[PATCH 0/2] gpio: use raw spinlocks in irq startup paths

[PATCH 0/2] gpio: use raw spinlocks in irq startup paths

[Runyu Xiao]

This 2-patch series fixes two GPIO irqchip paths where IRQ startup or
unmask can update controller state under a regular spinlock.  On
PREEMPT_RT, that lock can sleep while irq_startup() is running in a
non-sleepable context.

Both issues were found by our static analysis tool and then manually
reviewed against the current tree.  The grounded PoCs kept the
request_threaded_irq() -> __setup_irq() -> irq_startup() carriers and
Lockdep reported "BUG: sleeping function called from invalid context" on
the corresponding driver update helpers.

Convert the affected register locks to raw_spinlock_t.  The locked
sections only serialize MMIO register access and irqchip state updates,
so they should remain non-sleeping.  The conversion does not move any
sleepable operation under a raw lock; it preserves the existing short
register-critical sections while making their non-sleeping requirement
explicit for PREEMPT_RT.

Runyu Xiao (2):
  gpio: sch: use raw_spinlock_t in the irq startup path
  gpio: eic-sprd: use raw_spinlock_t in the irq startup path

 drivers/gpio/gpio-eic-sprd.c |  8 ++++----
 drivers/gpio/gpio-sch.c      | 32 ++++++++++++++++----------------
 2 files changed, 20 insertions(+), 20 deletions(-)

-- 
2.34.1

[PATCH 1/2] gpio: sch: use raw_spinlock_t in the irq startup path

[Runyu Xiao]

sch_irq_unmask() enables the GPIO IRQ and then updates the controller
state through sch_irq_mask_unmask(), which takes sch->lock with
spin_lock_irqsave().  The callback can be reached from irq_startup()
while setting up a requested IRQ.  That path is not sleepable, but on
PREEMPT_RT a regular spinlock_t becomes a sleeping lock.

This issue was found by our static analysis tool and then manually
reviewed against the current tree.

The grounded PoC kept the request_threaded_irq() -> __setup_irq() ->
irq_startup() -> sch_irq_unmask() -> sch_irq_mask_unmask() carrier and
used the original spin_lock_irqsave(&sch->lock) edge.  Lockdep reported:

  BUG: sleeping function called from invalid context
  hardirqs last disabled at ... __setup_irq.constprop.0 ... [vuln_msv]
  sch_rt_spin_lock_irqsave+0x1c/0x30 [vuln_msv]
  sch_irq_mask_unmask.constprop.0+0x31/0x70 [vuln_msv]
  __setup_irq.constprop.0+0xd/0x30 [vuln_msv]

Convert the SCH controller lock to raw_spinlock_t.  The same lock is
also used by the GPIO direction and value callbacks, but those critical
sections only update MMIO-backed GPIO registers and do not contain
sleepable operations.  Keeping this register lock non-sleeping is
therefore appropriate for the irqchip callbacks and does not change the
GPIO-side locking contract.

Fixes: 7a81638485c1 ("gpio: sch: Add edge event support")
Cc: stable@vger.kernel.org
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
---
 drivers/gpio/gpio-sch.c | 32 ++++++++++++++++----------------
 1 file changed, 16 insertions(+), 16 deletions(-)

diff --git a/drivers/gpio/gpio-sch.c b/drivers/gpio/gpio-sch.c
index 966d16a6d515..5e361742a11a 100644
--- a/drivers/gpio/gpio-sch.c
+++ b/drivers/gpio/gpio-sch.c
@@ -39,7 +39,7 @@
 struct sch_gpio {
 	struct gpio_chip chip;
 	void __iomem *regs;
-	spinlock_t lock;
+	raw_spinlock_t lock;
 	unsigned short resume_base;
 
 	/* GPE handling */
@@ -104,9 +104,9 @@ static int sch_gpio_direction_in(struct gpio_chip *gc, unsigned int gpio_num)
 	struct sch_gpio *sch = gpiochip_get_data(gc);
 	unsigned long flags;
 
