* [PATCH 01/62] kvm: Make pi_enable_wakeup_handler() easier to analyze
2026-02-23 22:00 [PATCH 00/62] Bug fixes and refactoring patches related to locking Bart Van Assche
@ 2026-02-23 22:00 ` Bart Van Assche
2026-02-23 22:00 ` [PATCH 02/62] blk-ioc: Prepare for enabling thread-safety analysis Bart Van Assche
` (29 subsequent siblings)
30 siblings, 0 replies; 57+ messages in thread
From: Bart Van Assche @ 2026-02-23 22:00 UTC (permalink / raw)
To: Peter Zijlstra
Cc: Ingo Molnar, Will Deacon, Boqun Feng, Waiman Long, linux-kernel,
Marco Elver, Christoph Hellwig, Steven Rostedt, Nick Desaulniers,
Nathan Chancellor, Kees Cook, Jann Horn, Bart Van Assche,
Sean Christopherson, Paolo Bonzini, kvm
From: Bart Van Assche <bvanassche@acm.org>
The Clang thread-safety analyzer does not support comparing expressions
that use per_cpu(). Hence introduce a new local variable to capture the
address of a per-cpu spinlock. This patch prepares for enabling the
Clang thread-safety analyzer.
Cc: Sean Christopherson <seanjc@google.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: kvm@vger.kernel.org
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
---
arch/x86/kvm/vmx/posted_intr.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/arch/x86/kvm/vmx/posted_intr.c b/arch/x86/kvm/vmx/posted_intr.c
index 4a6d9a17da23..f8711b7b85a8 100644
--- a/arch/x86/kvm/vmx/posted_intr.c
+++ b/arch/x86/kvm/vmx/posted_intr.c
@@ -164,6 +164,7 @@ static void pi_enable_wakeup_handler(struct kvm_vcpu *vcpu)
struct pi_desc *pi_desc = vcpu_to_pi_desc(vcpu);
struct vcpu_vt *vt = to_vt(vcpu);
struct pi_desc old, new;
+ raw_spinlock_t *wakeup_lock;
lockdep_assert_irqs_disabled();
@@ -179,11 +180,11 @@ static void pi_enable_wakeup_handler(struct kvm_vcpu *vcpu)
* entirety of the sched_out critical section, i.e. the wakeup handler
* can't run while the scheduler locks are held.
*/
- raw_spin_lock_nested(&per_cpu(wakeup_vcpus_on_cpu_lock, vcpu->cpu),
- PI_LOCK_SCHED_OUT);
+ wakeup_lock = &per_cpu(wakeup_vcpus_on_cpu_lock, vcpu->cpu);
+ raw_spin_lock_nested(wakeup_lock, PI_LOCK_SCHED_OUT);
list_add_tail(&vt->pi_wakeup_list,
&per_cpu(wakeup_vcpus_on_cpu, vcpu->cpu));
- raw_spin_unlock(&per_cpu(wakeup_vcpus_on_cpu_lock, vcpu->cpu));
+ raw_spin_unlock(wakeup_lock);
WARN(pi_test_sn(pi_desc), "PI descriptor SN field set before blocking");
^ permalink raw reply related [flat|nested] 57+ messages in thread* [PATCH 02/62] blk-ioc: Prepare for enabling thread-safety analysis
2026-02-23 22:00 [PATCH 00/62] Bug fixes and refactoring patches related to locking Bart Van Assche
2026-02-23 22:00 ` [PATCH 01/62] kvm: Make pi_enable_wakeup_handler() easier to analyze Bart Van Assche
@ 2026-02-23 22:00 ` Bart Van Assche
2026-02-23 22:00 ` [PATCH 03/62] drbd: Balance RCU calls in drbd_adm_dump_devices() Bart Van Assche
` (28 subsequent siblings)
30 siblings, 0 replies; 57+ messages in thread
From: Bart Van Assche @ 2026-02-23 22:00 UTC (permalink / raw)
To: Peter Zijlstra
Cc: Ingo Molnar, Will Deacon, Boqun Feng, Waiman Long, linux-kernel,
Marco Elver, Christoph Hellwig, Steven Rostedt, Nick Desaulniers,
Nathan Chancellor, Kees Cook, Jann Horn, Bart Van Assche,
Jens Axboe, Yu Kuai, Jan Kara, linux-block
From: Bart Van Assche <bvanassche@acm.org>
The Clang thread-safety analyzer does not support testing return values
with "< 0". Hence change the "< 0" test into "!= 0". This is fine since
the radix_tree_maybe_preload() return value is <= 0.
