* [PATCH] coresight: syscfg: fix deadlock on device registration failure
@ 2026-08-25 1:47 yingchao
2026-09-07 3:06 ` yingchao deng
2026-09-08 16:16 ` Leo Yan
0 siblings, 2 replies; 5+ messages in thread
From: yingchao @ 2026-08-25 1:47 UTC (permalink / raw)
To: Suzuki K Poulose, Alexander Shishkin
Cc: Mike Leach, James Clark, Leo Yan, Mathieu Poirier, Miaoqian Lin,
coresight, linux-arm-kernel, linux-kernel, qinyungao,
Yingchao Deng
From: Yingchao Deng <dengyingchao@kylinsec.com.cn>
cscfg_create_device() calls put_device() while holding cscfg_mutex. If
device_register() failed, put_device() drops the last reference and invokes
cscfg_dev_release(), which takes cscfg_mutex again, deadlocking.
Unlock cscfg_mutex before calling put_device().
Fixes: cfa5dbcdd7ae ("coresight: syscfg: Fix memleak on registration failure in cscfg_create_device")
Signed-off-by: Yingchao Deng <dengyingchao@kylinsec.com.cn>
---
drivers/hwtracing/coresight/coresight-syscfg.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/drivers/hwtracing/coresight/coresight-syscfg.c b/drivers/hwtracing/coresight/coresight-syscfg.c
index 2bfdd7b45e49..d0e7e4720e46 100644
--- a/drivers/hwtracing/coresight/coresight-syscfg.c
+++ b/drivers/hwtracing/coresight/coresight-syscfg.c
@@ -1210,8 +1210,14 @@ static int cscfg_create_device(void)
dev->init_name = "cs_system_cfg";
err = device_register(dev);
- if (err)
+ if (err) {
+ /* put_device() triggers cscfg_dev_release() which takes
+ * cscfg_mutex, so drop the lock first to avoid deadlocking.
+ */
+ mutex_unlock(&cscfg_mutex);
put_device(dev);
+ return err;
+ }
create_dev_exit_unlock:
mutex_unlock(&cscfg_mutex);
--
2.33.0
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH] coresight: syscfg: fix deadlock on device registration failure
2026-08-25 1:47 [PATCH] coresight: syscfg: fix deadlock on device registration failure yingchao
@ 2026-09-07 3:06 ` yingchao deng
2026-09-08 16:16 ` Leo Yan
1 sibling, 0 replies; 5+ messages in thread
From: yingchao deng @ 2026-09-07 3:06 UTC (permalink / raw)
To: Suzuki K Poulose, Alexander Shishkin, Mike Leach, James Clark, Leo Yan
Cc: Mathieu Poirier, Miaoqian Lin, coresight, linux-arm-kernel,
linux-kernel, qinyungao
Gentle reminder
On 25/08/2026 09:47, yingchao wrote:
> From: Yingchao Deng <dengyingchao@kylinsec.com.cn>
>
> cscfg_create_device() calls put_device() while holding cscfg_mutex. If
> device_register() failed, put_device() drops the last reference and invokes
> cscfg_dev_release(), which takes cscfg_mutex again, deadlocking.
>
> Unlock cscfg_mutex before calling put_device().
>
> Fixes: cfa5dbcdd7ae ("coresight: syscfg: Fix memleak on registration failure in cscfg_create_device")
> Signed-off-by: Yingchao Deng <dengyingchao@kylinsec.com.cn>
> ---
> drivers/hwtracing/coresight/coresight-syscfg.c | 8 +++++++-
> 1 file changed, 7 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/hwtracing/coresight/coresight-syscfg.c b/drivers/hwtracing/coresight/coresight-syscfg.c
> index 2bfdd7b45e49..d0e7e4720e46 100644
> --- a/drivers/hwtracing/coresight/coresight-syscfg.c
> +++ b/drivers/hwtracing/coresight/coresight-syscfg.c
> @@ -1210,8 +1210,14 @@ static int cscfg_create_device(void)
> dev->init_name = "cs_system_cfg";
>
> err = device_register(dev);
> - if (err)
> + if (err) {
> + /* put_device() triggers cscfg_dev_release() which takes
> + * cscfg_mutex, so drop the lock first to avoid deadlocking.
