[PATCH v3] panic: fix redirect CPU race in panic_try_force_cpu()

[Bradley Morgan <include@grrlz.net>]

The cmpxchg() in panic_try_force_cpu() makes sure that only one CPU
tries to redirect panic() to the requested CPU. It is similar to the
cmpxchg() in panic_try_start() which makes sure that only one CPU does
the panic(). In both situations, only the winner of cmpxchg() should
proceed further. Other CPUs should go offline.

There is a bug in panic_try_force_cpu() because CPUs continue with
vpanic() when the cmpxchg() fails. As a result, they might win in
panic_try_start() instead of the requested CPU.

The loser cannot just return true, because a CPU that already won the
redirect cmpxchg and then reenters panic(), for example via an NMI
during the string formatting, would fail its own cmpxchg and stop
itself, abandoning the panic. Check old_cpu == this_cpu so a recursive
reentry falls through to panic_try_start() instead.

Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20260705164123.18746-1-include@grrlz.net
Closes: https://sashiko.dev/#/patchset/20260707172252.4842-1-include@grrlz.net

Signed-off-by: Bradley Morgan <include@grrlz.net>
---
 kernel/panic.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

Changes since v2:
  - Rewrote the commit message to describe the race and the recursive case.
  - Used Reported-by and Closes tags.
  - Documented the reason return old_cpu != this_cpu is needed.

diff --git a/kernel/panic.c b/kernel/panic.c
index 03f1eef07b17..ebdc46af6aa9 100644
--- a/kernel/panic.c
+++ b/kernel/panic.c
@@ -401,11 +401,11 @@ static bool panic_try_force_cpu(const char *fmt, va_list args)
 		return false;
 
 	/*
-	 * Only one CPU can do the redirect. Use atomic cmpxchg to ensure
-	 * we don't race with another CPU also trying to redirect.
+	 * Only one CPU can do the redirection. Others should go
+	 * offline. Continue with panic() when ending recursively here.
 	 */
 	if (!atomic_try_cmpxchg(&panic_redirect_cpu, &old_cpu, this_cpu))
-		return false;
+		return old_cpu != this_cpu;
 
 	/*
 	 * Use dynamically allocated buffer if available, otherwise
-- 
2.53.0