[PATCH 1/2] hwmon: (gigabyte_waterforce) Make status_report_request_lock IRQ safe

[Guenter Roeck <linux@roeck-us.net>]

waterforce_raw_event() is the HID ->raw_event() callback and acquires
priv->status_report_request_lock with a plain spin_lock(), while
waterforce_get_status() acquires the same lock with spin_lock_bh().

Depending on the HID transport and USB host controller driver,
waterforce_raw_event() can run in process context (e.g. via uhid with
softirqs and hardirqs enabled), softirq context (USB HCDs using HCD_BH),
or hard interrupt context (USB HCDs without HCD_BH, such as OHCI/UHCI).

Because spin_lock_bh() in waterforce_get_status() leaves hard interrupts
enabled, a hard-IRQ URB completion invoking waterforce_raw_event() on the
same CPU will self-deadlock on status_report_request_lock. Likewise, a
plain spin_lock() in waterforce_raw_event() when called from process
context via uhid leaves both softirqs and hardirqs enabled, risking a
self-deadlock if interrupted by softirq or hardirq raw-event delivery on
the same CPU.

Use spin_lock_irq() in waterforce_get_status(), which always runs in
process context, and spin_lock_irqsave() in waterforce_raw_event(), which
may run with interrupts either enabled or disabled.

Reported-by: Sashiko <sashiko-bot@kernel.org>
Fixes: 41c71105a845 ("hwmon: (gigabyte_waterforce) Mark status report as received under a spinlock")
Cc: Aleksa Savic <savicaleksa83@gmail.com>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
---
 drivers/hwmon/gigabyte_waterforce.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/drivers/hwmon/gigabyte_waterforce.c b/drivers/hwmon/gigabyte_waterforce.c
index f4d0376dd68e..65169dbb91d8 100644
--- a/drivers/hwmon/gigabyte_waterforce.c
+++ b/drivers/hwmon/gigabyte_waterforce.c
@@ -139,9 +139,9 @@ static int waterforce_get_status(struct waterforce_data *priv)
 	 * the raw event parsing and marked the priv->status_report_received
 	 * completion as done.
 	 */
-	spin_lock_bh(&priv->status_report_request_lock);
+	spin_lock_irq(&priv->status_report_request_lock);
 	reinit_completion(&priv->status_report_received);
-	spin_unlock_bh(&priv->status_report_request_lock);
+	spin_unlock_irq(&priv->status_report_request_lock);
 
 	/* Send command for getting status */
 	ret = waterforce_write_expanded(priv, get_status_cmd, GET_STATUS_CMD_LENGTH);
@@ -256,6 +256,7 @@ static int waterforce_raw_event(struct hid_device *hdev, struct hid_report *repo
 				int size)
 {
 	struct waterforce_data *priv = hid_get_drvdata(hdev);
+	unsigned long flags;
 
 	if (size <= FIRMWARE_VER_START_OFFSET_2)
 		return 0;
@@ -281,10 +282,10 @@ static int waterforce_raw_event(struct hid_device *hdev, struct hid_report *repo
 	priv->duty_input[0] = data[WATERFORCE_FAN_DUTY];
 	priv->duty_input[1] = data[WATERFORCE_PUMP_DUTY];
 
-	spin_lock(&priv->status_report_request_lock);
+	spin_lock_irqsave(&priv->status_report_request_lock, flags);
 	if (!completion_done(&priv->status_report_received))
 		complete_all(&priv->status_report_received);
-	spin_unlock(&priv->status_report_request_lock);
+	spin_unlock_irqrestore(&priv->status_report_request_lock, flags);
 
 	priv->updated = jiffies;
 
-- 
2.45.2