[PATCH 16/62] md: Make mddev_suspend() easier to analyze

[PATCH 16/62] md: Make mddev_suspend() easier to analyze

[Bart Van Assche]

Prepare for enabling Clang's thread-safety analysis by moving an
if-statement. No functionality has been changed.

Cc: Song Liu <song@kernel.org>
Cc: Yu Kuai <yukuai@fnnas.com>
Cc: linux-raid@vger.kernel.org
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
---
 drivers/md/md.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/drivers/md/md.c b/drivers/md/md.c
index 3ce6f9e9d38e..b0d260d03a7d 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -475,12 +475,13 @@ int mddev_suspend(struct mddev *mddev, bool interruptible)
 	 */
 	lockdep_assert_not_held(&mddev->reconfig_mutex);
 
-	if (interruptible)
+	if (interruptible) {
 		err = mutex_lock_interruptible(&mddev->suspend_mutex);
-	else
+		if (err)
+			return err;
+	} else {
 		mutex_lock(&mddev->suspend_mutex);
-	if (err)
-		return err;
+	}
 
 	if (mddev->suspended) {
 		WRITE_ONCE(mddev->suspended, mddev->suspended + 1);

[PATCH 00/62] Bug fixes and refactoring patches related to locking

[Bart Van Assche]

From: Bart Van Assche <bvanassche@acm.org>

Hi Peter,

Annotating all source files in the kernel tree with lock context annotations
led to the discovery of a significant number of locking bugs. This patch
series includes fixes for the discovered bugs. Additionally, multiple
refactoring patches have been included that make it easier for the compiler
to verify correctness of locking operations. Please consider this patch series
for the next merge window.

While the previous version of this patch series only covered mutexes, this
patch series covers all synchronization operations currently annotated with
lock context annotations. The previous version is available here:
[PATCH RFC 00/33] Compile-time thread-safety checking, LKML, February 2025
(https://lore.kernel.org/lkml/20250206175114.1974171-1-bvanassche@acm.org/).

Thanks,

Bart.

Bart Van Assche (62):
  kvm: Make pi_enable_wakeup_handler() easier to analyze
  blk-ioc: Prepare for enabling thread-safety analysis
  drbd: Balance RCU calls in drbd_adm_dump_devices()
  dax/bus.c: Fix a locking bug
  dma-buf: Convert dma_buf_import_sync_file() to the early-return style
  dma-buf: Handle all dma_resv_lock() errors
  drm/amdgpu: Unlock a mutex before destroying it
  drm/amdgpu: Fix locking bugs in error paths
  drm: bridge: cdns-mhdp8546: Fix a locking bug in an error path
  drm: Make drm_read() easier to analyze
  drm/pagemap: Unlock cache->lock before freeing it
  drm/gpusvm.c: Fix a locking bug in an error path
  drm/qxl: Fix a buffer leak in an error path
  hwmon: (it87) Check the it87_lock() return value
  Input: synaptics-rmi4 - fix a locking bug in an error path
  md: Make mddev_suspend() easier to analyze
  bnxt_en: Make bnxt_resume() easier to analyze
  bnxt_en: Fix bnxt_dl_reload_up()
  ice: Fix a locking bug in an error path
  octeontx2-pf: Fix locking in an error path
  qed: Make _qed_mcp_cmd_and_union() easier to analyze
  mctp i3c: Fix locking in error paths
  net: phy: mxl-86110: Fix locking in an error path
  net/cw1200: Fix locking in error paths
  wlcore: Fix a locking bug
  misc: nsm: Fix a locking bug in an error path
  pci: Fix locking in pci_do_resource_release_and_resize() error paths
  PNP: isapnp: Check the isapnp_cfg_begin() return value
  fnic: Make fnic_queuecommand() easier to analyze
  megaraid: Protect more code with instance->reset_mutex
  target: Make transport_handle_queue_full() easier to analyze
  usbip: Move a check outside put_busid_priv()
  fbdev/omap2: Make the source code easier to analyze
  btrfs: Fix a bug in try_release_subpage_extent_buffer()
  cachefiles: Fix a locking bug in an error path
  f2fs: Fix handling of radix_tree_preload() failures
  lib: Split codetag_lock_module_list()
  treewide: Modify mutex_lock_interruptible() return value checks
  accel/ivpu: Check the ivpu_bo_lock() return value
  dma-buf: Check the dma_resv_lock() return value
  drm: Check the dma_resv_lock() return value
  drm/amdgpu: Check the dma_resv_lock() return value
  drm/gma500: Check the dma_resv_lock() return value
  drm/i915: Check the dma_resv_lock() return value
  drm/imagination: Check the dma_resv_lock() return value
  drm/lima: Check the dma_resv_lock() return value
  drm/loongson: Check the dma_resv_lock() return value
  drm/msm: Check the dma_resv_lock() return value
  drm/nouveau: Check the dma_resv_lock() return value
  drm/panfrost: Check the dma_resv_lock() return value
  drm/panthor: Check the dma_resv_lock() return value
  drm/radeon: Check the dma_resv_lock() return value
  drm/ttm: Check the dma_resv_lock() return value
  drm/vgem: Check the dma_resv_lock() return value
  drm/virtio: Check the dma_resv_lock() return value
  drm/vmwgfx: Check the dma_resv_lock() return value
  drm/xe: Check the dma_resv_lock() return value
  RDMA/core: Check the dma_resv_lock() return value
  RDMA/mlx5: Check the dma_resv_lock() return value
  iommufd: Check the dma_resv_lock() return value
  vfio/pci: Check the dma_resv_lock() return value
  dma-resv: Make checking the dma_resv_lock() return value mandatory

 arch/x86/kvm/vmx/posted_intr.c                |  7 +-
 block/blk-ioc.c                               |  2 +-
 drivers/accel/ivpu/ivpu_gem.c                 | 41 ++++++++----
 drivers/block/drbd/drbd_nl.c                  |  8 ++-
 drivers/dax/bus.c                             |  3 +-
 drivers/dma-buf/dma-buf.c                     | 66 +++++++++++++------
 drivers/dma-buf/dma-resv.c                    |  6 +-
 drivers/gpib/lpvo_usb_gpib/lpvo_usb_gpib.c    |  4 +-
 drivers/gpio/gpio-mlxbf2.c                    |  4 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c       |  1 +
 drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c   |  4 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp_ta.c    | 12 ++--
 .../drm/bridge/cadence/cdns-mhdp8546-core.c   |  3 +-
 drivers/gpu/drm/drm_file.c                    |  5 +-
 drivers/gpu/drm/drm_gem.c                     | 17 +++--
 drivers/gpu/drm/drm_gem_shmem_helper.c        | 42 ++++++++----
 drivers/gpu/drm/drm_gpusvm.c                  |  5 +-
 drivers/gpu/drm/drm_gpuvm.c                   |  4 +-
 drivers/gpu/drm/drm_mode_config.c             |  7 +-
 drivers/gpu/drm/drm_pagemap_util.c            |  2 +
 drivers/gpu/drm/drm_prime.c                   |  4 +-
 drivers/gpu/drm/gma500/gem.c                  | 10 ++-
 drivers/gpu/drm/i915/i915_vma.h               |  4 +-
 drivers/gpu/drm/imagination/pvr_gem.c         |  9 ++-
 drivers/gpu/drm/imagination/pvr_job.c         |  4 +-
 drivers/gpu/drm/imagination/pvr_vm.c          |  4 +-
 drivers/gpu/drm/lima/lima_gem.c               |  4 +-
 drivers/gpu/drm/loongson/lsdc_gem.c           |  6 +-
 drivers/gpu/drm/msm/msm_gem.h                 |  4 +-
 drivers/gpu/drm/nouveau/nouveau_gem.c         | 14 ++--
 drivers/gpu/drm/nouveau/nouveau_prime.c       |  4 +-
 drivers/gpu/drm/nouveau/nouveau_uvmm.c        | 15 +++--
 drivers/gpu/drm/panfrost/panfrost_gem.c       | 10 ++-
 drivers/gpu/drm/panfrost/panfrost_mmu.c       |  4 +-
 drivers/gpu/drm/panthor/panthor_gem.c         | 10 ++-
 drivers/gpu/drm/panthor/panthor_mmu.c         |  7 +-
 drivers/gpu/drm/qxl/qxl_ioctl.c               |  2 +-
 drivers/gpu/drm/radeon/radeon_prime.c         |  4 +-
 drivers/gpu/drm/ttm/tests/ttm_bo_test.c       | 39 +++++++----
 .../gpu/drm/ttm/tests/ttm_bo_validate_test.c  |  7 +-
 drivers/gpu/drm/ttm/tests/ttm_resource_test.c |  4 +-
 drivers/gpu/drm/ttm/tests/ttm_tt_test.c       | 15 +++--
 drivers/gpu/drm/ttm/ttm_bo.c                  |  9 ++-
 drivers/gpu/drm/vgem/vgem_fence.c             |  4 +-
 drivers/gpu/drm/virtio/virtgpu_plane.c        | 11 ++--
 drivers/gpu/drm/virtio/virtgpu_prime.c        | 18 ++---
 drivers/gpu/drm/vmwgfx/vmwgfx_gem.c           |  4 +-
 drivers/gpu/drm/xe/xe_bo.c                    |  4 +-
 drivers/gpu/drm/xe/xe_ggtt.c                  |  2 +-
 drivers/gpu/drm/xe/xe_pm.c                    |  4 +-
 drivers/hwmon/gigabyte_waterforce.c           |  2 +-
 drivers/hwmon/it87.c                          |  4 +-
 drivers/hwmon/nzxt-kraken3.c                  |  2 +-
 drivers/infiniband/core/ib_core_uverbs.c      |  5 +-
 drivers/infiniband/core/umem_dmabuf.c         | 10 ++-
 .../infiniband/core/uverbs_std_types_dmabuf.c |  6 +-
 drivers/infiniband/hw/mlx5/mr.c               | 21 ++++--
 drivers/infiniband/hw/mlx5/odp.c              |  4 +-
 drivers/infiniband/ulp/srp/ib_srp.c           |  2 +-
 drivers/infiniband/ulp/srpt/ib_srpt.c         |  4 +-
 drivers/input/rmi4/rmi_f54.c                  |  5 +-
 drivers/iommu/iommufd/pages.c                 | 10 ++-
 drivers/iommu/iommufd/selftest.c              |  4 +-
 drivers/leds/leds-blinkm.c                    |  2 +-
 drivers/md/md.c                               |  9 +--
 drivers/media/dvb-frontends/bcm3510.c         |  2 +-
 drivers/media/dvb-frontends/dib0070.c         |  4 +-
 drivers/media/dvb-frontends/dib0090.c         |  8 +--
 drivers/media/dvb-frontends/dib7000m.c        |  4 +-
 drivers/media/dvb-frontends/dib7000p.c        |  4 +-
 drivers/media/dvb-frontends/dib8000.c         | 10 +--
 drivers/media/dvb-frontends/dib9000.c         | 42 ++++++------
 drivers/media/dvb-frontends/dibx000_common.c  | 10 +--
 drivers/media/usb/dvb-usb-v2/af9035.c         |  2 +-
 drivers/media/usb/dvb-usb-v2/anysee.c         |  2 +-
 drivers/media/usb/dvb-usb-v2/au6610.c         |  2 +-
 drivers/media/usb/dvb-usb-v2/az6007.c         |  6 +-
 drivers/media/usb/dvb-usb-v2/ce6230.c         |  2 +-
 drivers/media/usb/dvb-usb-v2/dvbsky.c         |  2 +-
 drivers/media/usb/dvb-usb-v2/ec168.c          |  2 +-
 drivers/media/usb/dvb-usb-v2/lmedm04.c        |  2 +-
 drivers/media/usb/dvb-usb-v2/mxl111sf-i2c.c   |  2 +-
 drivers/media/usb/dvb-usb-v2/rtl28xxu.c       |  2 +-
 drivers/media/usb/dvb-usb/af9005.c            |  2 +-
 drivers/media/usb/dvb-usb/az6027.c            |  2 +-
 drivers/media/usb/dvb-usb/cxusb.c             |  2 +-
 drivers/media/usb/dvb-usb/dib0700_core.c      | 20 +++---
 drivers/media/usb/dvb-usb/dibusb-common.c     |  2 +-
 drivers/media/usb/dvb-usb/digitv.c            |  2 +-
 drivers/media/usb/dvb-usb/dtv5100.c           |  2 +-
 drivers/media/usb/dvb-usb/dvb-usb-urb.c       |  3 +-
 drivers/media/usb/dvb-usb/dw2102.c            | 16 ++---
 drivers/media/usb/dvb-usb/gp8psk.c            |  6 +-
 drivers/media/usb/dvb-usb/m920x.c             |  2 +-
 drivers/media/usb/dvb-usb/opera1.c            |  4 +-
 drivers/media/usb/dvb-usb/pctv452e.c          |  4 +-
 drivers/media/usb/dvb-usb/technisat-usb2.c    | 10 +--
 drivers/media/usb/dvb-usb/ttusb2.c            |  2 +-
 drivers/media/usb/dvb-usb/vp702x.c            |  5 +-
 .../media/usb/ttusb-budget/dvb-ttusb-budget.c |  4 +-
 drivers/media/usb/uvc/uvc_ctrl.c              |  6 +-
 drivers/misc/nsm.c                            |  2 +-
 drivers/net/ethernet/broadcom/bnxt/bnxt.c     |  2 +-
 .../net/ethernet/broadcom/bnxt/bnxt_devlink.c |  2 +
 drivers/net/ethernet/intel/ice/ice_dcb_lib.c  |  4 +-
 .../ethernet/marvell/octeontx2/nic/otx2_pf.c  |  2 +-
 drivers/net/ethernet/mellanox/mlxsw/i2c.c     |  4 +-
 drivers/net/ethernet/qlogic/qed/qed_mcp.c     | 56 ++++++++--------
 drivers/net/mctp/mctp-i3c.c                   |  5 +-
 drivers/net/phy/mxl-86110.c                   |  2 +-
 drivers/net/usb/cdc_subset.c                  |  2 +-
 drivers/net/wireless/intersil/p54/p54usb.c    |  2 +-
 drivers/net/wireless/st/cw1200/pm.c           |  2 +
 drivers/net/wireless/ti/wlcore/main.c         |  4 +-
 drivers/net/wireless/ti/wlcore/sysfs.c        |  2 +-
 drivers/pci/setup-bus.c                       |  2 +-
 drivers/platform/x86/lenovo/thinkpad_acpi.c   | 12 ++--
 drivers/pnp/isapnp/core.c                     | 16 +++--
 drivers/scsi/fnic/fnic_scsi.c                 |  9 +--
 drivers/scsi/hpsa.c                           |  2 +-
 drivers/scsi/megaraid/megaraid_sas_base.c     | 15 +++--
 drivers/target/target_core_transport.c        |  2 +-
 drivers/tty/tty_io.c                          |  6 +-
 drivers/usb/class/cdc-wdm.c                   |  3 +-
 drivers/usb/class/usblp.c                     |  2 +-
 drivers/usb/class/usbtmc.c                    |  2 +-
 drivers/usb/core/message.c                    |  2 +-
 drivers/usb/core/sysfs.c                      | 24 +++----
 drivers/usb/gadget/legacy/inode.c             | 13 ++--
 drivers/usb/misc/yurex.c                      |  2 +-
 drivers/usb/storage/transport.c               |  2 +-
 drivers/usb/usb-skeleton.c                    |  2 +-
 drivers/usb/usbip/stub_dev.c                  | 21 ++++--
 drivers/usb/usbip/stub_main.c                 |  3 +-
 drivers/usb/usbip/stub_rx.c                   |  2 +-
 drivers/vfio/pci/vfio_pci_dmabuf.c            | 25 ++++---
 .../video/fbdev/omap2/omapfb/omapfb-ioctl.c   |  4 +-
 .../video/fbdev/omap2/omapfb/omapfb-main.c    |  4 +-
 .../video/fbdev/omap2/omapfb/omapfb-sysfs.c   |  4 +-
 drivers/video/fbdev/omap2/omapfb/omapfb.h     |  4 +-
 drivers/w1/masters/omap_hdq.c                 |  8 +--
 fs/afs/validation.c                           |  2 +-
 fs/afs/vl_alias.c                             |  6 +-
 fs/btrfs/extent_io.c                          |  1 +
 fs/cachefiles/namei.c                         |  1 -
 fs/f2fs/checkpoint.c                          |  8 ++-
 fs/f2fs/node.c                                |  8 ++-
 fs/fsopen.c                                   |  2 +-
 fs/orangefs/devorangefs-req.c                 |  2 +-
 fs/proc/base.c                                |  2 +-
 include/linux/codetag.h                       |  3 +-
 include/linux/dma-resv.h                      |  4 +-
 kernel/seccomp.c                              | 10 +--
 lib/alloc_tag.c                               |  8 +--
 lib/codetag.c                                 | 12 ++--
 mm/kmemleak.c                                 |  4 +-
 net/rxrpc/recvmsg.c                           |  2 +-
 net/rxrpc/sendmsg.c                           |  2 +-
 security/integrity/ima/ima_fs.c               |  2 +-
 sound/pci/oxygen/oxygen_lib.c                 |  2 +-
 160 files changed, 695 insertions(+), 443 deletions(-)

