Re: [PATCH v5 01/13] gpio: mxc: fix race between chained IRQ handler install and probe completion

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] gpio: mxc: lockless mxc_gpio_ports list race with shared IRQ handler
--

commit cfebba0884b34920e4ae09750fb2bbf30c42ba32
Author: Peng Fan <peng.fan@nxp.com>

gpio: mxc: fix race between chained IRQ handler install and probe completion

This commit delays installing the chained IRQ handler in mxc_gpio_probe()
until after the generic IRQ chip, port list entry, and IRQ domain are fully
setup. This ensures the handler does not execute while data structures are
incomplete and prevents leaving a dangling handler if probe fails.

> diff --git a/drivers/gpio/gpio-mxc.c b/drivers/gpio/gpio-mxc.c
> index 7e2690d92df6f..e05f276a50e8d 100644
> --- a/drivers/gpio/gpio-mxc.c
> +++ b/drivers/gpio/gpio-mxc.c
[ ... ]
> @@ -525,6 +523,8 @@ static int mxc_gpio_probe(struct platform_device *pdev)
>  
>  	list_add_tail(&port->node, &mxc_gpio_ports);
>  
> +	mxc_update_irq_chained_handler(port, true);
> +

[Severity: High]
Does this still leave a race condition for shared IRQs?

On i.MX21/i.MX27, all GPIO ports share the same parent IRQ. When the first
port probes, it registers mx2_gpio_irq_handler for the shared IRQ, enabling
it.

When the second port probes, it calls list_add_tail() to add itself to
mxc_gpio_ports. If an interrupt arrives concurrently on the already-active
first port, mx2_gpio_irq_handler() iterates over mxc_gpio_ports locklessly in
hardirq context.

Since list_add_tail() uses non-atomic pointer updates without compiler or
memory barriers (unlike list_add_rcu), could the active IRQ handler traverse a
corrupted list if it preempts the update, dereferencing invalid memory?

While moving the handler installation prevents races for the first port, for
shared IRQs the handler is already live. This leaves the lockless list
mutation race unresolved.

>  	platform_set_drvdata(pdev, port);
>  	pm_runtime_put_autosuspend(&pdev->dev);
>

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261010-gpio-mxc-cleanup-v5-0-1e59e6ddfa00@nxp.com?part=1