From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qt1-f176.google.com (mail-qt1-f176.google.com [209.85.160.176]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 567C03CEB94 for ; Fri, 10 Apr 2026 14:22:12 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.160.176 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775830934; cv=none; b=ucFfpqTJKe9lt0gRgEnGQkKnr6kVTRcb18aEED68cgRRIk80yBcEZ3lLQaCc4anpmCn/a4TgzyfHB5YOFGdpGxBAV7H/5cGNmAZ/tDceDeB7qq9ShZkqBiUzzBYlnZtPG3I5hYl8gjVdUcWlmnVmoKI5qrYaek2sfkA/WNKNDO4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775830934; c=relaxed/simple; bh=BEoaEWFLa1ITjM8lXy3J1nbnzh7rySecyA+jLDZjVNg=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=fGZAc/p3d+c4TBVyvYOdqC3HQeYrQPc1ESG5j+vT3PxrqiFkO0N1ogrpqkHmYBSvt+VJ38J6ueq7QFHWHoft6EbJLpLtBHGgLyrnNAs2WYDpanoGotbydHzfDIkYruE37nwuzP4mUieHNuDre9YMePe3x/ErkAUBCQz+9KySo9c= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=ziepe.ca; spf=pass smtp.mailfrom=ziepe.ca; dkim=pass (2048-bit key) header.d=ziepe.ca header.i=@ziepe.ca header.b=j6uF4tgd; arc=none smtp.client-ip=209.85.160.176 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=ziepe.ca Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=ziepe.ca Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ziepe.ca header.i=@ziepe.ca header.b="j6uF4tgd" Received: by mail-qt1-f176.google.com with SMTP id d75a77b69052e-505a1789a27so11062111cf.3 for ; Fri, 10 Apr 2026 07:22:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ziepe.ca; s=google; t=1775830931; x=1776435731; darn=vger.kernel.org; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:from:to:cc:subject:date:message-id:reply-to; bh=jsgLyXpihP81WN97MMLnWtMbzcKDFvEbkDvgyFyKGLE=; b=j6uF4tgdLmSfeU7C77Hpm+zbtON48aSTiUYGbAH0UT7PfcklGQ0GQ4GdcsMynTZJFh ndMmCob5cIguXDdCJo5/R+mNzJw6v0tIgWg1m7n+erfLUBE4vHeKPAUTR74iIvJQpo7/ 7SBF2jXhp3eXUG0Z6IqwTm5rfHP8qOEhzoqALfwTYeUNc194BTXqqB2vEEcomRB96x14 KhjPR/xmy5wKp9Wbm31PTfh8xCMM129uD2e/Y/l6bGjaAS7aFDQ+HxAW2g2XpKRFAn7s 5zMlQl+4tbjhDotuN4GCXEkdeHXcBClKUbpConiATZYVTVQ+JF/hr6Je8Wb0HWeMfzgr hXaA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1775830931; x=1776435731; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:x-gm-gg:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=jsgLyXpihP81WN97MMLnWtMbzcKDFvEbkDvgyFyKGLE=; b=NiEIsVgmlwVZa0d0eR/egD9FZJJCDVhaEPkKjyc31k50oCHRbbuV9SntPeL6aO5Hkl 2oJQubpSqrkdeM82Q7rvflgAcuO4LntZwiLykVWBnqpMzCwUPSCVOp4SrCvjnu8UG3Eu 6Vp86PNZBbUo1HEug1jywKbutspjR3Gzhyobd8V+JAzzF6PFNFQesKtI5vQykmW4io1W pzl7jDgDjvPuOABy+GMFjWxFFEp/F+cI0GG8XbfkyBkwCfrtlfznhzx5CY75as2p483z D/YTt+Ci0V8GU9FLj4OMnrV38trIJZ567fcYWPnbrNQFCpqCz6pl7wPlrI2CxvESfBF+ sHng== X-Forwarded-Encrypted: i=1; AJvYcCXgeyiwx4IdK0nD+GwHy1ahIWFNWo7WjWefU6xNJVFYHJcEM0/kPgjEgQMJn7X21YYxHWYbC/YQUlSz4R8=@vger.kernel.org X-Gm-Message-State: AOJu0YyELfUnMcncg8ID/6lYLv52Jo4ixXLLIfx8HxZ7h6YE4H/BiLWE g83RZ6xFBB/CP6lmhpnGBnuTvyLf2GZkgOvyFgl2Qxr6oK8lurdl2y/ncvp5suhfMPw= X-Gm-Gg: AeBDietqfyhXFWYM7Vd5emo31xumdNbVamDMzzHzfJQpD+6I5MF69QM2zYvQE6gB6VZ OJtlyESMPNV80c97O5L+XILdLg+nuLGT1/Ip0pkLhWuJps3TAj+OQGeDwyRJZ9PPujb787bkqG6 clUMSEnVhONXvlRVwd06c9xZHD/DidjSwtCKTeRfn0vDwdodQYn31AiZpQ/0ehN5X9288lyIwKb ++p0FA8PbQpY78QoGiMbEeOzw5cuH5VyspLQBxYOg5FtaVSwPIWsgp73vKNW6pOJjdOij45Ydrl SKWwWTmqFGSzx7dx1gYLxh7yrSS5ziaWABluREZ++jixQboD8jSAzMkpgBLLZix/fmmcDhbZigC OWyElsLWUbPmGmZ4Ry5oLmRlgC+ShWiDZKXe8U+6+Wxo+0xGsZqayBhxsQkSiaAlhKkesKKVpFB hqd8uMGeVMWdktsORZBqzIQ+dZ+dtJgYzjRwXwUNtTbkEGezFKOZRiEA5sb/HrCL/dYYvmeg== X-Received: by 2002:a05:622a:4:b0:50d:80ee:3962 with SMTP id d75a77b69052e-50dd5ad7708mr50920201cf.17.1775830931097; Fri, 10 Apr 2026 07:22:11 -0700 (PDT) Received: from ziepe.ca (mctnnbsa70w-159-2-73-22.dhcp-dynamic.fibreop.nb.bellaliant.net. [159.2.73.22]) by smtp.gmail.com with ESMTPSA id d75a77b69052e-50dd54fcaa4sm21897931cf.20.2026.04.10.07.22.09 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 10 Apr 2026 07:22:10 -0700 (PDT) Received: from jgg by wakko with local (Exim 4.97) (envelope-from ) id 1wBCkL-0000000EMXO-20xk; Fri, 10 Apr 2026 11:22:09 -0300 Date: Fri, 10 Apr 2026 11:22:09 -0300 From: Jason Gunthorpe To: Richard Cheng Cc: dave.jiang@intel.com, saeedm@nvidia.com, Jonathan.Cameron@huawei.com, linux-kernel@vger.kernel.org, jan@nvidia.com, newtonl@nvidia.com, kristinc@nvidia.com, sreddym@nvidia.com, skomatineni@nvidia.com, vidyas@nvidia.com, kaihengf@nvidia.com, mochs@nvidia.com Subject: Re: [PATCH] fwctl: Fix class init ordering to avoid NULL pointer dereference on device removal Message-ID: <20260410142209.GW2551565@ziepe.ca> References: <20260409051902.40218-1-icheng@nvidia.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20260409051902.40218-1-icheng@nvidia.com> On Thu, Apr 09, 2026 at 01:19:02PM +0800, Richard Cheng wrote: > CXL is linked before fwctl in drivers/Makefile. Both use `module_init, > so `cxl_pci_driver_init()` runs first. When `cxl_pci_probe()` calls > `fwctl_register()` and then `device_add()`, fwctl_class is not yet > registered because fwctl_init() hasn't run, causing `class_to_subsys()` > to return NULL and skip knode_class initialization. > On device removal, `class_to_subsys()` returns non-NULL, and > `device_del()` calls `klist_del()` on the uninitialized knode, > triggering a NULL pointer dereference [1]. > > Fixes: 858ce2f56b52 ("cxl: Add FWCTL support to CXL") > Signed-off-by: Richard Cheng > Reviewed-by: Kai-Heng Feng > --- > [1]: > The error is triggered on with 7.0.0-rc6 kernel with CXL > device. > The PCI topology is as below > ``` > $ sudo lspci -tv > -[0001:00]---00.0-[01]--+-00.0 Mellanox Technologies CX8 Family [ConnectX-8] > +-00.1 Mellanox Technologies CX8 Family [ConnectX-8] > +-00.2 Mellanox