Cc: Jens Axboe <axboe@kernel.dk>
Cc: Yu Kuai <yukuai3@huawei.com>
Cc: Jan Kara <jack@suse.cz>
Cc: linux-block@vger.kernel.org
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
---
block/blk-ioc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/block/blk-ioc.c b/block/blk-ioc.c
index d15918d7fabb..0bf78aebc887 100644
--- a/block/blk-ioc.c
+++ b/block/blk-ioc.c
@@ -364,7 +364,7 @@ static struct io_cq *ioc_create_icq(struct request_queue *q)
if (!icq)
return NULL;
- if (radix_tree_maybe_preload(GFP_ATOMIC) < 0) {
+ if (radix_tree_maybe_preload(GFP_ATOMIC) != 0) {
kmem_cache_free(et->icq_cache, icq);
return NULL;
}
^ permalink raw reply related [flat|nested] 57+ messages in thread* [PATCH 03/62] drbd: Balance RCU calls in drbd_adm_dump_devices()
2026-02-23 22:00 [PATCH 00/62] Bug fixes and refactoring patches related to locking Bart Van Assche
2026-02-23 22:00 ` [PATCH 01/62] kvm: Make pi_enable_wakeup_handler() easier to analyze Bart Van Assche
2026-02-23 22:00 ` [PATCH 02/62] blk-ioc: Prepare for enabling thread-safety analysis Bart Van Assche
@ 2026-02-23 22:00 ` Bart Van Assche
2026-02-23 22:00 ` [PATCH 04/62] dax/bus.c: Fix a locking bug Bart Van Assche
` (27 subsequent siblings)
30 siblings, 0 replies; 57+ messages in thread
From: Bart Van Assche @ 2026-02-23 22:00 UTC (permalink / raw)
To: Peter Zijlstra
Cc: Ingo Molnar, Will Deacon, Boqun Feng, Waiman Long, linux-kernel,
Marco Elver, Christoph Hellwig, Steven Rostedt, Nick Desaulniers,
Nathan Chancellor, Kees Cook, Jann Horn, Bart Van Assche,
Andreas Gruenbacher, linux-block
From: Bart Van Assche <bvanassche@acm.org>
Make drbd_adm_dump_devices() call rcu_read_lock() before
rcu_read_unlock() is called. This has been detected by the Clang
thread-safety analyzer. Compile-tested only.
Cc: Andreas Gruenbacher <agruen@linbit.com>
Cc: linux-block@vger.kernel.org
Fixes: a55bbd375d18 ("drbd: Backport the "status" command")
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
---
drivers/block/drbd/drbd_nl.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/block/drbd/drbd_nl.c b/drivers/block/drbd/drbd_nl.c
index e201f0087a0f..728ecc431b38 100644
--- a/drivers/block/drbd/drbd_nl.c
+++ b/drivers/block/drbd/drbd_nl.c
@@ -3378,8 +3378,10 @@ int drbd_adm_dump_devices(struct sk_buff *skb, struct netlink_callback *cb)
if (resource_filter) {
retcode = ERR_RES_NOT_KNOWN;
resource = drbd_find_resource(nla_data(resource_filter));
- if (!resource)
+ if (!resource) {
+ rcu_read_lock();
goto put_result;
+ }
cb->args[0] = (long)resource;
}
}
@@ -3628,8 +3630,10 @@ int drbd_adm_dump_peer_devices(struct sk_buff *skb, struct netlink_callback *cb)
if (resource_filter) {
retcode = ERR_RES_NOT_KNOWN;
resource = drbd_find_resource(nla_data(resource_filter));
- if (!resource)
+ if (!resource) {
+ rcu_read_lock();
goto put_result;
+ }
}
cb->args[0] = (long)resource;
}
^ permalink raw reply related [flat|nested] 57+ messages in thread* [PATCH 04/62] dax/bus.c: Fix a locking bug
2026-02-23 22:00 [PATCH 00/62] Bug fixes and refactoring patches related to locking Bart Van Assche
` (2 preceding siblings ...)
