From nobody Mon Jun 8 06:36:24 2026 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 573AC3FB7D4 for ; Wed, 3 Jun 2026 06:28:08 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780468089; cv=none; b=QwJ9Kc1TdyupT2AMmBxO6sHNoIatDZ1aOINBYoFz0PtyhTP5gWQne7TJhs54F19NQPBP627nIkdqgIPVxp4lD06RuKc5an5fJ/8wumpOr3W+6p2w4euj3PyFS5U3mpOVo1z33GCvbr5c5bOvn+igR8lO4uFhVv6H2hYgieILUHU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780468089; c=relaxed/simple; bh=3eDMgVtf5m+44xpfp35+3P8/MdBU2gsy7d6PnfGDyWs=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=OO/Cq4tdddpZ/sW6itz9QBvpqRd7ybJlALUiodUSMfgZR9sCVIvb/6cMQWBPvx//+IXsWz845L6Tu+Q0o37X2x/oRr9fI+5zuTxl0vItwMzxn/7vuYmDwJiLhyWcXcGokS9Gpaal2QCBA0J6rs5fChaiZFYeDlU4BNch0RAEsIg= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=Tvm2SjJv; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="Tvm2SjJv" Received: from pps.filterd (m0356516.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 652GCjjp3293619; Wed, 3 Jun 2026 06:28:03 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=8+nYoA+x/dvSBguuB iHUHAojnvr48ap391q1RsglkA4=; b=Tvm2SjJv/7UvcCGNIGzeB6yZcwmdy34Tx ZwhkwXp+2KABbifjFaNYATQbNurDSgkl5ajzU0zTJmgTM9TneTj/eF4UiqPe+aiK /ATbkw1DMwey+FkJ6mfKfiLjFDF858ut1QKfeZ/aaJkFo84MfPbNIefns2FyGlT9 NXzR/5hz50rKw0AZtbiowdlxC1uFJW89i6MMh56zkAUuYjYVR7C8q4PceGb/FWi7 ubOuzUu5XcSHmga0e625K37R/KfVXkfOajlodK9vmVqHCGNtHCrsgEZDqgNKReg/ LnsZdOZvIKGu3riBdmtT9+iaQMopYfGjD0w4oLSsQk1gPljRIu84g== Received: from ppma23.wdc07v.mail.ibm.com (5d.69.3da9.ip4.static.sl-reverse.com [169.61.105.93]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4efnahs64n-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 03 Jun 2026 06:28:02 +0000 (GMT) Received: from pps.filterd (ppma23.wdc07v.mail.ibm.com [127.0.0.1]) by ppma23.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 6536OAS7021196; Wed, 3 Jun 2026 06:28:01 GMT Received: from smtprelay01.fra02v.mail.ibm.com ([9.218.2.227]) by ppma23.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4egbqhescm-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 03 Jun 2026 06:28:01 +0000 (GMT) Received: from smtpav02.fra02v.mail.ibm.com (smtpav02.fra02v.mail.ibm.com [10.20.54.101]) by smtprelay01.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 6536Rv4E30278130 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 3 Jun 2026 06:27:57 GMT Received: from smtpav02.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 7BF642004B; Wed, 3 Jun 2026 06:27:57 +0000 (GMT) Received: from smtpav02.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 62AD320040; Wed, 3 Jun 2026 06:27:54 +0000 (GMT) Received: from aboo.ibm.com.com (unknown [9.39.24.39]) by smtpav02.fra02v.mail.ibm.com (Postfix) with ESMTP; Wed, 3 Jun 2026 06:27:54 +0000 (GMT) From: Aboorva Devarajan To: Madhavan Srinivasan , linuxppc-dev@lists.ozlabs.org Cc: Athira Rajeev , Aboorva Devarajan , Christophe Leroy , linux-kernel@vger.kernel.org, Sourabh Jain , Ritesh Harjani , Shrikanth Hegde Subject: [PATCH 1/3] powerpc/perf: fix preempt count underflow in fsl_emb_pmu_del Date: Wed, 3 Jun 2026 11:57:41 +0530 Message-ID: <20260603062743.1152253-2-aboorvad@linux.ibm.