From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-ed1-f41.google.com (mail-ed1-f41.google.com [209.85.208.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E3BAC309EEC for ; Mon, 13 Jul 2026 23:00:47 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.208.41 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783983650; cv=none; b=tK05lwNrq09sKlafBS75E7uuVEbrjUtTLdX2y1vles3LRW+1QW/fpoVayDw2QoZUx33VJ+Q9g3zULDyxsRXUmxpYDW7CwotidoY2bRTDaR30A1QtjPIzZs7NmwH1a+fYZ1OYwGAqZXs8NT/hpgTDZVG8qhOEtC40tK77+gwQ7/Y= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783983650; c=relaxed/simple; bh=mjpOssqdko44vM+FfdPiQeA5zf+rOXDkLtZlLPaFU2I=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version:Content-Type; b=JXvI2VRM2QNaUxTJGS58rC/9vD8D4SXLonARwD+Po63AI70P+FC2cOC/7ebEiYU9PF3f86fnDwSbsc5iuxHaTJ3soHI1af5KJJdeEnKTA+M915gS4Ev1OE5iy+FcBWm0lolLgnc3pK30YYQF3h6GnwvLFF+NkRQL4c1MhXAFp0Y= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=GB1jVon8; arc=none smtp.client-ip=209.85.208.41 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="GB1jVon8" Received: by mail-ed1-f41.google.com with SMTP id 4fb4d7f45d1cf-698aa7ba3e6so6468816a12.1 for ; Mon, 13 Jul 2026 16:00:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783983646; x=1784588446; darn=vger.kernel.org; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:from:to:cc:subject :date:message-id:reply-to:content-type; bh=Qo7IAvthG118m/JTtLFPGSZtzV4fU1ihRDscsFNE2qM=; b=GB1jVon8+3wqgnv3pqL0xRdr2zkSuT6tMAH7IbAIom4j1Ik7//4Xid+OSODyTbG6Re U1kM49fv30kcV9UY5BYvCwwfUmS3COhrwDebpYLlluxHwpCEMAtDrmoIZL4PteAIcaJ5 tTxYq0IIM2c4GKYOJyWirtAVC3UXFxPxPreoI9rDKFWIQLlV4VamhZwzn5jGKIozaume J63XXdyrxsT6zZxWBu1fhcwk6jCFvrW3lRT9yMJnvipNkFO4hIhzLTCnsnPlSIxPxPep NQKTiNRvVjAeZnRQEVx7RcDoCf6U51o/WlFEEv0995b6wPIBvexpBT4V+kU2eZO3Ay4U YyzQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783983646; x=1784588446; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=Qo7IAvthG118m/JTtLFPGSZtzV4fU1ihRDscsFNE2qM=; b=Qfxwari5pam4lFsz/WVQkKX5eF0n7LhPahihVRW3I6deGW5G9lV1Vtu/yOl//LOIo4 8tJApZorarow8mfnxkH4JDzCqllB3d3ZDLOo5wyrJD914zri4tT7Bk0SCAu1AVVvzPZp v8Rv10/F9mViFeVW831PufjeBPfJPYvMyG2zWy6BujkkLEztntiwIwa2LtfL9XIORRt0 2fp3IyES0XW9S3zRgJXvGAobgc4uGoo4LygvDRI9nne+wUh4dPVMowPzevHKZMahdgyW EXQe9Wj1J7Ez3YOTuXvTAsEJJmvNOoEC3nfUWh5eN/tdILfuYmMKWRIbQweI7v7dWbV5 /7+Q== X-Forwarded-Encrypted: i=1; AHgh+RoPKg+tIylkGJTlgwylnSs/Kgp1S69dKlhHZEQMhbEseWY32oQ4BQ2rtWE7r7QGrnj23QkhtQ4RVetI99k=@vger.kernel.org X-Gm-Message-State: AOJu0YwURRYVj7IkVN6L0BqCIgb2mM1ErX6x9WuduvroTLgMpUjHHFOq 7zNiRCDE/eHM45A36wthLa46mEjD63lo8eJ4GsSDNdUB8jx3u5KUH8wZ X-Gm-Gg: AfdE7ckW/LMgzmGB09qPEYXNN3BrbLD9mbR7xXHrAywW/vxRuw1R1mTTC6rndaCrUD3 Ua0IZFX58UPOFU2bJKqqvVoEL+cxC9phX57INz3Gf313AZgpVMKDcfPnE61xbMwQksO48pdO4zz 2CCS71KWykFCnuIxyQ2Mo35xMHBBwxYOiK6X1rPiEHHU+NAdLRwEkT0mJWUuGTYYG0iyDm+ZzfS Zf+mrmFR1ouEs+rR35qFschCrYCnv688HvY8Fy9apDmtjSPKUIMLFgtpUI2ztRy7G3Ts2thddpX T8dK9LCdwNGNUPvIKDtkxeC61Ro6+IxysxtQ15ExwPqvsh4bOqkg1W0uy+BqKXyJdYDDk9zmpLS h/x7Gvu3HdzK0ELofoQINlKgo2GvDsk4c71tF9kubLegbOOSD/r5Hwij04PDxhLk2pZCckg/W4a Dg0H1rtZ2rQGFtTtDi/m4VPFS2JGVq8Vc7MIwENYK4rGQYGcHoIA== X-Received: by 2002:a05:6402:1e8f:b0:698:1973:1daa with SMTP id 