On Tue, May 13, 2025 at 06:06:21PM +0100, Yeoreum Yun wrote:

There'll be possible race scenario for coresight config:

CPU0 CPU1 (perf enable) load module cscfg_load_config_sets() activate config. // sysfs (sys_active_cnt == 1) ... cscfg_csdev_enable_active_config() lock(csdev->cscfg_csdev_lock) deactivate config // sysfs (sys_activec_cnt == 0) cscfg_unload_config_sets() <iterating config_csdev_list> cscfg_remove_owned_csdev_configs() // here load config activate by CPU1 unlock(csdev->cscfg_csdev_lock)

iterating config_csdev_list could be raced with config_csdev_list's entry delete.

To resolve this race , hold csdev->cscfg_csdev_lock() while cscfg_remove_owned_csdev_configs()

Signed-off-by: Yeoreum Yun yeoreum.yun@arm.com Fixes: 02bd588e12df ("coresight: configuration: Update API to permit dynamic load/unload")

---

drivers/hwtracing/coresight/coresight-syscfg.c | 3 +++ 1 file changed, 3 insertions(+)

diff --git a/drivers/hwtracing/coresight/coresight-syscfg.c b/drivers/hwtracing/coresight/coresight-syscfg.c index a70c1454b410..5d194b9269f5 100644 --- a/drivers/hwtracing/coresight/coresight-syscfg.c +++ b/drivers/hwtracing/coresight/coresight-syscfg.c @@ -391,14 +391,17 @@ static void cscfg_owner_put(struct cscfg_load_owner_info *owner_info) static void cscfg_remove_owned_csdev_configs(struct coresight_device *csdev, void *load_owner) { struct cscfg_config_csdev *config_csdev, *tmp;

• unsigned long flags;

if (list_empty(&csdev->config_csdev_list)) return;

• raw_spin_lock_irqsave(&csdev->cscfg_csdev_lock, flags);

Could we use the format:

guard(raw_spinlock_irqsave)(&csdev->cscfg_csdev_lock);

Sorry I did not mention this in the earlier review. Otherwise:

Reviewed-by: Leo Yan leo.yan@arm.com

list_for_each_entry_safe(config_csdev, tmp, &csdev->config_csdev_list, node) { if (config_csdev->config_desc->load_owner == load_owner) list_del(&config_csdev->node); }

• raw_spin_unlock_irqrestore(&csdev->cscfg_csdev_lock, flags);

} static void cscfg_remove_owned_csdev_features(struct coresight_device *csdev, void *load_owner) -- LEVI:{C3F47F37-75D8-414A-A8BA-3980EC8A46D7}