From nobody Mon Jun 8 07:22:55 2026 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 354BC3C73D9 for ; Fri, 5 Jun 2026 08:29:33 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780648175; cv=none; b=C3JGMkWWGvdw6iAlgjVG68ph2nrHFi1Qyams19D6OUs1e2fJLmvMaGgIElZTiCGnb+6z+O/80d2sxyJLhyRay4v6Dc7JpTYJ6lBiaK1zx+mODAWicuGjeW8tzoCeQ4193xGZPSb8/ZSdUQ6C/v0E/Ji7oNSLdwAETahb8CWw+i8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780648175; c=relaxed/simple; bh=3eDMgVtf5m+44xpfp35+3P8/MdBU2gsy7d6PnfGDyWs=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=N2GrQfcF0bFPShSPhmb+5G3iVfR6U34Y+6FEvHUf6tA/Na4eWGn6Tql0STZjAET4JkJ+E5TOkPTBhm+N5g9Ohr46OOIiq6wFMpu8KSSYkLjHPHWQGICDkKnNfOLNLfSn8a2aXyyFoi3HRetYhXQFLXvrZdphor0Htz3Cqz2yKRk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=fcDLrfAW; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="fcDLrfAW" Received: from pps.filterd (m0353729.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 6551QDbb2481076; Fri, 5 Jun 2026 08:29:29 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=8+nYoA+x/dvSBguuB iHUHAojnvr48ap391q1RsglkA4=; b=fcDLrfAWncaGL26q8vD1YQzOySsTmtfu3 ONAPwXTKrbWQ1B3NkR9XPfDl/aSSxdbb0efTAbbzpdm9suJyz4DuTQOjdvsoFqNo ZYwdkQ2BmTB3XHOTipkTegMd8u2HWhmWsab13OKPqHkLkuOVFU9rWVYNlm60ooee 3JejS+IM7S7BLeOp54ddjHYaJipVasa8HZQsD2EiC+3gK5UptabKTZm3VuASBEoS jBo70LtUWRm0bhaFFBI9f0LUa6wFw7q83Z4zxZu5nkhynd1Jqowqzx266nsAo9Bz ER5aXrqhYBV8s5mtX+8sQc5vicsT19zDh3HGYYcZMiYXfXwqTM8BA== Received: from ppma21.wdc07v.mail.ibm.com (5b.69.3da9.ip4.static.sl-reverse.com [169.61.105.91]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4efqjqkgyx-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 05 Jun 2026 08:29:29 +0000 (GMT) Received: from pps.filterd (ppma21.wdc07v.mail.ibm.com [127.0.0.1]) by ppma21.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 6558OHAA001863; Fri, 5 Jun 2026 08:29:28 GMT Received: from smtprelay04.fra02v.mail.ibm.com ([9.218.2.228]) by ppma21.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4egb7kgvhq-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 05 Jun 2026 08:29:27 +0000 (GMT) Received: from smtpav05.fra02v.mail.ibm.com (smtpav05.fra02v.mail.ibm.com [10.20.54.104]) by smtprelay04.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 6558TOfk31261190 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 5 Jun 2026 08:29:24 GMT Received: from smtpav05.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 039382004D; Fri, 5 Jun 2026 08:29:24 +0000 (GMT) Received: from smtpav05.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id A068020040; Fri, 5 Jun 2026 08:29:21 +0000 (GMT) Received: from aboo.bl1-in.ibm.com (unknown [9.123.14.187]) by smtpav05.fra02v.mail.ibm.com (Postfix) with ESMTP; Fri, 5 Jun 2026 08:29:21 +0000 (GMT) From: Aboorva Devarajan To: Madhavan Srinivasan , linuxppc-dev@lists.ozlabs.org Cc: Athira Rajeev , Aboorva Devarajan , Christophe Leroy , linux-kernel@vger.kernel.org, Sourabh Jain , Ritesh Harjani , Shrikanth Hegde Subject: [PATCH v3 1/3] powerpc/perf: fix preempt count underflow in fsl_emb_pmu_del Date: Fri, 5 Jun 2026 13:59:10 +0530 Message-ID: <20260605082912.305100-2-aboorvad@linux.ibm.