2026-02-23 22:00 ` [PATCH 03/62] drbd: Balance RCU calls in drbd_adm_dump_devices() Bart Van Assche
@ 2026-02-23 22:00 ` Bart Van Assche
2026-02-23 22:50 ` dan.j.williams
2026-02-23 22:00 ` [PATCH 05/62] dma-buf: Convert dma_buf_import_sync_file() to the early-return style Bart Van Assche
` (26 subsequent siblings)
30 siblings, 1 reply; 57+ messages in thread
From: Bart Van Assche @ 2026-02-23 22:00 UTC (permalink / raw)
To: Peter Zijlstra
Cc: Ingo Molnar, Will Deacon, Boqun Feng, Waiman Long, linux-kernel,
Marco Elver, Christoph Hellwig, Steven Rostedt, Nick Desaulniers,
Nathan Chancellor, Kees Cook, Jann Horn, Bart Van Assche,
Dan Williams, Vishal Verma, Dave Jiang, Alison Schofield, nvdimm,
linux-cxl
From: Bart Van Assche <bvanassche@acm.org>
Only unlock dax_dev_rwsem if it has been locked. This locking bug was
detected by the Clang thread-safety analyzer.
Cc: Dan Williams <dan.j.williams@intel.com>
Cc: Vishal Verma <vishal.l.verma@intel.com>
Cc: Dave Jiang <dave.jiang@intel.com>
Cc: Alison Schofield <alison.schofield@intel.com>
Cc: nvdimm@lists.linux.dev
Cc: linux-cxl@vger.kernel.org
Fixes: c05ae9d85b47 ("dax/bus.c: replace driver-core lock usage by a local rwsem")
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
---
drivers/dax/bus.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/dax/bus.c b/drivers/dax/bus.c
index c94c09622516..ebd3806c34e5 100644
--- a/drivers/dax/bus.c
+++ b/drivers/dax/bus.c
@@ -1117,11 +1117,10 @@ static ssize_t size_store(struct device *dev, struct device_attribute *attr,
}
rc = down_write_killable(&dax_dev_rwsem);
if (rc)
- goto err_dev;
+ goto err_region;
rc = dev_dax_resize(dax_region, dev_dax, val);
-err_dev:
up_write(&dax_dev_rwsem);
err_region:
up_write(&dax_region_rwsem);
^ permalink raw reply related [flat|nested] 57+ messages in thread* Re: [PATCH 04/62] dax/bus.c: Fix a locking bug
2026-02-23 22:00 ` [PATCH 04/62] dax/bus.c: Fix a locking bug Bart Van Assche
@ 2026-02-23 22:50 ` dan.j.williams
2026-02-24 12:45 ` Jonathan Cameron
0 siblings, 1 reply; 57+ messages in thread
From: dan.j.williams @ 2026-02-23 22:50 UTC (permalink / raw)
To: Bart Van Assche, Peter Zijlstra
Cc: Ingo Molnar, Will Deacon, Boqun Feng, Waiman Long, linux-kernel,
Marco Elver, Christoph Hellwig, Steven Rostedt, Nick Desaulniers,
Nathan Chancellor, Kees Cook, Jann Horn, Bart Van Assche,
Dan Williams, Vishal Verma, Dave Jiang, Alison Schofield, nvdimm,
linux-cxl
Bart Van Assche wrote:
> From: Bart Van Assche <bvanassche@acm.org>
>
> Only unlock dax_dev_rwsem if it has been locked. This locking bug was
> detected by the Clang thread-safety analyzer.
>
> Cc: Dan Williams <dan.j.williams@intel.com>
> Cc: Vishal Verma <vishal.l.verma@intel.com>
> Cc: Dave Jiang <dave.jiang@intel.com>
> Cc: Alison Schofield <alison.schofield@intel.com>
> Cc: nvdimm@lists.linux.dev
> Cc: linux-cxl@vger.kernel.org
> Fixes: c05ae9d85b47 ("dax/bus.c: replace driver-core lock usage by a local rwsem")
> Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Looks good,
Reviewed-by: Dan Williams <dan.j.williams@intel.com>
^ permalink raw reply [flat|nested] 57+ messages in thread* Re: [PATCH 04/62] dax/bus.c: Fix a locking bug
2026-02-23 22:50 ` dan.j.williams
@ 2026-02-24 12:45 ` Jonathan Cameron
0 siblings, 0 replies; 57+ messages in thread
From: Jonathan Cameron @ 2026-02-24 12:45 UTC (permalink / raw)
To: dan.j.williams
Cc: Bart Van Assche, Peter Zijlstra, Ingo Molnar, Will Deacon,
Boqun Feng, Waiman Long, linux-kernel, Marco Elver,
Christoph Hellwig, Steven Rostedt, Nick Desaulniers,
Nathan Chancellor, Kees Cook, Jann Horn, Bart Van Assche,
Vishal Verma, Dave Jiang, Alison Schofield, nvdimm, linux-cxl
On Mon, 23 Feb 2026 14:50:49 -0800
<dan.j.williams@intel.com> wrote:
> Bart Van Assche wrote:
> > From: Bart Van Assche <bvanassche@acm.org>
> >
> > Only unlock dax_dev_rwsem if it has been locked. This locking bug was
> > detected by the Clang thread-safety analyzer.
