tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

cxl: Fix race of nvdimm_bus object when creating nvdimm objects

Found issue during running of cxl-translate.sh unit test. Adding a 3s
sleep right before the test seems to make the issue reproduce fairly
consistently. The cxl_translate module has dependency on cxl_acpi and
causes orphaned nvdimm objects to reprobe after cxl_acpi is removed.
The nvdimm_bus object is registered by the cxl_nvb object when
cxl_acpi_probe() is called. With the nvdimm_bus object missing,
__nd_device_register() will trigger NULL pointer dereference when
accessing the dev->parent that points to &nvdimm_bus->dev.

[ 192.884510] BUG: kernel NULL pointer dereference, address: 000000000000006c
[ 192.895383] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS edk2-20250812-19.fc42 08/12/2025
[ 192.897721] Workqueue: cxl_port cxl_bus_rescan_queue [cxl_core]
[ 192.899459] RIP: 0010:kobject_get+0xc/0x90
[ 192.924871] Call Trace:
[ 192.925959] <TASK>
[ 192.926976] ? pm_runtime_init+0xb9/0xe0
[ 192.929712] __nd_device_register.part.0+0x4d/0xc0 [libnvdimm]
[ 192.933314] __nvdimm_create+0x206/0x290 [libnvdimm]
[ 192.936662] cxl_nvdimm_probe+0x119/0x1d0 [cxl_pmem]
[ 192.940245] cxl_bus_probe+0x1a/0x60 [cxl_core]
[ 192.943349] really_probe+0xde/0x380

This patch also relies on the previous change where
devm_cxl_add_nvdimm_bridge() is called from drivers/cxl/pmem.c instead
of drivers/cxl/core.c to ensure the dependency of cxl_acpi on cxl_pmem.

1. Set probe_type of cxl_nvb to PROBE_FORCE_SYNCHRONOUS to ensure the
driver is probed synchronously when add_device() is called.
2. Add a check in __devm_cxl_add_nvdimm_bridge() to ensure that the
cxl_nvb driver is attached during cxl_acpi_probe().
3. Take the cxl_root uport_dev lock and the cxl_nvb->dev lock in
devm_cxl_add_nvdimm() before checking nvdimm_bus is valid.
4. Set cxl_nvdimm flag to CXL_NVD_F_INVALIDATED so cxl_nvdimm_probe()
will exit with -EBUSY.

The removal of cxl_nvdimm devices should prevent any orphaned devices
from probing once the nvdimm_bus is gone.

[ dj: Fixed 0-day reported kdoc issue. ]
[ dj: Fix cxl_nvb reference leak on error. Gregory (kreview-0811365) ]

Suggested-by: Dan Williams <dan.j.williams@intel.com>
Fixes: 8fdcb1704f61 ("cxl/pmem: Add initial infrastructure for pmem support")
Tested-by: Alison Schofield <alison.schofield@intel.com>
Reviewed-by: Alison Schofield <alison.schofield@intel.com?>
Link: https://patch.msgid.link/20260205001633.1813643-3-dave.jiang@intel.com
Signed-off-by: Dave Jiang <dave.jiang@intel.com>