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260605082912.305100-1-aboorvad@linux.ibm.com> References: <20260605082912.305100-1-aboorvad@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Reinject: loops=2 maxloops=12 X-Proofpoint-ORIG-GUID: QhuRXniilY9g37LaWRLncqNVFvaFfz-S X-Proofpoint-GUID: Cxst93E8hevUwdl3z3Z0r8g8nkqmtq-p X-Authority-Analysis: v=2.4 cv=bcVbluPB c=1 sm=1 tr=0 ts=6a2288e9 cx=c_pps a=GFwsV6G8L6GxiO2Y/PsHdQ==:117 a=GFwsV6G8L6GxiO2Y/PsHdQ==:17 a=FelO9ux0wxsA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=uAbxVGIbfxUO_5tXvNgY:22 a=VnNF1IyMAAAA:8 a=-qzNKB2iBSQ2TZesQmUA:9 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNjA1MDA3NyBTYWx0ZWRfX8T3xz0xqONHA Y+D3/ur3bcWcXvoINChZj5Jgec1gfiG4bOqR+gsO/sxqOcwgylh1PRNqMmrTxJWs4SUaej0MXIS 0VLUMmOVyOSCRP9R65n1oYl4UHr2GaVWFzSUpcDz/Cp0QbAfkTEYGADbx/VidgQWyQio5lG778f /2qVCedsNMZ3eDNZzOTyq3JsbJxm4pbBImvHVDylBVhpd6Zu3U/ijLuMjk/PelKE6fdwFEzYCOG TkIaKPNoFUfInHGm2d5esimObcgd37Hvrj5GlKlYC9YWYTE2WzAE7kuiNSgzCr2HPmBuEGv37A7 Bvq32WH911K5rTbPKXKOIxO8H+LHuyzbiaZxLty0SxUI8C0q2p9KuRVh7qTwgLFJyhUkkRaE21g 5gQB2yzdI66uU1i/pPzAfHw1MKECuCT4HBpBX+VcbZb/t308tjzfEu7mSLvLrD6sFzQ3a07WRRK /hkKC0IhSD+50LIT4lA== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-06-05_01,2026-05-28_03,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 impostorscore=0 clxscore=1015 adultscore=0 priorityscore=1501 phishscore=0 lowpriorityscore=0 bulkscore=0 malwarescore=0 spamscore=0 suspectscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2605210000 definitions=main-2606050077 Content-Type: text/plain; charset="utf-8" fsl_emb_pmu_del() unconditionally calls put_cpu_var(cpu_hw_events) at the 'out:' label, but only calls the matching get_cpu_var() after the 'i < 0' early-return check. When event->hw.idx is negative the function jumps to 'out:' without having taken get_cpu_var(), and the trailing put_cpu_var() then issues an unmatched preempt_enable(), underflowing preempt_count. On a CONFIG_PREEMPT=3Dy kernel preempt_count would underflow and eventually present as a 'scheduling while atomic' BUG. Move put_cpu_var() to pair with get_cpu_var() so the percpu access is correctly bracketed and the 'out:' label only handles perf_pmu_enable. Fixes: a11106544f33 ("powerpc/perf: e500 support") Reviewed-by: Shrikanth Hegde Signed-off-by: Aboorva Devarajan --- arch/powerpc/perf/core-fsl-emb.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/arch/powerpc/perf/core-fsl-emb.c b/arch/powerpc/perf/core-fsl-= emb.c index 7120ab20cbfe..02b5dd74c187 100644 --- a/arch/powerpc/perf/core-fsl-emb.c +++ b/arch/powerpc/perf/core-fsl-emb.c @@ -366,9 +366,10 @@ static void fsl_emb_pmu_del(struct perf_event *event, = int flags) =20 cpuhw->n_events--; =20 + put_cpu_var(cpu_hw_events); + out: perf_pmu_enable(event->pmu); - put_cpu_var(cpu_hw_events); } =20 static void fsl_emb_pmu_start(struct perf_event *event, int ef_flags) --=20 2.54.0 From nobody Mon Jun 8 07:22:55 2026 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5883F3CEB8E for ; Fri, 5 Jun 2026 08:29:37 