> + */
> + mutex_unlock(&cscfg_mutex);
> put_device(dev);
> + return err;
> + }
>
> create_dev_exit_unlock:
> mutex_unlock(&cscfg_mutex);
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH] coresight: syscfg: fix deadlock on device registration failure
2026-08-25 1:47 [PATCH] coresight: syscfg: fix deadlock on device registration failure yingchao
2026-09-07 3:06 ` yingchao deng
@ 2026-09-08 16:16 ` Leo Yan
2026-09-09 1:34 ` yingchao deng
1 sibling, 1 reply; 5+ messages in thread
From: Leo Yan @ 2026-09-08 16:16 UTC (permalink / raw)
To: yingchao
Cc: Suzuki K Poulose, Alexander Shishkin, Mike Leach, James Clark,
Mathieu Poirier, Miaoqian Lin, coresight, linux-arm-kernel,
linux-kernel, qinyungao
On Tue, Aug 25, 2026 at 09:47:17AM +0800, yingchao wrote:
> diff --git a/drivers/hwtracing/coresight/coresight-syscfg.c b/drivers/hwtracing/coresight/coresight-syscfg.c
> index 2bfdd7b45e49..d0e7e4720e46 100644
> --- a/drivers/hwtracing/coresight/coresight-syscfg.c
> +++ b/drivers/hwtracing/coresight/coresight-syscfg.c
> @@ -1210,8 +1210,14 @@ static int cscfg_create_device(void)
> dev->init_name = "cs_system_cfg";
>
> err = device_register(dev);
> - if (err)
> + if (err) {
> + /* put_device() triggers cscfg_dev_release() which takes
> + * cscfg_mutex, so drop the lock first to avoid deadlocking.
> + */
> + mutex_unlock(&cscfg_mutex);
> put_device(dev);
> + return err;
> + }
As module init and exit are serialized by the kernel, I don't think we
need the mutex to protect the allocation and freeing of cscfg_mgr.
The mutex should only be used for exclusively access cscfg_mgr.
So how about the change below?
---8<---
diff --git a/drivers/hwtracing/coresight/coresight-syscfg.c b/drivers/hwtracing/coresight/coresight-syscfg.c
index 2bfdd7b45e49..2dd0b29f44e4 100644
--- a/drivers/hwtracing/coresight/coresight-syscfg.c
+++ b/drivers/hwtracing/coresight/coresight-syscfg.c
@@ -1173,27 +1173,21 @@ struct device *cscfg_device(void)
/* Must have a release function or the kernel will complain on module unload */
static void cscfg_dev_release(struct device *dev)
{
- mutex_lock(&cscfg_mutex);
kfree(cscfg_mgr);
cscfg_mgr = NULL;
- mutex_unlock(&cscfg_mutex);
}
/* a device is needed to "own" some kernel elements such as sysfs entries. */
static int cscfg_create_device(void)
{
struct device *dev;
- int err = -ENOMEM;
-
- mutex_lock(&cscfg_mutex);
- if (cscfg_mgr) {
- err = -EINVAL;
- goto create_dev_exit_unlock;
- }
+ int err;
cscfg_mgr = kzalloc_obj(struct cscfg_manager);
if (!cscfg_mgr)
- goto create_dev_exit_unlock;
+ return -ENOMEM;
+
+ mutex_lock(&cscfg_mutex);
/* initialise the cscfg_mgr structure */
INIT_LIST_HEAD(&cscfg_mgr->csdev_desc_list);
@@ -1204,6 +1198,8 @@ static int cscfg_create_device(void)
cscfg_mgr->load_state = CSCFG_NONE;
raw_spin_lock_init(&cscfg_mgr->sysfs_store_lock);
+ mutex_unlock(&cscfg_mutex);
+
/* setup the device */
dev = cscfg_device();
dev->release = cscfg_dev_release;
@@ -1213,8 +1209,6 @@ static int cscfg_create_device(void)
if (err)
put_device(dev);
-create_dev_exit_unlock:
- mutex_unlock(&cscfg_mutex);
return err;
}
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH] coresight: syscfg: fix deadlock on device registration failure
2026-09-08 16:16 ` Leo Yan
@ 2026-09-09 1:34 ` yingchao deng
2026-09-09 9:29 ` Leo Yan
0 siblings, 1 reply; 5+ messages in thread
From: yingchao deng @ 2026-09-09 1:34 UTC (permalink / raw)
To: Leo Yan
Cc: Suzuki K Poulose, Alexander Shishkin, Mike Leach, James Clark,
Mathieu Poirier, Miaoqian Lin, coresight, linux-arm-kernel,
linux-kernel, qinyungao, yingchao
On 09/09/2026 00:16, Leo Yan wrote:
> On Tue, Aug 25, 2026 at 09:47:17AM +0800, yingchao wrote:
>
>> diff --git a/drivers/hwtracing/coresight/coresight-syscfg.c b/drivers/hwtracing/coresight/coresight-syscfg.c
>> index 2bfdd7b45e49..d0e7e4720e46 100644
>> --- a/drivers/hwtracing/coresight/coresight-syscfg.c
>> +++ b/drivers/hwtracing/coresight/coresight-syscfg.c
>> @@ -1210,8 +1210,14 @@ static int cscfg_create_device(void)
>> dev->init_name = "cs_system_cfg";
>>
>> err = device_register(dev);
>> - if (err)
>> + if (err) {
>> + /* put_device() triggers cscfg_dev_release() which takes
>> + * cscfg_mutex, so drop the lock first to avoid deadlocking.