[PATCH 01/62] kvm: Make pi_enable_wakeup_handler() easier to analyze

[Bart Van Assche]

From: Bart Van Assche <bvanassche@acm.org>

The Clang thread-safety analyzer does not support comparing expressions
that use per_cpu(). Hence introduce a new local variable to capture the
address of a per-cpu spinlock. This patch prepares for enabling the
Clang thread-safety analyzer.

Cc: Sean Christopherson <seanjc@google.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: kvm@vger.kernel.org
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
---
 arch/x86/kvm/vmx/posted_intr.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/arch/x86/kvm/vmx/posted_intr.c b/arch/x86/kvm/vmx/posted_intr.c
index 4a6d9a17da23..f8711b7b85a8 100644
--- a/arch/x86/kvm/vmx/posted_intr.c
+++ b/arch/x86/kvm/vmx/posted_intr.c
@@ -164,6 +164,7 @@ static void pi_enable_wakeup_handler(struct kvm_vcpu *vcpu)
 	struct pi_desc *pi_desc = vcpu_to_pi_desc(vcpu);
 	struct vcpu_vt *vt = to_vt(vcpu);
 	struct pi_desc old, new;
+	raw_spinlock_t *wakeup_lock;
 
 	lockdep_assert_irqs_disabled();
 
@@ -179,11 +180,11 @@ static void pi_enable_wakeup_handler(struct kvm_vcpu *vcpu)
 	 * entirety of the sched_out critical section, i.e. the wakeup handler
 	 * can't run while the scheduler locks are held.
 	 */
-	raw_spin_lock_nested(&per_cpu(wakeup_vcpus_on_cpu_lock, vcpu->cpu),
-			     PI_LOCK_SCHED_OUT);
+	wakeup_lock = &per_cpu(wakeup_vcpus_on_cpu_lock, vcpu->cpu);
+	raw_spin_lock_nested(wakeup_lock, PI_LOCK_SCHED_OUT);
 	list_add_tail(&vt->pi_wakeup_list,
 		      &per_cpu(wakeup_vcpus_on_cpu, vcpu->cpu));
-	raw_spin_unlock(&per_cpu(wakeup_vcpus_on_cpu_lock, vcpu->cpu));
+	raw_spin_unlock(wakeup_lock);
 
 	WARN(pi_test_sn(pi_desc), "PI descriptor SN field set before blocking");
 

[PATCH 02/62] blk-ioc: Prepare for enabling thread-safety analysis

[Bart Van Assche]

From: Bart Van Assche <bvanassche@acm.org>

The Clang thread-safety analyzer does not support testing return values
with "< 0". Hence change the "< 0" test into "!= 0". This is fine since
the radix_tree_maybe_preload() return value is <= 0.

Cc: Jens Axboe <axboe@kernel.dk>
Cc: Yu Kuai <yukuai3@huawei.com>
Cc: Jan Kara <jack@suse.cz>
Cc: linux-block@vger.kernel.org
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
---
 block/blk-ioc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/block/blk-ioc.c b/block/blk-ioc.c
index d15918d7fabb..0bf78aebc887 100644
--- a/block/blk-ioc.c
+++ b/block/blk-ioc.c
@@ -364,7 +364,7 @@ static struct io_cq *ioc_create_icq(struct request_queue *q)
 	if (!icq)
 		return NULL;
 
-	if (radix_tree_maybe_preload(GFP_ATOMIC) < 0) {
+	if (radix_tree_maybe_preload(GFP_ATOMIC) != 0) {
 		kmem_cache_free(et->icq_cache, icq);
 		return NULL;
 	}

[PATCH 03/62] drbd: Balance RCU calls in drbd_adm_dump_devices()

[Bart Van Assche]

From: Bart Van Assche <bvanassche@acm.org>

Make drbd_adm_dump_devices() call rcu_read_lock() before
rcu_read_unlock() is called. This has been detected by the Clang
thread-safety analyzer. Compile-tested only.

Cc: Andreas Gruenbacher <agruen@linbit.com>
Cc: linux-block@vger.kernel.org
Fixes: a55bbd375d18 ("drbd: Backport the "status" command")
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
---
 drivers/block/drbd/drbd_nl.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/block/drbd/drbd_nl.c b/drivers/block/drbd/drbd_nl.c
index e201f0087a0f..728ecc431b38 100644
--- a/drivers/block/drbd/drbd_nl.c
+++ b/drivers/block/drbd/drbd_nl.c
@@ -3378,8 +3378,10 @@ int drbd_adm_dump_devices(struct sk_buff *skb, struct netlink_callback *cb)
 		if (resource_filter) {
 			retcode = ERR_RES_NOT_KNOWN;
 			resource = drbd_find_resource(nla_data(resource_filter));
-			if (!resource)
+			if (!resource) {
+				rcu_read_lock();
 				goto put_result;
+			}
 			cb->args[0] = (long)resource;
 		}
 	}
@@ -3628,8 +3630,10 @@ int drbd_adm_dump_peer_devices(struct sk_buff *skb, struct netlink_callback *cb)
 		if (resource_filter) {
 			retcode = ERR_RES_NOT_KNOWN;
 			resource = drbd_find_resource(nla_data(resource_filter));
-			if (!resource)
+			if (!resource) {
+				rcu_read_lock();
 				goto put_result;
+			}
 		}
 		cb->args[0] = (long)resource;
 	}

[PATCH 04/62] dax/bus.c: Fix a locking bug

[Bart Van Assche]

From: Bart Van Assche <bvanassche@acm.org>

Only unlock dax_dev_rwsem if it has been locked. This locking bug was
detected by the Clang thread-safety analyzer.

Cc: Dan Williams <dan.j.williams@intel.com>
Cc: Vishal Verma <vishal.l.verma@intel.com>
Cc: Dave Jiang <dave.jiang@intel.com>
Cc: Alison Schofield <alison.schofield@intel.com>
Cc: nvdimm@lists.linux.dev
Cc: linux-cxl@vger.kernel.org
Fixes: c05ae9d85b47 ("dax/bus.c: replace driver-core lock usage by a local rwsem")
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
---
 drivers/dax/bus.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/dax/bus.c b/drivers/dax/bus.c
index c94c09622516..ebd3806c34e5 100644
--- a/drivers/dax/bus.c
+++ b/drivers/dax/bus.c
@@ -1117,11 +1117,10 @@ static ssize_t size_store(struct device *dev, struct device_attribute *attr,
 	}
 	rc = down_write_killable(&dax_dev_rwsem);
 	if (rc)
-		goto err_dev;
+		goto err_region;
 
 	rc = dev_dax_resize(dax_region, dev_dax, val);
 
-err_dev:
 	up_write(&dax_dev_rwsem);
 err_region:
 	up_write(&dax_region_rwsem);

[PATCH 05/62] dma-buf: Convert dma_buf_import_sync_file() to the early-return style

[Bart Van Assche]

From: Bart Van Assche <bvanassche@acm.org>

Before making changes in dma_buf_import_sync_file(), convert it to
the early-return coding style. No functionality has been changed.

Cc: Sumit Semwal <sumit.semwal@linaro.org>
Cc: Christian König <christian.koenig@amd.com>
Cc: linux-media@vger.kernel.org
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
---
 drivers/dma-buf/dma-buf.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/drivers/dma-buf/dma-buf.c b/drivers/dma-buf/dma-buf.c
index 11711874a325..1666133ac8b8 100644
--- a/drivers/dma-buf/dma-buf.c
+++ b/drivers/dma-buf/dma-buf.c
@@ -523,11 +523,13 @@ static long dma_buf_import_sync_file(struct dma_buf *dmabuf,
 		dma_resv_lock(dmabuf->resv, NULL);
 
 		ret = dma_resv_reserve_fences(dmabuf->resv, num_fences);
-		if (!ret) {
-			dma_fence_unwrap_for_each(f, &iter, fence)
-				dma_resv_add_fence(dmabuf->resv, f, usage);
-		}
+		if (ret)
+			goto unlock;
+
+		dma_fence_unwrap_for_each(f, &iter, fence)
+			dma_resv_add_fence(dmabuf->resv, f, usage);
 
+unlock:
 		dma_resv_unlock(dmabuf->resv);
 	}
 

[PATCH 06/62] dma-buf: Handle all dma_resv_lock() errors

[Bart Van Assche]

From: Bart Van Assche <bvanassche@acm.org>

Instead of assuming that dma_resv_lock() only returns 0 or -EDEADLK,
handle all possible dma_resv_lock() return values. This patch prepares
for enabling compile-time thread-safety analysis. This will cause the
compiler to check whether all dma_resv_lock() return values are handled.

Cc: Sumit Semwal <sumit.semwal@linaro.org>
Cc: Christian König <christian.koenig@amd.com>
Cc: linux-media@vger.kernel.org
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
---
 drivers/dma-buf/dma-resv.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/dma-buf/dma-resv.c b/drivers/dma-buf/dma-resv.c
index bea3e9858aca..b4710f730e9b 100644
--- a/drivers/dma-buf/dma-resv.c
+++ b/drivers/dma-buf/dma-resv.c
@@ -792,6 +792,8 @@ static int __init dma_resv_lockdep(void)
 	ret = dma_resv_lock(&obj, &ctx);
 	if (ret == -EDEADLK)
 		dma_resv_lock_slow(&obj, &ctx);
+	else if (ret)
+		goto fini;
 	fs_reclaim_acquire(GFP_KERNEL);
 	/* for unmap_mapping_range on trylocked buffer objects in shrinkers */
 	i_mmap_lock_write(&mapping);
@@ -805,12 +807,14 @@ static int __init dma_resv_lockdep(void)
 #endif
 	fs_reclaim_release(GFP_KERNEL);
 	ww_mutex_unlock(&obj.lock);
+
+fini:
 	ww_acquire_fini(&ctx);
 	mmap_read_unlock(mm);
 
 	mmput(mm);
 
-	return 0;
+	return ret;
 }
 subsys_initcall(dma_resv_lockdep);
 #endif

[PATCH 07/62] drm/amdgpu: Unlock a mutex before destroying it

[Bart Van Assche]

From: Bart Van Assche <bvanassche@acm.org>

Mutexes must be unlocked before these are destroyed. This has been detected
by the Clang thread-safety analyzer.

