Re: [PATCH v4 2/3] i3c: master: add i3c_for_each_dev helper

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Unnecessary acquisition of `i3c_core_lock` in `i3c_for_each_dev` creates a deadlock risk and introduces a lock inversion with device release paths.
--

commit cf4ed3e7da2ded8dc5ec7a5d74c745aae27e4e0a
Author: Vitor Soares <vitor.soares@toradex.com>

i3c: master: add i3c_for_each_dev helper

Introduce i3c_for_each_dev(), an i3c device iterator for use by i3cdev.

> diff --git a/drivers/i3c/master.c b/drivers/i3c/master.c
> index e8a9f8c3041e6..dd5071ca9195a 100644
> --- a/drivers/i3c/master.c
> +++ b/drivers/i3c/master.c
> @@ -4011,6 +4011,18 @@ void i3c_dev_free_ibi_locked(struct i3c_dev_desc *dev)
>  }
>  EXPORT_SYMBOL_GPL(i3c_dev_free_ibi_locked);
>  
> +int i3c_for_each_dev(void *data, int (*fn)(struct device *, void *))
> +{
> +	int res;
> +
> +	mutex_lock(&i3c_core_lock);
> +	res = bus_for_each_dev(&i3c_bus_type, NULL, data, fn);

[Severity: High]
Does holding i3c_core_lock here create a potential deadlock risk?

Since bus_for_each_dev() invokes an opaque callback fn() over all bus
devices, if fn() performs an action that drops the last reference to an I3C
master controller device, the release function i3c_masterdev_release() could
execute synchronously on the same thread.

If that occurs, i3c_masterdev_release() calls i3c_bus_cleanup(), which
unconditionally attempts to lock i3c_core_lock:

drivers/i3c/master.c:i3c_bus_cleanup() {
    ...
    mutex_lock(&i3c_core_lock);
    idr_remove(&i3c_bus_idr, i3cbus->id);
    mutex_unlock(&i3c_core_lock);
    ...
}

Because i3c_core_lock appears to exclusively protect the subsystem IDR
(i3c_bus_idr) rather than the driver core device list used by
bus_for_each_dev(), can we safely perform this iteration without holding
the global lock to avoid this inversion?

> +	mutex_unlock(&i3c_core_lock);
> +
> +	return res;
> +}
> +EXPORT_SYMBOL_GPL(i3c_for_each_dev);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260906202747.4041389-1-samagazaryan@google.com?part=2

-- 
linux-i3c mailing list
linux-i3c@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-i3c