From 80892972ff23bf0b9049230ef0931b34163aaed3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ali=20Ahmet=20Memi=C5=9F?= Date: Sun, 18 Oct 2026 15:22:17 +0300 Subject: [PATCH 1/8] ACPI: utils: Add exclusive AML evaluation helpers MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ACPICA drops the interpreter lock while AML waits, for example around EC accesses, so two methods can run interleaved. Some firmware relies on methods not interleaving, for instance by switching an EC page selector without taking the AML mutex that the other users of that page hold. Add acpi_evaluate_object_exclusive(), acpi_evaluate_integer_exclusive() and acpi_execute_simple_method_exclusive() which serialize the evaluation under a global mutex, for callers that are known to be affected. Suggested-by: Rafael J. Wysocki Link: https://lore.kernel.org/all/CAJZ5v0gS4agVUkCO6M=VW4Wi2y1-s+k23bpzmX9aAZ0Rsv4z9Q@mail.gmail.com/ Signed-off-by: Ali Ahmet Memiş Reviewed-by: Rong Zhang Link: https://patch.msgid.link/20261018122220.678822-2-aliamemis@disroot.org Signed-off-by: Rafael J. Wysocki --- drivers/acpi/utils.c | 41 +++++++++++++++++++++++++++++++++++++++++ include/acpi/acpi_bus.h | 7 +++++++ 2 files changed, 48 insertions(+) diff --git a/drivers/acpi/utils.c b/drivers/acpi/utils.c index 7c584d490d6a..27ab2283937a 100644 --- a/drivers/acpi/utils.c +++ b/drivers/acpi/utils.c @@ -10,6 +10,7 @@ #include #include +#include #include #include #include @@ -243,6 +244,28 @@ acpi_extract_package(union acpi_object *package, EXPORT_SYMBOL(acpi_extract_package); +static DEFINE_MUTEX(acpi_exclusive_eval_lock); + +/** + * acpi_evaluate_object_exclusive - Evaluate an object without interleaving + * @handle: ACPI handle of the object or its scope. + * @pathname: Path of the object relative to @handle. + * @arguments: Arguments to pass, or NULL. + * @buffer: Buffer for the return value, or NULL. + * + * Same as acpi_evaluate_object(), but serialized with other exclusive + * evaluations. Use it only for methods known to break when interleaved. + */ +acpi_status acpi_evaluate_object_exclusive(acpi_handle handle, acpi_string pathname, + struct acpi_object_list *arguments, + struct acpi_buffer *buffer) +{ + guard(mutex)(&acpi_exclusive_eval_lock); + + return acpi_evaluate_object(handle, pathname, arguments, buffer); +} +EXPORT_SYMBOL_GPL(acpi_evaluate_object_exclusive); + acpi_status acpi_evaluate_integer(acpi_handle handle, acpi_string pathname, @@ -277,6 +300,16 @@ acpi_evaluate_integer(acpi_handle handle, EXPORT_SYMBOL(acpi_evaluate_integer); +acpi_status acpi_evaluate_integer_exclusive(acpi_handle handle, acpi_string pathname, + struct acpi_object_list *arguments, + unsigned long long *data) +{ + guard(mutex)(&acpi_exclusive_eval_lock); + + return acpi_evaluate_integer(handle, pathname, arguments, data); +} +EXPORT_SYMBOL_GPL(acpi_evaluate_integer_exclusive); + int acpi_get_local_u64_address(acpi_handle handle, u64 *addr) { acpi_status status; @@ -685,6 +718,14 @@ acpi_status acpi_execute_simple_method(acpi_handle handle, char *method, } EXPORT_SYMBOL(acpi_execute_simple_method); +acpi_status acpi_execute_simple_method_exclusive(acpi_handle handle, char *method, u64 arg) +{ + guard(mutex)(&acpi_exclusive_eval_lock); + + return acpi_execute_simple_method(handle, method, arg); +} +EXPORT_SYMBOL_GPL(acpi_execute_simple_method_exclusive); + /** * acpi_evaluate_ej0: Evaluate _EJ0 method for hotplug operations * @handle: ACPI device handle diff --git a/include/acpi/acpi_bus.h b/include/acpi/acpi_bus.h index a755b15af9db..f59b2de865e6 100644 --- a/include/acpi/acpi_bus.h +++ b/include/acpi/acpi_bus.h @@ -34,6 +34,12 @@ acpi_status acpi_evaluate_integer(acpi_handle handle, acpi_string pathname, struct acpi_object_list *arguments, unsigned long long *data); +acpi_status acpi_evaluate_object_exclusive(acpi_handle handle, acpi_string pathname, + struct acpi_object_list *arguments, + struct acpi_buffer *buffer); +acpi_status acpi_evaluate_integer_exclusive(acpi_handle handle, acpi_string pathname, + struct acpi_object_list *arguments, + unsigned long long *data); bool acpi_evaluate_reference(acpi_handle handle, acpi_string pathname, struct acpi_object_list *arguments, struct acpi_handle_list *list); @@ -50,6 +56,7 @@ acpi_evaluate_ost(acpi_handle handle, u32 source_event, u32 status_code, bool acpi_has_method(acpi_handle handle, char *name); acpi_status acpi_execute_simple_method(acpi_handle handle, char *method, u64 arg); +acpi_status acpi_execute_simple_method_exclusive(acpi_handle handle, char *method, u64 arg); acpi_status acpi_evaluate_ej0(acpi_handle handle); acpi_status acpi_evaluate_lck(acpi_handle handle, int lock); acpi_status acpi_evaluate_reg(acpi_handle handle, u8 space_id, u32 function); From 645f370c932db2cd3893f7fee61aa8b9debc8ac0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ali=20Ahmet=20Memi=C5=9F?= Date: Sun, 18 Oct 2026 15:22:18 +0300 Subject: [PATCH 2/8] ACPI: battery: Evaluate battery methods exclusively MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit On ThinkPad P1 Gen2 and P53, INT3403 _TMP switches the EC page selector without taking the AML mutex the battery methods use, so _BIX and _BST running at the same time can read the wrong page. Since commit d33e89d12295 ("thermal: core: Suspend thermal zones later and resume them earlier") this happens on most resumes. Evaluate the battery methods with acpi_evaluate_object_exclusive(). Fixes: d33e89d12295 ("thermal: core: Suspend thermal zones later and resume them earlier") Reported-by: Charis Stratakis Closes: https://lore.kernel.org/all/37N_jFulf7n-Z55NfKfE71C_wVPxYvZ0xD_iRUg2fXu7TypDiF5PStQ6siSfVBih6fThg5WoPes8U5ZQpfVm_teMFcUGXFxz2DdMbfSWuws=@proton.me/ Cc: All applicable # 80892972ff23 ACPI: utils: Add exclusive AML evaluation helpers Signed-off-by: Ali Ahmet Memiş Reviewed-by: Hans de Goede Reviewed-by: Rong Zhang Link: https://patch.msgid.link/20261018122220.678822-3-aliamemis@disroot.org Signed-off-by: Rafael J. Wysocki --- drivers/acpi/battery.c | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c index 8599949f8786..6edea559a5bc 100644 --- a/drivers/acpi/battery.c +++ b/drivers/acpi/battery.c @@ -647,9 +647,8 @@ static int acpi_battery_get_info(struct acpi_battery *battery) struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL }; acpi_status status = AE_ERROR; - status = acpi_evaluate_object(battery->device->handle, - use_bix ? "_BIX":"_BIF", - NULL, &buffer); + status = acpi_evaluate_object_exclusive(battery->device->handle, + use_bix ? "_BIX" : "_BIF", NULL, &buffer); if (ACPI_FAILURE(status)) { acpi_handle_info(battery->device->handle, @@ -688,8 +687,7 @@ static int acpi_battery_get_state(struct acpi_battery *battery) msecs_to_jiffies(cache_time))) return 0; - status = acpi_evaluate_object(battery->device->handle, "_BST", - NULL, &buffer); + status = acpi_evaluate_object_exclusive(battery->device->handle, "_BST", NULL, &buffer); if (ACPI_FAILURE(status)) { acpi_handle_info(battery->device->handle, "_BST evaluation failed: %s", @@ -739,8 +737,8 @@ static int acpi_battery_set_alarm(struct acpi_battery *battery) !test_bit(ACPI_BATTERY_ALARM_PRESENT, &battery->flags)) return -ENODEV; - status = acpi_execute_simple_method(battery->device->handle, "_BTP", - battery->alarm); + status = acpi_execute_simple_method_exclusive(battery->device->handle, "_BTP", + battery->alarm); if (ACPI_FAILURE(status)) return -ENODEV; From c4aae727beb23a736c15b8d53e219da29d791065 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ali=20Ahmet=20Memi=C5=9F?