Cc: Alex Deucher <alexander.deucher@amd.com>
Cc: Christian König <christian.koenig@amd.com>
Cc: Yang Wang <kevinyang.wang@amd.com>
Cc: Hawking Zhang <Hawking.Zhang@amd.com>
Cc: amd-gfx@lists.freedesktop.org
Fixes: f5e4cc8461c4 ("drm/amdgpu: implement RAS ACA driver framework")
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c
index afe5ca81beec..db7858fe0c3d 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c
@@ -641,6 +641,7 @@ static void aca_error_fini(struct aca_error *aerr)
 		aca_bank_error_remove(aerr, bank_error);
 
 out_unlock:
+	mutex_unlock(&aerr->lock);
 	mutex_destroy(&aerr->lock);
 }
 

[PATCH 08/62] drm/amdgpu: Fix locking bugs in error paths

[Bart Van Assche]

From: Bart Van Assche <bvanassche@acm.org>

Do not unlock psp->ras_context.mutex if it has not been locked. This has
been detected by the Clang thread-safety analyzer.

Cc: Alex Deucher <alexander.deucher@amd.com>
Cc: Christian König <christian.koenig@amd.com>
Cc: YiPeng Chai <YiPeng.Chai@amd.com>
Cc: Hawking Zhang <Hawking.Zhang@amd.com>
Cc: amd-gfx@lists.freedesktop.org
Fixes: b3fb79cda568 ("drm/amdgpu: add mutex to protect ras shared memory")
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp_ta.c | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp_ta.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp_ta.c
index 6e8aad91bcd3..0d3c18f04ac3 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp_ta.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp_ta.c
@@ -332,13 +332,13 @@ static ssize_t ta_if_invoke_debugfs_write(struct file *fp, const char *buf, size
 	if (!context || !context->initialized) {
 		dev_err(adev->dev, "TA is not initialized\n");
 		ret = -EINVAL;
-		goto err_free_shared_buf;
+		goto free_shared_buf;
 	}
 
 	if (!psp->ta_funcs || !psp->ta_funcs->fn_ta_invoke) {
 		dev_err(adev->dev, "Unsupported function to invoke TA\n");
 		ret = -EOPNOTSUPP;
-		goto err_free_shared_buf;
+		goto free_shared_buf;
 	}
 
 	context->session_id = ta_id;
@@ -346,7 +346,7 @@ static ssize_t ta_if_invoke_debugfs_write(struct file *fp, const char *buf, size
 	mutex_lock(&psp->ras_context.mutex);
 	ret = prep_ta_mem_context(&context->mem_context, shared_buf, shared_buf_len);
 	if (ret)
-		goto err_free_shared_buf;
+		goto unlock;
 
 	ret = psp_fn_ta_invoke(psp, cmd_id);
 	if (ret || context->resp_status) {
@@ -354,15 +354,17 @@ static ssize_t ta_if_invoke_debugfs_write(struct file *fp, const char *buf, size
 			ret, context->resp_status);
 		if (!ret) {
 			ret = -EINVAL;
-			goto err_free_shared_buf;
+			goto unlock;
 		}
 	}
 
 	if (copy_to_user((char *)&buf[copy_pos], context->mem_context.shared_buf, shared_buf_len))
 		ret = -EFAULT;
 
-err_free_shared_buf:
+unlock:
 	mutex_unlock(&psp->ras_context.mutex);
+
+free_shared_buf:
 	kfree(shared_buf);
 
 	return ret;

[PATCH 09/62] drm: bridge: cdns-mhdp8546: Fix a locking bug in an error path

[Bart Van Assche]

From: Bart Van Assche <bvanassche@acm.org>

Do not unlock mhdp->mbox_mutex if it has not been locked.

This bug has been detected by the Clang thread-safety analyzer.

Cc: Andrzej Hajda <andrzej.hajda@intel.com>
Cc: Neil Armstrong <neil.armstrong@linaro.org>
Cc: Robert Foss <rfoss@kernel.org>
Cc: Laurent Pinchart <Laurent.pinchart@ideasonboard.com>
Cc: Jonas Karlman <jonas@kwiboo.se>
Cc: Jernej Skrabec <jernej.skrabec@gmail.com>
Cc: Swapnil Jakhade <sjakhade@cadence.com>
Cc: Tomi Valkeinen <tomi.valkeinen@ti.com>
Fixes: fb43aa0acdfd ("drm: bridge: Add support for Cadence MHDP8546 DPI/DP bridge")
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
---
 drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c b/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c
index 9392c226ff5b..ce4516de11d8 100644
--- a/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c
+++ b/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c
@@ -502,8 +502,7 @@ int cdns_mhdp_adjust_lt(struct cdns_mhdp_device *mhdp, unsigned int nlanes,
 
 	if (nlanes != 4 && nlanes != 2 && nlanes != 1) {
 		dev_err(mhdp->dev, "invalid number of lanes: %u\n", nlanes);
-		ret = -EINVAL;
-		goto out;
+		return -EINVAL;
 	}
 
 	payload[0] = nlanes;

[PATCH 10/62] drm: Make drm_read() easier to analyze

[Bart Van Assche]

From: Bart Van Assche <bvanassche@acm.org>

Prepare for enabling the Clang thread-safety analyzer by duplicating a
return statement. No functionality has been changed.

Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Cc: Maxime Ripard <mripard@kernel.org>
Cc: Thomas Zimmermann <tzimmermann@suse.de>
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
---
 drivers/gpu/drm/drm_file.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/drm_file.c b/drivers/gpu/drm/drm_file.c
index ec820686b302..200979d78452 100644
--- a/drivers/gpu/drm/drm_file.c
+++ b/drivers/gpu/drm/drm_file.c
@@ -572,8 +572,9 @@ ssize_t drm_read(struct file *filp, char __user *buffer,
 			mutex_unlock(&file_priv->event_read_lock);
 			ret = wait_event_interruptible(file_priv->event_wait,
 						       !list_empty(&file_priv->event_list));
-			if (ret >= 0)
-				ret = mutex_lock_interruptible(&file_priv->event_read_lock);
+			if (ret < 0)
+				return ret;
+			ret = mutex_lock_interruptible(&file_priv->event_read_lock);
 			if (ret)
 				return ret;
 		} else {

[PATCH 11/62] drm/pagemap: Unlock cache->lock before freeing it

[Bart Van Assche]

From: Bart Van Assche <bvanassche@acm.org>

Although freeing a spinlock without unlocking it is fine, this confuses
static analyzers. Hence this patch.

Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Cc: Maxime Ripard <mripard@kernel.org>
Cc: Thomas Zimmermann <tzimmermann@suse.de>
Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Cc: Matthew Brost <matthew.brost@intel.com>
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
---
 drivers/gpu/drm/drm_pagemap_util.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/gpu/drm/drm_pagemap_util.c b/drivers/gpu/drm/drm_pagemap_util.c
index 14ddb948a32e..50cb5f9cdac5 100644
--- a/drivers/gpu/drm/drm_pagemap_util.c
+++ b/drivers/gpu/drm/drm_pagemap_util.c
@@ -74,6 +74,8 @@ static void drm_pagemap_cache_fini(void *arg)
 		cache->dpagemap = NULL;
 		spin_unlock(&cache->lock);
 		drm_pagemap_destroy(dpagemap, false);
+	} else {
+		spin_unlock(&cache->lock);
 	}
 
 out:

[PATCH 12/62] drm/gpusvm.c: Fix a locking bug in an error path

[Bart Van Assche]

From: Bart Van Assche <bvanassche@acm.org>

Only call drm_gpusvm_notifier_unlock() if drm_gpusvm_notifier_lock() was
called first. This has been detected by the Clang thread-safety
analyzer. Compile-tested only.

Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com>
Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Fixes: f1d08a586482 ("drm/gpusvm: Introduce a function to scan the current migration state")
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
---
 drivers/gpu/drm/drm_gpusvm.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/drm_gpusvm.c b/drivers/gpu/drm/drm_gpusvm.c
index 24180bfdf5a2..e9b79ab2f83c 100644
--- a/drivers/gpu/drm/drm_gpusvm.c
+++ b/drivers/gpu/drm/drm_gpusvm.c
@@ -819,7 +819,7 @@ enum drm_gpusvm_scan_result drm_gpusvm_scan_mm(struct drm_gpusvm_range *range,
 
 		if (!(pfns[i] & HMM_PFN_VALID)) {
 			state = DRM_GPUSVM_SCAN_UNPOPULATED;
-			goto err_free;
+			goto unlock;
 		}
 
 		page = hmm_pfn_to_page(pfns[i]);
@@ -856,9 +856,10 @@ enum drm_gpusvm_scan_result drm_gpusvm_scan_mm(struct drm_gpusvm_range *range,
 		i += 1ul << drm_gpusvm_hmm_pfn_to_order(pfns[i], i, npages);
 	}
 
-err_free:
+unlock:
 	drm_gpusvm_notifier_unlock(range->gpusvm);
 
+err_free:
 	kvfree(pfns);
 	return state;
 }

[PATCH 13/62] drm/qxl: Fix a buffer leak in an error path

[Bart Van Assche]

From: Bart Van Assche <bvanassche@acm.org>

If qxl_bo_reserve() succeeds, call qxl_bo_unreserve() instead of
skipping that call.

This has been detected by the Clang thread-safety analyzer.
Compile-tested only.

Cc: Dave Airlie <airlied@redhat.com>
Cc: Gerd Hoffmann <kraxel@redhat.com>
Cc: virtualization@lists.linux.dev
Fixes: f64122c1f6ad ("drm: add new QXL driver. (v1.4)")
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
---
 drivers/gpu/drm/qxl/qxl_ioctl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/qxl/qxl_ioctl.c b/drivers/gpu/drm/qxl/qxl_ioctl.c
index 4ee2b5acf2e0..5617811f3c9b 100644
--- a/drivers/gpu/drm/qxl/qxl_ioctl.c
+++ b/drivers/gpu/drm/qxl/qxl_ioctl.c
@@ -323,7 +323,7 @@ int qxl_update_area_ioctl(struct drm_device *dev, void *data, struct drm_file *f
 		qxl_ttm_placement_from_domain(qobj, qobj->type);
 		ret = ttm_bo_validate(&qobj->tbo, &qobj->placement, &ctx);
 		if (unlikely(ret))
-			goto out;
+			goto out2;
 	}
 
 	ret = qxl_bo_check_id(qdev, qobj);

[PATCH 14/62] hwmon: (it87) Check the it87_lock() return value

[Bart Van Assche]

From: Bart Van Assche <bvanassche@acm.org>

Return early in it87_resume() if it87_lock() fails instead of ignoring the
return value of that function. This patch suppresses a Clang thread-safety
warning.

Cc: Frank Crawford <frank@crawford.emu.id.au>
Cc: Guenter Roeck <linux@roeck-us.net>
Cc: Jean Delvare <jdelvare@suse.com>
Cc: linux-hwmon@vger.kernel.org
Fixes: 376e1a937b30 ("hwmon: (it87) Add calls to smbus_enable/smbus_disable as required")
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
---
 drivers/hwmon/it87.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/hwmon/it87.c b/drivers/hwmon/it87.c
index e233aafa8856..8e3935089fca 100644
--- a/drivers/hwmon/it87.c
+++ b/drivers/hwmon/it87.c
@@ -3593,7 +3593,9 @@ static int it87_resume(struct device *dev)
 
 	it87_resume_sio(pdev);
 
-	it87_lock(data);
+	int err = it87_lock(data);
+	if (err)
+		return err;
 
 	it87_check_pwm(dev);
 	it87_check_limit_regs(data);

[PATCH 15/62] Input: synaptics-rmi4 - fix a locking bug in an error path

[Bart Van Assche]

From: Bart Van Assche <bvanassche@acm.org>

Lock f54->data_mutex before the first 'goto error' statement since
jumping to the 'error' label causes that mutex to be unlocked.

This bug has been detected by the Clang thread-safety checker.

Cc: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Cc: Nick Dyer <nick@shmanahar.org>
Cc: linux-input@vger.kernel.org
Fixes: 3a762dbd5347 ("[media] Input: synaptics-rmi4 - add support for F54 diagnostics")
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
---
 drivers/input/rmi4/rmi_f54.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/input/rmi4/rmi_f54.c b/drivers/input/rmi4/rmi_f54.c
index ac4041a69fcd..fd57ebb1cb50 100644
--- a/drivers/input/rmi4/rmi_f54.c
+++ b/drivers/input/rmi4/rmi_f54.c
@@ -539,6 +539,9 @@ static void rmi_f54_work(struct work_struct *work)
 	int i;
 
 	report_size = rmi_f54_get_report_size(f54);
+
+	mutex_lock(&f54->data_mutex);
+
 	if (report_size == 0) {
 		dev_err(&fn->dev, "Bad report size, report type=%d\n",
 				f54->report_type);
@@ -546,8 +549,6 @@ static void rmi_f54_work(struct work_struct *work)
 		goto error;     /* retry won't help */
 	}
 
-	mutex_lock(&f54->data_mutex);
-
 	/*
 	 * Need to check if command has completed.
 	 * If not try again later.

[PATCH 16/62] md: Make mddev_suspend() easier to analyze

[Bart Van Assche]

From: Bart Van Assche <bvanassche@acm.org>

Prepare for enabling Clang's thread-safety analysis by moving an
if-statement. No functionality has been changed.

Cc: Song Liu <song@kernel.org>
Cc: Yu Kuai <yukuai@fnnas.com>
Cc: linux-raid@vger.kernel.org
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
---
 drivers/md/md.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/drivers/md/md.c b/drivers/md/md.c
index 3ce6f9e9d38e..b0d260d03a7d 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -475,12 +475,13 @@ int mddev_suspend(struct mddev *mddev, bool interruptible)
 	 */
 	lockdep_assert_not_held(&mddev->reconfig_mutex);
 
-	if (interruptible)
+	if (interruptible) {
 		err = mutex_lock_interruptible(&mddev->suspend_mutex);
-	else
+		if (err)
+			return err;
+	} else {
 		mutex_lock(&mddev->suspend_mutex);
-	if (err)
-		return err;
+	}
 
 	if (mddev->suspended) {
 		WRITE_ONCE(mddev->suspended, mddev->suspended + 1);

[PATCH 17/62] bnxt_en: Make bnxt_resume() easier to analyze

[Bart Van Assche]

From: Bart Van Assche <bvanassche@acm.org>

Pass the same argument to netdev_lock() and netdev_unlock(). This patch
prepares for enabling the Clang thread-safety analysis functionality. No
functional change intended.

