Re: [PATCH] irqchip/riscv-aplic: fix asynchronous probing

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] irqchip/riscv-aplic: unconditional atomic write to __ro_after_init variable in probe
--

commit 226fcd5ec01da9df7f8352eacfc1a2ef6a9d054e
Author: Vladimir Kondratiev <vladimir.kondratiev@mobileye.com>

irqchip/riscv-aplic: fix asynchronous probing

This commit addresses a race condition during asynchronous probing of multiple
APLIC instances. It prevents a double list_add warning in syscore registration
by replacing a boolean flag with an atomic counter.

> diff --git a/drivers/irqchip/irq-riscv-aplic-main.c b/drivers/irqchip/irq-riscv-aplic-main.c
> index d9afb6ae98cf5..db15ec8a2d346 100644
> --- a/drivers/irqchip/irq-riscv-aplic-main.c
> +++ b/drivers/irqchip/irq-riscv-aplic-main.c
[ ... ]
> @@ -116,14 +116,12 @@ static struct syscore aplic_syscore = {
>  	.ops = &aplic_syscore_ops,
>  };
>  
> -static bool aplic_syscore_registered __ro_after_init;
> +static atomic_t aplic_syscore_registered = ATOMIC_INIT(0) __ro_after_init;
>  
>  static void aplic_syscore_init(void)
>  {
> -	if (!aplic_syscore_registered) {
> +	if (!atomic_fetch_inc(&aplic_syscore_registered))

[Severity: High]
Does this unconditional atomic write risk a page fault crash? 

Since aplic_syscore_registered is marked with __ro_after_init, calling
atomic_fetch_inc() performs an unconditional read-modify-write operation on it.

If the platform driver's aplic_probe() executes after the kernel initialization
phase completes (for instance, via deferred probing or a manual sysfs unbind
and bind), writing to this read-only page will trigger a fatal Store/AMO access
page fault.

While a first probe post-init would have crashed previously as well, this 
change degrades the behavior. Previously, a second late probe would just read
true and skip the write entirely, whereas now it unconditionally writes and
crashes.

>  		register_syscore(&aplic_syscore);
> -		aplic_syscore_registered = true;
> -	}
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261012-aplic-async-probe-v1-1-4c2c4f5b0916@mobileye.com?part=1