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780648178; cv=none; b=RFe/dTZek0ayMKXt2XjJnKtuIYYeqe078+zLvTRPb/C8qv3JKiemC6tbFemD1+ipJx2Y2OgFABqBZWiV/gvjg5dSvy/JKEh5erQHJN7VjfnbDkKNZnfHbeef8JSujdK/pMiutKrM0lweMHqqoKK+dSBzORQQ8986LqeBVojDkJQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780648178; c=relaxed/simple; bh=JpB68VfK3UPX8nA7fsvEwKHkLroC5VBg3i3YA1KLY0E=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=KIFfowT9j/Zr88J87Qfb30lOjQASJsXGzxj3R7Ir3CjOtFej22UM9TuYHuXDKuflsUs7X+bNXsCKYA1sSyIBpOdAsGYOoCHLILlYnAc2YH1YaAYwc2wVS+ARqVUkz3WWmZtyNt5UBQP6i9Bgi0cdrprYdYPsuXM1/W0qPYOOr4U= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=j3lncAU+; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="j3lncAU+" Received: from pps.filterd (m0353725.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 6552AEKf3001044; Fri, 5 Jun 2026 08:29:31 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=EoIE6maGdMubNM2Su vofqxTH6KEp7HPXcmO3bqAAjnE=; b=j3lncAU+qTYQ6bdC+vf3K5EBsgKWjETX8 7y3nVKQpLIQlD5eVaZoeQ43EZQY899QF5SDnVCsPUJHwTUS8AfQyTuINoVfMTI1q tMLEUFx9yzAyFLfBpj7Z8Fe6m99SmrMxxR+XiQpxDs1g0shjlDHbi7PNUW3emqym eV+6wUjBDRe1WIBTmpApbAcZMH0DOzoyZc79/NL6/0zyCqNcBK3jn96icf6RmuEw 2jtUZb6mW0t3hyHDircpLbq8Dsu67kKNDOqvPDSnqMvjBmur25Zqz1c3UGGJinud ZvMMKLwV+O0l00TM6KmftAIMITLfvFegviwjzFojbK4qBmBqFKUEg== Received: from ppma21.wdc07v.mail.ibm.com (5b.69.3da9.ip4.static.sl-reverse.com [169.61.105.91]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4efpaejx1v-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 05 Jun 2026 08:29:31 +0000 (GMT) Received: from pps.filterd (ppma21.wdc07v.mail.ibm.com [127.0.0.1]) by ppma21.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 6558O7FW001814; Fri, 5 Jun 2026 08:29:30 GMT Received: from smtprelay06.fra02v.mail.ibm.com ([9.218.2.230]) by ppma21.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4egb7kgvhs-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 05 Jun 2026 08:29:30 +0000 (GMT) Received: from smtpav05.fra02v.mail.ibm.com (smtpav05.fra02v.mail.ibm.com [10.20.54.104]) by smtprelay06.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 6558TQX916187806 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 5 Jun 2026 08:29:26 GMT Received: from smtpav05.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 8E8892004B; Fri, 5 Jun 2026 08:29:26 +0000 (GMT) Received: from smtpav05.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 675B020043; Fri, 5 Jun 2026 08:29:24 +0000 (GMT) Received: from aboo.bl1-in.ibm.com (unknown [9.123.14.187]) by smtpav05.fra02v.mail.ibm.com (Postfix) with ESMTP; Fri, 5 Jun 2026 08:29:24 +0000 (GMT) From: Aboorva Devarajan To: Madhavan Srinivasan , linuxppc-dev@lists.ozlabs.org Cc: Athira Rajeev , Aboorva Devarajan , Christophe Leroy , linux-kernel@vger.kernel.org, Sourabh Jain , Ritesh Harjani , Shrikanth Hegde Subject: [PATCH v3 2/3] powerpc/powernv: fix preempt count leak in pnv_kexec_wait_secondaries_down Date: Fri, 5 Jun 2026 13:59:11 +0530 Message-ID: <20260605082912.305100-3-aboorvad@linux.ibm.