Cc: Shantiprasad Shettar <shantiprasad.shettar@broadcom.com>
Cc: netdev@vger.kernel.org
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
---
 drivers/net/ethernet/broadcom/bnxt/bnxt.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index e062d5d400da..950708575268 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -17121,7 +17121,7 @@ static int bnxt_resume(struct device *device)
 	}
 
 resume_exit:
-	netdev_unlock(bp->dev);
+	netdev_unlock(dev);
 	bnxt_ulp_start(bp, rc);
 	if (!rc)
 		bnxt_reenable_sriov(bp);

[PATCH 18/62] bnxt_en: Fix bnxt_dl_reload_up()

[Bart Van Assche]

From: Bart Van Assche <bvanassche@acm.org>

bnxt_dl_reload_down() calls rtnl_lock() and netdev_lock() if it returns
0. Hence, bnxt_dl_reload_up() should invoke the corresponding unlock
calls. This issue has been detected by the clang thread-sanitizer.
Compile-tested only.

Cc: Jakub Kicinski <kuba@kernel.org>
Cc: Shantiprasad Shettar <shantiprasad.shettar@broadcom.com>
Cc: Stanislav Fomichev <sdf@fomichev.me>
Cc: netdev@vger.kernel.org
Fixes: 004b5008016a ("eth: bnxt: remove most dependencies on RTNL")
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
---
 drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c
index 15de802bbac4..1e9a3454bb29 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c
@@ -562,6 +562,8 @@ static int bnxt_dl_reload_up(struct devlink *dl, enum devlink_reload_action acti
 		break;
 	}
 	default:
+		netdev_unlock(bp->dev);
+		rtnl_unlock();
 		return -EOPNOTSUPP;
 	}
 

[PATCH 19/62] ice: Fix a locking bug in an error path

[Bart Van Assche]

From: Bart Van Assche <bvanassche@acm.org>

Move the mutex_lock() call up to prevent that DCB settings change after
the ice_query_port_ets() call.

This patch fixes a bug in an error path. Without this patch pf->tc_mutex
may be unlocked in an error path without having been locked. This bug has
been detected by the clang thread-safety analyzer.

Cc: Tony Nguyen <anthony.l.nguyen@intel.com>
Cc: Przemek Kitszel <przemyslaw.kitszel@intel.com>
Cc: intel-wired-lan@lists.osuosl.org
Fixes: 242b5e068b25 ("ice: Fix DCB rebuild after reset")
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
---
 drivers/net/ethernet/intel/ice/ice_dcb_lib.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/intel/ice/ice_dcb_lib.c b/drivers/net/ethernet/intel/ice/ice_dcb_lib.c
index bd77f1c001ee..78ded6876581 100644
--- a/drivers/net/ethernet/intel/ice/ice_dcb_lib.c
+++ b/drivers/net/ethernet/intel/ice/ice_dcb_lib.c
@@ -537,14 +537,14 @@ void ice_dcb_rebuild(struct ice_pf *pf)
 	struct ice_dcbx_cfg *err_cfg;
 	int ret;
 
+	mutex_lock(&pf->tc_mutex);
+
 	ret = ice_query_port_ets(pf->hw.port_info, &buf, sizeof(buf), NULL);
 	if (ret) {
 		dev_err(dev, "Query Port ETS failed\n");
 		goto dcb_error;
 	}
 
-	mutex_lock(&pf->tc_mutex);
-
 	if (!pf->hw.port_info->qos_cfg.is_sw_lldp)
 		ice_cfg_etsrec_defaults(pf->hw.port_info);
 

[PATCH 20/62] octeontx2-pf: Fix locking in an error path

[Bart Van Assche]

From: Bart Van Assche <bvanassche@acm.org>

Only unlock pf->mbox.lock if it has been locked by otx2_do_set_vf_vlan().
This bug has been detected by the Clang thread-safety analyzer.

Cc: Naveen Mamindlapalli <naveenm@marvell.com>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: Sunil Goutham <sgoutham@marvell.com>
Cc: Geetha sowjanya <gakula@marvell.com>
Cc: Subbaraya Sundeep <sbhatta@marvell.com>
Cc: hariprasad <hkelam@marvell.com>
Cc: Bharat Bhushan <bbhushan2@marvell.com>
Cc: netdev@vger.kernel.org
Fixes: f0c2982aaf98 ("octeontx2-pf: Add support for SR-IOV management functions")
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
---
 drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c
index ee623476e5ff..8c9f08ed90fd 100644
--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c
+++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c
@@ -2588,7 +2588,7 @@ static int otx2_do_set_vf_vlan(struct otx2_nic *pf, int vf, u16 vlan, u8 qos,
 	config = &pf->vf_configs[vf];
 
 	if (!vlan && !config->vlan)
-		goto out;
+		return err;
 
 	mutex_lock(&pf->mbox.lock);
 

[PATCH 21/62] qed: Make _qed_mcp_cmd_and_union() easier to analyze

[Bart Van Assche]

From: Bart Van Assche <bvanassche@acm.org>

Make the implementation of this function compatible with clang's
compile-time thread-safety analysis by moving error-handling code to the
end of this function. No functionality has been changed.

Cc: Manish Chopra <manishc@marvell.com>
Cc: netdev@vger.kernel.org
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
---
 drivers/net/ethernet/qlogic/qed/qed_mcp.c | 56 ++++++++++++-----------
 1 file changed, 30 insertions(+), 26 deletions(-)

diff --git a/drivers/net/ethernet/qlogic/qed/qed_mcp.c b/drivers/net/ethernet/qlogic/qed/qed_mcp.c
index 7e37fe631a58..462e758c5890 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_mcp.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_mcp.c
@@ -467,7 +467,7 @@ _qed_mcp_cmd_and_union(struct qed_hwfn *p_hwfn,
 	int rc = 0;
 
 	/* Wait until the mailbox is non-occupied */
-	do {
+	for (;;) {
 		/* Exit the loop if there is no pending command, or if the
 		 * pending command is completed during this iteration.
 		 * The spinlock stays locked until the command is sent.
@@ -486,18 +486,14 @@ _qed_mcp_cmd_and_union(struct qed_hwfn *p_hwfn,
 
 		spin_unlock_bh(&p_hwfn->mcp_info->cmd_lock);
 
+		if (++cnt >= QED_DRV_MB_MAX_RETRIES)
+			goto retries_exceeded_1;
+
 		if (QED_MB_FLAGS_IS_SET(p_mb_params, CAN_SLEEP))
 			usleep_range(QED_MCP_RESP_ITER_US,
 				     QED_MCP_RESP_ITER_US * 2);
 		else
 			udelay(QED_MCP_RESP_ITER_US);
-	} while (++cnt < QED_DRV_MB_MAX_RETRIES);
-
-	if (cnt >= QED_DRV_MB_MAX_RETRIES) {
-		DP_NOTICE(p_hwfn,
-			  "The MFW mailbox is occupied by an uncompleted command. Failed to send command 0x%08x [param 0x%08x].\n",
-			  p_mb_params->cmd, p_mb_params->param);
-		return -EAGAIN;
 	}
 
 	/* Send the mailbox command */
@@ -513,7 +509,7 @@ _qed_mcp_cmd_and_union(struct qed_hwfn *p_hwfn,
 	spin_unlock_bh(&p_hwfn->mcp_info->cmd_lock);
 
 	/* Wait for the MFW response */
-	do {
+	for (;;) {
 		/* Exit the loop if the command is already completed, or if the
 		 * command is completed during this iteration.
 		 * The spinlock stays locked until the list element is removed.
@@ -537,24 +533,9 @@ _qed_mcp_cmd_and_union(struct qed_hwfn *p_hwfn,
 			goto err;
 
 		spin_unlock_bh(&p_hwfn->mcp_info->cmd_lock);
-	} while (++cnt < QED_DRV_MB_MAX_RETRIES);
-
-	if (cnt >= QED_DRV_MB_MAX_RETRIES) {
-		DP_NOTICE(p_hwfn,
-			  "The MFW failed to respond to command 0x%08x [param 0x%08x].\n",
-			  p_mb_params->cmd, p_mb_params->param);
-		qed_mcp_print_cpu_info(p_hwfn, p_ptt);
-
-		spin_lock_bh(&p_hwfn->mcp_info->cmd_lock);
-		qed_mcp_cmd_del_elem(p_hwfn, p_cmd_elem);
-		spin_unlock_bh(&p_hwfn->mcp_info->cmd_lock);
 
-		if (!QED_MB_FLAGS_IS_SET(p_mb_params, AVOID_BLOCK))
-			qed_mcp_cmd_set_blocking(p_hwfn, true);
-
-		qed_hw_err_notify(p_hwfn, p_ptt,
-				  QED_HW_ERR_MFW_RESP_FAIL, NULL);
-		return -EAGAIN;
+		if (++cnt >= QED_DRV_MB_MAX_RETRIES)
+			goto retries_exceeded_2;
 	}
 
 	qed_mcp_cmd_del_elem(p_hwfn, p_cmd_elem);
@@ -576,6 +557,29 @@ _qed_mcp_cmd_and_union(struct qed_hwfn *p_hwfn,
 err:
 	spin_unlock_bh(&p_hwfn->mcp_info->cmd_lock);
 	return rc;
+
+retries_exceeded_1:
+	DP_NOTICE(p_hwfn,
+		  "The MFW mailbox is occupied by an uncompleted command. Failed to send command 0x%08x [param 0x%08x].\n",
+		  p_mb_params->cmd, p_mb_params->param);
+	return -EAGAIN;
+
+retries_exceeded_2:
+	DP_NOTICE(p_hwfn,
+		  "The MFW failed to respond to command 0x%08x [param 0x%08x].\n",
+		  p_mb_params->cmd, p_mb_params->param);
+	qed_mcp_print_cpu_info(p_hwfn, p_ptt);
+
+	spin_lock_bh(&p_hwfn->mcp_info->cmd_lock);
+	qed_mcp_cmd_del_elem(p_hwfn, p_cmd_elem);
+	spin_unlock_bh(&p_hwfn->mcp_info->cmd_lock);
+
+	if (!QED_MB_FLAGS_IS_SET(p_mb_params, AVOID_BLOCK))
+		qed_mcp_cmd_set_blocking(p_hwfn, true);
+
+	qed_hw_err_notify(p_hwfn, p_ptt,
+			  QED_HW_ERR_MFW_RESP_FAIL, NULL);
+	return -EAGAIN;
 }
 
 static int qed_mcp_cmd_and_union(struct qed_hwfn *p_hwfn,

[PATCH 22/62] mctp i3c: Fix locking in error paths

[Bart Van Assche]

From: Bart Van Assche <bvanassche@acm.org>

Only unlock mi->lock if it has been locked. This bug has been detected by
the Clang thread-safety analyzer.

Cc: Leo Yang <Leo-Yang@quantatw.com>
Cc: Paolo Abeni <pabeni@redhat.com>
Cc: Jeremy Kerr <jk@codeconstruct.com.au>
Cc: Matt Johnston <matt@codeconstruct.com.au>
Cc: netdev@vger.kernel.org
Fixes: 2d2d4f60ed26 ("mctp i3c: fix MCTP I3C driver multi-thread issue")
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
---
 drivers/net/mctp/mctp-i3c.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/net/mctp/mctp-i3c.c b/drivers/net/mctp/mctp-i3c.c
index 6d2bbae7477b..d4a29912c7e1 100644
--- a/drivers/net/mctp/mctp-i3c.c
+++ b/drivers/net/mctp/mctp-i3c.c
@@ -112,7 +112,7 @@ static int mctp_i3c_read(struct mctp_i3c_device *mi)
 	if (!skb) {
 		stats->rx_dropped++;
 		rc = -ENOMEM;
-		goto err;
+		goto free_skb;
 	}
 
 	skb->protocol = htons(ETH_P_MCTP);
@@ -170,8 +170,11 @@ static int mctp_i3c_read(struct mctp_i3c_device *mi)
 
 	mutex_unlock(&mi->lock);
 	return 0;
+
 err:
 	mutex_unlock(&mi->lock);
+
+free_skb:
 	kfree_skb(skb);
 	return rc;
 }

[PATCH 23/62] net: phy: mxl-86110: Fix locking in an error path

[Bart Van Assche]

From: Bart Van Assche <bvanassche@acm.org>

Only call phy_unlock_mdio_bus() if phy_lock_mdio_bus() has been called
first. This has been detected by the Clang thread-safety analyzer.

Cc: Daniel Golle <daniel@makrotopia.org>
Cc: Andrew Lunn <andrew@lunn.ch>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: Xu Liang <lxu@maxlinear.com>
Cc: netdev@vger.kernel.org
Fixes: 3d1b3f4ffc0a ("net: phy: mxl-86110: add basic support for MxL86111 PHY")
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
---
 drivers/net/phy/mxl-86110.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/phy/mxl-86110.c b/drivers/net/phy/mxl-86110.c
index 42a5fe3f115f..d010b023f7b9 100644
--- a/drivers/net/phy/mxl-86110.c
+++ b/drivers/net/phy/mxl-86110.c
@@ -891,7 +891,7 @@ static int mxl86111_config_inband(struct phy_device *phydev, unsigned int modes)
 			       MII_BMCR, BMCR_ANENABLE,
 			       (modes == LINK_INBAND_DISABLE) ? 0 : BMCR_ANENABLE);
 	if (ret < 0)
-		goto out;
+		return ret;
 
 	phy_lock_mdio_bus(phydev);
 

[PATCH 24/62] net/cw1200: Fix locking in error paths

[Bart Van Assche]

From: Bart Van Assche <bvanassche@acm.org>

cw1200_wow_suspend() must only return with priv->conf_mutex locked if it
returns zero. This mutex must be unlocked if an error is returned. Add
mutex_unlock() calls to the error paths from which that call is missing.
This has been detected by the Clang thread-safety analyzer.

