From nobody Wed Feb 11 08:12:59 2026 Received: from mail-qv1-f53.google.com (mail-qv1-f53.google.com [209.85.219.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4DD7C3EBF25 for ; Tue, 10 Feb 2026 15:43:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.219.53 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770738206; cv=none; b=Q6CHEEbIXett/nWz5I3mu/uSjQYODt7SCZtctEJdJkHfka//gpw5ZefOr0VEC4cq7kU4ZUhVcfgXbu+D2J6nOwILqADbfTeDPLS+y8ys4mkGYuFVOS26NTYfDoCGUl8oZR4BIE/t0NbZbh+r2106zAdHLOCpK090o3Njv68HIq0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770738206; c=relaxed/simple; bh=wOR2nmEk2IOriT4/LftK2zJ6ppRZIzmlrGyp9OklFuI=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=bkSTWbbfS09hnDZukT0+ay0yaF4O65dsC8F3Mas9GX/R+JroXGoFJgLDi8rGRLvLj+IRjBtvIFd4g0TMvnSBujBrgNyhaWWn9E5lEgZl2+zN4mk6P4hhazTdfklwp8t4Tep952wgQ5LGRxASutvRqg4a2eNlzqKjHPMG64FfANs= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=gourry.net; spf=pass smtp.mailfrom=gourry.net; dkim=pass (2048-bit key) header.d=gourry.net header.i=@gourry.net header.b=DtZJ+iqV; arc=none smtp.client-ip=209.85.219.53 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=gourry.net Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gourry.net Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gourry.net header.i=@gourry.net header.b="DtZJ+iqV" Received: by mail-qv1-f53.google.com with SMTP id 6a1803df08f44-896f9397ecdso10503806d6.3 for ; Tue, 10 Feb 2026 07:43:25 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gourry.net; s=google; t=1770738204; x=1771343004; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=FoJZrSjCiUuXH3ZlZRBV9LhTTJWjcyDlBywhmcp5Aag=; b=DtZJ+iqVd5Ccu/Re1ULsWfPaHAuJbgn7DPzy18J2xxO1tfvniKsL0TFJT4ibOOZR1i +mAEEvYXwAhE07W/QbCtPCiYz7BVttO27Gs00yxcNuVGkQ8ZYtcMLFDcPbJc7VgpNaa/ mw07YxykVkr6IUavSa5Ccgl1aUpJ414saqA7ElgAzbC02D4Yr9+ew3OT5+cJm8oZwTcy G0Gg2IJPKYckbDNfnhzrYaFs0Bv4e2giM5hgp6sFnudIRy5jmygCfbiSs6q2kNIvoWXY CprtMarbIFS0NCm0Vxe0DkHqqXaAhDFcao7OmH2cEc40izaxNmhD+UNgHJQm7/kipM1w EYoQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1770738204; x=1771343004; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=FoJZrSjCiUuXH3ZlZRBV9LhTTJWjcyDlBywhmcp5Aag=; b=HWoylCPNg5Aaut/4ZpoxdjbW9Ju1yWviY0b1+x76f2ySwzOJSdvsHywkLpEIZ9v8wO J/C3DVxWbmOWjyeT3YSyZHaKNxBbr1o8Ypy+N93wyQD8ROEMwzaqfzXzWaH+ogCVb5S8 FnjASnwTPeXy+MqLbJd7KQVUJ1u+gtt6o0481y9Sc2dnwerZWN5wW1ITVZON4SwmPTdD q8HKgxZ7tzStQi4I17NZU3bDsg1GD+SyM45NEmJwb+x7q6hCEUe7HAaUYgkFmDUnqQ3n ssroEG1W+FKC4Ch3pn5Oux6AJhFUFhB6EHk9zVA7UT+AZsJ3aFJEKQzfdaKDQTPicmq0 lWrw== X-Gm-Message-State: AOJu0Yz1ZbLbGV+QEFFXT0fHNyeInzsi4i1dRdeG1Zp+okOHqM58x6wr qT4gYNTX3QQbe/WNzxUadyzLahhlnWDfAZT+9MC1+x6WCw3n+OpYftwdKchYOnYxxrE= X-Gm-Gg: AZuq6aKzOPlwBra9bERP8WDuuAlrU1jLKc4YWbP95gRS9Qp2Wa2P75r9aWczXNJALlg HHwxUFP5mBQAJESWFpwSqhT98TLn++YFyuLmt2uOtaLgyqkdJOb8i0ftm7FYYMGnknys4d+e0R8 iDDF6pSb+ZXr2i+iqH82eaCSxhhSU2KsanJ+xfcO/yVkej0sMjznLUjboEk5E+4mtYj12yDPsJO 94wpNM0n2V26+saETuE8k779pBUxMsEURsAsarLYz4T1x4Oet3Sx2xSy02S2KuKNHbO6I5pUR9V lO8GJfiNnN1r6j6+0/FvbFOvZnaNZzEMiSiumJBe9TC9zFFK1Nq3KlIRchdzhq4VBw/04MCCh+L 2Cfv06JT14z29jrywzsIJhrELiVUPbp4WTteMjk/9vGUHNzV/Gg2XpmqoanK3Fsi0VLrI7+929O MZjML3K0rPDRyEdFaupvx+YNtMNVJl+rWjLYgvmjIzr0oqtb5RqDNkqqpChyKxsHjyWe8zFlHWn