Technologies CX8 Family [ConnectX-8] > \-00.3 Mellanox Technologies CX8 Family [ConnectX-8] > -[0002:00]---00.0-[01]-- > -+-[0003:00]---00.0-[01]----00.0 Montage Technology Co., Ltd. Device c002 > \-[0003:80]---00.0-[81]----00.0 Montage Technology Co., Ltd. Device c002 > -[0004:00]---00.0-[01]-- > -+-[0005:00]---00.0-[01]----00.0 Samsung Electronics Co Ltd Device a810 > +-[0005:40]---00.0-[41]----00.0 Samsung Electronics Co Ltd Device a810 > +-[0005:c0]---00.0-[c1]----00.0 Intel Corporation I210 Gigabit Network Connection > \-[0005:e0]---00.0-[e1-e2]----00.0-[e2]--+-00.0 ASPEED Technology, Inc. ASPEED Graphics Family > \-02.0 ASPEED Technology, Inc. Device 2603 > -+-[0006:00]---00.0-[01]-- > \-[0006:80]---00.0-[81]-- > ``` > The CXL device is on 0003:01:00.0 CXL [0502]: Montage Technology Co., > Ltd. Device [1b00:c002] (rev 03) and another one is 0003:81:00.0 CXL > [0502]: Montage Technology Co., Ltd. Device [1b00:c002] (rev 03). The > one we are targeting is 0003:01:00.0. > > The kernel should be built with CONFIG_FWCTL=y and > CONFIG_CXL_FEATURES=y, otherwise the bug won't be triggered. > > With `sudo setpci -v -s 0003:00:00.0 CAP_EXP+0x10.b=0x10:0x10` to bring > its root port link down and the error log in dmesg is like the following > ``` > [ 890.137377] pcieport 0003:00:00.0: pciehp: Slot(0-2): Link Down > [ 890.145201] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020 > [ 890.145203] Mem abort info: > [ 890.145205] ESR = 0x0000000096000006 > [ 890.145207] EC = 0x25: DABT (current EL), IL = 32 bits > [ 890.145208] SET = 0, FnV = 0 > [ 890.145209] EA = 0, S1PTW = 0 > [ 890.145211] FSC = 0x06: level 2 translation fault > [ 890.145212] Data abort info: > [ 890.145213] ISV = 0, ISS = 0x00000006, ISS2 = 0x00000000 > [ 890.145214] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 > [ 890.145215] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 > [ 890.145216] user pgtable: 4k pages, 48-bit VAs, pgdp=00000001d1937000 > [ 890.145218] [0000000000000020] pgd=08000001d193e403, p4d=08000001d193e403, pud=08000001d193d403, pmd=0000000000000000 > [ 890.145223] Internal error: Oops: 0000000096000006 [#1] SMP > [ 890.214749] Modules linked in: nft_masq nft_ct nft_reject_ipv4 nf_reject_ipv4 nft_reject act_csum cls_u32 sch_htb nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables bridge stp llc qrtr cfg80211 binfmt_misc nls_iso8859_1 ast cxl_pmu dax_hmem nvidia_cspmu acpi_power_meter coresight_trbe sbsa_gwdt ipmi_ssif acpi_ipmi cxl_acpi arm_smmuv3_pmu coresight arm_cspmu_module arm_spe_pmu ipmi_devintf ipmi_msghandler cxl_pmem cppc_cpufreq sch_fq_codel dm_multipath nvme_fabrics efi_pstore nfnetlink dmi_sysfs ip_tables x_tables autofs4 btrfs libblake2b raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor xor_neon raid6_pq raid1 raid0 linear mlx5_ib macsec ib_uverbs ib_core