Cc: Kalle Valo <kvalo@codeaurora.org>
Cc: Johannes Berg <johannes@sipsolutions.net>
Cc: linux-wireless@vger.kernel.org
Fixes: a910e4a94f69 ("cw1200: add driver for the ST-E CW1100 & CW1200 WLAN chipsets")
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
---
 drivers/net/wireless/st/cw1200/pm.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/wireless/st/cw1200/pm.c b/drivers/net/wireless/st/cw1200/pm.c
index 120f0379f81d..84eb15d729c7 100644
--- a/drivers/net/wireless/st/cw1200/pm.c
+++ b/drivers/net/wireless/st/cw1200/pm.c
@@ -264,12 +264,14 @@ int cw1200_wow_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
 		wiphy_err(priv->hw->wiphy,
 			  "PM request failed: %d. WoW is disabled.\n", ret);
 		cw1200_wow_resume(hw);
+		mutex_unlock(&priv->conf_mutex);
 		return -EBUSY;
 	}
 
 	/* Force resume if event is coming from the device. */
 	if (atomic_read(&priv->bh_rx)) {
 		cw1200_wow_resume(hw);
+		mutex_unlock(&priv->conf_mutex);
 		return -EAGAIN;
 	}
 

[PATCH 25/62] wlcore: Fix a locking bug

[Bart Van Assche]

From: Bart Van Assche <bvanassche@acm.org>

Make sure that wl->mutex is locked before it is unlocked. This has been
detected by the Clang thread-safety analyzer.

Cc: Johannes Berg <johannes@sipsolutions.net>
Cc: Eyal Reizer <eyalr@ti.com>
Cc: Tony Lindgren <tony@atomide.com>
Cc: Kalle Valo <kvalo@codeaurora.org>
Cc: linux-wireless@vger.kernel.org
Fixes: 45aa7f071b06 ("wlcore: Use generic runtime pm calls for wowlan elp configuration")
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
---
 drivers/net/wireless/ti/wlcore/main.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/ti/wlcore/main.c b/drivers/net/wireless/ti/wlcore/main.c
index 17dd417756f2..1c340a4a0930 100644
--- a/drivers/net/wireless/ti/wlcore/main.c
+++ b/drivers/net/wireless/ti/wlcore/main.c
@@ -1875,6 +1875,8 @@ static int __maybe_unused wl1271_op_resume(struct ieee80211_hw *hw)
 		     wl->wow_enabled);
 	WARN_ON(!wl->wow_enabled);
 
+	mutex_lock(&wl->mutex);
+
 	ret = pm_runtime_force_resume(wl->dev);
 	if (ret < 0) {
 		wl1271_error("ELP wakeup failure!");
@@ -1891,8 +1893,6 @@ static int __maybe_unused wl1271_op_resume(struct ieee80211_hw *hw)
 		run_irq_work = true;
 	spin_unlock_irqrestore(&wl->wl_lock, flags);
 
-	mutex_lock(&wl->mutex);
-
 	/* test the recovery flag before calling any SDIO functions */
 	pending_recovery = test_bit(WL1271_FLAG_RECOVERY_IN_PROGRESS,
 				    &wl->flags);

[PATCH 26/62] misc: nsm: Fix a locking bug in an error path

[Bart Van Assche]

From: Bart Van Assche <bvanassche@acm.org>

If nsm->lock has not been locked, do not unlock it from any error path.
This bug has been detected by the Clang thread-safety analyzer.

Cc: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Cc: Michael S. Tsirkin <mst@redhat.com>
Cc: Alexander Graf <graf@amazon.com>
Cc: The AWS Nitro Enclaves Team <aws-nitro-enclaves-devel@amazon.com>
Cc: linux-kernel@vger.kernel.org
Fixes: b9873755a6c8 ("misc: Add Nitro Secure Module driver")
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
---
 drivers/misc/nsm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/misc/nsm.c b/drivers/misc/nsm.c
index ef7b32742340..185900cdad4a 100644
--- a/drivers/misc/nsm.c
+++ b/drivers/misc/nsm.c
@@ -367,7 +367,7 @@ static long nsm_dev_ioctl(struct file *file, unsigned int cmd,
 	/* Copy user argument struct to kernel argument struct */
 	r = -EFAULT;
 	if (copy_from_user(&raw, argp, _IOC_SIZE(cmd)))
-		goto out;
+		return r;
 
 	mutex_lock(&nsm->lock);
 

[PATCH 27/62] pci: Fix locking in pci_do_resource_release_and_resize() error paths

[Bart Van Assche]

From: Bart Van Assche <bvanassche@acm.org>

Make sure that down(&pci_bus_sem) has been called before
up(&pci_bus_sem) is called. This has been detected by the Clang
thread-safety analyzer. Compile-tested only.

Cc: Bjorn Helgaas <bhelgaas@google.com>
Cc: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Cc: linux-pci@vger.kernel.org
Fixes: 337b1b566db0 ("PCI: Fix restoring BARs on BAR resize rollback path")
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
---
 drivers/pci/setup-bus.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/pci/setup-bus.c b/drivers/pci/setup-bus.c
index 61f769aaa2f6..3bb8cd9a581e 100644
--- a/drivers/pci/setup-bus.c
+++ b/drivers/pci/setup-bus.c
@@ -2346,6 +2346,7 @@ int pci_do_resource_release_and_resize(struct pci_dev *pdev, int resno, int size
 	if (ret)
 		return ret;
 
+	down_read(&pci_bus_sem);
 	pci_dev_for_each_resource(pdev, r, i) {
 		if (i >= PCI_BRIDGE_RESOURCES)
 			break;
@@ -2367,7 +2368,6 @@ int pci_do_resource_release_and_resize(struct pci_dev *pdev, int resno, int size
 	if (!bus->self)
 		goto out;
 
-	down_read(&pci_bus_sem);
 	ret = pbus_reassign_bridge_resources(bus, res, &saved);
 	if (ret)
 		goto restore;

[PATCH 28/62] PNP: isapnp: Check the isapnp_cfg_begin() return value

[Bart Van Assche]

From: Bart Van Assche <bvanassche@acm.org>

Instead of ignoring isapnp_cfg_begin() failures, propagate the value
returned by this function in case of a failure. This patch prepares
for enabling thread-safety analysis since isapnp_cfg_begin() only locks
a particular mutex if it returns zero.

Cc: Jaroslav Kysela <perex@perex.cz>
Cc: Adam Belay <ambx1@neo.rr.com>
Cc: Rafael J. Wysocki <rafael@kernel.org>
Cc: linux-acpi@vger.kernel.org
Fixes: f72e5c5c861c ("[PATCH] PnP Rewrite V0.9 - 2.5.43")
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
---
 drivers/pnp/isapnp/core.c | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/drivers/pnp/isapnp/core.c b/drivers/pnp/isapnp/core.c
index 219f96f2aaaf..3591a2791c1a 100644
--- a/drivers/pnp/isapnp/core.c
+++ b/drivers/pnp/isapnp/core.c
@@ -853,7 +853,9 @@ static int isapnp_get_resources(struct pnp_dev *dev)
 
 	pnp_dbg(&dev->dev, "get resources\n");
 	pnp_init_resources(dev);
-	isapnp_cfg_begin(dev->card->number, dev->number);
+	ret = isapnp_cfg_begin(dev->card->number, dev->number);
+	if (ret)
+		return ret;
 	dev->active = isapnp_read_byte(ISAPNP_CFG_ACTIVATE);
 	if (!dev->active)
 		goto __end;
@@ -887,10 +889,12 @@ static int isapnp_get_resources(struct pnp_dev *dev)
 static int isapnp_set_resources(struct pnp_dev *dev)
 {
 	struct resource *res;
-	int tmp;
+	int tmp, ret;
 
 	pnp_dbg(&dev->dev, "set resources\n");
-	isapnp_cfg_begin(dev->card->number, dev->number);
+	ret = isapnp_cfg_begin(dev->card->number, dev->number);
+	if (ret)
+		return ret;
 	dev->active = 1;
 	for (tmp = 0; tmp < ISAPNP_MAX_PORT; tmp++) {
 		res = pnp_get_resource(dev, IORESOURCE_IO, tmp);
@@ -936,9 +940,13 @@ static int isapnp_set_resources(struct pnp_dev *dev)
 
 static int isapnp_disable_resources(struct pnp_dev *dev)
 {
+	int ret;
+
 	if (!dev->active)
 		return -EINVAL;
-	isapnp_cfg_begin(dev->card->number, dev->number);
+	ret = isapnp_cfg_begin(dev->card->number, dev->number);
+	if (ret)
+		return ret;
 	isapnp_deactivate(dev->number);
 	dev->active = 0;
 	isapnp_cfg_end();

[PATCH 29/62] fnic: Make fnic_queuecommand() easier to analyze

[Bart Van Assche]

From: Bart Van Assche <bvanassche@acm.org>

Move a spin_unlock_irqrestore() call such that the io_lock_acquired
variable can be eliminated. This patch prepares for enabling the Clang
thread-safety analyzer.

Cc: Satish Kharat <satishkh@cisco.com>
Cc: Sesidhar Baddela <sebaddel@cisco.com>
Cc: Karan Tilak Kumar <kartilak@cisco.com>
Cc: James E.J. Bottomley <James.Bottomley@HansenPartnership.com>
Cc: Martin K. Petersen <martin.petersen@oracle.com>
Cc: linux-scsi@vger.kernel.org
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
---
 drivers/scsi/fnic/fnic_scsi.c | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/drivers/scsi/fnic/fnic_scsi.c b/drivers/scsi/fnic/fnic_scsi.c
index 29d7aca06958..f47c92dfbfd0 100644
--- a/drivers/scsi/fnic/fnic_scsi.c
+++ b/drivers/scsi/fnic/fnic_scsi.c
@@ -471,7 +471,6 @@ enum scsi_qc_status fnic_queuecommand(struct Scsi_Host *shost,
 	int sg_count = 0;
 	unsigned long flags = 0;
 	unsigned long ptr;
-	int io_lock_acquired = 0;
 	uint16_t hwq = 0;
 	struct fnic_tport_s *tport = NULL;
 	struct rport_dd_data_s *rdd_data;
@@ -636,7 +635,6 @@ enum scsi_qc_status fnic_queuecommand(struct Scsi_Host *shost,
 	spin_lock_irqsave(&fnic->wq_copy_lock[hwq], flags);
 
 	/* initialize rest of io_req */
-	io_lock_acquired = 1;
 	io_req->port_id = rport->port_id;
 	io_req->start_time = jiffies;
 	fnic_priv(sc)->state = FNIC_IOREQ_CMD_PENDING;
@@ -689,6 +687,9 @@ enum scsi_qc_status fnic_queuecommand(struct Scsi_Host *shost,
 		/* REVISIT: Use per IO lock in the final code */
 		fnic_priv(sc)->flags |= FNIC_IO_ISSUED;
 	}
+
+	spin_unlock_irqrestore(&fnic->wq_copy_lock[hwq], flags);
+
 out:
 	cmd_trace = ((u64)sc->cmnd[0] << 56 | (u64)sc->cmnd[7] << 40 |
 			(u64)sc->cmnd[8] << 32 | (u64)sc->cmnd[2] << 24 |
@@ -699,10 +700,6 @@ enum scsi_qc_status fnic_queuecommand(struct Scsi_Host *shost,
 		   mqtag, sc, io_req, sg_count, cmd_trace,
 		   fnic_flags_and_state(sc));
 
-	/* if only we issued IO, will we have the io lock */
-	if (io_lock_acquired)
-		spin_unlock_irqrestore(&fnic->wq_copy_lock[hwq], flags);
-
 	atomic_dec(&fnic->in_flight);
 	atomic_dec(&tport->in_flight);
 

[PATCH 30/62] megaraid: Protect more code with instance->reset_mutex

[Bart Van Assche]

From: Bart Van Assche <bvanassche@acm.org>

megasas_get_device_list() and megasas_get_snapdump_properties() may
unlock instance->reset_mutex indirectly. Hence, hold reset_mutex while
calling these functions.