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260603062743.1152253-1-aboorvad@linux.ibm.com> References: <20260603062743.1152253-1-aboorvad@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Reinject: loops=2 maxloops=12 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNjAzMDA1NiBTYWx0ZWRfX4c1QArWfljhH o9R9K7dW9Pey/MGA9b+oGdXCI+tuKtbmTAXv8oe0dgw2Gj/lBO6dz2++Wqgo/l0L+zke/q6WgeH /nxmYQq3kPO2A8R5ZorDcKTXnq5Rk+LyRGdGZ6FJD2n4pwruApBYyRNJLoIM2Cd2rdlRfYoJNYk Mt5bz9PFZOP/tH0meTptlyaBExOCxMcMqdKO869z4zqnhFhx4w8GQUdiBzjsP8Lqt5JQGm57bkL 1byzGJYLEPZrHtRS3Or1A0SBqyaQ8XctF5ZqvtBA4ip/qJhV6xg+RhrwaspBtFPwIyKsQQ3oEDp e5DWT8cq+n9mOF8O9F1zuO6e2hTCg0PHBId4NkXyYpUIZ1HIXcX+rNxTPk8Xln628CCCPCqUXdu XXtkpnLJj3clKp6KIcTNCaecHWa6EreaVw7hzgY7sMPu7PrMnrZOg9kOIrJRAMeHG2h2Wz9cmDC 6QFSyc07BWaJlUhgzRQ== X-Proofpoint-ORIG-GUID: xs-p6tdLRBKDoLyAJ8WU9_8v9dRYH4Cc X-Authority-Analysis: v=2.4 cv=cOzQdFeN c=1 sm=1 tr=0 ts=6a1fc972 cx=c_pps a=3Bg1Hr4SwmMryq2xdFQyZA==:117 a=3Bg1Hr4SwmMryq2xdFQyZA==:17 a=FelO9ux0wxsA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=Y2IxJ9c9Rs8Kov3niI8_:22 a=VnNF1IyMAAAA:8 a=-qzNKB2iBSQ2TZesQmUA:9 X-Proofpoint-GUID: pbHtMBC4par7jfvnfN5FHAKH4ZukmdfW X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-06-03_02,2026-05-28_03,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 clxscore=1015 impostorscore=0 lowpriorityscore=0 spamscore=0 bulkscore=0 malwarescore=0 phishscore=0 suspectscore=0 priorityscore=1501 adultscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2605210000 definitions=main-2606030056 Content-Type: text/plain; charset="utf-8" fsl_emb_pmu_del() unconditionally calls put_cpu_var(cpu_hw_events) at the 'out:' label, but only calls the matching get_cpu_var() after the 'i < 0' early-return check. When event->hw.idx is negative the function jumps to 'out:' without having taken get_cpu_var(), and the trailing put_cpu_var() then issues an unmatched preempt_enable(), underflowing preempt_count. On a CONFIG_PREEMPT=3Dy kernel preempt_count would underflow and eventually present as a 'scheduling while atomic' BUG. Move put_cpu_var() to pair with get_cpu_var() so the percpu access is correctly bracketed and the 'out:' label only handles perf_pmu_enable. Fixes: a11106544f33 ("powerpc/perf: e500 support") Reviewed-by: Shrikanth Hegde Signed-off-by: Aboorva Devarajan --- arch/powerpc/perf/core-fsl-emb.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/arch/powerpc/perf/core-fsl-emb.c b/arch/powerpc/perf/core-fsl-= emb.c index 7120ab20cbfe..02b5dd74c187 100644 --- a/arch/powerpc/perf/core-fsl-emb.c +++ b/arch/powerpc/perf/core-fsl-emb.c @@ -366,9 +366,10 @@ static void fsl_emb_pmu_del(struct perf_event *event, = int flags) =20 cpuhw->n_events--; =20 + put_cpu_var(cpu_hw_events); + out: perf_pmu_enable(event->pmu); - put_cpu_var(cpu_hw_events); } =20 static void fsl_emb_pmu_start(struct perf_event *event, int ef_flags) --=20 2.54.0 From nobody Mon Jun 8 06:36:24 2026 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7BDD53FB7FC for ; Wed, 3 Jun 2026 06:28:10 