Dave Jiang 96a1fd0d e7e222ad

+42 -2
+29
drivers/cxl/core/pmem.c
··· 115 115 device_unregister(&cxl_nvb->dev); 116 116 } 117 117 118 + static bool cxl_nvdimm_bridge_failed_attach(struct cxl_nvdimm_bridge *cxl_nvb) 119 + { 120 + struct device *dev = &cxl_nvb->dev; 121 + 122 + guard(device)(dev); 123 + /* If the device has no driver, then it failed to attach. */ 124 + return dev->driver == NULL; 125 + } 126 + 118 127 struct cxl_nvdimm_bridge *__devm_cxl_add_nvdimm_bridge(struct device *host, 119 128 struct cxl_port *port) 120 129 { ··· 146 137 rc = device_add(dev); 147 138 if (rc) 148 139 goto err; 140 + 141 + if (cxl_nvdimm_bridge_failed_attach(cxl_nvb)) { 142 + unregister_nvb(cxl_nvb); 143 + return ERR_PTR(-ENODEV); 144 + } 149 145 150 146 rc = devm_add_action_or_reset(host, unregister_nvb, cxl_nvb); 151 147 if (rc) ··· 261 247 cxl_nvb = cxl_find_nvdimm_bridge(port); 262 248 if (!cxl_nvb) 263 249 return -ENODEV; 250 + 251 + /* 252 + * Take the uport_dev lock to guard against race of nvdimm_bus object. 253 + * cxl_acpi_probe() registers the nvdimm_bus and is done under the 254 + * root port uport_dev lock. 255 + * 256 + * Take the cxl_nvb device lock to ensure that cxl_nvb driver is in a 257 + * consistent state. And the driver registers nvdimm_bus. 258 + */ 259 + guard(device)(cxl_nvb->port->uport_dev); 260 + guard(device)(&cxl_nvb->dev); 261 + if (!cxl_nvb->nvdimm_bus) { 262 + rc = -ENODEV; 263 + goto err_alloc; 264 + } 264 265 265 266 cxl_nvd = cxl_nvdimm_alloc(cxl_nvb, cxlmd); 266 267 if (IS_ERR(cxl_nvd)) {
+5
drivers/cxl/cxl.h
··· 574 574 575 575 #define CXL_DEV_ID_LEN 19 576 576 577 + enum { 578 + CXL_NVD_F_INVALIDATED = 0, 579 + }; 580 + 577 581 struct cxl_nvdimm { 578 582 struct device dev; 579 583 struct cxl_memdev *cxlmd; 580 584 u8 dev_id[CXL_DEV_ID_LEN]; /* for nvdimm, string of 'serial' */ 581 585 u64 dirty_shutdowns; 586 + unsigned long flags; 582 587 }; 583 588 584 589 struct cxl_pmem_region_mapping {
+8 -2
drivers/cxl/pmem.c
··· 14 14 static __read_mostly DECLARE_BITMAP(exclusive_cmds, CXL_MEM_COMMAND_ID_MAX); 15 15 16 16 /** 17 - * __devm_cxl_add_nvdimm_bridge() - add the root of a LIBNVDIMM topology 17 + * devm_cxl_add_nvdimm_bridge() - add the root of a LIBNVDIMM topology 18 18 * @host: platform firmware root device 19 19 * @port: CXL port at the root of a CXL topology 20 20 * ··· 142 142 unsigned long flags = 0, cmd_mask = 0; 143 143 struct nvdimm *nvdimm; 144 144 int rc; 145 + 146 + if (test_bit(CXL_NVD_F_INVALIDATED, &cxl_nvd->flags)) 147 + return -EBUSY; 145 148 146 149 set_exclusive_cxl_commands(mds, exclusive_cmds); 147 150 rc = devm_add_action_or_reset(dev, clear_exclusive, mds); ··· 326 323 scoped_guard(device, dev) { 327 324 if (dev->driver) { 328 325 cxl_nvd = to_cxl_nvdimm(dev); 329 - if (cxl_nvd->cxlmd && cxl_nvd->cxlmd->cxl_nvb == data) 326 + if (cxl_nvd->cxlmd && cxl_nvd->cxlmd->cxl_nvb == data) { 330 327 release = true; 328 + set_bit(CXL_NVD_F_INVALIDATED, &cxl_nvd->flags); 329 + } 331 330 } 332 331 } 333 332 if (release) ··· 372 367 .probe = cxl_nvdimm_bridge_probe, 373 368 .id = CXL_DEVICE_NVDIMM_BRIDGE, 374 369 .drv = { 370 + .probe_type = PROBE_FORCE_SYNCHRONOUS, 375 371 .suppress_bind_attrs = true, 376 372 }, 377 373 };