4fb4d7f45d1cf-69c5f10c9b9mr4960904a12.18.1783983646028; Mon, 13 Jul 2026 16:00:46 -0700 (PDT) Received: from ST.. ([154.189.248.22]) by smtp.gmail.com with ESMTPSA id 4fb4d7f45d1cf-69cd2878e74sm512640a12.4.2026.07.13.16.00.42 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 13 Jul 2026 16:00:44 -0700 (PDT) From: Mohamed Ayman To: Suzuki K Poulose , Mike Leach , James Clark , Leo Yan , Alexander Shishkin , Sebastian Andrzej Siewior , Clark Williams , Steven Rostedt , coresight@lists.linaro.org (moderated list:ARM/CORESIGHT FRAMEWORK AND DRIVERS), linux-arm-kernel@lists.infradead.org (moderated list:ARM/CORESIGHT FRAMEWORK AND DRIVERS), linux-kernel@vger.kernel.org (open list), linux-rt-devel@lists.linux.dev (open list:Real-time Linux (PREEMPT_RT):Keyword:PREEMPT_RT) Cc: Mohamed Ayman , coresight@lists.linaro.org (moderated list:ARM/CORESIGHT FRAMEWORK AND DRIVERS), linux-arm-kernel@lists.infradead.org (moderated list:ARM/CORESIGHT FRAMEWORK AND DRIVERS), linux-kernel@vger.kernel.org (open list), linux-rt-devel@lists.linux.dev (open list:Real-time Linux (PREEMPT_RT):Keyword:PREEMPT_RT) Subject: [PATCH v2] coresight: Fix scheduling while atomic in coresight_put_percpu_source_ref() Date: Tue, 14 Jul 2026 02:00:27 +0300 Message-Id: <20260713230028.8046-1-mohamedaymanworkspace@gmail.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260712210446.14290-1-mohamedaymanworkspace@gmail.com> References: <20260712210446.14290-1-mohamedaymanworkspace@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Dropping the last reference to a coresight_device triggers a kernel panic on PREEMPT_RT builds due to a "scheduling while atomic" violation. During CPU idle transitions, coresight_cpu_pm_notify() runs with interrupts disabled. It eventually calls put_device(), which can synchronously trigger the device's release callback and drop the parent device's reference. On PREEMPT_RT, free_percpu() takes a sleeping lock (rt-mutex), and the parent's release callback might also sleep. Sleeping in this atomic PM context crashes the system. A previous patch tried deferring just the coresight_device_release() body, but this still left the synchronous put_device() call dangerously exposed to sleeping parent release functions. Fix this by entirely deferring the put_device() call to process context. We add a pending counter (put_pending) and a work_struct to the coresight device. When releasing a reference, we increment the counter and queue the work. A worker thread then safely drains the counter and calls put_device(). The counter prevents leaking references if multiple puts are queued before the worker even has a chance to run. To prevent a use-after-free race condition during module unload, the work is queued on a dedicated coresight_wq which is safely drained and destroyed in coresight_exit(). Finally, remove the unnecessary raw_spinlock_irqsave in the put path, as dropping a reference doesn't require protecting the per-CPU table. Signed-off-by: Mohamed Ayman --- drivers/hwtracing/coresight/coresight-core.c | 37 ++++++++++++++------ include/linux/coresight.h | 3 ++ 2 files changed, 30 insertions(+), 10 deletions(-) diff --git a/drivers/hwtracing/coresight/coresight-core.c