-	spin_lock_irqsave(&sch->lock, flags);
+	raw_spin_lock_irqsave(&sch->lock, flags);
 	sch_gpio_reg_set(sch, gpio_num, GIO, 1);
-	spin_unlock_irqrestore(&sch->lock, flags);
+	raw_spin_unlock_irqrestore(&sch->lock, flags);
 	return 0;
 }
 
@@ -122,9 +122,9 @@ static int sch_gpio_set(struct gpio_chip *gc, unsigned int gpio_num, int val)
 	struct sch_gpio *sch = gpiochip_get_data(gc);
 	unsigned long flags;
 
-	spin_lock_irqsave(&sch->lock, flags);
+	raw_spin_lock_irqsave(&sch->lock, flags);
 	sch_gpio_reg_set(sch, gpio_num, GLV, val);
-	spin_unlock_irqrestore(&sch->lock, flags);
+	raw_spin_unlock_irqrestore(&sch->lock, flags);
 
 	return 0;
 }
@@ -135,9 +135,9 @@ static int sch_gpio_direction_out(struct gpio_chip *gc, unsigned int gpio_num,
 	struct sch_gpio *sch = gpiochip_get_data(gc);
 	unsigned long flags;
 
-	spin_lock_irqsave(&sch->lock, flags);
+	raw_spin_lock_irqsave(&sch->lock, flags);
 	sch_gpio_reg_set(sch, gpio_num, GIO, 0);
-	spin_unlock_irqrestore(&sch->lock, flags);
+	raw_spin_unlock_irqrestore(&sch->lock, flags);
 
 	/*
 	 * according to the datasheet, writing to the level register has no
@@ -196,14 +196,14 @@ static int sch_irq_type(struct irq_data *d, unsigned int type)
 		return -EINVAL;
 	}
 
-	spin_lock_irqsave(&sch->lock, flags);
+	raw_spin_lock_irqsave(&sch->lock, flags);
 
 	sch_gpio_reg_set(sch, gpio_num, GTPE, rising);
 	sch_gpio_reg_set(sch, gpio_num, GTNE, falling);
 
 	irq_set_handler_locked(d, handle_edge_irq);
 
-	spin_unlock_irqrestore(&sch->lock, flags);
+	raw_spin_unlock_irqrestore(&sch->lock, flags);
 
 	return 0;
 }
@@ -215,9 +215,9 @@ static void sch_irq_ack(struct irq_data *d)
 	irq_hw_number_t gpio_num = irqd_to_hwirq(d);
 	unsigned long flags;
 
-	spin_lock_irqsave(&sch->lock, flags);
+	raw_spin_lock_irqsave(&sch->lock, flags);
 	sch_gpio_reg_set(sch, gpio_num, GTS, 1);
-	spin_unlock_irqrestore(&sch->lock, flags);
+	raw_spin_unlock_irqrestore(&sch->lock, flags);
 }
 
 static void sch_irq_mask_unmask(struct gpio_chip *gc, irq_hw_number_t gpio_num, int val)
@@ -225,9 +225,9 @@ static void sch_irq_mask_unmask(struct gpio_chip *gc, irq_hw_number_t gpio_num,
 	struct sch_gpio *sch = gpiochip_get_data(gc);
 	unsigned long flags;
 
-	spin_lock_irqsave(&sch->lock, flags);
+	raw_spin_lock_irqsave(&sch->lock, flags);
 	sch_gpio_reg_set(sch, gpio_num, GGPE, val);
-	spin_unlock_irqrestore(&sch->lock, flags);
+	raw_spin_unlock_irqrestore(&sch->lock, flags);
 }
 
 static void sch_irq_mask(struct irq_data *d)
@@ -268,12 +268,12 @@ static u32 sch_gpio_gpe_handler(acpi_handle gpe_device, u32 gpe, void *context)
 	int offset;
 	u32 ret;
 
-	spin_lock_irqsave(&sch->lock, flags);
+	raw_spin_lock_irqsave(&sch->lock, flags);
 
 	core_status = ioread32(sch->regs + CORE_BANK_OFFSET + GTS);
 	resume_status = ioread32(sch->regs + RESUME_BANK_OFFSET + GTS);
 
