From: Charles Keepax <ckeepax@opensource.cirrus.com>
To: Lee Jones <lee@kernel.org>
Cc: Vinod Koul <vkoul@kernel.org>,
Bard Liao <yung-chuan.liao@linux.intel.com>,
Pierre-Louis Bossart <pierre-louis.bossart@linux.dev>,
linux-sound@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH v2 01/10] soundwire: bus: Hold bus_lock when looking up slave devices
Date: Fri, 13 Nov 2026 16:42:48 +0000 [thread overview]
Message-ID: <avc+COuQMX74xTHD@opensource.cirrus.com> (raw)
In-Reply-To: <20261103095445.81414-2-lee@kernel.org>
On Tue, Nov 03, 2026 at 09:53:45AM +0000, Lee Jones wrote:
> sdw_get_slave() iterates over bus->slaves and requires bus->bus_lock to
> be held by the caller. However, sdw_handle_slave_status() and
> sdw_clear_slave_status() drop bus->bus_lock immediately before calling
> sdw_get_slave(). If a concurrent slave teardown unlinks the node via
> list_del_init() and frees the slave while bus->bus_lock is dropped,
> sdw_get_slave() can spin forever on the self-referential list entry or
> dereference freed memory.
>
> Keep bus->bus_lock held across the sdw_get_slave() lookup in
> sdw_handle_slave_status() and sdw_clear_slave_status().
>
> Closes: https://sashiko.dev/#/bug/linux-b0e65a93-dfd4-4e3d-a96c-8f13ba0aafd2
> Signed-off-by: Lee Jones <lee@kernel.org>
> ---
Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Tested-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Thanks,
Charles
next prev parent reply other threads:[~2026-11-13 16:46 UTC|newest]
Thread overview: 24+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-11-03 9:53 [PATCH v2 00/10] soundwire: Fix Critical and High issues reported by Sashiko Lee Jones
2026-11-03 9:53 ` [PATCH v2 01/10] soundwire: bus: Hold bus_lock when looking up slave devices Lee Jones
2026-11-07 9:41 ` HyeongJun An
2026-11-13 16:42 ` Charles Keepax [this message]
2026-11-03 9:53 ` [PATCH v2 02/10] soundwire: sysfs: Use sysfs_emit_at() in array show callbacks Lee Jones
2026-11-07 9:42 ` HyeongJun An
2026-11-13 16:44 ` Charles Keepax
2026-11-03 9:53 ` [PATCH v2 03/10] soundwire: stream: Prevent m_rt_count underflow in sdw_stream_remove_master() Lee Jones
2026-11-07 9:42 ` HyeongJun An
2026-11-13 16:53 ` Charles Keepax
2026-11-03 9:53 ` [PATCH v2 04/10] soundwire: stream: Clean up allocated runtime resources on config failure Lee Jones
2026-11-03 10:13 ` sashiko-bot
2026-11-03 11:09 ` Lee Jones
2026-11-07 9:42 ` HyeongJun An
2026-11-13 17:00 ` Charles Keepax
2026-11-03 9:53 ` [PATCH v2 05/10] soundwire: intel_ace2x: Protect bus.bpt_stream with bus_lock Lee Jones
2026-11-03 9:53 ` [PATCH v2 06/10] soundwire: qcom: Prevent pconfig buffer overflow in qcom_swrm_stream_alloc_ports() Lee Jones
2026-11-03 10:26 ` sashiko-bot
2026-11-03 9:53 ` [PATCH v2 07/10] soundwire: qcom: Disable runtime PM and avoid clock underflow in qcom_swrm_remove() Lee Jones
2026-11-03 9:53 ` [PATCH v2 08/10] soundwire: qcom: Check clk_prepare_enable() return value Lee Jones
2026-11-03 9:53 ` [PATCH v2 09/10] soundwire: qcom: Serialise ctrl->intr_mask updates Lee Jones
2026-11-03 9:53 ` [PATCH v2 10/10] soundwire: qcom: Prevent stale broadcast IRQ from completing subsequent command Lee Jones
2026-11-07 9:41 ` [PATCH v2 00/10] soundwire: Fix Critical and High issues reported by Sashiko HyeongJun An
2026-11-10 9:04 ` Lee Jones
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=avc+COuQMX74xTHD@opensource.cirrus.com \
--to=ckeepax@opensource.cirrus.com \
--cc=lee@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-sound@vger.kernel.org \
--cc=pierre-louis.bossart@linux.dev \
--cc=vkoul@kernel.org \
--cc=yung-chuan.liao@linux.intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.