> >
> > Cc: Dan Williams <dan.j.williams@intel.com>
> > Cc: Vishal Verma <vishal.l.verma@intel.com>
> > Cc: Dave Jiang <dave.jiang@intel.com>
> > Cc: Alison Schofield <alison.schofield@intel.com>
> > Cc: nvdimm@lists.linux.dev
> > Cc: linux-cxl@vger.kernel.org
> > Fixes: c05ae9d85b47 ("dax/bus.c: replace driver-core lock usage by a local rwsem")
> > Signed-off-by: Bart Van Assche <bvanassche@acm.org>
>
> Looks good,
>
> Reviewed-by: Dan Williams <dan.j.williams@intel.com>
>
Agreed
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Maybe worth some ACQUIRE() magic as a follow up.
^ permalink raw reply [flat|nested] 57+ messages in thread
* [PATCH 05/62] dma-buf: Convert dma_buf_import_sync_file() to the early-return style
2026-02-23 22:00 [PATCH 00/62] Bug fixes and refactoring patches related to locking Bart Van Assche
` (3 preceding siblings ...)
2026-02-23 22:00 ` [PATCH 04/62] dax/bus.c: Fix a locking bug Bart Van Assche
@ 2026-02-23 22:00 ` Bart Van Assche
2026-02-23 22:00 ` [PATCH 06/62] dma-buf: Handle all dma_resv_lock() errors Bart Van Assche
` (25 subsequent siblings)
30 siblings, 0 replies; 57+ messages in thread
From: Bart Van Assche @ 2026-02-23 22:00 UTC (permalink / raw)
To: Peter Zijlstra
Cc: Ingo Molnar, Will Deacon, Boqun Feng, Waiman Long, linux-kernel,
Marco Elver, Christoph Hellwig, Steven Rostedt, Nick Desaulniers,
Nathan Chancellor, Kees Cook, Jann Horn, Bart Van Assche,
Sumit Semwal, Christian König, linux-media
From: Bart Van Assche <bvanassche@acm.org>
Before making changes in dma_buf_import_sync_file(), convert it to
the early-return coding style. No functionality has been changed.
Cc: Sumit Semwal <sumit.semwal@linaro.org>
Cc: Christian König <christian.koenig@amd.com>
Cc: linux-media@vger.kernel.org
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
---
drivers/dma-buf/dma-buf.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/drivers/dma-buf/dma-buf.c b/drivers/dma-buf/dma-buf.c
index 11711874a325..1666133ac8b8 100644
--- a/drivers/dma-buf/dma-buf.c
+++ b/drivers/dma-buf/dma-buf.c
@@ -523,11 +523,13 @@ static long dma_buf_import_sync_file(struct dma_buf *dmabuf,
dma_resv_lock(dmabuf->resv, NULL);
ret = dma_resv_reserve_fences(dmabuf->resv, num_fences);
- if (!ret) {
- dma_fence_unwrap_for_each(f, &iter, fence)
- dma_resv_add_fence(dmabuf->resv, f, usage);
- }
+ if (ret)
+ goto unlock;
+
+ dma_fence_unwrap_for_each(f, &iter, fence)
+ dma_resv_add_fence(dmabuf->resv, f, usage);
+unlock:
dma_resv_unlock(dmabuf->resv);
}
^ permalink raw reply related [flat|nested] 57+ messages in thread* [PATCH 06/62] dma-buf: Handle all dma_resv_lock() errors
2026-02-23 22:00 [PATCH 00/62] Bug fixes and refactoring patches related to locking Bart Van Assche
` (4 preceding siblings ...)
