powercap: intel_rapl: Fix kernel panic during PMU unbind
PATCH 1/1 powercap: intel_rapl: Fix kernel panic during PMU unbind
rapl_package_add_pmu() fails internally at perf_pmu_register(), and rapl_pmu_update() leaves the global rapl_pmu.pmu structure zero-initialized via memset and returns an error. But any previously probed packages retain has_pmu = true.
When the driver is subsequently unbound or removed, rapl_package_remove_pmu_locked() sees has_pmu == true and unconditionally calls perf_pmu_unregister(&rapl_pmu.pmu) on the zeroed-out structure. This attempts a list_del_rcu() on a NULL list head, immediately causing a kernel panic.
Fix this by checking if the PMU is actually registered before attempting to unregister it.
--- drivers/powercap/intel_rapl_common.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/powercap/intel_rapl_common.c +2 -1
@@ -1652,7 +1652,8 @@ void rapl_package_remove_pmu_locked(struct rapl_package *rp)return ; } -perf_pmu_unregister (&rapl_pmu.pmu); +if (rapl_pmu.registered) +perf_pmu_unregister (&rapl_pmu.pmu);memset (&rapl_pmu,0 ,sizeof (struct rapl_pmu )); }EXPORT_SYMBOL_NS_GPL (rapl_package_remove_pmu_locked,"INTEL_RAPL" );
Signature · 1 line
2.43.0
Quoted 12 lines · Sumeet Pawnikar
rapl_package_add_pmu()fails internally atperf_pmu_register(), andrapl_pmu_update()leaves the global rapl_pmu.pmu structure zero-initialized via memset and returns an error. But any previously probed packages retainhas_pmu= true.When the driver is subsequently unbound or removed,
rapl_package_remove_pmu_locked()seeshas_pmu== true and unconditionally callsperf_pmu_unregister(&rapl_pmu.pmu)on the zeroed-out structure. This attempts alist_del_rcu()on a NULL list head, immediately causing a kernel panic.
Quoted 4 lines
Fix this by checking if the PMU is actually registered before attempting to unregister it.
Signed-off-by Sumeet Pawnikar <[email protected]>
Hi Rafael,
Gentle ping.
Any chance for this to go into next rc ?
Thanks & Regards,
Sumeet Pawnikar.
Quoted 21 lines
--- drivers/powercap/intel_rapl_common.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)drivers/powercap/intel_rapl_common.c +2
-2@@ -1652,7 +1652,8 @@ void rapl_package_remove_pmu_locked(struct rapl_package *rp)return ; } -perf_pmu_unregister (&rapl_pmu.pmu); +if (rapl_pmu.registered) +perf_pmu_unregister (&rapl_pmu.pmu);memset (&rapl_pmu,0 ,sizeof (struct rapl_pmu )); }EXPORT_SYMBOL_NS_GPL (rapl_package_remove_pmu_locked,"INTEL_RAPL" ); --2.43.0
Rafael J. Wysocki (Intel)
maintainerQuoted 17 lines · Sumeet R.P.
Quoted 15 lines · Sumeet Pawnikar
rapl_package_add_pmu()fails internally atperf_pmu_register(), andrapl_pmu_update()leaves the global rapl_pmu.pmu structure zero-initialized via memset and returns an error. But any previously probed packages retainhas_pmu= true.When the driver is subsequently unbound or removed,
rapl_package_remove_pmu_locked()seeshas_pmu== true and unconditionally callsperf_pmu_unregister(&rapl_pmu.pmu)on the zeroed-out structure. This attempts alist_del_rcu()on a NULL list head, immediately causing a kernel panic.Fix this by checking if the PMU is actually registered before attempting to unregister it.
Quoted 6 lines
Quoted 1 line
Signed-off-by Sumeet Pawnikar <[email protected]>Hi Rafael,
Gentle ping.
Any chance for this to go into next rc ?
It looks like I lost track of it, sorry.
Can you please resend it and make sure that your name in the S-o-b tag is the same as in the From: header?
Quoted 21 lines
Quoted 21 lines
--- drivers/powercap/intel_rapl_common.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)drivers/powercap/intel_rapl_common.c +2
-2@@ -1652,7 +1652,8 @@ void rapl_package_remove_pmu_locked(struct rapl_package *rp)return ; } -perf_pmu_unregister (&rapl_pmu.pmu); +if (rapl_pmu.registered) +perf_pmu_unregister (&rapl_pmu.pmu);memset (&rapl_pmu,0 ,sizeof (struct rapl_pmu )); }EXPORT_SYMBOL_NS_GPL (rapl_package_remove_pmu_locked,"INTEL_RAPL" ); --2.43.0