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780468091; cv=none; b=PTEgKmoINL8oQDNdOmAhx3Vz4c5d9eIbqSn55GbjIF24BmXk3jDcoUn3mXQxC9t4oZI4643oGM2GlhdvMOj7QKqO4GveE49Yei6+AiFcu2AO5Jd4PaGma+DEzevOs5gJ/04Ss4O5N145VVMrtBXCP8tiGjWOaGCYD0KSno/HTeI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780468091; c=relaxed/simple; bh=rXfNO9D/CycBrgOIAU+Vj4VPPg+2hHbzpjvWME8Uwpk=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=ALwo5cxSXg415G9D4cBAlZY/NJu4BJcFXZFqny29n3ypBs6bCzRJLkqA1LwvoBmxwFah22I7ubaROP2vezYmFf38fOoajPThycVz8zblCfMlZaVCCaRnjusKHty9IfgLtPmU6IzT5oN/FN76/w+9+UJccEvpQCjKcFlME1dZ6yI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=l4KG3PwA; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="l4KG3PwA" Received: from pps.filterd (m0353729.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 6532nbTL1611171; Wed, 3 Jun 2026 06:28:06 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=ePLCEtt8hffEw8/Pq AMEo4hqUVnY6UPKSRDXJzbbNxY=; b=l4KG3PwAA9yZ0UBRQCZlxyEDLpjYxQJ+w 5Vno5RcmLM/E+LPXCjc1s4P+gETybvY2WjvhXyiCfuBR8agcwNoyqRqrd0ngstfW b/Bwc1Iu3FuQt+srxHW5zTVRiziGwIPKPdpy+BM7pmugcuuktUAwmNTJJLYElTx9 IOaBqT/TtyUELPT3/9hH3bXpvUmK6xvnIroVos3Ts203j5y8BL3y3Skd0Nzn4tvy hB+nh06kMg3/hkVgEarUB/9WYRYUFpHSGB4q+nw4D06bYYlAmLqIBJlQihyzMn+d 57sA6Ip8jtuNZN8VoOImMRXvIMofiFltE9foG22Y6I7hJfAwhYT1w== Received: from ppma13.dal12v.mail.ibm.com (dd.9e.1632.ip4.static.sl-reverse.com [50.22.158.221]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4efqjq9f9j-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 03 Jun 2026 06:28:05 +0000 (GMT) Received: from pps.filterd (ppma13.dal12v.mail.ibm.com [127.0.0.1]) by ppma13.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 6536OII7006341; Wed, 3 Jun 2026 06:28:04 GMT Received: from smtprelay05.fra02v.mail.ibm.com ([9.218.2.225]) by ppma13.dal12v.mail.ibm.com (PPS) with ESMTPS id 4egcegpm8n-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 03 Jun 2026 06:28:04 +0000 (GMT) Received: from smtpav02.fra02v.mail.ibm.com (smtpav02.fra02v.mail.ibm.com [10.20.54.101]) by smtprelay05.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 6536S1DP48234792 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 3 Jun 2026 06:28:01 GMT Received: from smtpav02.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 4388420043; Wed, 3 Jun 2026 06:28:01 +0000 (GMT) Received: from smtpav02.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id EBF7220040; Wed, 3 Jun 2026 06:27:57 +0000 (GMT) Received: from aboo.ibm.com.com (unknown [9.39.24.39]) by smtpav02.fra02v.mail.ibm.com (Postfix) with ESMTP; Wed, 3 Jun 2026 06:27:57 +0000 (GMT) From: Aboorva Devarajan To: Madhavan Srinivasan , linuxppc-dev@lists.ozlabs.org Cc: Athira Rajeev , Aboorva Devarajan , Christophe Leroy , linux-kernel@vger.kernel.org, Sourabh Jain , Ritesh Harjani , Shrikanth Hegde Subject: [PATCH 2/3] powerpc/powernv: fix preempt count leak in pnv_kexec_wait_secondaries_down Date: Wed, 3 Jun 2026 11:57:42 +0530 Message-ID: <20260603062743.1152253-3-aboorvad@linux.ibm.