[PATCH] coresight: Fix scheduling while atomic in coresight_device_release()
From: Mohamed Ayman <hidden>
Date: 2026-07-12 21:05:22
Also in:
linux-rt-devel, lkml
Subsystem:
arm/coresight framework and drivers, hardware tracing facilities, the rest · Maintainers:
Suzuki K Poulose, Alexander Shishkin, Linus Torvalds
Dropping the last reference to a coresight_device can trigger a kernel
panic on PREEMPT_RT builds due to a "scheduling while atomic" violation.
When the CPU enters an idle state, coresight_cpu_pm_notify() is invoked
with local interrupts disabled (atomic context). This function eventually
calls coresight_put_percpu_source_ref(), which drops the device reference
via put_device(). If this is the last reference, it triggers the release
chain:
coresight_cpu_pm_notify() (IRQs off)
-> coresight_put_percpu_source_ref()
-> put_device()
-> coresight_device_release()
-> free_percpu()
On a PREEMPT_RT kernel, free_percpu() acquires pcpu_lock, which is
implemented as a sleeping rt-mutex. Sleeping while in an atomic context
causes a system crash.
Fix this by deferring the teardown of the coresight_device to process
context. Add a work_struct to `struct coresight_device` and use
schedule_work() inside coresight_device_release() to safely execute
free_percpu() and kfree() in a worker thread, away from the atomic PM
notifier path.
Additionally, remove the redundant raw_spinlock_irqsave guard in
coresight_put_percpu_source_ref(). The lock was originally intended to
protect the per-CPU pointer table, but dropping a reference does not
touch this table.
Signed-off-by: Mohamed Ayman <redacted>
---
drivers/hwtracing/coresight/coresight-core.c | 28 +++++++++++++-------
include/linux/coresight.h | 2 ++
2 files changed, 21 insertions(+), 9 deletions(-)
diff --git a/drivers/hwtracing/coresight/coresight-core.c b/drivers/hwtracing/coresight/coresight-core.c
index 6d65c43d5..9dbdb2977 100644
--- a/drivers/hwtracing/coresight/coresight-core.c
+++ b/drivers/hwtracing/coresight/coresight-core.c@@ -165,13 +165,6 @@ void coresight_put_percpu_source_ref(struct coresight_device *csdev) guard(raw_spinlock_irqsave)(&coresight_dev_lock); - /* - * TODO: coresight_device_release() is invoked to release resources when - * the device's refcount reaches zero. It then calls free_percpu(), - * which acquires pcpu_lock — a sleepable lock when PREEMPT_RT is - * enabled. Since the raw spinlock coresight_dev_lock is held, this can - * lead to a potential "scheduling while atomic" issue. - */ put_device(&csdev->dev); }
@@ -1257,13 +1250,30 @@ static void coresight_clear_default_sink(struct coresight_device *csdev) } } +static void coresight_device_release_work(struct work_struct *work) +{ + struct coresight_device *csdev = + container_of(work, struct coresight_device, free_work); + + free_percpu(csdev->perf_sink_id_map.cpu_map); + kfree(csdev); +} + static void coresight_device_release(struct device *dev) { struct coresight_device *csdev = to_coresight_device(dev); fwnode_handle_put(csdev->dev.fwnode); - free_percpu(csdev->perf_sink_id_map.cpu_map); - kfree(csdev); + + /* + * This release callback can run with the last reference dropped + * from atomic/IRQs-off context (e.g. coresight_put_percpu_source_ref() + * called from the CPU_PM notifier). free_percpu() takes pcpu_lock, + * which is a sleeping lock under PREEMPT_RT, so defer the actual + * teardown to process context. + */ + INIT_WORK(&csdev->free_work, coresight_device_release_work); + schedule_work(&csdev->free_work); } static int coresight_orphan_match(struct device *dev, void *data)
diff --git a/include/linux/coresight.h b/include/linux/coresight.h
index ddf18c970..63253f6c4 100644
--- a/include/linux/coresight.h
+++ b/include/linux/coresight.h@@ -13,6 +13,7 @@ #include <linux/perf_event.h> #include <linux/sched.h> #include <linux/platform_device.h> +#include <linux/workqueue.h> /* Peripheral id registers (0xFD0-0xFEC) */ #define CORESIGHT_PERIPHIDR4 0xfd0
@@ -293,6 +294,7 @@ struct coresight_device { struct csdev_access access; struct device dev; struct coresight_path *path; + struct work_struct free_work; atomic_t mode; int refcnt; int cpu;
--
2.34.1