(struct coresight_device *csdev) > } > } > > +static void coresight_device_release_work(struct work_struct *work) > +{ > + struct coresight_device *csdev = > + container_of(work, struct coresight_device, free_work); > + > + free_percpu(csdev->perf_sink_id_map.cpu_map); > + kfree(csdev); > +} > + > static void coresight_device_release(struct device *dev) > { > struct coresight_device *csdev = to_coresight_device(dev); > > fwnode_handle_put(csdev->dev.fwnode); > - free_percpu(csdev->perf_sink_id_map.cpu_map); > - kfree(csdev); > + > + /* > + * This release callback can run with the last reference dropped > + * from atomic/IRQs-off context (e.g. coresight_put_percpu_source_ref() > + * called from the CPU_PM notifier). free_percpu() takes pcpu_lock, > + * which is a sleeping lock under PREEMPT_RT, so defer the actual > + * teardown to process context. > + */ > + INIT_WORK(&csdev->free_work, coresight_device_release_work); > + schedule_work(&csdev->free_work); Consider the module unload process, the async work can lead to UAF: For example: 1. unload ETM4X module: coresight_unregister() -> device_unregister() -> put_device() -> ref 0 -> coresight_device_release() -> schedule_work(&csdev->free_work) At this point, the release work is only queued, while the ETM4X module unload path proceeds as if the release operation has finished. 2. unload the coresight module without flushing the workqueue 3. A UAF occurs when the pending work is eventually executed and attempts to free csdev via coresight_device_release_work(), after the relevant code or resources have already been unloaded. We must drain out the workqueue in coresight_exit to close the gap. Thanks, Jie > } > > static int coresight_orphan_match(struct device *dev, void *data) > diff --git a/include/linux/coresight.h b/include/linux/coresight.h > index ddf18c970..63253f6c4 100644 > --- a/include/linux/coresight.h > +++ b/include/linux/coresight.h > @@ -13,6 +13,7 @@ > #include > #include > #include > +#include > > /* Peripheral id registers (0xFD0-0xFEC) */ > #define CORESIGHT_PERIPHIDR4 0xfd0 > @@ -293,6 +294,7 @@ struct coresight_device { > struct csdev_access access; > struct device dev; > struct coresight_path *path; > + struct work_struct free_work; > atomic_t mode; > int refcnt; > int cpu;