From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794062906; b=23uf8W/tiYVS+fxNds2qhv7nsx+GfQaPY8QL7Q2GOaAwoNxRP3hTr1Q0fThIkTwkfAC4 sloYW3+4UfVnNiPnTRFbc2ytwDJG8yr294yrit9/fPlDax59I8bDDKUd15F06MuaANYxt GSdOirSr7KnlSi41aCY7nYGPQTJI+KVk2frGgnS3wAe4/gdLTpw4TyVn5nVnytqOyTArz K8kG1sGlJ7Cl3XOD9XO2WtPhax43GOCGai2VKnd1bAhEsPTn+JldX03Nu4Gbo3UEZffLu 9IaNbmmCluHCHNEW2BijlM2b/k/DaDt9Bajx+YUXGE8bjK4R9aYw2x+tqGwsDQvJF6A== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794062906; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=9ie4xruDtGmVbjMSLMc8lEbt4QLnq5Jqa5phEVJ1qlg=; b=KTA2G61xpO4pt4Rg9JsP8RsU/Q1QewkGJPFJFbNqJYUsZgC0+Kj8ghBoHruwPXsjsmS5 ofynSC7mtj+zaEKMVQCRcgJMzp8Jy1LOeQ+WXMAZyK+y7Hx5ky8b5IaxQkBkw006k/87W LggT1VYRCmLjhL36mciWS1Gf6WlUl0V7FijGZJXl4sA+c/CgLcv/66oJOcEDDliZUyRfw gAxjgP63yQf9kD60/5tCy6B9Ghw94XVpDJTLpbssQYLsALWyzc6ENaf/iZaDT0bT6mNyA 8T5x42xL8ZMQbcLTfpDzGmR7nzSuB3npffG3p6HSiJXPlvL8dn5NWeYF2VyThp5OVIw== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b="Cs/YHGev"; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 834C0606A326; Sat, 7 Nov 2026 14:48:26 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=Cs/YHGev Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2A9951F008A1; Sat, 7 Nov 2026 14:48:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1794062906; bh=9ie4xruDtGmVbjMSLMc8lEbt4QLnq5Jqa5phEVJ1qlg=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=Cs/YHGev+WEGwlrmmhuxgSUjLYGepqVb64e6z7qVJ5SOtGLuKUFoXhdwIGxXgFi20 7W/4lcNS4CluSGP9DgHPjGyFseDXV0kyWvc08OuzKU/A5YLfH3o1bfIivkgVSt3iXT tM93S1SQOyMsvZ1o2oAdrD3DTy+EAdg4x/C+pIIM= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Bradley Morgan , "Rafael J. Wysocki" , Sasha Levin Subject: [PATCH 6.18 131/869] PM: CPU: Restore synchronize_rcu() to cpu_pm_unregister_notifier() Date: Sat, 7 Nov 2026 08:46:53 -0500 Message-ID: <20261107134856.900735577@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261107134852.069646174@linuxfoundation.org> References: <20261107134852.069646174@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Bradley Morgan [ Upstream commit 61f7eee7d4664079fbce821576891c3ee5ccf597 ] cpu_pm_notify() walks the notifier chain lockless under only rcu_read_lock(). That only works if a removed notifier block is not freed until every concurrent walker is done with it. The chain used to be an atomic_notifier, whose unregister ends in synchronize_rcu(). Commit b2f6662ac08d ("PM: cpu: Make notifier chain use a raw_spinlock_t") switched it over to a raw_notifier, and in doing so replaced that with raw_notifier_chain_unregister(), which does not synchronize. The grace period quietly went away, so a driver that frees the memory holding its notifier block right after cpu_pm_unregister_notifier() returns can race with a concurrent walker: cpu1 (idle exit) cpu2 (driver remove) ---------------- -------------------- cpu_pm_notify(CPU_PM_EXIT) rcu_read_lock() nb = rcu_dereference_raw(*nl) cpu_pm_unregister_notifier(&od->nb) unlink, no grace period remove() frees od (devm) nb->notifier_call(nb, ...) /* use after free */ The rcu_read_lock() on cpu1 does not stop cpu2 from freeing the block, and nothing else does. The read side is the idle exit path, so this can hit on any system where a driver with a cpu_pm notifier gets unbound. Add the grace period back. It is only needed when a notifier was actually removed, so wait on success and return -ENOENT without waiting otherwise. The kerneldoc gets back the "may sleep" note that the same commit dropped. Fixes: b2f6662ac08d ("PM: cpu: Make notifier chain use a raw_spinlock_t") Cc: All applicable Signed-off-by: Bradley Morgan [ rjw: Subject tweak ] Link: https://patch.msgid.link/20260813074343.26460-3-include@grrlz.net Signed-off-by: Rafael J. Wysocki Signed-off-by: Sasha Levin --- kernel/cpu_pm.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/kernel/cpu_pm.c b/kernel/cpu_pm.c index 7481fbb947d32..a2a598ad6e6d5 100644 --- a/kernel/cpu_pm.c +++ b/kernel/cpu_pm.c @@ -10,6 +10,7 @@ #include #include #include +#include #include #include @@ -76,7 +77,8 @@ EXPORT_SYMBOL_GPL(cpu_pm_register_notifier); * * Remove a driver from the CPU PM notifier list. * - * This function has the same return conditions as raw_notifier_chain_unregister. + * This function may sleep, and has the same return conditions as + * raw_notifier_chain_unregister. */ int cpu_pm_unregister_notifier(struct notifier_block *nb) { @@ -86,6 +88,11 @@ int cpu_pm_unregister_notifier(struct notifier_block *nb) raw_spin_lock_irqsave(&cpu_pm_notifier.lock, flags); ret = raw_notifier_chain_unregister(&cpu_pm_notifier.chain, nb); raw_spin_unlock_irqrestore(&cpu_pm_notifier.lock, flags); + + /* Wait for the rcu_read_lock() walkers in cpu_pm_notify(). */ + if (!ret) + synchronize_rcu(); + return ret; } EXPORT_SYMBOL_GPL(cpu_pm_unregister_notifier); -- 2.53.0