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260605082912.305100-1-aboorvad@linux.ibm.com> References: <20260605082912.305100-1-aboorvad@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Reinject: loops=2 maxloops=12 X-Authority-Analysis: v=2.4 cv=Zt3d7d7G c=1 sm=1 tr=0 ts=6a2288eb cx=c_pps a=GFwsV6G8L6GxiO2Y/PsHdQ==:117 a=GFwsV6G8L6GxiO2Y/PsHdQ==:17 a=FelO9ux0wxsA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=V8glGbnc2Ofi9Qvn3v5h:22 a=VnNF1IyMAAAA:8 a=AoYj4kKG8rnORiwU5IoA:9 a=O8hF6Hzn-FEA:10 X-Proofpoint-GUID: VpH3c-xPy_6aYD4ZIjGk7A6ni7zYgXT4 X-Proofpoint-ORIG-GUID: EozKhGVZmtqGjHeclEM33J4FWo044RUM X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNjA1MDA3NyBTYWx0ZWRfX4F2GNhY+XJDh y3wUuG17OrdtBBqCJIEjKw0rq7D1psgXgucV3jzSz5bGXk55mYKQv9rU/Wdvsqg3ddBjhKDJVg3 zOl8RMuHHU21fbhtyK0IGndAGOECtKXCStaAZucq5VpXy79dxZIJJTeXO3sd39h+YI5spF2JYtT W5PgQliaQWLDc+oi0OjwDWTLGOlBnMJFwbFB55OQ8hlAvQAI26kGLRGkPPEEe3A3AO3WS6frNhE soS4DQe1Cnp+JY0rqXxXgRqAy+p8y8LVdSaiozblMNVr6PozxDgKFbhz5hB6YUEnJOjJtWlAGQB JCws1FYAR8uNiYUG3ju56BcptCAi+DQFcTiUEKHA/UDUYFehLmAjUFsHGjmkGiGFIyEF4lE7+zg 0BD1WLAeLWv/9j+dxkUhlyYSvNPdLAxcTj/wzv3YTsWPQbpGV2JLNnvCukzS9aaCsSOhdA2WOxz 9eVuJFP8WxfEDmECJgQ== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-06-05_01,2026-05-28_03,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 impostorscore=0 suspectscore=0 priorityscore=1501 bulkscore=0 clxscore=1015 phishscore=0 spamscore=0 malwarescore=0 adultscore=0 lowpriorityscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2605210000 definitions=main-2606050077 Content-Type: text/plain; charset="utf-8" pnv_kexec_wait_secondaries_down() calls get_cpu() to obtain the current CPU id but never calls the matching put_cpu(), leaking one preempt_disable() nesting level on every invocation. In practice the imbalance does not trigger a visible splat because the kexec teardown path is a one-way trip: IRQs are already disabled, no schedule() occurs after the leak, and default_machine_kexec() overwrites preempt_count with HARDIRQ_OFFSET before jumping into kexec_sequence() which never returns. However the bookkeeping is still wrong. The function only needs the current CPU id, and this path runs with interrupts disabled and the CPU pinned, so the preempt_disable() side-effect of get_cpu() is unnecessary. Replace it with raw_smp_processor_id(). Fixes: 298b34d7d578 ("powerpc/powernv: Fix kexec races going back to OPAL") Signed-off-by: Aboorva Devarajan --- arch/powerpc/platforms/powernv/setup.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/arch/powerpc/platforms/powernv/setup.c b/arch/powerpc/platform= s/powernv/setup.c index 4dbb47ddbdcc..06ed5e2aa265 100644 --- a/arch/powerpc/platforms/powernv/setup.c +++ b/arch/powerpc/platforms/powernv/setup.c @@ -396,7 +396,8 @@ static void pnv_kexec_wait_secondaries_down(void) { int my_cpu, i, notified =3D -1; =20 - my_cpu =3D get_cpu(); + /* Called with interrupts disabled, so the CPU is pinned. */ + my_cpu =3D raw_smp_processor_id(); =20 for_each_online_cpu(i) { uint8_t status; --=20 2.54.0 From nobody Mon Jun 8 07:22:55 2026 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0EF093D301A for ; Fri, 5 Jun 2026 08:29:37 