From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 66856C43602 for ; Wed, 8 Jul 2026 09:00:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender:List-Subscribe:List-Help :List-Post:List-Archive:List-Unsubscribe:List-Id:Cc:To:In-Reply-To:References :Message-Id:Content-Transfer-Encoding:Content-Type:MIME-Version:Subject:Date: From:Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=BybbGgDiYgbz9TZX1FD4MxIQneZDoTZK5llcNLbHG8c=; b=yW0yvZRx788dp52yzgLj2t5FPT FJfxuEY6voPl7jIl+LjA7u6G706vrbCvqDvRCQoDCVNRc8c8hD/HHpkfiURyj9pVKPCnbwWx3qpRF MT7DSL/gbyPnfJeXAf8rqPZxqsSzQLEWtQHnQJkQ7oHWn1qdsXHgdm7SJKWRsu7QBjGJ/m1itrk/i GhFkfadQ7lPsiuKpJ2BoGbiW37uQnBZDDqCS8ABiuyY7fSrlEe8RJCtF4Avsc+BtvGlpg7CnIfGfb /4giTIJAP3jz0k0yZIH9p3cgle5bLFiqHAHlI5MkXXgEPYfQYHwUF6IHhUUnj8sXhIwzbBk5Tccwf EU7d7weA==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.99.1 #2 (Red Hat Linux)) id 1whO9B-0000000GgED-0nPK; Wed, 08 Jul 2026 09:00:49 +0000 Received: from sea.source.kernel.org ([2600:3c0a:e001:78e:0:1991:8:25]) by bombadil.infradead.org with esmtps (Exim 4.99.1 #2 (Red Hat Linux)) id 1whO8w-0000000Gfxd-3fw8 for linux-arm-kernel@lists.infradead.org; Wed, 08 Jul 2026 09:00:35 +0000 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) by sea.source.kernel.org (Postfix) with ESMTP id A186043D6E; Wed, 8 Jul 2026 09:00:34 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id F2EF71F00A3A; Wed, 8 Jul 2026 09:00:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1783501234; bh=BybbGgDiYgbz9TZX1FD4MxIQneZDoTZK5llcNLbHG8c=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=i3RUqeVUGYa7012mJuLHBrb4cf5FE3G2MDlS89NcgC6xE+mIgTJc5IxeoaNqZQTm6 3T9rgtXKD/Lkn2oezaPtyIIvHJO0sP0mXqFxMZk/7jdC69fPzgVksr76EZ9HmtzPUi jQmLyk/SGhsShNGihsLOA2tFCdRcScSf6wPnD8tesW43uOcciN4oQowhqdOcJqBl4O hppYJ2M8nrN5BPKguHf8gIdraBSQHuW+IGwZ2P83ggyBL9pzP/ss8qTV3XKBSWIQaq /rtxJbWhfUFVDB8U4adEeffiXoiUdlUvVeFKzj5IiEEv1TCcnPda5/ZFwshKRLmHq/ 6qc9FXPurm6PQ== From: Sudeep Holla Date: Wed, 08 Jul 2026 10:00:06 +0100 Subject: [PATCH v4 10/16] firmware: arm_scmi: Drop handle on protocol bind failures MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-Id: <20260708-scmi_core_fixes-v4-10-53142cd60b63@kernel.org> References: <20260708-scmi_core_fixes-v4-0-53142cd60b63@kernel.org> In-Reply-To: <20260708-scmi_core_fixes-v4-0-53142cd60b63@kernel.org> To: arm-scmi@vger.kernel.org, linux-arm-kernel@lists.infradead.org Cc: Cristian Marussi X-Mailer: b4 0.15.2 X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org The SCMI bus notifier acquires an SCMI handle when the driver core emits BUS_NOTIFY_BIND_DRIVER, before invoking the protocol driver probe callback. The protocol probe path only checks whether sdev->handle is set. If device_link_add() fails after the handle has been acquired, the protocol device can still bind with a valid handle but without the dependency link to the SCMI parent. A concurrent parent unbind can then miss the child and tear down the SCMI instance while the child still holds a handle