From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8E2752F8BC3; Mon, 13 Apr 2026 16:21:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776097275; cv=none; b=SWOKKqDmCxkXmqUJ63g5zsyFZDzXlBpemJmxx1zhaLDkB1yk8LBO0XSqo23cfPAeDZppj5Hav7jg/ZnSAeClTAnVHdP1BhPHqdOV+bTCpr7F9s/iiap+/3Vz1aC1uV6oZFn7FM8Cq5KIFE5Q4a7EgJGRUlyYELELAjzJquKi4tw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776097275; c=relaxed/simple; bh=PBo392yP+dROg9RRdKPoOq4B80BjBYJtwlOcpjmggd0=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=vC7zXtnODu+/02YgyYE2SxywW0QRj3lcVxlzsSQNzv3TJ5cAGBK8DXbtSVwXGKdJOFDhY7Md47NYsGz+XuqZmIQFyH1soDl7yNG5/7CpAVaiPAmocTtusz9FizO9xYOG/W+avJNSzkZUcEMt2Nth/5UTbrX7gNFoLU9EQWX70Eg= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=oNpjsK0l; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="oNpjsK0l" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 23E87C2BCAF; Mon, 13 Apr 2026 16:21:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1776097275; bh=PBo392yP+dROg9RRdKPoOq4B80BjBYJtwlOcpjmggd0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=oNpjsK0lPHiusXzf61Hc9DdHBxRuTY/2VSB4po841KmmLZBkrizSZjGsUz9rfSs06 NEkoU+QasSHbiVAnEIVov0OXP9cB3fPQoZ1jLp+4fcAUEmX7qdtGxYHceFXxiq3t61 X+GpSfyp4GfrTV7n5okVOA6Kxc0EG9om5qexPVr4= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Alban Bedel , Marc Kleine-Budde , Sasha Levin Subject: [PATCH 5.15 073/570] can: mcp251x: fix deadlock in error path of mcp251x_open Date: Mon, 13 Apr 2026 17:53:24 +0200 Message-ID: <20260413155833.176784271@linuxfoundation.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260413155830.386096114@linuxfoundation.org> References: <20260413155830.386096114@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 5.15-stable review patch. If anyone has any objections, please let me know. ------------------ From: Alban Bedel [ Upstream commit ab3f894de216f4a62adc3b57e9191888cbf26885 ] The mcp251x_open() function call free_irq() in its error path with the mpc_lock mutex held. But if an interrupt already occurred the interrupt handler will be waiting for the mpc_lock and free_irq() will deadlock waiting for the handler to finish. This issue is similar to the one fixed in commit 7dd9c26bd6cf ("can: mcp251x: fix deadlock if an interrupt occurs during mcp251x_open") but for the error path. To solve this issue move the call to free_irq() after the lock is released. Setting `priv->force_quit = 1` beforehand ensure that the IRQ handler will exit right away once it acquired the lock. Signed-off-by: Alban Bedel Link: https://patch.msgid.link/20260209144706.2261954-1-alban.bedel@lht.dlh.de Fixes: bf66f3736a94 ("can: mcp251x: Move to threaded interrupts instead of workqueues.") Signed-off-by: Marc Kleine-Budde Signed-off-by: Sasha Levin --- drivers/net/can/spi/mcp251x.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/drivers/net/can/spi/mcp251x.c b/drivers/net/can/spi/mcp251x.c index 653566c570df8..e71edca7afbb2 100644 --- a/drivers/net/can/spi/mcp251x.c +++ b/drivers/net/can/spi/mcp251x.c @@ -1207,6 +1207,7 @@ static int mcp251x_open(struct net_device *net) { struct mcp251x_priv *priv = netdev_priv(net); struct spi_device *spi = priv->spi; + bool release_irq = false; unsigned long flags = 0; int ret; @@ -1252,12 +1253,24 @@ static int mcp251x_open(struct net_device *net) return 0; out_free_irq: - free_irq(spi->irq, priv); + /* The IRQ handler might be running, and if so it will be waiting + * for the lock. But free_irq() must wait for the handler to finish + * so calling it here would deadlock. + * + * Setting priv->force_quit will let the handler exit right away + * without any access to the hardware. This make it safe to call + * free_irq() after the lock is released. + */ + priv->force_quit = 1; + release_irq = true; + mcp251x_hw_sleep(spi); out_close: mcp251x_power_enable(priv->transceiver, 0); close_candev(net); mutex_unlock(&priv->mcp_lock); + if (release_irq) + free_irq(spi->irq, priv); return ret; } -- 2.51.0