= Date: Sun, 18 Oct 2026 15:22:19 +0300 Subject: [PATCH 3/8] thermal: intel: int340x: Evaluate _TMP exclusively MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit On ThinkPad P1 Gen2 and P53, INT3403 _TMP switches the EC page selector without taking the mutex the battery methods use, so it must not run interleaved with them. Evaluate _TMP with acpi_evaluate_integer_exclusive(), also where int3403 and processor_thermal probe for it. Fixes: d33e89d12295 ("thermal: core: Suspend thermal zones later and resume them earlier") Reported-by: Charis Stratakis Closes: https://lore.kernel.org/all/37N_jFulf7n-Z55NfKfE71C_wVPxYvZ0xD_iRUg2fXu7TypDiF5PStQ6siSfVBih6fThg5WoPes8U5ZQpfVm_teMFcUGXFxz2DdMbfSWuws=@proton.me/ Cc: All applicable # 80892972ff23 ACPI: utils: Add exclusive AML evaluation helpers Signed-off-by: Ali Ahmet Memiş Reviewed-by: Hans de Goede Reviewed-by: Rong Zhang Link: https://patch.msgid.link/20261018122220.678822-4-aliamemis@disroot.org Signed-off-by: Rafael J. Wysocki --- drivers/thermal/intel/int340x_thermal/int3403_thermal.c | 3 +-- .../thermal/intel/int340x_thermal/int340x_thermal_zone.c | 6 +++++- .../intel/int340x_thermal/processor_thermal_device.c | 2 +- 3 files changed, 7 insertions(+), 4 deletions(-) diff --git a/drivers/thermal/intel/int340x_thermal/int3403_thermal.c b/drivers/thermal/intel/int340x_thermal/int3403_thermal.c index 264c9bc8e645..2262de1e14d9 100644 --- a/drivers/thermal/intel/int340x_thermal/int3403_thermal.c +++ b/drivers/thermal/intel/int340x_thermal/int3403_thermal.c @@ -217,8 +217,7 @@ static int int3403_add(struct platform_device *pdev) } - status = acpi_evaluate_integer(priv->adev->handle, "_TMP", - NULL, &tmp); + status = acpi_evaluate_integer_exclusive(priv->adev->handle, "_TMP", NULL, &tmp); if (ACPI_FAILURE(status)) { status = acpi_evaluate_integer(priv->adev->handle, "PTYP", NULL, &priv->type); diff --git a/drivers/thermal/intel/int340x_thermal/int340x_thermal_zone.c b/drivers/thermal/intel/int340x_thermal/int340x_thermal_zone.c index 965700ee6962..9451fea1f65c 100644 --- a/drivers/thermal/intel/int340x_thermal/int340x_thermal_zone.c +++ b/drivers/thermal/intel/int340x_thermal/int340x_thermal_zone.c @@ -18,7 +18,11 @@ static int int340x_thermal_get_zone_temp(struct thermal_zone_device *zone, unsigned long long tmp; acpi_status status; - status = acpi_evaluate_integer(d->adev->handle, "_TMP", NULL, &tmp); + /* + * On some ThinkPads _TMP switches the EC page selector without + * taking the mutex the battery methods use. + */ + status = acpi_evaluate_integer_exclusive(d->adev->handle, "_TMP", NULL, &tmp); if (ACPI_FAILURE(status)) return -EIO; diff --git a/drivers/thermal/intel/int340x_thermal/processor_thermal_device.c b/drivers/thermal/intel/int340x_thermal/processor_thermal_device.c index 850bfe7c1ede..cef1d34f3f53 100644 --- a/drivers/thermal/intel/int340x_thermal/processor_thermal_device.c +++ b/drivers/thermal/intel/int340x_thermal/processor_thermal_device.c @@ -287,7 +287,7 @@ int proc_thermal_add(struct device *dev, struct proc_thermal_device *proc_priv) if (ret) return ret; - status = acpi_evaluate_integer(adev->handle, "_TMP", NULL, &tmp); + status = acpi_evaluate_integer_exclusive(adev->handle, "_TMP", NULL, &tmp); if (ACPI_FAILURE(status)) { /* there is no _TMP method, add local method */ if (intel_tcc_get_tjmax(-1) > 0) From f91c2cd6dbcedf52e227b2eea8d7b99ecbac7552 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ali=20Ahmet=20Memi=C5=9F?