Re: [PATCH 06/11] gpio: Add NVIDIA LSTP GPIO driver

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] core: module unload race in lstp_gpio_leds_release() waking module_exit
--

commit 4aeddbd8eb4f935f2de9273a79a09c2407988002
Author: Adrian Ambrozewicz <aambrozewicz@nvidia.com>

gpio: Add NVIDIA LSTP GPIO driver

Add a driver for the GPIO channels of NVIDIA LSTP USB adapters. Each
channel is registered as a GPIO chip with an interrupt controller for
its pins. Pins the firmware reports as LEDs are handed to the LED driver
as an auxiliary device.

> diff --git a/drivers/gpio/gpio-lstp.c b/drivers/gpio/gpio-lstp.c
> new file mode 100644
> index 0000000000000..cc988a09582b0
> --- /dev/null
> +++ b/drivers/gpio/gpio-lstp.c
[ ... ]
> +static void lstp_gpio_leds_release(struct device *dev)
> +{
> +	struct lstp_leds *leds = container_of(to_auxiliary_dev(dev), struct lstp_leds, auxdev);
> +	struct device *parent = leds->ch->dev;
> +
> +	kfree(leds);
> +	put_device(parent);
> +	if (atomic_dec_and_test(&lstp_gpio_live_leds))
> +		wake_up_var(&lstp_gpio_live_leds);
> +}

[Severity: High]
Does this create a module unload race condition?

If a user-space process holds an active sysfs reference to the LED auxiliary
device, the device release callback is delayed until userspace drops its
reference (for example, closing a file descriptor). By this time, the rmmod
command could be executing and waiting in lstp_gpio_module_exit().

When lstp_gpio_leds_release() wakes up the module_exit waiter, the rmmod
thread finishes and the kernel unmaps the module's text memory. However, the
thread running the release callback is still executing the epilogue of
lstp_gpio_leds_release(), which resides in this module.

Returning to unmapped memory causes a kernel panic. A device release function
must not wake the module_exit thread that unloads its own code.

[ ... ]
> +/* The unregister unbinds every channel, which deletes its LED child. */
> +static void __exit lstp_gpio_module_exit(void)
> +{
> +	lstp_auxiliary_driver_unregister(&lstp_gpio_drv);
> +	wait_var_event(&lstp_gpio_live_leds, !atomic_read(&lstp_gpio_live_leds));
> +}
> +module_exit(lstp_gpio_module_exit);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261012-lstp-usb-adapter-v1-0-aambrozewicz@nvidia.com?part=6