The CPU_DYING notifier modifies the per-cpu pointer pmu->box, and this can race with functions such as uncore_pmu_to_box() and uncore_pci_remove() when we remove stop_machine() from the CPU offline path. So protect them using get/put_online_cpus_atomic(). Cc: "H. Peter Anvin" <hpa@xxxxxxxxx> Cc: x86@xxxxxxxxxx Cc: Arnaldo Carvalho de Melo <acme@xxxxxxxxxx> Signed-off-by: Srivatsa S. Bhat <srivatsa.bhat@xxxxxxxxxxxxxxxxxx> --- arch/x86/kernel/cpu/perf_event_intel_uncore.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/arch/x86/kernel/cpu/perf_event_intel_uncore.c b/arch/x86/kernel/cpu/perf_event_intel_uncore.c index b43200d..6faae53 100644 --- a/arch/x86/kernel/cpu/perf_event_intel_uncore.c +++ b/arch/x86/kernel/cpu/perf_event_intel_uncore.c @@ -1,3 +1,4 @@ +#include <linux/cpu.h> #include "perf_event_intel_uncore.h" static struct intel_uncore_type *empty_uncore[] = { NULL, }; @@ -1965,6 +1966,7 @@ uncore_pmu_to_box(struct intel_uncore_pmu *pmu, int cpu) if (box) return box; + get_online_cpus_atomic(); raw_spin_lock(&uncore_box_lock); list_for_each_entry(box, &pmu->box_list, list) { if (box->phys_id == topology_physical_package_id(cpu)) { @@ -1974,6 +1976,7 @@ uncore_pmu_to_box(struct intel_uncore_pmu *pmu, int cpu) } } raw_spin_unlock(&uncore_box_lock); + put_online_cpus_atomic(); return *per_cpu_ptr(pmu->box, cpu); } @@ -2556,6 +2559,7 @@ static void uncore_pci_remove(struct pci_dev *pdev) if (WARN_ON_ONCE(phys_id != box->phys_id)) return; + get_online_cpus_atomic(); raw_spin_lock(&uncore_box_lock); list_del(&box->list); raw_spin_unlock(&uncore_box_lock); @@ -2569,6 +2573,7 @@ static void uncore_pci_remove(struct pci_dev *pdev) WARN_ON_ONCE(atomic_read(&box->refcnt) != 1); kfree(box); + put_online_cpus_atomic(); } static int uncore_pci_probe(struct pci_dev *pdev, -- To unsubscribe from this list: send the line "unsubscribe linux-doc" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html