-	spin_unlock_irqrestore(&sch->lock, flags);
+	raw_spin_unlock_irqrestore(&sch->lock, flags);
 
 	pending = (resume_status << sch->resume_base) | core_status;
 	for_each_set_bit(offset, &pending, sch->chip.ngpio)
@@ -343,7 +343,7 @@ static int sch_gpio_probe(struct platform_device *pdev)
 
 	sch->regs = regs;
 
-	spin_lock_init(&sch->lock);
+	raw_spin_lock_init(&sch->lock);
 	sch->chip = sch_gpio_chip;
 	sch->chip.label = dev_name(dev);
 	sch->chip.parent = dev;
-- 
2.34.1

Re: [PATCH 1/2] gpio: sch: use raw_spinlock_t in the irq startup path

[Andy Shevchenko]

On Wed, Jun 17, 2026 at 11:40:34PM +0800, Runyu Xiao wrote:
> sch_irq_unmask() enables the GPIO IRQ and then updates the controller
> state through sch_irq_mask_unmask(), which takes sch->lock with
> spin_lock_irqsave().  The callback can be reached from irq_startup()
> while setting up a requested IRQ.  That path is not sleepable, but on
> PREEMPT_RT a regular spinlock_t becomes a sleeping lock.
> 
> This issue was found by our static analysis tool and then manually
> reviewed against the current tree.
> 
> The grounded PoC kept the request_threaded_irq() -> __setup_irq() ->
> irq_startup() -> sch_irq_unmask() -> sch_irq_mask_unmask() carrier and
> used the original spin_lock_irqsave(&sch->lock) edge.  Lockdep reported:
> 
>   BUG: sleeping function called from invalid context
>   hardirqs last disabled at ... __setup_irq.constprop.0 ... [vuln_msv]
>   sch_rt_spin_lock_irqsave+0x1c/0x30 [vuln_msv]
>   sch_irq_mask_unmask.constprop.0+0x31/0x70 [vuln_msv]
>   __setup_irq.constprop.0+0xd/0x30 [vuln_msv]
> 
> Convert the SCH controller lock to raw_spinlock_t.  The same lock is
> also used by the GPIO direction and value callbacks, but those critical
> sections only update MMIO-backed GPIO registers and do not contain
> sleepable operations.  Keeping this register lock non-sleeping is
> therefore appropriate for the irqchip callbacks and does not change the
> GPIO-side locking contract.

Okay, no objection.

Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>

Bart, you can take it to your branch directly in case it's not too late
for getting into v7.2-rc1, otherwise I can take via my branch and then PR
somewhere near -rc2.

-- 
With Best Regards,
Andy Shevchenko

Re: [PATCH 1/2] gpio: sch: use raw_spinlock_t in the irq startup path

[Sebastian Andrzej Siewior]

On 2026-06-17 23:40:34 [+0800], Runyu Xiao wrote:
> sch_irq_unmask() enables the GPIO IRQ and then updates the controller
> state through sch_irq_mask_unmask(), which takes sch->lock with
> spin_lock_irqsave().  The callback can be reached from irq_startup()
> while setting up a requested IRQ.  That path is not sleepable, but on
> PREEMPT_RT a regular spinlock_t becomes a sleeping lock.
…
> Fixes: 7a81638485c1 ("gpio: sch: Add edge event support")
> Cc: stable@vger.kernel.org
> Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>

Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>

Sebastian

Re: [PATCH 1/2] gpio: sch: use raw_spinlock_t in the irq startup path

[Andy Shevchenko]

On Thu, Jun 18, 2026 at 08:28:39AM +0200, Sebastian Andrzej Siewior wrote:
> On 2026-06-17 23:40:34 [+0800], Runyu Xiao wrote:
> > sch_irq_unmask() enables the GPIO IRQ and then updates the controller
> > state through sch_irq_mask_unmask(), which takes sch->lock with
> > spin_lock_irqsave().  The callback can be reached from irq_startup()
> > while setting up a requested IRQ.  That path is not sleepable, but on
> > PREEMPT_RT a regular spinlock_t becomes a sleeping lock.
> …
> > Fixes: 7a81638485c1 ("gpio: sch: Add edge event support")
> > Cc: stable@vger.kernel.org
> > Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
> 
> Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>

There is already a v2.

