linux-kernel - Re: [PATCH v4 2/2] coresight: Fix possible deadlock in coresight_panic

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20250922103412.GF516577@e132581.arm.com>
Date: Mon, 22 Sep 2025 11:34:12 +0100
From: Leo Yan <leo.yan@....com>
To: Sean Anderson <sean.anderson@...ux.dev>
Cc: Suzuki K Poulose <suzuki.poulose@....com>, coresight@...ts.linaro.org,
	linux-arm-kernel@...ts.infradead.org,
	James Clark <james.clark@...aro.org>,
	Alexander Shishkin <alexander.shishkin@...ux.intel.com>,
	Yeoreum Yun <yeoreum.yun@....com>,
	Linu Cherian <lcherian@...vell.com>,
	Mike Leach <mike.leach@...aro.org>, linux-kernel@...r.kernel.org
Subject: Re: [PATCH v4 2/2] coresight: Fix possible deadlock in
 coresight_panic_cb

On Fri, Sep 19, 2025 at 12:06:53PM -0400, Sean Anderson wrote:

[...]

> diff --git a/drivers/hwtracing/coresight/coresight-core.c b/drivers/hwtracing/coresight/coresight-core.c
> index 022c8384b98d..6dfb1198c16e 100644
> --- a/drivers/hwtracing/coresight/coresight-core.c
> +++ b/drivers/hwtracing/coresight/coresight-core.c
> @@ -1046,8 +1046,11 @@ static void coresight_device_release(struct device *dev)
>  {
>  	struct coresight_device *csdev = to_coresight_device(dev);
>  
> -	fwnode_handle_put(csdev->dev.fwnode);
> +	if (panic_ops(csdev))
> +		atomic_notifier_chain_unregister(&panic_notifier_list,
> +						 &csdev->panic_notifier);
>  	free_percpu(csdev->perf_sink_id_map.cpu_map);
> +	fwnode_handle_put(csdev->dev.fwnode);

The moving fwnode_handle_put() is irrelvant to panic notifier fix,
should be moved out from this patch.

>  	kfree(csdev);
>  }
>  
> @@ -1315,6 +1318,16 @@ void coresight_release_platform_data(struct coresight_device *csdev,
>  		coresight_remove_conns_sysfs_group(csdev);
>  }
>  
> +static int coresight_panic_notifier(struct notifier_block *nb,
> +				    unsigned long action, void *data)
> +{
> +	struct coresight_device *csdev =
> +		container_of(nb, struct coresight_device, panic_notifier);
> +

Need to check device mode:

        if (coresight_get_mode(csdev) == CS_MODE_DISABLED)
            return NOTIFY_DONE;

The rest is fine for me.

Thanks,
Leo

> +	panic_ops(csdev)->sync(csdev);
> +	return NOTIFY_DONE;
> +}
> +
>  struct coresight_device *coresight_register(struct coresight_desc *desc)
>  {
>  	int ret;
> @@ -1357,6 +1370,17 @@ struct coresight_device *coresight_register(struct coresight_desc *desc)
>  			goto err_out;
>  		}
>  	}
> +
> +	if (panic_ops(csdev)) {
> +		csdev->panic_notifier.notifier_call = coresight_panic_notifier;
> +		ret = atomic_notifier_chain_register(&panic_notifier_list,
> +						     &csdev->panic_notifier);
> +		if (ret) {
> +			coresight_device_release(&csdev->dev);
> +			goto err_out;
> +		}
> +	}
> +
>  	/*
>  	 * Make sure the device registration and the connection fixup
>  	 * are synchronised, so that we don't see uninitialised devices
> @@ -1563,36 +1587,6 @@ const struct bus_type coresight_bustype = {
>  	.name	= "coresight",
>  };
>  
> -static int coresight_panic_sync(struct device *dev, void *data)
> -{
> -	int mode;
> -	struct coresight_device *csdev;
> -
> -	/* Run through panic sync handlers for all enabled devices */
> -	csdev = container_of(dev, struct coresight_device, dev);
> -	mode = coresight_get_mode(csdev);
> -
> -	if ((mode == CS_MODE_SYSFS) || (mode == CS_MODE_PERF)) {
> -		if (panic_ops(csdev))
> -			panic_ops(csdev)->sync(csdev);
> -	}
> -
> -	return 0;
> -}
> -
> -static int coresight_panic_cb(struct notifier_block *self,
> -			       unsigned long v, void *p)
> -{
> -	bus_for_each_dev(&coresight_bustype, NULL, NULL,
> -				 coresight_panic_sync);
> -
> -	return 0;
> -}
> -
> -static struct notifier_block coresight_notifier = {
> -	.notifier_call = coresight_panic_cb,
> -};
> -
>  static int __init coresight_init(void)
>  {
>  	int ret;
> @@ -1605,20 +1599,11 @@ static int __init coresight_init(void)
>  	if (ret)
>  		goto exit_bus_unregister;
>  
> -	/* Register function to be called for panic */
> -	ret = atomic_notifier_chain_register(&panic_notifier_list,
> -					     &coresight_notifier);
> -	if (ret)
> -		goto exit_perf;
> -
>  	/* initialise the coresight syscfg API */
>  	ret = cscfg_init();
>  	if (!ret)
>  		return 0;
>  
> -	atomic_notifier_chain_unregister(&panic_notifier_list,
> -					     &coresight_notifier);
> -exit_perf:
>  	etm_perf_exit();
>  exit_bus_unregister:
>  	bus_unregister(&coresight_bustype);
> @@ -1628,8 +1613,6 @@ static int __init coresight_init(void)
>  static void __exit coresight_exit(void)
>  {
>  	cscfg_exit();
> -	atomic_notifier_chain_unregister(&panic_notifier_list,
> -					     &coresight_notifier);
>  	etm_perf_exit();
>  	bus_unregister(&coresight_bustype);
>  }
> diff --git a/include/linux/coresight.h b/include/linux/coresight.h
> index 4ac65c68bbf4..a7aaf9d3d01d 100644
> --- a/include/linux/coresight.h
> +++ b/include/linux/coresight.h
> @@ -280,6 +280,7 @@ struct coresight_trace_id_map {
>   * @config_csdev_list:  List of system configurations added to the device.
>   * @cscfg_csdev_lock:	Protect the lists of configurations and features.
>   * @active_cscfg_ctxt:  Context information for current active system configuration.
> + * @panic_notifier: Notifier block used to clean up during a panic
>   */
>  struct coresight_device {
>  	struct coresight_platform_data *pdata;
> @@ -304,6 +305,7 @@ struct coresight_device {
>  	struct list_head config_csdev_list;
>  	raw_spinlock_t cscfg_csdev_lock;
>  	void *active_cscfg_ctxt;
> +	struct notifier_block panic_notifier;
>  };
>  
>  /*
> -- 
> 2.35.1.1320.gc452695387.dirty
>