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260603062743.1152253-1-aboorvad@linux.ibm.com> References: <20260603062743.1152253-1-aboorvad@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Reinject: loops=2 maxloops=12 X-Proofpoint-ORIG-GUID: uzqumJyjx6DjWfJ_Tpia6bzWjfJ3DUlu X-Proofpoint-GUID: oB9ux16OQR66vHl4aa3r_uP1VSwNlxfM X-Authority-Analysis: v=2.4 cv=bcVbluPB c=1 sm=1 tr=0 ts=6a1fc976 cx=c_pps a=AfN7/Ok6k8XGzOShvHwTGQ==:117 a=AfN7/Ok6k8XGzOShvHwTGQ==:17 a=FelO9ux0wxsA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=uAbxVGIbfxUO_5tXvNgY:22 a=VnNF1IyMAAAA:8 a=AoYj4kKG8rnORiwU5IoA:9 a=O8hF6Hzn-FEA:10 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNjAzMDA1NiBTYWx0ZWRfX2mQdY2N2hD8j Wj7gYDCsuDGXNqNkmvkLih6OOw60WzsqC4TfHasNs7MCTXRCx4psSxERDQFcJLogSqfqoZPY/7s L7FIBzmsqFcUqijmx3hPEPUUAqTmxyvTLZaGJ+GgtYr0ZYNaU6F0eVS04GdHxP/YoPb2uUnSvdz wRUPdvN50NSJTxDsVZwIz9NRkMLRiW0EET3JJMsTX9bEem176Dwy+cxNnsaC2amF8b9SoXyLti5 F6s79znHqImWkdnVj5Oe72PTYdxZZtR0iZ/RQXlAbsUMEMMAiO9NV+kBQubqxIDPUYq2NIfco7m TqdN5b9E9BH1wOLzqw/GS+hvJvIiPP1x8I1SrrBl2THPGHmawsV1k5ycp8CWlUB9zf/mjlk/WsD nMRPXqoNV5x28z2X79UfWHKLt7+d+JXpcPbz8LZ3DhwQTnZztkXEaJU0wpzAY1pKTYFT62z5O86 eUonrD+tOqxQFDZwniA== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-06-03_02,2026-05-28_03,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 impostorscore=0 clxscore=1015 adultscore=0 priorityscore=1501 phishscore=0 lowpriorityscore=0 bulkscore=0 malwarescore=0 spamscore=0 suspectscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2605210000 definitions=main-2606030056 Content-Type: text/plain; charset="utf-8" pnv_kexec_wait_secondaries_down() calls get_cpu() to obtain the current CPU id but never calls the matching put_cpu(), leaking one preempt_disable() nesting level on every invocation. In practice the imbalance does not trigger a visible splat because the kexec teardown path is a one-way trip: IRQs are already disabled, no schedule() occurs after the leak, and default_machine_kexec() overwrites preempt_count with HARDIRQ_OFFSET before jumping into kexec_sequence() which never returns. However the bookkeeping is still wrong. The function only needs the current CPU id, and this path runs with the CPU pinned and IRQs disabled, so the preempt_disable() side-effect of get_cpu() is unnecessary. Replace it with smp_processor_id(), which returns the CPU id without touching preempt_count. Fixes: 298b34d7d578 ("powerpc/powernv: Fix kexec races going back to OPAL") Signed-off-by: Aboorva Devarajan --- arch/powerpc/platforms/powernv/setup.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/powerpc/platforms/powernv/setup.c b/arch/powerpc/platform= s/powernv/setup.c index 4dbb47ddbdcc..73193264cbe7 100644 --- a/arch/powerpc/platforms/powernv/setup.c +++ b/arch/powerpc/platforms/powernv/setup.c @@ -396,7 +396,7 @@ static void pnv_kexec_wait_secondaries_down(void) { int my_cpu, i, notified =3D -1; =20 - my_cpu =3D get_cpu(); + my_cpu =3D smp_processor_id(); =20 for_each_online_cpu(i) { uint8_t status; --=20 2.54.0 From nobody Mon Jun 8 06:36:24 2026 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6EA643FB7E9 for ; Wed, 3 Jun 2026 