-- 
With Best Regards,
Andy Shevchenko

Re: [PATCH 1/2] gpio: sch: use raw_spinlock_t in the irq startup path

[Andy Shevchenko]

On Thu, Jun 18, 2026 at 09:40:31AM +0300, Andy Shevchenko wrote:
> On Thu, Jun 18, 2026 at 08:28:39AM +0200, Sebastian Andrzej Siewior wrote:
> > On 2026-06-17 23:40:34 [+0800], Runyu Xiao wrote:
> > > sch_irq_unmask() enables the GPIO IRQ and then updates the controller
> > > state through sch_irq_mask_unmask(), which takes sch->lock with
> > > spin_lock_irqsave().  The callback can be reached from irq_startup()
> > > while setting up a requested IRQ.  That path is not sleepable, but on
> > > PREEMPT_RT a regular spinlock_t becomes a sleeping lock.
…
> > > Fixes: 7a81638485c1 ("gpio: sch: Add edge event support")
> > > Cc: stable@vger.kernel.org
> > > Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
> > 
> > Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
> 
> There is already a v2.

Or not... I might have been confused with other patch that got two versions
in a row.

-- 
With Best Regards,
Andy Shevchenko

Re: [PATCH 1/2] gpio: sch: use raw_spinlock_t in the irq startup path

[Sebastian Andrzej Siewior]

On 2026-06-18 09:41:50 [+0300], Andy Shevchenko wrote:
> On Thu, Jun 18, 2026 at 09:40:31AM +0300, Andy Shevchenko wrote:
> > On Thu, Jun 18, 2026 at 08:28:39AM +0200, Sebastian Andrzej Siewior wrote:
> > > On 2026-06-17 23:40:34 [+0800], Runyu Xiao wrote:
> > > > sch_irq_unmask() enables the GPIO IRQ and then updates the controller
> > > > state through sch_irq_mask_unmask(), which takes sch->lock with
> > > > spin_lock_irqsave().  The callback can be reached from irq_startup()
> > > > while setting up a requested IRQ.  That path is not sleepable, but on
> > > > PREEMPT_RT a regular spinlock_t becomes a sleeping lock.
> …
> > > > Fixes: 7a81638485c1 ("gpio: sch: Add edge event support")
> > > > Cc: stable@vger.kernel.org
> > > > Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
> > > 
> > > Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
> > 
> > There is already a v2.
> 
> Or not... I might have been confused with other patch that got two versions
> in a row.

I am catching up so I wouldn't be surprised ;) And it is entirely
possible that sashiko came up with the pre-existing condition worth
fixing ;)

Sebastian

[PATCH 2/2] gpio: eic-sprd: use raw_spinlock_t in the irq startup path

[Runyu Xiao]

sprd_eic_irq_unmask() enables the GPIO IRQ and then updates controller
state through sprd_eic_update(), which takes sprd_eic->lock with
spin_lock_irqsave().  The callback can be reached from irq_startup()
while setting up a requested IRQ.  That path is not sleepable, but on
PREEMPT_RT a regular spinlock_t becomes a sleeping lock.

This issue was found by our static analysis tool and then manually
reviewed against the current tree.

The grounded PoC kept the request_threaded_irq() -> __setup_irq() ->
irq_startup() -> sprd_eic_irq_unmask() -> sprd_eic_update() carrier and
used the original spin_lock_irqsave(&sprd_eic->lock) edge.  Lockdep
reported:

  BUG: sleeping function called from invalid context
  hardirqs last disabled at ... __setup_irq.constprop.0 ... [vuln_msv]
  sprd_rt_spin_lock_irqsave+0x1c/0x30 [vuln_msv]
  sprd_eic_update.constprop.0+0x48/0x90 [vuln_msv]
  sprd_eic_irq_unmask.constprop.0+0x35/0x50 [vuln_msv]
  __setup_irq.constprop.0+0xd/0x30 [vuln_msv]

Convert the Spreadtrum EIC controller lock to raw_spinlock_t.  The
locked section only serializes MMIO register updates and does not contain
sleepable operations, so keeping it non-sleeping is appropriate for the
irqchip callbacks.