Cc: Kashyap Desai <kashyap.desai@broadcom.com>
Cc: Sumit Saxena <sumit.saxena@broadcom.com>
Cc: Shivasharan S <shivasharan.srikanteshwara@broadcom.com>
Cc: Chandrakanth patil <chandrakanth.patil@broadcom.com>
Cc: James E.J. Bottomley <James.Bottomley@HansenPartnership.com>
Cc: Martin K. Petersen <martin.petersen@oracle.com>
Cc: megaraidlinux.pdl@broadcom.com
Cc: linux-scsi@vger.kernel.org
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
---
 drivers/scsi/megaraid/megaraid_sas_base.c | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
index ac71ea4898b2..ecd365d78ae3 100644
--- a/drivers/scsi/megaraid/megaraid_sas_base.c
+++ b/drivers/scsi/megaraid/megaraid_sas_base.c
@@ -6365,11 +6365,13 @@ static int megasas_init_fw(struct megasas_instance *instance)
 
 	megasas_setup_jbod_map(instance);
 
-	if (megasas_get_device_list(instance) != SUCCESS) {
-		dev_err(&instance->pdev->dev,
-			"%s: megasas_get_device_list failed\n",
-			__func__);
-		goto fail_get_ld_pd_list;
+	scoped_guard(mutex, &instance->reset_mutex) {
+		if (megasas_get_device_list(instance) != SUCCESS) {
+			dev_err(&instance->pdev->dev,
+				"%s: megasas_get_device_list failed\n",
+				__func__);
+			goto fail_get_ld_pd_list;
+		}
 	}
 
 	/* stream detection initialization */
@@ -6468,7 +6470,8 @@ static int megasas_init_fw(struct megasas_instance *instance)
 	}
 
 	if (instance->snapdump_wait_time) {
-		megasas_get_snapdump_properties(instance);
+		scoped_guard(mutex, &instance->reset_mutex)
+			megasas_get_snapdump_properties(instance);
 		dev_info(&instance->pdev->dev, "Snap dump wait time\t: %d\n",
 			 instance->snapdump_wait_time);
 	}

Re: [PATCH 12/62] drm/gpusvm.c: Fix a locking bug in an error path

[Matthew Brost]

On Mon, Feb 23, 2026 at 02:00:12PM -0800, Bart Van Assche wrote:
> From: Bart Van Assche <bvanassche@acm.org>
> 
> Only call drm_gpusvm_notifier_unlock() if drm_gpusvm_notifier_lock() was
> called first. This has been detected by the Clang thread-safety
> analyzer. Compile-tested only.
> 
> Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
> Cc: Matthew Brost <matthew.brost@intel.com>
> Cc: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com>
> Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
> Fixes: f1d08a586482 ("drm/gpusvm: Introduce a function to scan the current migration state")
> Signed-off-by: Bart Van Assche <bvanassche@acm.org>
> ---
>  drivers/gpu/drm/drm_gpusvm.c | 5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/gpu/drm/drm_gpusvm.c b/drivers/gpu/drm/drm_gpusvm.c
> index 24180bfdf5a2..e9b79ab2f83c 100644
> --- a/drivers/gpu/drm/drm_gpusvm.c
> +++ b/drivers/gpu/drm/drm_gpusvm.c
> @@ -819,7 +819,7 @@ enum drm_gpusvm_scan_result drm_gpusvm_scan_mm(struct drm_gpusvm_range *range,
>  
>  		if (!(pfns[i] & HMM_PFN_VALID)) {
>  			state = DRM_GPUSVM_SCAN_UNPOPULATED;
> -			goto err_free;
> +			goto unlock;

Indeed a problem but we have this fixed in drm-tip.

git format-patch -1 d287dee565c3c

'drm/gpusvm: Fix unbalanced unlock in drm_gpusvm_scan_mm'

Not sure which tree you are in but this should propagate up to Linus
during the 7.0 cycle.

Matt

>  		}
>  
>  		page = hmm_pfn_to_page(pfns[i]);
> @@ -856,9 +856,10 @@ enum drm_gpusvm_scan_result drm_gpusvm_scan_mm(struct drm_gpusvm_range *range,
>  		i += 1ul << drm_gpusvm_hmm_pfn_to_order(pfns[i], i, npages);
>  	}
>  
> -err_free:
> +unlock:
>  	drm_gpusvm_notifier_unlock(range->gpusvm);
>  
> +err_free:
>  	kvfree(pfns);
>  	return state;
>  }

Re: [PATCH 11/62] drm/pagemap: Unlock cache->lock before freeing it

[Matthew Brost]

On Mon, Feb 23, 2026 at 02:00:11PM -0800, Bart Van Assche wrote:
> From: Bart Van Assche <bvanassche@acm.org>
> 
> Although freeing a spinlock without unlocking it is fine, this confuses

Fine, but pretty bad practice.

> static analyzers. Hence this patch.
> 
> Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
> Cc: Maxime Ripard <mripard@kernel.org>
> Cc: Thomas Zimmermann <tzimmermann@suse.de>
> Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
> Cc: Matthew Brost <matthew.brost@intel.com>

With that:
Reviewed-by: Matthew Brost <matthew.brost@intel.com>

We can apply this to the DRM branches and propagate this up to Linus
during 7.0 cycle if that works for you? Or if you have other plans to
merge, let us know.

Matt

> Signed-off-by: Bart Van Assche <bvanassche@acm.org>
> ---
>  drivers/gpu/drm/drm_pagemap_util.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/gpu/drm/drm_pagemap_util.c b/drivers/gpu/drm/drm_pagemap_util.c
> index 14ddb948a32e..50cb5f9cdac5 100644
> --- a/drivers/gpu/drm/drm_pagemap_util.c
> +++ b/drivers/gpu/drm/drm_pagemap_util.c
> @@ -74,6 +74,8 @@ static void drm_pagemap_cache_fini(void *arg)
>  		cache->dpagemap = NULL;
>  		spin_unlock(&cache->lock);
>  		drm_pagemap_destroy(dpagemap, false);
> +	} else {
> +		spin_unlock(&cache->lock);
>  	}
>  
>  out:

Re: [PATCH 12/62] drm/gpusvm.c: Fix a locking bug in an error path

[Bart Van Assche]

On 2/23/26 2:11 PM, Matthew Brost wrote:
> On Mon, Feb 23, 2026 at 02:00:12PM -0800, Bart Van Assche wrote:
>> From: Bart Van Assche <bvanassche@acm.org>
>>
>> Only call drm_gpusvm_notifier_unlock() if drm_gpusvm_notifier_lock() was
>> called first. This has been detected by the Clang thread-safety
>> analyzer. Compile-tested only.
>>
>> Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
>> Cc: Matthew Brost <matthew.brost@intel.com>
>> Cc: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com>
>> Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
>> Fixes: f1d08a586482 ("drm/gpusvm: Introduce a function to scan the current migration state")
>> Signed-off-by: Bart Van Assche <bvanassche@acm.org>
>> ---
>>   drivers/gpu/drm/drm_gpusvm.c | 5 +++--
>>   1 file changed, 3 insertions(+), 2 deletions(-)
>>
>> diff --git a/drivers/gpu/drm/drm_gpusvm.c b/drivers/gpu/drm/drm_gpusvm.c
>> index 24180bfdf5a2..e9b79ab2f83c 100644
>> --- a/drivers/gpu/drm/drm_gpusvm.c
>> +++ b/drivers/gpu/drm/drm_gpusvm.c
>> @@ -819,7 +819,7 @@ enum drm_gpusvm_scan_result drm_gpusvm_scan_mm(struct drm_gpusvm_range *range,
>>   
>>   		if (!(pfns[i] & HMM_PFN_VALID)) {
>>   			state = DRM_GPUSVM_SCAN_UNPOPULATED;
>> -			goto err_free;
>> +			goto unlock;
> 
> Indeed a problem but we have this fixed in drm-tip.
> 
> git format-patch -1 d287dee565c3c
> 
> 'drm/gpusvm: Fix unbalanced unlock in drm_gpusvm_scan_mm'
> 
> Not sure which tree you are in but this should propagate up to Linus
> during the 7.0 cycle.

Thanks Matt for the quick follow-up. This patch series is based on
Linus' master branch. Since a fix has already been queued in the drm-tip
branch, I will drop this patch.

Bart.

Re: [PATCH 26/62] misc: nsm: Fix a locking bug in an error path

[Alexander Graf]

On 23.02.26 23:00, Bart Van Assche wrote:
> From: Bart Van Assche <bvanassche@acm.org>
>
> If nsm->lock has not been locked, do not unlock it from any error path.
> This bug has been detected by the Clang thread-safety analyzer.
>
> Cc: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> Cc: Michael S. Tsirkin <mst@redhat.com>
> Cc: Alexander Graf <graf@amazon.com>
> Cc: The AWS Nitro Enclaves Team <aws-nitro-enclaves-devel@amazon.com>
> Cc: linux-kernel@vger.kernel.org
> Fixes: b9873755a6c8 ("misc: Add Nitro Secure Module driver")
> Signed-off-by: Bart Van Assche <bvanassche@acm.org>


Thanks for catching this!

Reviewed-by: Alexander Graf <graf@amazon.com>


Alex





Amazon Web Services Development Center Germany GmbH
Tamara-Danz-Str. 13
10243 Berlin
Geschaeftsfuehrung: Christof Hellmis, Andreas Stieger
Eingetragen am Amtsgericht Charlottenburg unter HRB 257764 B
Sitz: Berlin
Ust-ID: DE 365 538 597

Re: [PATCH 11/62] drm/pagemap: Unlock cache->lock before freeing it

[Bart Van Assche]

On 2/23/26 2:14 PM, Matthew Brost wrote:
> On Mon, Feb 23, 2026 at 02:00:11PM -0800, Bart Van Assche wrote:
>> From: Bart Van Assche <bvanassche@acm.org>
>>
>> Although freeing a spinlock without unlocking it is fine, this confuses
> 
> Fine, but pretty bad practice.
> 
>> static analyzers. Hence this patch.
>>
>> Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
>> Cc: Maxime Ripard <mripard@kernel.org>
>> Cc: Thomas Zimmermann <tzimmermann@suse.de>
>> Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
>> Cc: Matthew Brost <matthew.brost@intel.com>
> 
> With that:
> Reviewed-by: Matthew Brost <matthew.brost@intel.com>
> 
> We can apply this to the DRM branches and propagate this up to Linus
> during 7.0 cycle if that works for you? Or if you have other plans to
> merge, let us know.
Peter asked me to split this series into one series per maintainer and
to send the patches directly to the respective maintainers. Feel free to
queue this patch in a DRM branch.

Thanks,

Bart.

Re: [PATCH 11/62] drm/pagemap: Unlock cache->lock before freeing it

[Matthew Brost]

On Mon, Feb 23, 2026 at 02:20:20PM -0800, Bart Van Assche wrote:
> On 2/23/26 2:14 PM, Matthew Brost wrote:
> > On Mon, Feb 23, 2026 at 02:00:11PM -0800, Bart Van Assche wrote:
> > > From: Bart Van Assche <bvanassche@acm.org>
> > > 
> > > Although freeing a spinlock without unlocking it is fine, this confuses
> > 
> > Fine, but pretty bad practice.
> > 
> > > static analyzers. Hence this patch.
> > > 
> > > Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
> > > Cc: Maxime Ripard <mripard@kernel.org>
> > > Cc: Thomas Zimmermann <tzimmermann@suse.de>
> > > Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
> > > Cc: Matthew Brost <matthew.brost@intel.com>
> > 
> > With that:
> > Reviewed-by: Matthew Brost <matthew.brost@intel.com>
> > 
> > We can apply this to the DRM branches and propagate this up to Linus
> > during 7.0 cycle if that works for you? Or if you have other plans to
> > merge, let us know.
> Peter asked me to split this series into one series per maintainer and
> to send the patches directly to the respective maintainers. Feel free to
> queue this patch in a DRM branch.
> 

I've reposted the patch, retaining you as the author, to our lists [1],
since we pull patches from the lists when merging and to run our CI.

Let me know if anything looks wrong there, but I’ll merge once CI comes
back (might take a few days, as CI is currently broken after we rebased
on 7.0‑rc1). After that, it will be in the PR up to Linus during the
fixes phase.

Matt

[1] https://patchwork.freedesktop.org/series/162019/

> Thanks,
> 
> Bart.

Re: [PATCH 04/62] dax/bus.c: Fix a locking bug

[dan.j.williams]

Bart Van Assche wrote:
> From: Bart Van Assche <bvanassche@acm.org>
> 
> Only unlock dax_dev_rwsem if it has been locked. This locking bug was
> detected by the Clang thread-safety analyzer.
> 
> Cc: Dan Williams <dan.j.williams@intel.com>
> Cc: Vishal Verma <vishal.l.verma@intel.com>
> Cc: Dave Jiang <dave.jiang@intel.com>
> Cc: Alison Schofield <alison.schofield@intel.com>
> Cc: nvdimm@lists.linux.dev
> Cc: linux-cxl@vger.kernel.org
> Fixes: c05ae9d85b47 ("dax/bus.c: replace driver-core lock usage by a local rwsem")
> Signed-off-by: Bart Van Assche <bvanassche@acm.org>

Looks good,

Reviewed-by: Dan Williams <dan.j.williams@intel.com>

Re: [PATCH 23/62] net: phy: mxl-86110: Fix locking in an error path

[Daniel Golle]

On Mon, Feb 23, 2026 at 02:00:23PM -0800, Bart Van Assche wrote:
> From: Bart Van Assche <bvanassche@acm.org>
> 
> Only call phy_unlock_mdio_bus() if phy_lock_mdio_bus() has been called
> first. This has been detected by the Clang thread-safety analyzer.
> 
> Cc: Daniel Golle <daniel@makrotopia.org>
> Cc: Andrew Lunn <andrew@lunn.ch>
> Cc: Jakub Kicinski <kuba@kernel.org>
> Cc: Xu Liang <lxu@maxlinear.com>
> Cc: netdev@vger.kernel.org
> Fixes: 3d1b3f4ffc0a ("net: phy: mxl-86110: add basic support for MxL86111 PHY")
> Signed-off-by: Bart Van Assche <bvanassche@acm.org>

Reviewed-by: Daniel Golle <daniel@makrotopia.org>

> ---
>  drivers/net/phy/mxl-86110.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/net/phy/mxl-86110.c b/drivers/net/phy/mxl-86110.c
> index 42a5fe3f115f..d010b023f7b9 100644
> --- a/drivers/net/phy/mxl-86110.c
> +++ b/drivers/net/phy/mxl-86110.c
> @@ -891,7 +891,7 @@ static int mxl86111_config_inband(struct phy_device *phydev, unsigned int modes)
>  			       MII_BMCR, BMCR_ANENABLE,
>  			       (modes == LINK_INBAND_DISABLE) ? 0 : BMCR_ANENABLE);
>  	if (ret < 0)
> -		goto out;
> +		return ret;
>  
>  	phy_lock_mdio_bus(phydev);
>  

Re: [PATCH 23/62] net: phy: mxl-86110: Fix locking in an error path

[Andrew Lunn]