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780648179; cv=none; b=Jn5PxyUcipP9823P44zPjuJ+5pqUieLeo+QKB9K8HG7GEMjiHdBNjWEsru13CTCY60+4O2wsmnpjYVYVCuc0akiYIoiPQ34WC41dObWvlmjeMQcvZ4rzwvtNGQFtA9A8Gd+GrV12BSL7KNT2eFOY1t2fHUzHPyF1sK4FM9AJzZU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780648179; c=relaxed/simple; bh=we7T0hLRGdd5MHq07765FbauqvE+M1+W3I7m21RVe4I=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=adSdM3AQxWkJA3+2lEe2I4Gj/bjQitFnT9oecbnIR3P44RRUsMUChyp1BEeC3SLpQj6yDbMtGA3T9LIROUFoODvpTshrx/6keKkQcYb5MWnbBJZcpJ7W1fvMyo+qsi1T39kAn+DaPJrUaaYjvOcOu5wfmgsdmDHTLq5lTdtkYSA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=BVqg3OqM; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="BVqg3OqM" Received: from pps.filterd (m0360083.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 654NXin61360394; Fri, 5 Jun 2026 08:29:34 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=d4hXaYe94B9/FFJ57 4qBSPONlF6wJ/38U7rXh2orgCc=; b=BVqg3OqMKLWc46N6uwNgY0Y2f6XenAdL8 lECsKRRR0nVm7mBMxvfrFmlkErJznhue75DQW7TM2kGvEXjmyxdU8k/UIGJa/e8X vMHokT+9r//MEGemhC5QGof1EaB2TTvb1lUZATKthV6R4liDOrnUaPf4MXRGUDQ/ 0splPNK68D/YHx5UyJ3EVzhG7HoKWPPPBaZDpTyZZFDttRg658ZtADL+UH9YYD4T iJgE36yZqZ4Xc2NVZrNTmUpMJxFTYikkwb4VClEEyA48eMMxJi/VjaZmXxF9NyHO T0qNj9yFGooZrmVa6J9DKTBPqzlZjlVbCp932Ueq7qem0OWEBe4TQ== Received: from ppma12.dal12v.mail.ibm.com (dc.9e.1632.ip4.static.sl-reverse.com [50.22.158.220]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4efqd4knen-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 05 Jun 2026 08:29:33 +0000 (GMT) Received: from pps.filterd (ppma12.dal12v.mail.ibm.com [127.0.0.1]) by ppma12.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 6558O7YO023761; Fri, 5 Jun 2026 08:29:32 GMT Received: from smtprelay01.fra02v.mail.ibm.com ([9.218.2.227]) by ppma12.dal12v.mail.ibm.com (PPS) with ESMTPS id 4ega7qs13b-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 05 Jun 2026 08:29:32 +0000 (GMT) Received: from smtpav05.fra02v.mail.ibm.com (smtpav05.fra02v.mail.ibm.com [10.20.54.104]) by smtprelay01.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 6558TTev61538658 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 5 Jun 2026 08:29:29 GMT Received: from smtpav05.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 21AF620040; Fri, 5 Jun 2026 08:29:29 +0000 (GMT) Received: from smtpav05.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id F03F120043; Fri, 5 Jun 2026 08:29:26 +0000 (GMT) Received: from aboo.bl1-in.ibm.com (unknown [9.123.14.187]) by smtpav05.fra02v.mail.ibm.com (Postfix) with ESMTP; Fri, 5 Jun 2026 08:29:26 +0000 (GMT) From: Aboorva Devarajan To: Madhavan Srinivasan , linuxppc-dev@lists.ozlabs.org Cc: Athira Rajeev , Aboorva Devarajan , Christophe Leroy , linux-kernel@vger.kernel.org, Sourabh Jain , Ritesh Harjani , Shrikanth Hegde Subject: [PATCH v3 3/3] powerpc/kexec: fix double get_cpu() imbalance in kexec_prepare_cpus Date: Fri, 5 Jun 2026 13:59:12 +0530 Message-ID: <20260605082912.305100-4-aboorvad@linux.ibm.