UYet0Jgw5njrJs= X-Received: by 2002:ad4:4091:0:b0:895:48b9:4fd2 with SMTP id 6a1803df08f44-89548b953c8mr133265566d6.70.1770738204180; Tue, 10 Feb 2026 07:43:24 -0800 (PST) Received: from gourry-fedora-PF4VCD3F.lan (pool-96-255-20-138.washdc.ftas.verizon.net. [96.255.20.138]) by smtp.gmail.com with ESMTPSA id af79cd13be357-8cafa3bf628sm1097682285a.48.2026.02.10.07.43.23 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 10 Feb 2026 07:43:23 -0800 (PST) From: Gregory Price To: linux-cxl@vger.kernel.org Cc: linux-kernel@vger.kernel.org, kernel-team@meta.com, dave@stgolabs.net, jonathan.cameron@huawei.com, dave.jiang@intel.com, alison.schofield@intel.com, vishal.l.verma@intel.com, ira.weiny@intel.com, dan.j.williams@intel.com Subject: [PATCH] cxl/memdev: fix deadlock in cxl_memdev_autoremove() on attach failure Date: Tue, 10 Feb 2026 10:43:20 -0500 Message-ID: <20260210154320.1748223-1-gourry@gourry.net> X-Mailer: git-send-email 2.53.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" cxl_memdev_autoremove() takes device_lock(&cxlmd->dev) via guard(device) and then calls cxl_memdev_unregister() when the attach callback was provided but cxl_mem_probe() failed to bind. cxl_memdev_unregister() calls cdev_device_del() device_del() bus_remove_device() device_release_driver() which also takes device_lock(), deadlocking the calling thread. This path is reached when a driver uses the @attach parameter to devm_cxl_add_memdev() and the CXL topology fails to enumerate (e.g. DVSEC range registers decode outside platform-defined CXL ranges, causing the endpoint port probe to fail). Fix by using scoped_guard() and breaking out of the guard scope before calling cxl_memdev_unregister(), so device_lock() is released first. Fixes: 29317f8dc6ed ("cxl/mem: Introduce cxl_memdev_attach for CXL-dependen= t operation") Signed-off-by: Gregory Price --- drivers/cxl/core/memdev.c | 25 ++++++++++++++----------- 1 file changed, 14 insertions(+), 11 deletions(-) diff --git a/drivers/cxl/core/memdev.c b/drivers/cxl/core/memdev.c index af3d0cc65138..c0de767b24fb 100644 --- a/drivers/cxl/core/memdev.c +++ b/drivers/cxl/core/memdev.c @@ -1098,19 +1098,22 @@ static struct cxl_memdev *cxl_memdev_autoremove(str= uct cxl_memdev *cxlmd) * return. Note that failure here could be the result of a race to * teardown the CXL port topology. I.e. cxl_mem_probe() could have * succeeded and then cxl_mem unbound before the lock is acquired. + * + * Check under device_lock but unregister outside of it, as + * cxl_memdev_unregister() will also take the device lock. */ - guard(device)(&cxlmd->dev); - if (cxlmd->attach && !cxlmd->dev.driver) { - cxl_memdev_unregister(cxlmd); - return ERR_PTR(-ENXIO); + scoped_guard(device, &cxlmd->dev) { + if (cxlmd->attach && !cxlmd->dev.driver) + break; + + rc =3D devm_add_action_or_reset(cxlmd->cxlds->dev, + cxl_memdev_unregister, cxlmd); + if (rc) + return ERR_PTR(rc); + return cxlmd; } - - rc =3D devm_add_action_or_reset(cxlmd->cxlds->dev, cxl_memdev_unregister, - cxlmd); - if (rc) - return ERR_PTR(rc); - - return cxlmd; + cxl_memdev_unregister(cxlmd); + return ERR_PTR(-ENXIO); } =20 /* --=20 2.53.0