Re: [PATCH v4 01/10] gpio: mxc: fix race between chained IRQ handler install and probe completion

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] gpio: mxc: data race on mxc_gpio_ports list during concurrent probe and shared IRQ
--

commit bd719d33a26c1f816073bbdb04f543bc3f5ed730
Author: Peng Fan <peng.fan@nxp.com>

gpio: mxc: fix race between chained IRQ handler install and probe completion

mxc_update_irq_chained_handler() is called before the IRQ domain, the
generic IRQ chip, and the port list entry are set up. If an interrupt
arrives in that window, it leads to a crash or missing port. This commit
moves the handler installation after all dependencies are ready.

> diff --git a/drivers/gpio/gpio-mxc.c b/drivers/gpio/gpio-mxc.c
> index 7e2690d92df6f..e05f276a50e8d 100644
> --- a/drivers/gpio/gpio-mxc.c
> +++ b/drivers/gpio/gpio-mxc.c

[ ... ]

> @@ -525,6 +523,8 @@ static int mxc_gpio_probe(struct platform_device *pdev)
>  
>  	list_add_tail(&port->node, &mxc_gpio_ports);
>  

[Severity: High]
For fsl,imx21-gpio devices, all ports share a single parent IRQ. After the
first port probes, the shared chained handler (mx2_gpio_irq_handler)
becomes active.

When a subsequent port is probed, list_add_tail() mutates the global
mxc_gpio_ports list without any spinlocks or RCU primitives.

If an interrupt fires concurrently on the shared parent IRQ, the handler
running on another CPU will traverse the actively mutating list:

drivers/gpio/gpio-mxc.c:mx2_gpio_irq_handler() {
    ...
    list_for_each_entry(port, &mxc_gpio_ports, node) {
    ...
}

Can this lockless traversal of a list undergoing non-atomic mutation cause
pointer corruption or an immediate crash?

> +	mxc_update_irq_chained_handler(port, true);
> +
>  	platform_set_drvdata(pdev, port);
>  	pm_runtime_put_autosuspend(&pdev->dev);
>

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261007-gpio-mxc-cleanup-v4-0-c9f5a8b50df9@nxp.com?part=1