[PATCH v3 2/8] coresight: configfs: Don't assume active until cscfg_mgr is set

[James Clark]

On 13/08/2026 10:09, Leo Yan wrote:
> On Tue, Jul 28, 2026 at 04:00:14PM +0100, James Clark wrote:
>> Perf's etm_setup_aux() calls cscfg_activate_config() and dereferences
>> cscfg_mgr, which can be done after coresight_init() has initialized the
>> Perf PMU but before cscfg_init() has finished while the driver is still
>> loading.
> 
> For this patch, if Perf PMU is dependent on cscfg, why we cannot
> adjust the init sequence that first call cscfg_init(), then register
> cs_etm PMU event?
> 

cscfg_init() relies on perf making some files in sysfs. I think I tried 
that first but it doesn't work:

  	/* add config to perf fs to allow selection */
	err = etm_perf_add_symlink_cscfg(cscfg_device(), config_desc);

One solution would be to combine the modules into one. Not sure if there 
is any functional requirement for them being separate. They're both 
"software" parts of the set of Coresight modules, rather than being 
associated with any hardware. Having them separate is obviously creating 
some bugs and needless complexity.

> In _cscfg_activate_config(), I can see it dereferences cscfg_mgr:
> 
>    if (cscfg_mgr->load_state == CSCFG_UNLOAD)
> 
> This patch does not check if cscfg_mgr is set. If we try to check
> cscfg_mgr every time before dereferences it, this approach is quite
> fragile.
> 

Maybe we can have a "cscfg_get_state()" function which also checks for 
NULL and returns CSCFG_UNLOAD in that case?

> 
>> Fix it by only assuming cscfg is initialized if cscfg_mgr is set.
>>
>> Reported-by: sashiko-bot <sashiko-bot at kernel.org>
>> Fixes: a0114b4740dd ("coresight: etm-perf: Update to activate selected configuration")
>> Signed-off-by: James Clark <james.clark at linaro.org>
>> ---
>>   drivers/hwtracing/coresight/coresight-syscfg.c | 6 +++---
>>   1 file changed, 3 insertions(+), 3 deletions(-)
>>
>> diff --git a/drivers/hwtracing/coresight/coresight-syscfg.c b/drivers/hwtracing/coresight/coresight-syscfg.c
>> index 2bfdd7b45e49..475e8fefa100 100644
>> --- a/drivers/hwtracing/coresight/coresight-syscfg.c
>> +++ b/drivers/hwtracing/coresight/coresight-syscfg.c
>> @@ -581,7 +581,7 @@ int cscfg_load_config_sets(struct cscfg_config_desc **config_descs,
>>   	int err = 0;
>>   
>>   	mutex_lock(&cscfg_mutex);
>> -	if (cscfg_mgr->load_state != CSCFG_NONE) {
>> +	if (!cscfg_mgr || cscfg_mgr->load_state != CSCFG_NONE) {
>>   		mutex_unlock(&cscfg_mutex);
>>   		return -EBUSY;
> 
> If cscfg_mgr is NULL, would directly bail out? This can avoid adding
> check for every dereference.

Not sure what you mean by this?

> 
> Thanks,
> Leo
> 
> P.S. For me, this kind of rare race condition reported by Sashiko can
> sometimes distract from the main issue. Trying to address it in the
> same series may mix different issues together. I miss the simpler
> approach where issues could be resolved with clear boundary.

It's a bit like the other fix, we're holding new refcounts to the 
task_struct and PID, so we should probably make sure we're going to 
release them. Getting this wrong prevents free_event_data() from being 
called.

Don't worry I didn't fix all of the edge cases either.