= Date: Sun, 18 Oct 2026 15:23:48 +0300 Subject: [PATCH 4/8] platform/x86: ideapad-laptop: Evaluate ACPI methods exclusively MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit On some Lenovo IdeaPad and Yoga models, the battery _BIX takes the EC AML mutex and then calls the serialized RDER through RDIF, while GBMD calls RDER first and then takes the EC mutex. When the two run interleaved they deadlock until the mutex acquisition in RDER times out, and GBMD returns garbage that is reported as both charge types being enabled. Evaluate all methods with the exclusive helpers, so that GBMD never runs interleaved with the battery methods. Link: https://bugzilla.kernel.org/show_bug.cgi?id=221065 Link: https://lore.kernel.org/all/58586fa666f09c209f9d7fe8c692a8bdda6d4410.camel@rong.moe/ Signed-off-by: Ali Ahmet Memiş Reviewed-by: Rong Zhang Cc: All applicable # 80892972ff23 ACPI: utils: Add exclusive AML evaluation helpers Link: https://patch.msgid.link/20261018122348.679126-1-aliamemis@disroot.org Signed-off-by: Rafael J. Wysocki --- drivers/platform/x86/lenovo/ideapad-laptop.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/drivers/platform/x86/lenovo/ideapad-laptop.c b/drivers/platform/x86/lenovo/ideapad-laptop.c index 8213524504ee..1335f4e48870 100644 --- a/drivers/platform/x86/lenovo/ideapad-laptop.c +++ b/drivers/platform/x86/lenovo/ideapad-laptop.c @@ -297,12 +297,16 @@ static void ideapad_shared_exit(struct ideapad_private *priv) #define IDEAPAD_EC_POLL_MIN_US 150 #define IDEAPAD_EC_POLL_MAX_US 300 +/* + * On some models GBMD and the battery _BIX take the EC mutex and a + * serialized method in opposite order, so evaluate all methods exclusively. + */ static int eval_int(acpi_handle handle, const char *name, unsigned long *res) { unsigned long long result; acpi_status status; - status = acpi_evaluate_integer(handle, (char *)name, NULL, &result); + status = acpi_evaluate_integer_exclusive(handle, (char *)name, NULL, &result); if (ACPI_FAILURE(status)) return -EIO; @@ -324,7 +328,7 @@ static int eval_int_with_arg(acpi_handle handle, const char *name, unsigned long in_obj.type = ACPI_TYPE_INTEGER; in_obj.integer.value = arg; - status = acpi_evaluate_integer(handle, (char *)name, ¶ms, &result); + status = acpi_evaluate_integer_exclusive(handle, (char *)name, ¶ms, &result); if (ACPI_FAILURE(status)) return -EIO; @@ -336,7 +340,7 @@ static int eval_int_with_arg(acpi_handle handle, const char *name, unsigned long static int exec_simple_method(acpi_handle handle, const char *name, unsigned long arg) { - acpi_status status = acpi_execute_simple_method(handle, (char *)name, arg); + acpi_status status = acpi_execute_simple_method_exclusive(handle, (char *)name, arg); return ACPI_FAILURE(status) ? -EIO : 0; } @@ -394,7 +398,7 @@ static int eval_vpcw(acpi_handle handle, unsigned long cmd, unsigned long data) in_obj[1].type = ACPI_TYPE_INTEGER; in_obj[1].integer.value = data; - status = acpi_evaluate_object(handle, "VPCW", ¶ms, NULL); + status = acpi_evaluate_object_exclusive(handle, "VPCW", ¶ms, NULL); if (ACPI_FAILURE(status)) return -EIO; From b66621ad2a8fb553c4cb75b9d69fead4f0532933 Mon Sep 17 00:00:00 2001 From: Daniel Lezcano Date: Tue, 20 Oct 2026 16:45:25 +0200 Subject: [PATCH 5/8] ACPI: platform_profile: Separate handler locking from sysfs lifetime MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Registration and removal currently hold profile_lock across device_unregister() and sysfs_update_group(). These operations can remove sysfs attributes and wait for their active callbacks to finish. The profile read and write callbacks acquire profile_lock themselves, so a concurrent access can deadlock: Removal/update path Active sysfs callback ------------------- --------------------- acquire profile_lock hold kernfs active reference remove a sysfs attribute wait for profile_lock wait for its active references The removal path cannot finish until the callback returns, and the callback cannot return until the removal path releases profile_lock. This applies both to per-provider device teardown and to updates of the legacy aggregate attribute group. Commit 