From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794063966; b=bHZmJByzRUhvWcq/xtmq3lcxpHkXCGHzX7RAPNsZnE3bCV2bQ3rd+45K/5/vfyp5RI2E bc99NrZiUPug8YjJyPYe8qY3FoZuIY+NQrRcNcVOpqh/Xgqv7dEJpxMjmEzcxrHnCyLDW DFTgahyyiTLGZSKVwzqXcS92vrjJU1LBfa4OGqTxuS9FfTK1/vKKDPoMrmD95Ih5AWK+f 0LfOWFO2Ke3hSFLDQHhMLeJ5/IJ58iuwSiGfRAJXPJ++Q7at9J9ZYGP8E+x/w4hFx5xDE qUMmsxqMgoCiywXT3DdUNlHs6ojjX90xIAI/aG8pdOqu1u1rwf4hBQWYSgpotQUsEvQ== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794063966; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=zXB63G2JFDhkFi9gAzRUGqf7fdZJkOu+0lS4J6yR5mQ=; b=21Z+VxF4MM/42mzmzsSqYwgi8FRhkzV5OBRx8RGivN7YXkT2pJdLsLw41fDTPZjhSHH+ 80Iqwvav1LHri23IgHYQvCBKqSHpVwkcICixXROo5gpbyojc31Q89G44tMqCPreIrPkek 1Rff0CQiJk6XSAB79Z2LoBL6lgmYZQ6KXlrB7/xWd7s0s4Z+20KmyWpLUP/Iz13oOz+1R zTgEhtqbE5c08ZzjwhQmWHSZ9/7RKOjRY6m6ll96WKsdq62Hd6aPxFFoUa4gD8F0cUEEA KsksCw2tdiF+vZiEzu11bl0NwM+9sxzsFxbvUGc0pfhrJqHXceLBSWCBpufvBUwOqFg== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=hpYl8u1M; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A8522606EE97; Sat, 7 Nov 2026 15:06:05 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=hpYl8u1M Received: by smtp.kernel.org (Postfix) with ESMTPSA id 53D941F0089F; Sat, 7 Nov 2026 15:06:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1794063965; bh=zXB63G2JFDhkFi9gAzRUGqf7fdZJkOu+0lS4J6yR5mQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=hpYl8u1MNjhfSU/qHtY4EQf5XJi2/ptF6JT6s7EhpjBcZp7hk37+mNxHxFi/F2NuE nHDyegMEjzuCh8hWIskOVhyoUX8boDmS/hkvsVPdjElGp/wsEIq5RByEIr2I4RKXXU cM4kCmwTlo/vObitz0EWW2u2skLmstH1xHObWWes= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Bradley Morgan , "Rafael J. Wysocki" , Sasha Levin Subject: [PATCH 7.3 0152/1257] PM: CPU: Restore synchronize_rcu() to cpu_pm_unregister_notifier() Date: Sat, 7 Nov 2026 08:40:48 -0500 Message-ID: <20261107134943.513806777@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261107134939.434104957@linuxfoundation.org> References: <20261107134939.434104957@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 7.3-stable review patch. If anyone has any objections, please let me know. ------------------ From: Bradley Morgan [ Upstream commit 61f7eee7d4664079fbce821576891c3ee5ccf597 ] cpu_pm_notify() walks the notifier chain lockless under only rcu_read_lock(). That only works if a removed notifier block is not freed until every concurrent walker is done with it. The chain used to be an atomic_notifier, whose unregister ends in synchronize_rcu(). Commit b2f6662ac08d ("PM: cpu: Make notifier chain use a raw_spinlock_t") switched it over to a raw_notifier, and in doing so replaced that with raw_notifier_chain_unregister(), which does not synchronize. The grace period quietly went away, so a driver that frees the memory holding its notifier block right after cpu_pm_unregister_notifier() returns can race with a concurrent walker: cpu1 (idle exit) cpu2 (driver remove) ---------------- -------------------- cpu_pm_notify(CPU_PM_EXIT) rcu_read_lock() nb = rcu_dereference_raw(*nl) cpu_pm_unregister_notifier(&od->nb) unlink, no grace period remove() frees od (devm) nb->notifier_call(nb, ...) /* use after free */ The rcu_read_lock() on cpu1 does not stop cpu2 from freeing the block, and nothing else does. The read side is the idle exit path, so this can hit on any system where a driver with a cpu_pm notifier gets unbound. Add the grace period back. It is only needed when a notifier was actually removed, so wait on success and return -ENOENT without waiting otherwise. The kerneldoc gets back the "may sleep" note that the same commit dropped. Fixes: b2f6662ac08d ("PM: cpu: Make notifier chain use a raw_spinlock_t") Cc: All applicable Signed-off-by: Bradley Morgan [ rjw: Subject tweak ] Link: https://patch.msgid.link/20260813074343.26460-3-include@grrlz.net Signed-off-by: Rafael J. Wysocki Signed-off-by: Sasha Levin --- kernel/cpu_pm.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/kernel/cpu_pm.c b/kernel/cpu_pm.c index 7481fbb947d32..a2a598ad6e6d5 100644 --- a/kernel/cpu_pm.c +++ b/kernel/cpu_pm.c @@ -10,6 +10,7 @@ #include #include #include +#include #include #include @@ -76,7 +77,8 @@ EXPORT_SYMBOL_GPL(cpu_pm_register_notifier); * * Remove a driver from the CPU PM notifier list. * - * This function has the same return conditions as raw_notifier_chain_unregister. + * This function may sleep, and has the same return conditions as + * raw_notifier_chain_unregister. */ int cpu_pm_unregister_notifier(struct notifier_block *nb) { @@ -86,6 +88,11 @@ int cpu_pm_unregister_notifier(struct notifier_block *nb) raw_spin_lock_irqsave(&cpu_pm_notifier.lock, flags); ret = raw_notifier_chain_unregister(&cpu_pm_notifier.chain, nb); raw_spin_unlock_irqrestore(&cpu_pm_notifier.lock, flags); + + /* Wait for the rcu_read_lock() walkers in cpu_pm_notify(). */ + if (!ret) + synchronize_rcu(); + return ret; } EXPORT_SYMBOL_GPL(cpu_pm_unregister_notifier); -- 2.53.0