mlx5_dpll ghash_ce sm4_ce_gcm nvme sm4_ce_ccm mlx5_core nvme_core sm4_ce mlxfw nvme_keyring sm4_ce_cipher tls sm4 igb nvme_auth sm3_ce arm_smccc_trng i2c_algo_bit hkdf psample aes_neon_bs aes_neon_blk aes_ce_blk > [ 890.294573] CPU: 28 UID: 0 PID: 1350 Comm: irq/156-pciehp Not tainted 7.0.0-rc6-richard+ #3 PREEMPT(full) > [ 890.304108] Hardware name: , BIOS buildbrain-gcid-sbios-44706962 Mon Mar 30 03:04:08 PM UTC 2026 > [ 890.312959] pstate: 61400009 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) > [ 890.319660] pc : klist_put+0x2c/0x140 > [ 890.323441] lr : klist_del+0x18/0x38 > [ 890.327050] sp : ffff80008cfd39e0 > [ 890.330229] x29: ffff80008cfd39e0 x28: 0000000000000018 x27: ffffd9f0a1a9deb0 > [ 890.337275] x26: ffffd9f0a1a9a2b8 x25: ffff00009c3ebe78 x24: ffff00009c3ebe00 > [ 890.344321] x23: ffff00008d1cc800 x22: 0000000000000001 x21: ffff00009c3ebe68 > [ 890.351367] x20: 0000000000000000 x19: ffff00009afc7188 x18: ffff80008cfb50a8 > [ 890.358413] x17: 0000000000000000 x16: 0000000000000000 x15: 633d4d4554535953 > [ 890.365459] x14: 42555300302e306d x13: 5300302e306d656d x12: 5f756d702f302e30 > [ 890.372504] x11: 0035333033343d4d x10: 0000000000000000 x9 : ffffd9f0a31b9a5c > [ 890.379551] x8 : 0101010101010101 x7 : 7fff7f7f7f7f7f7f x6 : 339eff3033746f62 > [ 890.386597] x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000 > [ 890.393642] x2 : 0000000000000000 x1 : 0000000000000001 x0 : 0000000000000000 > [ 890.400689] Call trace: > [ 890.402923] klist_put+0x2c/0x140 (P) > [ 890.406703] klist_del+0x18/0x38 > [ 890.409968] device_del+0x120/0x3c8 > [ 890.413148] cdev_device_del+0x2c/0xa8 > [ 890.416928] fwctl_unregister+0x11c/0x128 > [ 890.420967] free_memdev_fwctl+0x24/0x50 > [ 890.424919] devm_action_release+0x20/0x48 > [ 890.428786] release_nodes+0x68/0xc8 > [ 890.432481] devres_release_all+0x9c/0x130 > [ 890.436348] device_unbind_cleanup+0x24/0xb0 > [ 890.440730] device_release_driver_internal+0x234/0x2e0 > [ 890.445627] device_release_driver+0x24/0x50 > [ 890.450096] pci_stop_bus_device+0x88/0x100 > [ 890.453962] pci_stop_and_remove_bus_device+0x24/0x58 > [ 890.459118] pciehp_unconfigure_device+0xb4/0x1e0 > [ 890.463758] pciehp_disable_slot+0x7c/0x190 > [ 890.467710] pciehp_handle_presence_or_link_change+0x94/0x518 > [ 890.473554] pciehp_ist+0x1c8/0x310 > [ 890.476819] irq_thread_fn+0x38/0xd0 > [ 890.480599] irq_thread+0x1ac/0x450 > [ 890.483779] kthread+0x13c/0x150 > [ 890.487215] ret_from_fork+0x10/0x20 > [ 890.490739] Code: 12001c36 f9400014 927ffa94 aa1403e0 (f9401295) > [ 890.496668] ---[ end trace 0000000000000000 ]--- > [ 890.552081] genirq: exiting task "irq/156-pciehp" (1350) is an active IRQ thread (irq 156) > ``` > > > Best regards, > Richard Cheng. > --- > drivers/fwctl/main.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) Applied thanks Jason