On Mon, Feb 23, 2026 at 02:00:23PM -0800, Bart Van Assche wrote:
> From: Bart Van Assche <bvanassche@acm.org>
> 
> Only call phy_unlock_mdio_bus() if phy_lock_mdio_bus() has been called
> first. This has been detected by the Clang thread-safety analyzer.
> 
> Cc: Daniel Golle <daniel@makrotopia.org>
> Cc: Andrew Lunn <andrew@lunn.ch>
> Cc: Jakub Kicinski <kuba@kernel.org>
> Cc: Xu Liang <lxu@maxlinear.com>
> Cc: netdev@vger.kernel.org
> Fixes: 3d1b3f4ffc0a ("net: phy: mxl-86110: add basic support for MxL86111 PHY")
> Signed-off-by: Bart Van Assche <bvanassche@acm.org>

Reviewed-by: Andrew Lunn <andrew@lunn.ch>

    Andrew

RE: [PATCH 07/62] drm/amdgpu: Unlock a mutex before destroying it

[Wang, Yang(Kevin)]

[AMD Official Use Only - AMD Internal Distribution Only]

Reviewed-by: Yang Wang <kevinyang.wang@amd.com>

Best Regards,
Kevin

-----Original Message-----
From: Bart Van Assche <bart.vanassche@linux.dev>
Sent: Tuesday, February 24, 2026 6:00 AM
To: Peter Zijlstra <peterz@infradead.org>
Cc: Ingo Molnar <mingo@redhat.com>; Will Deacon <will@kernel.org>; Boqun Feng <boqun@kernel.org>; Waiman Long <longman@redhat.com>; linux-kernel@vger.kernel.org; Marco Elver <elver@google.com>; Christoph Hellwig <hch@lst.de>; Steven Rostedt <rostedt@goodmis.org>; Nick Desaulniers <ndesaulniers@google.com>; Nathan Chancellor <nathan@kernel.org>; Kees Cook <kees@kernel.org>; Jann Horn <jannh@google.com>; Bart Van Assche <bvanassche@acm.org>; Deucher, Alexander <Alexander.Deucher@amd.com>; Koenig, Christian <Christian.Koenig@amd.com>; Wang, Yang(Kevin) <KevinYang.Wang@amd.com>; Zhang, Hawking <Hawking.Zhang@amd.com>; amd-gfx@lists.freedesktop.org
Subject: [PATCH 07/62] drm/amdgpu: Unlock a mutex before destroying it

[You don't often get email from bart.vanassche@linux.dev. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]

From: Bart Van Assche <bvanassche@acm.org>

Mutexes must be unlocked before these are destroyed. This has been detected by the Clang thread-safety analyzer.

Cc: Alex Deucher <alexander.deucher@amd.com>
Cc: Christian König <christian.koenig@amd.com>
Cc: Yang Wang <kevinyang.wang@amd.com>
Cc: Hawking Zhang <Hawking.Zhang@amd.com>
Cc: amd-gfx@lists.freedesktop.org
Fixes: f5e4cc8461c4 ("drm/amdgpu: implement RAS ACA driver framework")
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c
index afe5ca81beec..db7858fe0c3d 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c
@@ -641,6 +641,7 @@ static void aca_error_fini(struct aca_error *aerr)
                aca_bank_error_remove(aerr, bank_error);

 out_unlock:
+       mutex_unlock(&aerr->lock);
        mutex_destroy(&aerr->lock);
 }

Re: [PATCH 27/62] pci: Fix locking in pci_do_resource_release_and_resize() error paths

[Ilpo Järvinen]

[-- Attachment #1: Type: text/plain, Size: 1719 bytes --]

On Mon, 23 Feb 2026, Bart Van Assche wrote:

> From: Bart Van Assche <bvanassche@acm.org>
> 
> Make sure that down(&pci_bus_sem) has been called before
> up(&pci_bus_sem) is called.

Before explaining the solution, it would be useful to mention how this 
problem can manifest itself (taking one of the early gotos).

> This has been detected by the Clang
> thread-safety analyzer. Compile-tested only.
> 
> Cc: Bjorn Helgaas <bhelgaas@google.com>
> Cc: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
> Cc: linux-pci@vger.kernel.org

These (obvious) Ccs are not needed in the commit message, if your workflow 
requires having them, please place them below the --- line so that the 
maintainer's tools remove them while applying the patch.

> Fixes: 337b1b566db0 ("PCI: Fix restoring BARs on BAR resize rollback path")
> Signed-off-by: Bart Van Assche <bvanassche@acm.org>
> ---
>  drivers/pci/setup-bus.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/pci/setup-bus.c b/drivers/pci/setup-bus.c
> index 61f769aaa2f6..3bb8cd9a581e 100644
> --- a/drivers/pci/setup-bus.c
> +++ b/drivers/pci/setup-bus.c
> @@ -2346,6 +2346,7 @@ int pci_do_resource_release_and_resize(struct pci_dev *pdev, int resno, int size
>  	if (ret)
>  		return ret;
>  
> +	down_read(&pci_bus_sem);
>  	pci_dev_for_each_resource(pdev, r, i) {
>  		if (i >= PCI_BRIDGE_RESOURCES)
>  			break;
> @@ -2367,7 +2368,6 @@ int pci_do_resource_release_and_resize(struct pci_dev *pdev, int resno, int size
>  	if (!bus->self)
>  		goto out;
>  
> -	down_read(&pci_bus_sem);
>  	ret = pbus_reassign_bridge_resources(bus, res, &saved);
>  	if (ret)
>  		goto restore;

-- 
 i.

Re: [PATCH 19/62] ice: Fix a locking bug in an error path

[Przemek Kitszel]

On 2/23/26 23:00, Bart Van Assche wrote:
> From: Bart Van Assche <bvanassche@acm.org>
> 
> Move the mutex_lock() call up to prevent that DCB settings change after
> the ice_query_port_ets() call.
> 
> This patch fixes a bug in an error path. Without this patch pf->tc_mutex
> may be unlocked in an error path without having been locked. This bug has
> been detected by the clang thread-safety analyzer.

Thank you. This is a good catch, and current error path is obviously
wrong, in the way you have described.

 From the commit msg alone, it is not clear why moving the lock up,
instead moving the unlock to match the lock order, is right.
But from the code, I see that you are right - we call
ice_query_port_ets() again under the lock some 20 lines below (L566)

Let us know If you want to enhance your commit message (including the
subject), as it looks like a big quasi-automated series.

> 
> Cc: Tony Nguyen <anthony.l.nguyen@intel.com>
> Cc: Przemek Kitszel <przemyslaw.kitszel@intel.com>
> Cc: intel-wired-lan@lists.osuosl.org
> Fixes: 242b5e068b25 ("ice: Fix DCB rebuild after reset")
> Signed-off-by: Bart Van Assche <bvanassche@acm.org>
> ---
>   drivers/net/ethernet/intel/ice/ice_dcb_lib.c | 4 ++--
>   1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/net/ethernet/intel/ice/ice_dcb_lib.c b/drivers/net/ethernet/intel/ice/ice_dcb_lib.c
> index bd77f1c001ee..78ded6876581 100644
> --- a/drivers/net/ethernet/intel/ice/ice_dcb_lib.c
> +++ b/drivers/net/ethernet/intel/ice/ice_dcb_lib.c
> @@ -537,14 +537,14 @@ void ice_dcb_rebuild(struct ice_pf *pf)
>   	struct ice_dcbx_cfg *err_cfg;
>   	int ret;
>   
> +	mutex_lock(&pf->tc_mutex);
> +
>   	ret = ice_query_port_ets(pf->hw.port_info, &buf, sizeof(buf), NULL);
>   	if (ret) {
>   		dev_err(dev, "Query Port ETS failed\n");
>   		goto dcb_error;
>   	}
>   
> -	mutex_lock(&pf->tc_mutex);
> -
>   	if (!pf->hw.port_info->qos_cfg.is_sw_lldp)
>   		ice_cfg_etsrec_defaults(pf->hw.port_info);
>   

Re: [PATCH 28/62] PNP: isapnp: Check the isapnp_cfg_begin() return value

[Rafael J. Wysocki]

On Mon, Feb 23, 2026 at 11:03 PM Bart Van Assche
<bart.vanassche@linux.dev> wrote:
>
> From: Bart Van Assche <bvanassche@acm.org>
>
> Instead of ignoring isapnp_cfg_begin() failures, propagate the value
> returned by this function in case of a failure. This patch prepares
> for enabling thread-safety analysis since isapnp_cfg_begin() only locks
> a particular mutex if it returns zero.
>
> Cc: Jaroslav Kysela <perex@perex.cz>
> Cc: Adam Belay <ambx1@neo.rr.com>
> Cc: Rafael J. Wysocki <rafael@kernel.org>
> Cc: linux-acpi@vger.kernel.org
> Fixes: f72e5c5c861c ("[PATCH] PnP Rewrite V0.9 - 2.5.43")
> Signed-off-by: Bart Van Assche <bvanassche@acm.org>

Acked-by: Rafael J. Wysocki (Intel) <rafael@kernel.org>

> ---
>  drivers/pnp/isapnp/core.c | 16 ++++++++++++----
>  1 file changed, 12 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/pnp/isapnp/core.c b/drivers/pnp/isapnp/core.c
> index 219f96f2aaaf..3591a2791c1a 100644
> --- a/drivers/pnp/isapnp/core.c
> +++ b/drivers/pnp/isapnp/core.c
> @@ -853,7 +853,9 @@ static int isapnp_get_resources(struct pnp_dev *dev)
>
>         pnp_dbg(&dev->dev, "get resources\n");
>         pnp_init_resources(dev);
> -       isapnp_cfg_begin(dev->card->number, dev->number);
> +       ret = isapnp_cfg_begin(dev->card->number, dev->number);
> +       if (ret)
> +               return ret;
>         dev->active = isapnp_read_byte(ISAPNP_CFG_ACTIVATE);
>         if (!dev->active)
>                 goto __end;
> @@ -887,10 +889,12 @@ static int isapnp_get_resources(struct pnp_dev *dev)
>  static int isapnp_set_resources(struct pnp_dev *dev)
>  {
>         struct resource *res;
> -       int tmp;
> +       int tmp, ret;
>
>         pnp_dbg(&dev->dev, "set resources\n");
> -       isapnp_cfg_begin(dev->card->number, dev->number);
> +       ret = isapnp_cfg_begin(dev->card->number, dev->number);
> +       if (ret)
> +               return ret;
>         dev->active = 1;
>         for (tmp = 0; tmp < ISAPNP_MAX_PORT; tmp++) {
>                 res = pnp_get_resource(dev, IORESOURCE_IO, tmp);
> @@ -936,9 +940,13 @@ static int isapnp_set_resources(struct pnp_dev *dev)
>
>  static int isapnp_disable_resources(struct pnp_dev *dev)
>  {
> +       int ret;
> +
>         if (!dev->active)
>                 return -EINVAL;
> -       isapnp_cfg_begin(dev->card->number, dev->number);
> +       ret = isapnp_cfg_begin(dev->card->number, dev->number);
> +       if (ret)
> +               return ret;
>         isapnp_deactivate(dev->number);
>         dev->active = 0;
>         isapnp_cfg_end();

Re: [PATCH 04/62] dax/bus.c: Fix a locking bug

[Jonathan Cameron]

On Mon, 23 Feb 2026 14:50:49 -0800
<dan.j.williams@intel.com> wrote:

> Bart Van Assche wrote:
> > From: Bart Van Assche <bvanassche@acm.org>
> > 
> > Only unlock dax_dev_rwsem if it has been locked. This locking bug was
> > detected by the Clang thread-safety analyzer.
> > 
> > Cc: Dan Williams <dan.j.williams@intel.com>
> > Cc: Vishal Verma <vishal.l.verma@intel.com>
> > Cc: Dave Jiang <dave.jiang@intel.com>
> > Cc: Alison Schofield <alison.schofield@intel.com>
> > Cc: nvdimm@lists.linux.dev
> > Cc: linux-cxl@vger.kernel.org
> > Fixes: c05ae9d85b47 ("dax/bus.c: replace driver-core lock usage by a local rwsem")
> > Signed-off-by: Bart Van Assche <bvanassche@acm.org>  
> 
> Looks good,
> 
> Reviewed-by: Dan Williams <dan.j.williams@intel.com>
> 

Agreed
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>

Maybe worth some ACQUIRE() magic as a follow up.

Re: [PATCH 07/62] drm/amdgpu: Unlock a mutex before destroying it

[Alex Deucher]

Applied.  Thanks!