2026-02-23 22:00 ` [PATCH 05/62] dma-buf: Convert dma_buf_import_sync_file() to the early-return style Bart Van Assche
@ 2026-02-23 22:00 ` Bart Van Assche
2026-02-23 22:00 ` [PATCH 07/62] drm/amdgpu: Unlock a mutex before destroying it Bart Van Assche
` (24 subsequent siblings)
30 siblings, 0 replies; 57+ messages in thread
From: Bart Van Assche @ 2026-02-23 22:00 UTC (permalink / raw)
To: Peter Zijlstra
Cc: Ingo Molnar, Will Deacon, Boqun Feng, Waiman Long, linux-kernel,
Marco Elver, Christoph Hellwig, Steven Rostedt, Nick Desaulniers,
Nathan Chancellor, Kees Cook, Jann Horn, Bart Van Assche,
Sumit Semwal, Christian König, linux-media
From: Bart Van Assche <bvanassche@acm.org>
Instead of assuming that dma_resv_lock() only returns 0 or -EDEADLK,
handle all possible dma_resv_lock() return values. This patch prepares
for enabling compile-time thread-safety analysis. This will cause the
compiler to check whether all dma_resv_lock() return values are handled.
Cc: Sumit Semwal <sumit.semwal@linaro.org>
Cc: Christian König <christian.koenig@amd.com>
Cc: linux-media@vger.kernel.org
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
---
drivers/dma-buf/dma-resv.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/dma-buf/dma-resv.c b/drivers/dma-buf/dma-resv.c
index bea3e9858aca..b4710f730e9b 100644
--- a/drivers/dma-buf/dma-resv.c
+++ b/drivers/dma-buf/dma-resv.c
@@ -792,6 +792,8 @@ static int __init dma_resv_lockdep(void)
ret = dma_resv_lock(&obj, &ctx);
if (ret == -EDEADLK)
dma_resv_lock_slow(&obj, &ctx);
+ else if (ret)
+ goto fini;
fs_reclaim_acquire(GFP_KERNEL);
/* for unmap_mapping_range on trylocked buffer objects in shrinkers */
i_mmap_lock_write(&mapping);
@@ -805,12 +807,14 @@ static int __init dma_resv_lockdep(void)
#endif
fs_reclaim_release(GFP_KERNEL);
ww_mutex_unlock(&obj.lock);
+
+fini:
ww_acquire_fini(&ctx);
mmap_read_unlock(mm);
mmput(mm);
- return 0;
+ return ret;
}
subsys_initcall(dma_resv_lockdep);
#endif
^ permalink raw reply related [flat|nested] 57+ messages in thread* [PATCH 07/62] drm/amdgpu: Unlock a mutex before destroying it
2026-02-23 22:00 [PATCH 00/62] Bug fixes and refactoring patches related to locking Bart Van Assche
` (5 preceding siblings ...)
2026-02-23 22:00 ` [PATCH 06/62] dma-buf: Handle all dma_resv_lock() errors Bart Van Assche
@ 2026-02-23 22:00 ` Bart Van Assche
2026-02-24 2:41 ` Wang, Yang(Kevin)
2026-02-23 22:00 ` [PATCH 08/62] drm/amdgpu: Fix locking bugs in error paths Bart Van Assche
` (23 subsequent siblings)
30 siblings, 1 reply; 57+ messages in thread
From: Bart Van Assche @ 2026-02-23 22:00 UTC (permalink / raw)
To: Peter Zijlstra
Cc: Ingo Molnar, Will Deacon, Boqun Feng, Waiman Long, linux-kernel,
Marco Elver, Christoph Hellwig, Steven Rostedt, Nick Desaulniers,
Nathan Chancellor, Kees Cook, Jann Horn, Bart Van Assche,
Alex Deucher, Christian König, Yang Wang, Hawking Zhang,
amd-gfx
From: Bart Van Assche <bvanassche@acm.org>
Mutexes must be unlocked before these are destroyed. This has been detected
by the Clang thread-safety analyzer.