041142d7d252 ("ACPI: platform-profile: Fix possible deadlock in platform_profile_remove()") previously fixed this lock ordering by moving sysfs_remove_group() outside profile_lock. Commit 55b1e68134bf ("ACPI: platform_profile: Use guard(mutex) for register/unregister") reintroduced the issue by extending the mutex guard over sysfs_remove_group(). Later, commit 77be5cacb2c2 ("ACPI: platform_profile: Create class for ACPI platform profile") replaced that teardown with device_unregister() and sysfs_update_group(), still under the same mutex, extending the problem to class-device teardown and aggregate attribute updates. Simply dropping profile_lock around these operations is insufficient. Aggregate operations currently discover providers through the class device list. A provider being unregistered could therefore still be selected for an aggregate read, write or cycle while its sysfs files are being torn down. Concurrent registrations and removals would also race when updating aggregate attribute visibility. Introduce profile_registration_lock to serialize registration, removal and aggregate sysfs updates. Sysfs callbacks never acquire this mutex. Retain profile_lock for profile operations and use it to protect an explicit list of handlers participating in the aggregate interface. Add a handler to that list only after device_register() succeeds. On removal, unlink it under profile_lock before calling device_unregister(). Acquiring profile_lock first waits for any aggregate operation already using the handler to complete; unlinking prevents later aggregate operations from finding it. Release profile_lock before draining sysfs callbacks, allowing active per-provider callbacks to complete before the device is released. Apply the same unlink-before-unregister ordering to registration error cleanup. Walk this list for aggregate reads, writes and profile cycling, and use its emptiness to determine aggregate attribute visibility. The class devices remain the per-provider userspace interface. There can now be an interval between removing the last handler from the list and removing the aggregate attributes. Explicitly reject choices reads and writes during that interval: the intersection bitmap starts with every bit set, so an empty traversal must not advertise all profiles or report a successful write without updating a provider. This separates aggregate membership from class device teardown while preserving the existing class and ACPI sysfs interfaces. Fixes: 55b1e68134bf ("ACPI: platform_profile: Use guard(mutex) for register/unregister") Fixes: 77be5cacb2c2 ("ACPI: platform_profile: Create class for ACPI platform profile") Signed-off-by: Daniel Lezcano Reviewed-by: Ilpo Järvinen Reviewed-by: Mark Pearson [ rjw: Subject adjustment, added two empty code lines ] [ rjw: Renamed profile_walk_handlers() to profile_for_each_handler() ] Link: https://patch.msgid.link/20261020144525.3265851-1-daniel.lezcano@oss.qualcomm.com Signed-off-by: Rafael J. Wysocki --- drivers/acpi/platform_profile.c | 82 ++++++++++++++++++++------------- 1 file changed, 49 insertions(+), 33 deletions(-) diff --git a/drivers/acpi/platform_profile.c b/drivers/acpi/platform_profile.c index 79d2e92e5c28..b4c91d57f3d4 100644 --- a/drivers/acpi/platform_profile.c +++ b/drivers/acpi/platform_profile.c @@ -8,15 +8,25 @@ #include #include #include +#include #include #include #include #define to_pprof_handler(d) (container_of(d, struct platform_profile_handler, dev)) +/* + * Protects profile_handlers membership and serializes profile operations + * against each other and handler removal. Never held across sysfs teardown, + * which can wait for callbacks that acquire this lock. + */ static DEFINE_MUTEX(profile_lock); +/* Serialize registration and sysfs updates without