b/drivers/hwtracing/coresight/coresight-core.c index 6d65c43d5..e931e6bdc 100644 --- a/drivers/hwtracing/coresight/coresight-core.c +++ b/drivers/hwtracing/coresight/coresight-core.c @@ -63,6 +63,8 @@ static LIST_HEAD(coresight_dev_idx_list); static const struct cti_assoc_op *cti_assoc_ops; +static struct workqueue_struct *coresight_wq; + static struct coresight_node * coresight_path_first_node(struct coresight_path *path) { @@ -132,6 +134,16 @@ static void coresight_clear_percpu_source(struct coresight_device *csdev) per_cpu(csdev_source, csdev->cpu) = NULL; } +static void coresight_put_device_work(struct work_struct *work) +{ + struct coresight_device *csdev = + container_of(work, struct coresight_device, put_work); + int n = atomic_xchg(&csdev->put_pending, 0); + + while (n--) + put_device(&csdev->dev); +} + struct coresight_device *coresight_get_percpu_source_ref(int cpu) { struct coresight_device *csdev; @@ -163,16 +175,9 @@ void coresight_put_percpu_source_ref(struct coresight_device *csdev) if (!csdev || !coresight_is_percpu_source(csdev)) return; - guard(raw_spinlock_irqsave)(&coresight_dev_lock); + atomic_inc(&csdev->put_pending); - /* - * TODO: coresight_device_release() is invoked to release resources when - * the device's refcount reaches zero. It then calls free_percpu(), - * which acquires pcpu_lock — a sleepable lock when PREEMPT_RT is - * enabled. Since the raw spinlock coresight_dev_lock is held, this can - * lead to a potential "scheduling while atomic" issue. - */ - put_device(&csdev->dev); + queue_work(coresight_wq, &csdev->put_work); } struct coresight_device *coresight_get_source(struct coresight_path *path) @@ -1563,6 +1568,9 @@ coresight_init_device(struct coresight_desc *desc) csdev->dev.release = coresight_device_release; csdev->dev.bus = &coresight_bustype; + INIT_WORK(&csdev->put_work, coresight_put_device_work); + atomic_set(&csdev->put_pending, 0); + return csdev; } @@ -2090,9 +2098,13 @@ static int __init coresight_init(void) { int ret; + coresight_wq = alloc_workqueue("coresight_wq", 0, 0); + if (!coresight_wq) + return -ENOMEM; + ret = bus_register(&coresight_bustype); if (ret) - return ret; + goto exit_wq; ret = etm_perf_init(); if (ret) @@ -2121,6 +2133,8 @@ static int __init coresight_init(void) etm_perf_exit(); exit_bus_unregister: bus_unregister(&coresight_bustype); +exit_wq: + destroy_workqueue(coresight_wq); return ret; } @@ -2133,6 +2147,9 @@ static void __exit coresight_exit(void) etm_perf_exit(); bus_unregister(&coresight_bustype); coresight_release_device_list(); + + if (coresight_wq) + destroy_workqueue(coresight_wq); } module_init(coresight_init); diff --git a/include/linux/coresight.h b/include/linux/coresight.h index ddf18c970..589a6c20d 100644 --- a/include/linux/coresight.h +++ b/include/linux/coresight.h @@ -13,6 +13,7 @@ #include #include #include +#include /* Peripheral id registers (0xFD0-0xFEC) */ #define CORESIGHT_PERIPHIDR4 0xfd0 @@ -293,6 +294,8 @@ struct coresight_device { struct csdev_access access; struct device dev; struct coresight_path *path; + struct work_struct put_work; + atomic_t put_pending; atomic_t mode; int refcnt; int cpu; -- 2.34.1