Cc: Alex Deucher <alexander.deucher@amd.com>
Cc: Christian König <christian.koenig@amd.com>
Cc: Yang Wang <kevinyang.wang@amd.com>
Cc: Hawking Zhang <Hawking.Zhang@amd.com>
Cc: amd-gfx@lists.freedesktop.org
Fixes: f5e4cc8461c4 ("drm/amdgpu: implement RAS ACA driver framework")
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c
index afe5ca81beec..db7858fe0c3d 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c
@@ -641,6 +641,7 @@ static void aca_error_fini(struct aca_error *aerr)
aca_bank_error_remove(aerr, bank_error);
out_unlock:
+ mutex_unlock(&aerr->lock);
mutex_destroy(&aerr->lock);
}
^ permalink raw reply related [flat|nested] 57+ messages in thread* RE: [PATCH 07/62] drm/amdgpu: Unlock a mutex before destroying it
2026-02-23 22:00 ` [PATCH 07/62] drm/amdgpu: Unlock a mutex before destroying it Bart Van Assche
@ 2026-02-24 2:41 ` Wang, Yang(Kevin)
2026-02-24 14:25 ` Alex Deucher
0 siblings, 1 reply; 57+ messages in thread
From: Wang, Yang(Kevin) @ 2026-02-24 2:41 UTC (permalink / raw)
To: Bart Van Assche, Peter Zijlstra
Cc: Ingo Molnar, Will Deacon, Boqun Feng, Waiman Long,
linux-kernel@vger.kernel.org, Marco Elver, Christoph Hellwig,
Steven Rostedt, Nick Desaulniers, Nathan Chancellor, Kees Cook,
Jann Horn, Bart Van Assche, Deucher, Alexander, Koenig, Christian,
Zhang, Hawking, amd-gfx@lists.freedesktop.org
[AMD Official Use Only - AMD Internal Distribution Only]
Reviewed-by: Yang Wang <kevinyang.wang@amd.com>
Best Regards,
Kevin
-----Original Message-----
From: Bart Van Assche <bart.vanassche@linux.dev>
Sent: Tuesday, February 24, 2026 6:00 AM
To: Peter Zijlstra <peterz@infradead.org>
Cc: Ingo Molnar <mingo@redhat.com>; Will Deacon <will@kernel.org>; Boqun Feng <boqun@kernel.org>; Waiman Long <longman@redhat.com>; linux-kernel@vger.kernel.org; Marco Elver <elver@google.com>; Christoph Hellwig <hch@lst.de>; Steven Rostedt <rostedt@goodmis.org>; Nick Desaulniers <ndesaulniers@google.com>; Nathan Chancellor <nathan@kernel.org>; Kees Cook <kees@kernel.org>; Jann Horn <jannh@google.com>; Bart Van Assche <bvanassche@acm.org>; Deucher, Alexander <Alexander.Deucher@amd.com>; Koenig, Christian <Christian.Koenig@amd.com>; Wang, Yang(Kevin) <KevinYang.Wang@amd.com>; Zhang, Hawking <Hawking.Zhang@amd.com>; amd-gfx@lists.freedesktop.org
Subject: [PATCH 07/62] drm/amdgpu: Unlock a mutex before destroying it
[You don't often get email from bart.vanassche@linux.dev. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]
From: Bart Van Assche <bvanassche@acm.org>
Mutexes must be unlocked before these are destroyed. This has been detected by the Clang thread-safety analyzer.
Cc: Alex Deucher <alexander.deucher@amd.com>
Cc: Christian König <christian.koenig@amd.com>
Cc: Yang Wang <kevinyang.wang@amd.com>
Cc: Hawking Zhang <Hawking.Zhang@amd.com>
Cc: amd-gfx@lists.freedesktop.org
Fixes: f5e4cc8461c4 ("drm/amdgpu: implement RAS ACA driver framework")
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c
index afe5ca81beec..db7858fe0c3d 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c
@@ -641,6 +641,7 @@ static void aca_error_fini(struct aca_error *aerr)
aca_bank_error_remove(aerr, bank_error);
out_unlock:
+ mutex_unlock(&aerr->lock);
mutex_destroy(&aerr->lock);
}
^ permalink raw reply related [flat|nested] 57+ messages in thread* Re: [PATCH 07/62] drm/amdgpu: Unlock a mutex before destroying it
2026-02-24 2:41 ` Wang, Yang(Kevin)
@ 2026-02-24 14:25 ` Alex Deucher
0 siblings, 0 replies; 57+ messages in thread
From: Alex Deucher @ 2026-02-24 14:25 UTC (permalink / raw)
To: Wang, Yang(Kevin)
Cc: Bart Van Assche, Peter Zijlstra, Ingo Molnar, Will Deacon,
Boqun Feng, Waiman Long, linux-kernel@vger.kernel.org,
Marco Elver, Christoph Hellwig, Steven Rostedt, Nick Desaulniers,
Nathan Chancellor, Kees Cook, Jann Horn, Bart Van Assche,
Deucher, Alexander, Koenig, Christian, Zhang, Hawking,
amd-gfx@lists.freedesktop.org
Applied. Thanks!