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260605082912.305100-1-aboorvad@linux.ibm.com> References: <20260605082912.305100-1-aboorvad@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Reinject: loops=2 maxloops=12 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNjA1MDA3NyBTYWx0ZWRfX+YM7nanr4TyV tzqeKrKloUK6CerzETUZ6bRoRj3KjbpIkgxd2lZocgAQPYM8BOdDMInKqL4VFZ4ufYzoYkw+QfR WeTZXnH0CUr+P0nz74Fee4gqddW5up7KOSBgd2tQTMDtTwYGOIjRD9N/fG29/9v3f8A3OACDuCm aRU0qSpg4yGZVrJ/pYJSKHrFujlMHoTP35LHL1M7t9MNU4HTS9D7YaNVnd/X/9zWK9DKtC1FuV6 FiTPkvJF1m48Gkfbl9CeNjFEPH0tp/XxnlSyDaZmbfFVChDwChinjqxP+dngyq/SlBzzL9HRboe xnw8ZAa1xOf0IPkDK4Bz4wj/uqchtWhqUzPxZxEd/IP69XF5j8C3rhLFcy6t+TUBjQ+vMmDHoZw KyokuQUOK66cxJ008l2BB7ptAUzquQ99fS2tOUiAdwQrb6c2jNhf6sYkLPXFOsvtAQQVA4UdAtj 6geBXVBCLZYf5u7GLrQ== X-Proofpoint-GUID: w1bjydGki8gRIEYyckWJTZvVLvAEEBmf X-Proofpoint-ORIG-GUID: 6oPV2FUYmr39PCo5uZhBQnXQGYe7h1W_ X-Authority-Analysis: v=2.4 cv=DZknbPtW c=1 sm=1 tr=0 ts=6a2288ee cx=c_pps a=bLidbwmWQ0KltjZqbj+ezA==:117 a=bLidbwmWQ0KltjZqbj+ezA==:17 a=FelO9ux0wxsA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=iQ6ETzBq9ecOQQE5vZCe:22 a=VnNF1IyMAAAA:8 a=NZuQ31_9CfGeVvh8xa4A:9 a=O8hF6Hzn-FEA:10 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-06-05_01,2026-05-28_03,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 clxscore=1015 suspectscore=0 impostorscore=0 lowpriorityscore=0 phishscore=0 malwarescore=0 priorityscore=1501 bulkscore=0 adultscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2605210000 definitions=main-2606050077 Content-Type: text/plain; charset="utf-8" kexec_prepare_cpus_wait() calls get_cpu() internally to obtain the current CPU id. kexec_prepare_cpus() calls kexec_prepare_cpus_wait() twice -- once for KEXEC_STATE_IRQS_OFF and once for KEXEC_STATE_REAL_MODE -- but only issues a single put_cpu() at the end, leaving preempt_count elevated by one extra nesting level. In practice the imbalance does not trigger a 'scheduling while atomic' splat because the kexec path is a one-way trip: IRQs are already disabled, no schedule() occurs after the leak, and default_machine_kexec() overwrites preempt_count with HARDIRQ_OFFSET before jumping into kexec_sequence() which never returns. However the bookkeeping is still wrong. kexec_prepare_cpus() calls local_irq_disable()/hard_irq_disable() before invoking kexec_prepare_cpus_wait(), so the CPU is already pinned and the get_cpu()/put_cpu() preempt_disable() bracketing is unnecessary. Only the current CPU id is needed, so replace get_cpu() with raw_smp_processor_id() and drop the now-unneeded put_cpu(). Fixes: 1fc711f7ffb0 ("powerpc/kexec: Fix race in kexec shutdown") Signed-off-by: Aboorva Devarajan Reviewed-by: Shrikanth Hegde --- arch/powerpc/kexec/core_64.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/arch/powerpc/kexec/core_64.c b/arch/powerpc/kexec/core_64.c index 825ab8a88f18..58c13a59b93b 100644 --- a/arch/powerpc/kexec/core_64.c +++ b/arch/powerpc/kexec/core_64.c @@ -169,7 +169,7 @@ static void kexec_prepare_cpus_wait(int wait_state) int my_cpu, i, notified=3D-1; =20 hw_breakpoint_disable(); - my_cpu =3D get_cpu(); + my_cpu =3D raw_smp_processor_id(); /* Make sure each CPU has at least made it to the state we need. * * FIXME: There is a (slim) chance of a problem if not all of the CPUs @@ -267,8 +267,6 @@ static void kexec_prepare_cpus(void) /* after we tell the others to go down */ if (ppc_md.kexec_cpu_down) ppc_md.kexec_cpu_down(0, 0); - - put_cpu(); } =20 #else /* ! SMP */ --=20 2.54.0