From nobody Fri Jul 24 21:53:36 2026 Received: from galois.linutronix.de (Galois.linutronix.de [193.142.43.55]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4A15E439F67; Thu, 23 Jul 2026 10:21:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=193.142.43.55 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784802085; cv=none; b=htfhHJd1SNUV05VwbNJ0Gpuh1tF4d9YBkjsw+z72zDH56qyTbwreTThIb60XPSx/7h4OEVZ7QFe089zM/ZZTrXQAReAUDn26QbyFGKEFciYrqc+/aYwQpiI5wiuyQKBCvyvrShLzsSNeYJOc/qA+ngVIKDGoSpf6XUFq1OpMvxg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784802085; c=relaxed/simple; bh=KVLYDI0+vcHxVzkIPlqfrzVIt/xtpR+0hjTwAcBHHCs=; h=Date:From:To:Subject:Cc:In-Reply-To:References:MIME-Version: Message-ID:Content-Type; b=k+71nngvSmUqLXivXcFr12Q03CnmM9pDXx5xXKWY1TspLcy6+EouIjUPaNrhzclk4t8I1zpS4EM0zR+yMcZGyoZweGk5HS2YEH4gLd0zfdgTOsQ7dPBNHT1NUa2bxNglG/amHcV3X5D4WfWYy1CIbchQDyz1wm03jBoy7Plae6k= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linutronix.de; spf=pass smtp.mailfrom=linutronix.de; dkim=pass (2048-bit key) header.d=linutronix.de header.i=@linutronix.de header.b=DL2P7hfs; dkim=permerror (0-bit key) header.d=linutronix.de header.i=@linutronix.de header.b=tObwoYIW; arc=none smtp.client-ip=193.142.43.55 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linutronix.de Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linutronix.de Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=linutronix.de header.i=@linutronix.de header.b="DL2P7hfs"; dkim=permerror (0-bit key) header.d=linutronix.de header.i=@linutronix.de header.b="tObwoYIW" Date: Thu, 23 Jul 2026 10:21:20 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020; t=1784802082; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=gh9VBCP6nfD/gShJxJH2O5P4+okTlP/CEQJF5tpEx28=; b=DL2P7hfshstwiuF+RoFTRijUysfkxAAtGAzc12PQ+YT3Bd7W7NvBNGNti2VZZAv5oN4apr SIGITXLcU+PlwlK5VB2E8OSJpx8Xfv+o96rkSj7tvQEdnp7zkwpeHUCqw+ZBt/ofs6XcQ+ lWbURgPBEgkM2CmuxxtBkRrkNZZAcVugPSr7RaB1LPDXqrpXyeKINpqQVGUP5uaxKhXVt6 P/sQli+r13aKkLaEUCDgxbIH+5+qiI4MMkNd2jr4St6rZsALjAw5yPwjyURhbfrfW/eTQr ml1UFeP0CEwq1K/Zq1Iafua/ZYCzf34HAY/dBObObG6r/yxk5Ez6QbWyNf8P7A== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020e; t=1784802082; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=gh9VBCP6nfD/gShJxJH2O5P4+okTlP/CEQJF5tpEx28=; b=tObwoYIWxnj0iYP6UvbhUdTHh/yFNIaOTJJZxF7hNhMSBmEhSkFaGZ+e7xiDGn2CmeY3LN mXZq/FQ+FfQLOiAg== From: "tip-bot2 for Chuyi Zhou" Sender: tip-bot2@linutronix.de Reply-to: linux-kernel@vger.kernel.org To: linux-tip-commits@vger.kernel.org Subject: [tip: smp/core] smp: Alloc percpu csd data in smpcfd_prepare_cpu() only once Cc: Chuyi Zhou , Thomas Gleixner , "Paul E. McKenney" , Sebastian Andrzej Siewior , Muchun Song , x86@kernel.org, linux-kernel@vger.kernel.org In-Reply-To: <20260709122933.4021501-6-zhouchuyi@bytedance.com> References: <20260709122933.4021501-6-zhouchuyi@bytedance.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Message-ID: <178480208080.2943223.7484297375030595515.tip-bot2@tip-bot2> Robot-ID: Robot-Unsubscribe: Contact to get blacklisted from these emails Precedence: bulk Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable The following commit has been merged into the smp/core branch of tip: Commit-ID: 9f483e5b2f1263f7fad20bcc5b09d01d2da57f1f Gitweb: https://git.kernel.org/tip/9f483e5b2f1263f7fad20bcc5b09d01d2= da57f1f Author: Chuyi Zhou AuthorDate: Thu, 09 Jul 2026 20:29:24 +08:00 Committer: Thomas Gleixner CommitterDate: Thu, 16 Jul 2026 09:24:55 +02:00 smp: Alloc percpu csd data in smpcfd_prepare_cpu() only once smp_call_function_many_cond() uses per-CPU CSD objects when queueing callbacks to remote CPUs, and the wait path later dereferences those CSDs from csd_lock_wait(). Making the wait path preemptible allows the initiating task to be preempted or migrated before it waits for completion. A target CPU can be offlined in that window. If smpcfd_dead_cpu() frees the target CPU's per-CPU CSD storage, csd_lock_wait() can later dereference freed memory. One way to protect the CSD storage is to free it via RCU or after a synchronization step in the CPU offline path, but that would add unnecessary complexity and can delay CPU shutdown. Allocate the per-CPU CSD storage the first time a CPU comes up and keep it allocated when the CPU is offlined. This allows csd_lock_wait() to access the CSD even when the target CPU is offlined after preemption is re-enabled and before the wait is invoked. Signed-off-by: Chuyi Zhou Signed-off-by: Thomas Gleixner Tested-by: Paul E. McKenney Reviewed-by: Sebastian Andrzej Siewior Acked-by: Muchun Song Link: https://patch.msgid.link/20260709122933.4021501-6-zhouchuyi@bytedance= .com --- kernel/smp.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/kernel/smp.c b/kernel/smp.c index 19fdee6..e6c1d83 100644 --- a/kernel/smp.c +++ b/kernel/smp.c @@ -64,7 +64,14 @@ int smpcfd_prepare_cpu(unsigned int cpu) free_cpumask_var(cfd->cpumask); return -ENOMEM; } - cfd->csd =3D alloc_percpu(call_single_data_t); + + /* + * Allocate the per-CPU CSD the first time a CPU comes up. It is + * not freed when the CPU is offlined, so csd_lock_wait() can access + * it even when the CPU was offlined after preemption was re-enabled. + */ + if (!cfd->csd) + cfd->csd =3D alloc_percpu(call_single_data_t); if (!cfd->csd) { free_cpumask_var(cfd->cpumask); free_cpumask_var(cfd->cpumask_ipi); @@ -80,7 +87,6 @@ int smpcfd_dead_cpu(unsigned int cpu) =20 free_cpumask_var(cfd->cpumask); free_cpumask_var(cfd->cpumask_ipi); - free_percpu(cfd->csd); return 0; } =20