On Mon, Feb 23, 2026 at 10:59 PM Wang, Yang(Kevin)
<KevinYang.Wang@amd.com> wrote:
>
> [AMD Official Use Only - AMD Internal Distribution Only]
>
> Reviewed-by: Yang Wang <kevinyang.wang@amd.com>
>
> Best Regards,
> Kevin
>
> -----Original Message-----
> From: Bart Van Assche <bart.vanassche@linux.dev>
> Sent: Tuesday, February 24, 2026 6:00 AM
> To: Peter Zijlstra <peterz@infradead.org>
> Cc: Ingo Molnar <mingo@redhat.com>; Will Deacon <will@kernel.org>; Boqun Feng <boqun@kernel.org>; Waiman Long <longman@redhat.com>; linux-kernel@vger.kernel.org; Marco Elver <elver@google.com>; Christoph Hellwig <hch@lst.de>; Steven Rostedt <rostedt@goodmis.org>; Nick Desaulniers <ndesaulniers@google.com>; Nathan Chancellor <nathan@kernel.org>; Kees Cook <kees@kernel.org>; Jann Horn <jannh@google.com>; Bart Van Assche <bvanassche@acm.org>; Deucher, Alexander <Alexander.Deucher@amd.com>; Koenig, Christian <Christian.Koenig@amd.com>; Wang, Yang(Kevin) <KevinYang.Wang@amd.com>; Zhang, Hawking <Hawking.Zhang@amd.com>; amd-gfx@lists.freedesktop.org
> Subject: [PATCH 07/62] drm/amdgpu: Unlock a mutex before destroying it
>
> [You don't often get email from bart.vanassche@linux.dev. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]
>
> From: Bart Van Assche <bvanassche@acm.org>
>
> Mutexes must be unlocked before these are destroyed. This has been detected by the Clang thread-safety analyzer.
>
> Cc: Alex Deucher <alexander.deucher@amd.com>
> Cc: Christian König <christian.koenig@amd.com>
> Cc: Yang Wang <kevinyang.wang@amd.com>
> Cc: Hawking Zhang <Hawking.Zhang@amd.com>
> Cc: amd-gfx@lists.freedesktop.org
> Fixes: f5e4cc8461c4 ("drm/amdgpu: implement RAS ACA driver framework")
> Signed-off-by: Bart Van Assche <bvanassche@acm.org>
> ---
> drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c
> index afe5ca81beec..db7858fe0c3d 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c
> @@ -641,6 +641,7 @@ static void aca_error_fini(struct aca_error *aerr)
> aca_bank_error_remove(aerr, bank_error);
>
> out_unlock:
> + mutex_unlock(&aerr->lock);
> mutex_destroy(&aerr->lock);
> }
>
^ permalink raw reply [flat|nested] 57+ messages in thread
* [PATCH 08/62] drm/amdgpu: Fix locking bugs in error paths
2026-02-23 22:00 [PATCH 00/62] Bug fixes and refactoring patches related to locking Bart Van Assche
` (6 preceding siblings ...)
2026-02-23 22:00 ` [PATCH 07/62] drm/amdgpu: Unlock a mutex before destroying it Bart Van Assche
@ 2026-02-23 22:00 ` Bart Van Assche
2026-02-23 22:00 ` [PATCH 09/62] drm: bridge: cdns-mhdp8546: Fix a locking bug in an error path Bart Van Assche
` (22 subsequent siblings)
30 siblings, 0 replies; 57+ messages in thread
From: Bart Van Assche @ 2026-02-23 22:00 UTC (permalink / raw)
To: Peter Zijlstra
Cc: Ingo Molnar, Will Deacon, Boqun Feng, Waiman Long, linux-kernel,
Marco Elver, Christoph Hellwig, Steven Rostedt, Nick Desaulniers,
Nathan Chancellor, Kees Cook, Jann Horn, Bart Van Assche,
Alex Deucher, Christian König, YiPeng Chai, Hawking Zhang,
amd-gfx
From: Bart Van Assche <bvanassche@acm.org>
Do not unlock psp->ras_context.mutex if it has not been locked. This has
been detected by the Clang thread-safety analyzer.