06:28:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780468097; cv=none; b=UgbFQAY1i6H4v/PUnHQRfDGMGSW4+j5qzVEdemLxleVaZ8t+1ek1LVTfSu/A9QkEHzpL3JFNDH+D6usrfIOgqbNnnesF/Z0RGZmkC1ixykmSJloyWMQ9Bjbsw+T4xvhOscAPE/4Z3GqpYTwjttoh6O/o8etR9PPY25pk6GOkMGs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780468097; c=relaxed/simple; bh=oSTktYrRGQfv39mDkMJq3d/GX3+v+u/9qpC+OHruh10=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=CihzomH/g1cRsCpPVHn2CzHs2oclcJq84IwGy1ur8dORfkUG6zdmuJpl1rKJj2I3kDpHHVV3v7lJkMTrH8xQz3Q4KI6dEr/K2Xpe1/LNLSKooJI3zNeIQ+KRPk15JwDg614s1BqH5LXKaP6bxm5YGIAXOhJb3g79AzcJyRmFAEU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=FGxCSZuZ; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="FGxCSZuZ" Received: from pps.filterd (m0353729.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 653669BW2897645; Wed, 3 Jun 2026 06:28:10 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=5RuyxDjFPIpjwknUP XiV6WeC/V+p6pLbpxglLwF1LmU=; b=FGxCSZuZhEGWpFGdLnc/owU60pU/5LiLL LONOZF7LToiDaQsxs7ENuj24iF2GROGc9HWUrq+6eCfiFmXIzKvrZiW1ErGpnUdm 7nQoXTNrFoGfG98Y+CUDTeUrLp5Z/M/yGsiy6PPR0cEe7qyEEq9wFnSJqfT40fob D2t0HxVew2t4PMCy+51Wh685y/EuTNHdpLtXlRPtURyKoB9IjhOl4AtH7cUfeWJe 1MVzjoDrDMur1H6gBRChUCod3t8+wMSR9uBwIzo5SwP6ZHSOK8LSEBmGWFKvDNZN gsyMXyKpfwrDiXFhIa6NNneh6WW1/uT1C4U5Lh15xZX76mJUeBgBg== Received: from ppma22.wdc07v.mail.ibm.com (5c.69.3da9.ip4.static.sl-reverse.com [169.61.105.92]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4efqjq9f9w-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 03 Jun 2026 06:28:10 +0000 (GMT) Received: from pps.filterd (ppma22.wdc07v.mail.ibm.com [127.0.0.1]) by ppma22.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 6536Oadj022721; Wed, 3 Jun 2026 06:28:09 GMT Received: from smtprelay03.fra02v.mail.ibm.com ([9.218.2.224]) by ppma22.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4egakvy04k-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 03 Jun 2026 06:28:09 +0000 (GMT) Received: from smtpav02.fra02v.mail.ibm.com (smtpav02.fra02v.mail.ibm.com [10.20.54.101]) by smtprelay03.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 6536S5gb50987502 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 3 Jun 2026 06:28:05 GMT Received: from smtpav02.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 224CB20043; Wed, 3 Jun 2026 06:28:05 +0000 (GMT) Received: from smtpav02.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id DDB3220040; Wed, 3 Jun 2026 06:28:01 +0000 (GMT) Received: from aboo.ibm.com.com (unknown [9.39.24.39]) by smtpav02.fra02v.mail.ibm.com (Postfix) with ESMTP; Wed, 3 Jun 2026 06:28:01 +0000 (GMT) From: Aboorva Devarajan To: Madhavan Srinivasan , linuxppc-dev@lists.ozlabs.org Cc: Athira Rajeev , Aboorva Devarajan , Christophe Leroy , linux-kernel@vger.kernel.org, Sourabh Jain , Ritesh Harjani , Shrikanth Hegde Subject: [PATCH 3/3] powerpc/kexec: fix double get_cpu() imbalance in kexec_prepare_cpus Date: Wed, 3 Jun 2026 11:57:43 +0530 Message-ID: <20260603062743.1152253-4-aboorvad@linux.ibm.