On Mon, Feb 23, 2026 at 10:59 PM Wang, Yang(Kevin)
<KevinYang.Wang@amd.com> wrote:
>
> [AMD Official Use Only - AMD Internal Distribution Only]
>
> Reviewed-by: Yang Wang <kevinyang.wang@amd.com>
>
> Best Regards,
> Kevin
>
> -----Original Message-----
> From: Bart Van Assche <bart.vanassche@linux.dev>
> Sent: Tuesday, February 24, 2026 6:00 AM
> To: Peter Zijlstra <peterz@infradead.org>
> Cc: Ingo Molnar <mingo@redhat.com>; Will Deacon <will@kernel.org>; Boqun Feng <boqun@kernel.org>; Waiman Long <longman@redhat.com>; linux-kernel@vger.kernel.org; Marco Elver <elver@google.com>; Christoph Hellwig <hch@lst.de>; Steven Rostedt <rostedt@goodmis.org>; Nick Desaulniers <ndesaulniers@google.com>; Nathan Chancellor <nathan@kernel.org>; Kees Cook <kees@kernel.org>; Jann Horn <jannh@google.com>; Bart Van Assche <bvanassche@acm.org>; Deucher, Alexander <Alexander.Deucher@amd.com>; Koenig, Christian <Christian.Koenig@amd.com>; Wang, Yang(Kevin) <KevinYang.Wang@amd.com>; Zhang, Hawking <Hawking.Zhang@amd.com>; amd-gfx@lists.freedesktop.org
> Subject: [PATCH 07/62] drm/amdgpu: Unlock a mutex before destroying it
>
> [You don't often get email from bart.vanassche@linux.dev. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]
>
> From: Bart Van Assche <bvanassche@acm.org>
>
> Mutexes must be unlocked before these are destroyed. This has been detected by the Clang thread-safety analyzer.
>
> Cc: Alex Deucher <alexander.deucher@amd.com>
> Cc: Christian König <christian.koenig@amd.com>
> Cc: Yang Wang <kevinyang.wang@amd.com>
> Cc: Hawking Zhang <Hawking.Zhang@amd.com>
> Cc: amd-gfx@lists.freedesktop.org
> Fixes: f5e4cc8461c4 ("drm/amdgpu: implement RAS ACA driver framework")
> Signed-off-by: Bart Van Assche <bvanassche@acm.org>
> ---
>  drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c
> index afe5ca81beec..db7858fe0c3d 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c
> @@ -641,6 +641,7 @@ static void aca_error_fini(struct aca_error *aerr)
>                 aca_bank_error_remove(aerr, bank_error);
>
>  out_unlock:
> +       mutex_unlock(&aerr->lock);
>         mutex_destroy(&aerr->lock);
>  }
>

Re: [PATCH 14/62] hwmon: (it87) Check the it87_lock() return value

[Guenter Roeck]

On Mon, Feb 23, 2026 at 02:00:14PM -0800, Bart Van Assche wrote:
> From: Bart Van Assche <bvanassche@acm.org>
> 
> Return early in it87_resume() if it87_lock() fails instead of ignoring the
> return value of that function. This patch suppresses a Clang thread-safety
> warning.
> 
> Cc: Frank Crawford <frank@crawford.emu.id.au>
> Cc: Guenter Roeck <linux@roeck-us.net>
> Cc: Jean Delvare <jdelvare@suse.com>
> Cc: linux-hwmon@vger.kernel.org
> Fixes: 376e1a937b30 ("hwmon: (it87) Add calls to smbus_enable/smbus_disable as required")
> Signed-off-by: Bart Van Assche <bvanassche@acm.org>
> ---
>  drivers/hwmon/it87.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/hwmon/it87.c b/drivers/hwmon/it87.c
> index e233aafa8856..8e3935089fca 100644
> --- a/drivers/hwmon/it87.c
> +++ b/drivers/hwmon/it87.c
> @@ -3593,7 +3593,9 @@ static int it87_resume(struct device *dev)
>  
>  	it87_resume_sio(pdev);
>  
> -	it87_lock(data);
> +	int err = it87_lock(data);
> +	if (err)
> +		return err;

checkpatch: missing empty line after declarations.

Oh, never mind, I'll fix that up and declare ret at the beginning of the
function, to match the rest of the driver.

Applied.

Guenter

Re: [PATCH 19/62] ice: Fix a locking bug in an error path

[Bart Van Assche]

On 2/24/26 12:40 AM, Przemek Kitszel wrote:
> On 2/23/26 23:00, Bart Van Assche wrote:
>> From: Bart Van Assche <bvanassche@acm.org>
>>
>> Move the mutex_lock() call up to prevent that DCB settings change after
>> the ice_query_port_ets() call.
>>
>> This patch fixes a bug in an error path. Without this patch pf->tc_mutex
>> may be unlocked in an error path without having been locked. This bug has
>> been detected by the clang thread-safety analyzer.
> 
> Thank you. This is a good catch, and current error path is obviously
> wrong, in the way you have described.
> 
> From the commit msg alone, it is not clear why moving the lock up,
> instead moving the unlock to match the lock order, is right.

Please take a look at the prior discussion of this change, available 
here: 
https://lore.kernel.org/all/61e3cc7a-af79-48e4-acb6-8ac7c8d2552c@intel.com/

> But from the code, I see that you are right - we call
> ice_query_port_ets() again under the lock some 20 lines below (L566)
> 
> Let us know If you want to enhance your commit message (including the
> subject), as it looks like a big quasi-automated series.

I have been asked to split this patch series and to send it directly to
the maintainers of the modified subsystems. Suggestions for how to
improve the patch description are welcome.

Thanks,

Bart.

RE: [PATCH 29/62] fnic: Make fnic_queuecommand() easier to analyze

[Karan Tilak Kumar (kartilak)]

On Monday, February 23, 2026 2:00 PM, Bart Van Assche <bart.vanassche@linux.dev> wrote:
>
>
> Move a spin_unlock_irqrestore() call such that the io_lock_acquired
> variable can be eliminated. This patch prepares for enabling the Clang
> thread-safety analyzer.
>
> Cc: Satish Kharat <satishkh@cisco.com>
> Cc: Sesidhar Baddela <sebaddel@cisco.com>
> Cc: Karan Tilak Kumar <kartilak@cisco.com>
> Cc: James E.J. Bottomley <James.Bottomley@HansenPartnership.com>
> Cc: Martin K. Petersen <martin.petersen@oracle.com>
> Cc: linux-scsi@vger.kernel.org
> Signed-off-by: Bart Van Assche <bvanassche@acm.org>
> ---
>  drivers/scsi/fnic/fnic_scsi.c | 9 +++------
>  1 file changed, 3 insertions(+), 6 deletions(-)
>
> diff --git a/drivers/scsi/fnic/fnic_scsi.c b/drivers/scsi/fnic/fnic_scsi.c
> index 29d7aca06958..f47c92dfbfd0 100644
> --- a/drivers/scsi/fnic/fnic_scsi.c
> +++ b/drivers/scsi/fnic/fnic_scsi.c
> @@ -471,7 +471,6 @@ enum scsi_qc_status fnic_queuecommand(struct Scsi_Host *shost,
>       int sg_count = 0;
>       unsigned long flags = 0;
>       unsigned long ptr;
> -     int io_lock_acquired = 0;
>       uint16_t hwq = 0;
>       struct fnic_tport_s *tport = NULL;
>       struct rport_dd_data_s *rdd_data;
> @@ -636,7 +635,6 @@ enum scsi_qc_status fnic_queuecommand(struct Scsi_Host *shost,
>       spin_lock_irqsave(&fnic->wq_copy_lock[hwq], flags);
>
>       /* initialize rest of io_req */
> -     io_lock_acquired = 1;
>       io_req->port_id = rport->port_id;
>       io_req->start_time = jiffies;
>       fnic_priv(sc)->state = FNIC_IOREQ_CMD_PENDING;
> @@ -689,6 +687,9 @@ enum scsi_qc_status fnic_queuecommand(struct Scsi_Host *shost,
>               /* REVISIT: Use per IO lock in the final code */
>               fnic_priv(sc)->flags |= FNIC_IO_ISSUED;
>       }
> +
> +     spin_unlock_irqrestore(&fnic->wq_copy_lock[hwq], flags);
> +
>  out:
>       cmd_trace = ((u64)sc->cmnd[0] << 56 | (u64)sc->cmnd[7] << 40 |
>                       (u64)sc->cmnd[8] << 32 | (u64)sc->cmnd[2] << 24 |
> @@ -699,10 +700,6 @@ enum scsi_qc_status fnic_queuecommand(struct Scsi_Host *shost,
>                  mqtag, sc, io_req, sg_count, cmd_trace,
>                  fnic_flags_and_state(sc));
>
> -     /* if only we issued IO, will we have the io lock */
> -     if (io_lock_acquired)
> -             spin_unlock_irqrestore(&fnic->wq_copy_lock[hwq], flags);
> -
>       atomic_dec(&fnic->in_flight);
>       atomic_dec(&tport->in_flight);
>
>

Thanks for this change, Bart.

Reviewed-by: Karan Tilak Kumar <kartilak@cisco.com>

Regards,
Karan

Re: [PATCH 29/62] fnic: Make fnic_queuecommand() easier to analyze

[Martin K. Petersen]

Bart,

> Move a spin_unlock_irqrestore() call such that the io_lock_acquired
> variable can be eliminated. This patch prepares for enabling the Clang
> thread-safety analyzer.

Applied to 7.1/scsi-staging, thanks!

-- 
Martin K. Petersen

Re: [PATCH 22/62] mctp i3c: Fix locking in error paths

[Matt Johnston]

Hi Bart,

On Mon, 2026-02-23 at 14:00 -0800, Bart Van Assche wrote:
> From: Bart Van Assche <bvanassche@acm.org>
> 
> Only unlock mi->lock if it has been locked. This bug has been detected by
> the Clang thread-safety analyzer.

Thanks for the fix.

Acked-by: Matt Johnston <matt@codeconstruct.com.au>

Cheers,
Matt

Re: [PATCH 19/62] ice: Fix a locking bug in an error path

[Przemek Kitszel]

On 2/24/26 18:43, Bart Van Assche wrote:
> On 2/24/26 12:40 AM, Przemek Kitszel wrote:
>> On 2/23/26 23:00, Bart Van Assche wrote:
>>> From: Bart Van Assche <bvanassche@acm.org>
>>>
>>> Move the mutex_lock() call up to prevent that DCB settings change after
>>> the ice_query_port_ets() call.

s/./, as the other call in ice_dcb_rebuild() is/

>>>
>>> This patch fixes a bug in an error path. Without this patch pf->tc_mutex
>>> may be unlocked in an error path without having been locked. 

suggestion:
This also fixes a bug in an error path, as before taking the first
"goto dcb_error" in the function jumped over mutex_lock() to
mutex_unlock()

This bug
>>> has
>>> been detected by the clang thread-safety analyzer.
>>
>> Thank you. This is a good catch, and current error path is obviously
>> wrong, in the way you have described.
>>
>> From the commit msg alone, it is not clear why moving the lock up,
>> instead moving the unlock to match the lock order, is right.
> 
> Please take a look at the prior discussion of this change, available 
> here: https://lore.kernel.org/all/61e3cc7a-af79-48e4- 
> acb6-8ac7c8d2552c@intel.com/
> 
>> But from the code, I see that you are right - we call
>> ice_query_port_ets() again under the lock some 20 lines below (L566)
>>
>> Let us know If you want to enhance your commit message (including the
>> subject), as it looks like a big quasi-automated series.
> 
> I have been asked to split this patch series and to send it directly to
> the maintainers of the modified subsystems. Suggestions for how to
> improve the patch description are welcome.

ok, that aligns with what I wanted too,

see my suggestions inline above, and update Subject, perhaps:

Subject: ice: fix locking in ice_dcb_rebuild()

please send with the "iwl-net" prefix, as a separate single-patch series

> 
> Thanks,
> 
> Bart.
> 

Re: (subset) [PATCH 00/62] Bug fixes and refactoring patches related to locking

[Martin K. Petersen]

On Mon, 23 Feb 2026 14:00:00 -0800, Bart Van Assche wrote:

> Annotating all source files in the kernel tree with lock context annotations
> led to the discovery of a significant number of locking bugs. This patch
> series includes fixes for the discovered bugs. Additionally, multiple
> refactoring patches have been included that make it easier for the compiler
> to verify correctness of locking operations. Please consider this patch series
> for the next merge window.
> 
> [...]

Applied to 7.1/scsi-queue, thanks!

[30/62] megaraid: Protect more code with instance->reset_mutex
        https://git.kernel.org/mkp/scsi/c/e521b7768836

-- 
Martin K. Petersen

Re: (subset) [PATCH 00/62] Bug fixes and refactoring patches related to locking

[Martin K. Petersen]

On Mon, 23 Feb 2026 14:00:00 -0800, Bart Van Assche wrote:

> Annotating all source files in the kernel tree with lock context annotations
> led to the discovery of a significant number of locking bugs. This patch
> series includes fixes for the discovered bugs. Additionally, multiple
> refactoring patches have been included that make it easier for the compiler
> to verify correctness of locking operations. Please consider this patch series
> for the next merge window.
> 
> [...]

Applied to 7.1/scsi-queue, thanks!

[30/62] megaraid: Protect more code with instance->reset_mutex
        https://git.kernel.org/mkp/scsi/c/e521b7768836

-- 
Martin K. Petersen

Re: [PATCH 24/62] net/cw1200: Fix locking in error paths

[Johannes Berg]

On Mon, 2026-02-23 at 14:00 -0800, Bart Van Assche wrote:
> From: Bart Van Assche <bvanassche@acm.org>
> 
> cw1200_wow_suspend() must only return with priv->conf_mutex locked if it
> returns zero. This mutex must be unlocked if an error is returned. Add
> mutex_unlock() calls to the error paths from which that call is missing.
> This has been detected by the Clang thread-safety analyzer.
> 
> Cc: Kalle Valo <kvalo@codeaurora.org>
> Cc: Johannes Berg <johannes@sipsolutions.net>
> Cc: linux-wireless@vger.kernel.org

This, and 25, are part of a larger series and I didn't get a cover
letter, so not sure what's supposed to happen with it.

johannes

Re: [PATCH 24/62] net/cw1200: Fix locking in error paths

[Bart Van Assche]

On 3/2/26 3:08 AM, Johannes Berg wrote:
> On Mon, 2026-02-23 at 14:00 -0800, Bart Van Assche wrote:
>> From: Bart Van Assche <bvanassche@acm.org>
>>
>> cw1200_wow_suspend() must only return with priv->conf_mutex locked if it
>> returns zero. This mutex must be unlocked if an error is returned. Add
>> mutex_unlock() calls to the error paths from which that call is missing.
>> This has been detected by the Clang thread-safety analyzer.
>>
>> Cc: Kalle Valo <kvalo@codeaurora.org>
>> Cc: Johannes Berg <johannes@sipsolutions.net>
>> Cc: linux-wireless@vger.kernel.org
> 
> This, and 25, are part of a larger series and I didn't get a cover
> letter, so not sure what's supposed to happen with it.

Peter Zijlstra prefers that subsystem maintainers queue these patches as
one can see here:
https://lore.kernel.org/lkml/20260223220117.GT1282955@noisy.programming.kicks-ass.net/

I plan to resend the patches from this series that have not yet been
queued by subsystem maintainers to the respective maintainers.

Thanks,

Bart.