blocking sysfs callbacks. */ +static DEFINE_MUTEX(profile_registration_lock); +static LIST_HEAD(profile_handlers); struct platform_profile_handler { + struct list_head node; const char *name; struct device dev; int minor; @@ -44,6 +54,23 @@ static_assert(ARRAY_SIZE(profile_names) == PLATFORM_PROFILE_LAST); static DEFINE_IDA(platform_profile_ida); +static int profile_for_each_handler(void *data, + int (*fn)(struct device *dev, void *data)) +{ + struct platform_profile_handler *handler; + int ret; + + lockdep_assert_held(&profile_lock); + + list_for_each_entry(handler, &profile_handlers, node) { + ret = fn(&handler->dev, data); + if (ret) + return ret; + } + + return 0; +} + /** * _commmon_choices_show - Show the available profile choices * @choices: The available profile choices @@ -306,20 +333,18 @@ static ssize_t platform_profile_choices_show(struct kobject *kobj, int err; scoped_cond_guard(mutex_intr, return -ERESTARTSYS, &profile_lock) { - err = class_for_each_device(&platform_profile_class, NULL, - &data, _aggregate_choices); + err = profile_for_each_handler(&data, _aggregate_choices); if (err) return err; if (data.count == 1) { - err = class_for_each_device(&platform_profile_class, NULL, - &data, _remove_hidden_choices); + err = profile_for_each_handler(&data, _remove_hidden_choices); if (err) return err; } } /* no profile handler registered any more */ - if (bitmap_empty(data.aggregate, PLATFORM_PROFILE_LAST)) + if (!data.count || bitmap_empty(data.aggregate, PLATFORM_PROFILE_LAST)) return -EINVAL; return _commmon_choices_show(data.aggregate, buf); @@ -384,8 +409,7 @@ static ssize_t platform_profile_show(struct kobject *kobj, int err; scoped_cond_guard(mutex_intr, return -ERESTARTSYS, &profile_lock) { - err = class_for_each_device(&platform_profile_class, NULL, - &profile, _aggregate_profiles); + err = profile_for_each_handler(&profile, _aggregate_profiles); if (err) return err; } @@ -423,15 +447,13 @@ static ssize_t platform_profile_store(struct kobject *kobj, return -EINVAL; scoped_cond_guard(mutex_intr, return -ERESTARTSYS, &profile_lock) { - ret = class_for_each_device(&platform_profile_class, NULL, - &data, _aggregate_choices); + ret = profile_for_each_handler(&data, _aggregate_choices); if (ret) return ret; - if (!test_bit(i, data.aggregate)) + if (!data.count || !test_bit(i, data.aggregate)) return -EOPNOTSUPP; - ret = class_for_each_device(&platform_profile_class, NULL, &i, - _store_and_notify); + ret = profile_for_each_handler(&i, _store_and_notify); if (ret) return ret; } @@ -450,22 +472,11 @@ static struct attribute *platform_profile_attrs[] = { NULL }; -static int profile_class_registered(struct device *dev, const void *data) -{ - return 1; -} - static umode_t profile_class_is_visible(struct kobject *kobj, struct attribute *attr, int idx) { - struct device *dev; + guard(mutex)(&profile_lock); - dev = class_find_device(&platform_profile_class, NULL, NULL, profile_class_registered); - if (!dev) - return 0; - - put_device(dev); - - return attr->mode; + return list_empty(&profile_handlers) ? 0 : attr->mode; } static const struct attribute_group platform_profile_group = { @@ -502,8 +513,7 @@ int platform_profile_cycle(void) int err; scoped_cond_guard(mutex_intr, return -ERESTARTSYS, &profile_lock) { - err = class_for_each_device(&platform_profile_class, NULL, - &profile, _aggregate_profiles); + err = profile_for_each_handler(&profile, _aggregate_profiles); if (err) return err; @@ -512,8 +522,7 @@ int platform_profile_cycle(void) profile == PLATFORM_PROFILE_LAST) return -EINVAL; - err = class_for_each_device(&platform_profile_class, NULL, - &data, _aggregate_choices); + err = profile_for_each_handler(&data, _aggregate_choices); if (err) return err; @@ -525,8 +534,7 @@ int