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260603062743.1152253-1-aboorvad@linux.ibm.com> References: <20260603062743.1152253-1-aboorvad@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Reinject: loops=2 maxloops=12 X-Proofpoint-ORIG-GUID: yUIY4cDnkKZJp1H322_jgn677HP3tL2k X-Proofpoint-GUID: u7iXvpUrp6lWhCOYoS685Vm5LWcDY0du X-Authority-Analysis: v=2.4 cv=bcVbluPB c=1 sm=1 tr=0 ts=6a1fc97a cx=c_pps a=5BHTudwdYE3Te8bg5FgnPg==:117 a=5BHTudwdYE3Te8bg5FgnPg==:17 a=FelO9ux0wxsA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=uAbxVGIbfxUO_5tXvNgY:22 a=VnNF1IyMAAAA:8 a=NZuQ31_9CfGeVvh8xa4A:9 a=O8hF6Hzn-FEA:10 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNjAzMDA1NiBTYWx0ZWRfXysn2RhiqjE8Y TzpEo4UPiNtYXhYBF2pXXLCho1VY2q5T8wKSi+iazq5fq1fQq3rmoPtIMZgiWV9ltGd7UPhe/wi YXqxSvk0s41cfCDGTdU3aW8xV38oQ6bGR+GyDPwQ3zvaOOPRF6nxChXH/awc3rlryGu+nKArY0S 5eqFYaurM/LNmJ24HGrcYS5N3zIaNkSAkS03eHdYDNFA4rocy/LgPwR31gwQwEeYLRISusc157V gl2pEg1YvWJfJB8ELREl9uTQYS6VigK0wv3iE9WDj7YTccT9MCkZ/8stybQsAq9Y6klLedzxGfv H9w6ZlqCkajilGLFT4yMCYbRuq8ZPV0+vH418p7oSLWMWHwa5jfR+q/Pw8bSJxobJf20urKWTk9 TiKAqNVGz7g6lQzmDNP5XADIrjj4eDj5LTr8AhOWDuv2puIPZqqkiJDC1ViZ3M7gyAZSzXoQU05 Jx7zER+aHgwy6s28aBA== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-06-03_02,2026-05-28_03,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 impostorscore=0 clxscore=1015 adultscore=0 priorityscore=1501 phishscore=0 lowpriorityscore=0 bulkscore=0 malwarescore=0 spamscore=0 suspectscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2605210000 definitions=main-2606030056 Content-Type: text/plain; charset="utf-8" kexec_prepare_cpus_wait() calls get_cpu() internally to obtain the current CPU id. kexec_prepare_cpus() calls kexec_prepare_cpus_wait() twice -- once for KEXEC_STATE_IRQS_OFF and once for KEXEC_STATE_REAL_MODE -- but only issues a single put_cpu() at the end, leaving preempt_count elevated by one extra nesting level. In practice the imbalance does not trigger a 'scheduling while atomic' splat because the kexec path is a one-way trip: IRQs are already disabled, no schedule() occurs after the leak, and default_machine_kexec() overwrites preempt_count with HARDIRQ_OFFSET before jumping into kexec_sequence() which never returns. However the bookkeeping is still wrong. kexec_prepare_cpus() calls local_irq_disable()/hard_irq_disable() before invoking kexec_prepare_cpus_wait(), so the CPU is already pinned and the get_cpu()/put_cpu() preempt_disable() bracketing is unnecessary. Only the current CPU id is needed, so replace get_cpu() with smp_processor_id() and drop the now-unneeded put_cpu(). Fixes: 1fc711f7ffb0 ("powerpc/kexec: Fix race in kexec shutdown") Signed-off-by: Aboorva Devarajan --- arch/powerpc/kexec/core_64.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/arch/powerpc/kexec/core_64.c b/arch/powerpc/kexec/core_64.c index 825ab8a88f18..d7bdc362d497 100644 --- a/arch/powerpc/kexec/core_64.c +++ b/arch/powerpc/kexec/core_64.c @@ -169,7 +169,7 @@ static void kexec_prepare_cpus_wait(int wait_state) int my_cpu, i, notified=3D-1; =20 hw_breakpoint_disable(); - my_cpu =3D get_cpu(); + my_cpu =3D smp_processor_id(); /* Make sure each CPU has at least made it to the state we need. * * FIXME: There is a (slim) chance of a problem if not all of the CPUs @@ -267,8 +267,6 @@ static void kexec_prepare_cpus(void) /* after we tell the others to go down */ if (ppc_md.kexec_cpu_down) ppc_md.kexec_cpu_down(0, 0); - - put_cpu(); } =20 #else /* ! SMP */ --=20 2.54.0