Fixes: 25518e024e3a ("gpio: Add Spreadtrum EIC driver support")
Cc: stable@vger.kernel.org
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
---
 drivers/gpio/gpio-eic-sprd.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/gpio/gpio-eic-sprd.c b/drivers/gpio/gpio-eic-sprd.c
index 50fafeda8d7e..3b7ebcf12fe7 100644
--- a/drivers/gpio/gpio-eic-sprd.c
+++ b/drivers/gpio/gpio-eic-sprd.c
@@ -95,7 +95,7 @@ struct sprd_eic {
 	struct notifier_block irq_nb;
 	void __iomem *base[SPRD_EIC_MAX_BANK];
 	enum sprd_eic_type type;
-	spinlock_t lock;
+	raw_spinlock_t lock;
 	int irq;
 };
 
@@ -149,7 +149,7 @@ static void sprd_eic_update(struct gpio_chip *chip, unsigned int offset,
 	unsigned long flags;
 	u32 tmp;
 
-	spin_lock_irqsave(&sprd_eic->lock, flags);
+	raw_spin_lock_irqsave(&sprd_eic->lock, flags);
 	tmp = readl_relaxed(base + reg);
 
 	if (val)
@@ -158,7 +158,7 @@ static void sprd_eic_update(struct gpio_chip *chip, unsigned int offset,
 		tmp &= ~BIT(SPRD_EIC_BIT(offset));
 
 	writel_relaxed(tmp, base + reg);
-	spin_unlock_irqrestore(&sprd_eic->lock, flags);
+	raw_spin_unlock_irqrestore(&sprd_eic->lock, flags);
 }
 
 static int sprd_eic_read(struct gpio_chip *chip, unsigned int offset, u16 reg)
@@ -628,7 +628,7 @@ static int sprd_eic_probe(struct platform_device *pdev)
 	if (!sprd_eic)
 		return -ENOMEM;
 
-	spin_lock_init(&sprd_eic->lock);
+	raw_spin_lock_init(&sprd_eic->lock);
 	sprd_eic->type = pdata->type;
 
 	sprd_eic->irq = platform_get_irq(pdev, 0);
-- 
2.34.1

Re: [PATCH 2/2] gpio: eic-sprd: use raw_spinlock_t in the irq startup path

[Sebastian Andrzej Siewior]

On 2026-06-17 23:40:35 [+0800], Runyu Xiao wrote:
> sprd_eic_irq_unmask() enables the GPIO IRQ and then updates controller
> state through sprd_eic_update(), which takes sprd_eic->lock with
> spin_lock_irqsave().  The callback can be reached from irq_startup()
> while setting up a requested IRQ.  That path is not sleepable, but on
> PREEMPT_RT a regular spinlock_t becomes a sleeping lock.
…
> Fixes: 25518e024e3a ("gpio: Add Spreadtrum EIC driver support")
> Cc: stable@vger.kernel.org
> Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>

Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>

Sebastian

Re: [PATCH 0/2] gpio: use raw spinlocks in irq startup paths

[Bartosz Golaszewski]

On Wed, 17 Jun 2026 23:40:33 +0800, Runyu Xiao wrote:
> This 2-patch series fixes two GPIO irqchip paths where IRQ startup or
> unmask can update controller state under a regular spinlock.  On
> PREEMPT_RT, that lock can sleep while irq_startup() is running in a
> non-sleepable context.
> 
> Both issues were found by our static analysis tool and then manually
> reviewed against the current tree.  The grounded PoCs kept the
> request_threaded_irq() -> __setup_irq() -> irq_startup() carriers and
> Lockdep reported "BUG: sleeping function called from invalid context" on
> the corresponding driver update helpers.
> 
> [...]

Applied, thanks!

[1/2] gpio: sch: use raw_spinlock_t in the irq startup path
      https://git.kernel.org/brgl/c/286533cb14a3c8a8bd39ff64ea2fc8e1aa0f638b
[2/2] gpio: eic-sprd: use raw_spinlock_t in the irq startup path
      https://git.kernel.org/brgl/c/90f0109019e6817eb40a486671b7722d1544ae29

Best regards,
-- 
Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>