>> + */
>> + mutex_unlock(&cscfg_mutex);
>> put_device(dev);
>> + return err;
>> + }
> As module init and exit are serialized by the kernel, I don't think we
> need the mutex to protect the allocation and freeing of cscfg_mgr.
>
> The mutex should only be used for exclusively access cscfg_mgr.
> So how about the change below?
>
> ---8<---
>
> diff --git a/drivers/hwtracing/coresight/coresight-syscfg.c b/drivers/hwtracing/coresight/coresight-syscfg.c
> index 2bfdd7b45e49..2dd0b29f44e4 100644
> --- a/drivers/hwtracing/coresight/coresight-syscfg.c
> +++ b/drivers/hwtracing/coresight/coresight-syscfg.c
> @@ -1173,27 +1173,21 @@ struct device *cscfg_device(void)
> /* Must have a release function or the kernel will complain on module unload */
> static void cscfg_dev_release(struct device *dev)
> {
> - mutex_lock(&cscfg_mutex);
> kfree(cscfg_mgr);
> cscfg_mgr = NULL;
> - mutex_unlock(&cscfg_mutex);
> }
>
> /* a device is needed to "own" some kernel elements such as sysfs entries. */
> static int cscfg_create_device(void)
> {
> struct device *dev;
> - int err = -ENOMEM;
> -
> - mutex_lock(&cscfg_mutex);
> - if (cscfg_mgr) {
> - err = -EINVAL;
> - goto create_dev_exit_unlock;
> - }
> + int err;
>
> cscfg_mgr = kzalloc_obj(struct cscfg_manager);
> if (!cscfg_mgr)
> - goto create_dev_exit_unlock;
> + return -ENOMEM;
> +
> + mutex_lock(&cscfg_mutex);
>
> /* initialise the cscfg_mgr structure */
> INIT_LIST_HEAD(&cscfg_mgr->csdev_desc_list);
> @@ -1204,6 +1198,8 @@ static int cscfg_create_device(void)
> cscfg_mgr->load_state = CSCFG_NONE;
> raw_spin_lock_init(&cscfg_mgr->sysfs_store_lock);
>
> + mutex_unlock(&cscfg_mutex);
> +
> /* setup the device */
> dev = cscfg_device();
> dev->release = cscfg_dev_release;
> @@ -1213,8 +1209,6 @@ static int cscfg_create_device(void)
> if (err)
> put_device(dev);
>
> -create_dev_exit_unlock:
> - mutex_unlock(&cscfg_mutex);
> return err;
> }
Agreed — module init/exit are serialized, so the mutex around cscfg_mgr
alloc/free is unnecessary. Removing it from cscfg_dev_release() is the
cleaner fix and also resolves
the deadlock. I'll send v2 with your suggested change.
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH] coresight: syscfg: fix deadlock on device registration failure
2026-09-09 1:34 ` yingchao deng
@ 2026-09-09 9:29 ` Leo Yan
0 siblings, 0 replies; 5+ messages in thread
From: Leo Yan @ 2026-09-09 9:29 UTC (permalink / raw)
To: yingchao deng
Cc: Suzuki K Poulose, Alexander Shishkin, Mike Leach, James Clark,
Mathieu Poirier, Miaoqian Lin, coresight, linux-arm-kernel,
linux-kernel, qinyungao
On Wed, Sep 09, 2026 at 09:34:07AM +0800, yingchao deng wrote:
[...]
> I'll send v2 with your suggested change.
Thanks a lot!
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2026-09-09 9:29 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-08-25 1:47 [PATCH] coresight: syscfg: fix deadlock on device registration failure yingchao
2026-09-07 3:06 ` yingchao deng
2026-09-08 16:16 ` Leo Yan
2026-09-09 1:34 ` yingchao deng
2026-09-09 9:29 ` Leo Yan
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®