platform_profile_cycle(void) PLATFORM_PROFILE_LAST, profile + 1); - err = class_for_each_device(&platform_profile_class, NULL, &next, - _store_and_notify); + err = profile_for_each_handler(&next, _store_and_notify); if (err) return err; @@ -583,7 +591,7 @@ struct device *platform_profile_register(struct device *dev, const char *name, } } - guard(mutex)(&profile_lock); + guard(mutex)(&profile_registration_lock); /* create class interface for individual handler */ minor = ida_alloc(&platform_profile_ida, GFP_KERNEL); @@ -604,6 +612,8 @@ struct device *platform_profile_register(struct device *dev, const char *name, put_device(ppdev); goto cleanup_ida; } + scoped_guard(mutex, &profile_lock) + list_add_tail(&to_pprof_handler(ppdev)->node, &profile_handlers); sysfs_notify(acpi_kobj, NULL, "platform_profile"); @@ -614,6 +624,9 @@ struct device *platform_profile_register(struct device *dev, const char *name, return ppdev; cleanup_cur: + scoped_guard(mutex, &profile_lock) + list_del(&to_pprof_handler(ppdev)->node); + device_unregister(ppdev); cleanup_ida: @@ -636,7 +649,10 @@ void platform_profile_remove(struct device *dev) pprof = to_pprof_handler(dev); - guard(mutex)(&profile_lock); + guard(mutex)(&profile_registration_lock); + + scoped_guard(mutex, &profile_lock) + list_del(&pprof->node); ida_free(&platform_profile_ida, pprof->minor); device_unregister(&pprof->dev); From ec696f34774db985841bac9a2df179c0040ef073 Mon Sep 17 00:00:00 2001 From: Ivan Hu Date: Mon, 19 Oct 2026 16:54:17 +0200 Subject: [PATCH 6/8] ACPICA: Initialize parser_state.aml_end in acpi_install_method() In AcpiInstallMethod(), the local ParserState is stack-allocated and only ParserState.Aml was initialized. Parser helpers called by this path read ParserState.AmlEnd for bounds checking: AcpiPsPeekOpcode() reads it before validating the first AML opcode, and AcpiPsGetNextPackageEnd() reads it indirectly via AcpiPsGetNextPackageLength(). The subsequent package-limit check also compares against ParserState.AmlEnd. Because AmlEnd was never set, these checks operated on an uninitialized value, which Coverity flagged as an uninitialized read (CID 1684785) and which could lead to incorrect parser bounds decisions. Coverity report: *** CID 1684785: Memory - illegal accesses (UNINIT) /src/acpica/source/components/namespace/nsxfname.c: 712 in AcpiInstallMethod() ParserState.Aml += AcpiPsGetOpcodeSize (Opcode); >>> CID 1684785: Memory - illegal accesses (UNINIT) >>> Using uninitialized value "ParserState.AmlEnd" when calling "AcpiPsGetNextPackageEnd". ParserState.PkgEnd = AcpiPsGetNextPackageEnd (&ParserState); Initialize ParserState.AmlEnd to the end of the table (Buffer + Table->Length) so the parser bounds checks operate on a valid limit. Link: https://github.com/open-acpica/acpica/commit/19429ef91ebfb2144c918038dce13e297b4ef051 Fixes: bdc357540129 ("ACPICA: add boundary checks in two places") Signed-off-by: Ivan Hu Signed-off-by: Maciej Wieczor-Retman Signed-off-by: Leonard Lausen [ rjw: Subject tweaks ] Link: https://patch.msgid.link/20261019145421.47181-2-leonard@lausen.nl Signed-off-by: Rafael J. Wysocki --- drivers/acpi/acpica/nsxfname.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/acpi/acpica/nsxfname.c b/drivers/acpi/acpica/nsxfname.c index b6534187cd43..fcd94947fedb 100644 --- a/drivers/acpi/acpica/nsxfname.c +++ b/drivers/acpi/acpica/nsxfname.c @@ -503,6 +503,7 @@ acpi_status acpi_install_method(u8 *buffer) /* First AML opcode in the table must be a control method */ parser_state.aml = buffer + sizeof(struct acpi_table_header); + parser_state.aml_end = buffer + table->length; opcode = acpi_ps_peek_opcode(&parser_state); if (opcode != AML_METHOD_OP) { return (AE_BAD_PARAMETER); From 4d23d84ef2d04ba554b3063931dd12bed4223e1f Mon Sep 17 00:00:00 2001 From: Jamie Nguyen