into it. If the protocol driver probe later fails, for example with -EPROBE_DEFER, the driver core emits BUS_NOTIFY_DRIVER_NOT_BOUND rather than BUS_NOTIFY_UNBOUND_DRIVER. The SCMI notifier only released the handle on BUS_NOTIFY_UNBOUND_DRIVER, so each failed protocol-device bind leaked the SCMI instance users refcount and left sdev->handle set after the failed probe. Make the link helper report failure and drop the acquired handle if the link cannot be created. Also handle BUS_NOTIFY_DRIVER_NOT_BOUND in the same cleanup path used for unbind so failed probes balance the earlier BUS_NOTIFY_BIND_DRIVER acquisition. Fixes: 971fc0665f13 ("firmware: arm_scmi: Move handle get/set helpers") Reported-by: Sashiko Signed-off-by: Sudeep Holla --- drivers/firmware/arm_scmi/driver.c | 31 +++++++++++++++++++++++-------- 1 file changed, 23 insertions(+), 8 deletions(-) diff --git a/drivers/firmware/arm_scmi/driver.c b/drivers/firmware/arm_scmi/driver.c index 73cfe2eaacea..3e0f0fac9626 100644 --- a/drivers/firmware/arm_scmi/driver.c +++ b/drivers/firmware/arm_scmi/driver.c @@ -2629,21 +2629,31 @@ static int scmi_handle_put(const struct scmi_handle *handle) return 0; } -static void scmi_device_link_add(struct device *consumer, +static bool scmi_device_link_add(struct device *consumer, struct device *supplier) { struct device_link *link; link = device_link_add(consumer, supplier, DL_FLAG_AUTOREMOVE_CONSUMER); - WARN_ON(!link); + return !WARN_ON(!link); +} + +static void scmi_clear_handle(struct scmi_device *scmi_dev) +{ + if (!scmi_dev->handle) + return; + + scmi_handle_put(scmi_dev->handle); + scmi_dev->handle = NULL; } static void scmi_set_handle(struct scmi_device *scmi_dev) { scmi_dev->handle = scmi_handle_get(&scmi_dev->dev); - if (scmi_dev->handle) - scmi_device_link_add(&scmi_dev->dev, scmi_dev->handle->dev); + if (scmi_dev->handle && + !scmi_device_link_add(&scmi_dev->dev, scmi_dev->handle->dev)) + scmi_clear_handle(scmi_dev); } static int __scmi_xfer_info_init(struct scmi_info *sinfo, @@ -2927,6 +2937,7 @@ static int scmi_bus_notifier(struct notifier_block *nb, { struct scmi_info *info = bus_nb_to_scmi_info(nb); struct scmi_device *sdev = to_scmi_dev(data); + const char *status; /* Skip devices of different SCMI instances */ if (sdev->dev.parent != info->dev) @@ -2936,18 +2947,22 @@ static int scmi_bus_notifier(struct notifier_block *nb, case BUS_NOTIFY_BIND_DRIVER: /* setup handle now as the transport is ready */ scmi_set_handle(sdev); + status = "about to be BOUND."; + break; + case BUS_NOTIFY_DRIVER_NOT_BOUND: + scmi_clear_handle(sdev); + status = "NOT BOUND."; break; case BUS_NOTIFY_UNBOUND_DRIVER: - scmi_handle_put(sdev->handle); - sdev->handle = NULL; + scmi_clear_handle(sdev); + status = "UNBOUND."; break; default: return NOTIFY_DONE; } dev_dbg(info->dev, "Device %s (%s) is now %s\n", dev_name(&sdev->dev), - sdev->name, action == BUS_NOTIFY_BIND_DRIVER ? - "about to be BOUND." : "UNBOUND."); + sdev->name, status); return NOTIFY_OK; } -- 2.43.0