Date: Tue, 13 Oct 2026 11:07:28 -0700 Subject: [PATCH 7/8] ACPI: sysfs: Map only the requested range in acpi_data_show() acpi_data_show() maps the whole data region on every read(), although it copies at most count bytes and sysfs passes at most PAGE_SIZE bytes per call. acpi_os_unmap_iomem() defers the iounmap until after an RCU grace period, so a process reading one of these files in a loop keeps many full-size mappings in flight. Map only the range being read. acpi_os_map_iomem() rounds the mapping to page boundaries, so each mapping is now at most two pages, whatever the size of the region. A malformed table can describe a region that wraps around the end of the physical address space. acpi_os_map_iomem() doesn't check for that, and its lookup of existing mappings then matches an unrelated mapping, with or without this change. Fail reads of such a region before mapping anything. Signed-off-by: Jamie Nguyen Link: https://patch.msgid.link/20261013180728.957618-1-jamien@nvidia.com Signed-off-by: Rafael J. Wysocki --- drivers/acpi/sysfs.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/drivers/acpi/sysfs.c b/drivers/acpi/sysfs.c index a99373547126..c7188d506dda 100644 --- a/drivers/acpi/sysfs.c +++ b/drivers/acpi/sysfs.c @@ -420,6 +420,7 @@ static ssize_t acpi_data_show(struct file *filp, struct kobject *kobj, struct acpi_data_attr *data_attr; void __iomem *base; ssize_t size; + u64 end; data_attr = container_of(bin_attr, struct acpi_data_attr, attr); size = data_attr->attr.size; @@ -433,13 +434,17 @@ static ssize_t acpi_data_show(struct file *filp, struct kobject *kobj, if (count > size - offset) count = size - offset; - base = acpi_os_map_iomem(data_attr->addr, size); + /* acpi_os_map_iomem() can't handle a range that wraps around */ + if (check_add_overflow(data_attr->addr, size, &end)) + return -EINVAL; + + base = acpi_os_map_iomem(data_attr->addr + offset, count); if (!base) return -ENOMEM; - memcpy_fromio(buf, base + offset, count); + memcpy_fromio(buf, base, count); - acpi_os_unmap_iomem(base, size); + acpi_os_unmap_iomem(base, count); return count; } From f54ec8af333761e3bf6c2d347e1053d9fca8db6e Mon Sep 17 00:00:00 2001 From: Jamie Nguyen Date: Tue, 13 Oct 2026 12:39:00 -0700 Subject: [PATCH 8/8] ACPI: sysfs: Finish sysfs init when creating a table file fails If creating the file for a table fails, acpi_tables_sysfs_init() returns without sending the uevents for the tables directories, and acpi_sysfs_init() returns before creating the hotplug and pm_profile files. Stop creating table files at that point, but finish the rest of the initialization. Skipping only the failed table would give its file name to the next table with the same signature, so reading that file would return the failed table. Signed-off-by: Jamie Nguyen Link: https://patch.msgid.link/20261013193900.1258808-1-jamien@nvidia.com Signed-off-by: Rafael J. Wysocki --- drivers/acpi/sysfs.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/drivers/acpi/sysfs.c b/drivers/acpi/sysfs.c index c7188d506dda..a4534b3e3cfb 100644 --- a/drivers/acpi/sysfs.c +++ b/drivers/acpi/sysfs.c @@ -516,7 +516,6 @@ static int acpi_tables_sysfs_init(void) struct acpi_table_header *table_header = NULL; int table_index; acpi_status status; - int ret; tables_kobj = kobject_create_and_add("tables", acpi_kobj); if (!tables_kobj) @@ -541,13 +540,11 @@ static int acpi_tables_sysfs_init(void) table_attr = kzalloc_obj(*table_attr); if (!table_attr) - return -ENOMEM; + break; - ret = acpi_table_attr_init(tables_kobj, - table_attr, table_header); - if (ret) { + if (acpi_table_attr_init(tables_kobj, table_attr, table_header)) { kfree(table_attr); - return ret; + break; } list_add_tail(&table_attr->node, &acpi_table_attr_list); acpi_table_data_init(table_header, table_attr);