Cc: Alex Deucher <alexander.deucher@amd.com>
Cc: Christian König <christian.koenig@amd.com>
Cc: YiPeng Chai <YiPeng.Chai@amd.com>
Cc: Hawking Zhang <Hawking.Zhang@amd.com>
Cc: amd-gfx@lists.freedesktop.org
Fixes: b3fb79cda568 ("drm/amdgpu: add mutex to protect ras shared memory")
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_psp_ta.c | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp_ta.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp_ta.c
index 6e8aad91bcd3..0d3c18f04ac3 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp_ta.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp_ta.c
@@ -332,13 +332,13 @@ static ssize_t ta_if_invoke_debugfs_write(struct file *fp, const char *buf, size
if (!context || !context->initialized) {
dev_err(adev->dev, "TA is not initialized\n");
ret = -EINVAL;
- goto err_free_shared_buf;
+ goto free_shared_buf;
}
if (!psp->ta_funcs || !psp->ta_funcs->fn_ta_invoke) {
dev_err(adev->dev, "Unsupported function to invoke TA\n");
ret = -EOPNOTSUPP;
- goto err_free_shared_buf;
+ goto free_shared_buf;
}
context->session_id = ta_id;
@@ -346,7 +346,7 @@ static ssize_t ta_if_invoke_debugfs_write(struct file *fp, const char *buf, size
mutex_lock(&psp->ras_context.mutex);
ret = prep_ta_mem_context(&context->mem_context, shared_buf, shared_buf_len);
if (ret)
- goto err_free_shared_buf;
+ goto unlock;
ret = psp_fn_ta_invoke(psp, cmd_id);
if (ret || context->resp_status) {
@@ -354,15 +354,17 @@ static ssize_t ta_if_invoke_debugfs_write(struct file *fp, const char *buf, size
ret, context->resp_status);
if (!ret) {
ret = -EINVAL;
- goto err_free_shared_buf;
+ goto unlock;
}
}
if (copy_to_user((char *)&buf[copy_pos], context->mem_context.shared_buf, shared_buf_len))
ret = -EFAULT;
-err_free_shared_buf:
+unlock:
mutex_unlock(&psp->ras_context.mutex);
+
+free_shared_buf:
kfree(shared_buf);
return ret;
^ permalink raw reply related [flat|nested] 57+ messages in thread* [PATCH 09/62] drm: bridge: cdns-mhdp8546: Fix a locking bug in an error path
2026-02-23 22:00 [PATCH 00/62] Bug fixes and refactoring patches related to locking Bart Van Assche
` (7 preceding siblings ...)
2026-02-23 22:00 ` [PATCH 08/62] drm/amdgpu: Fix locking bugs in error paths Bart Van Assche
@ 2026-02-23 22:00 ` Bart Van Assche
2026-02-23 22:00 ` [PATCH 10/62] drm: Make drm_read() easier to analyze Bart Van Assche
` (21 subsequent siblings)
30 siblings, 0 replies; 57+ messages in thread
From: Bart Van Assche @ 2026-02-23 22:00 UTC (permalink / raw)
To: Peter Zijlstra
Cc: Ingo Molnar, Will Deacon, Boqun Feng, Waiman Long, linux-kernel,
Marco Elver, Christoph Hellwig, Steven Rostedt, Nick Desaulniers,
Nathan Chancellor, Kees Cook, Jann Horn, Bart Van Assche,
Andrzej Hajda, Neil Armstrong, Robert Foss, Laurent Pinchart,
Jonas Karlman, Jernej Skrabec, Swapnil Jakhade, Tomi Valkeinen
From: Bart Van Assche <bvanassche@acm.org>
Do not unlock mhdp->mbox_mutex if it has not been locked.
This bug has been detected by the Clang thread-safety analyzer.
Cc: Andrzej Hajda <andrzej.hajda@intel.com>
Cc: Neil Armstrong <neil.armstrong@linaro.org>
Cc: Robert Foss <rfoss@kernel.org>
Cc: Laurent Pinchart <Laurent.pinchart@ideasonboard.com>
Cc: Jonas Karlman <jonas@kwiboo.se>
Cc: Jernej Skrabec <jernej.skrabec@gmail.com>
Cc: Swapnil Jakhade <sjakhade@cadence.com>
Cc: Tomi Valkeinen <tomi.valkeinen@ti.com>
Fixes: fb43aa0acdfd ("drm: bridge: Add support for Cadence MHDP8546 DPI/DP bridge")
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
---
drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c b/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c
index 9392c226ff5b..ce4516de11d8 100644
--- a/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c
+++ b/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c
@@ -502,8 +502,7 @@ int cdns_mhdp_adjust_lt(struct cdns_mhdp_device *mhdp, unsigned int nlanes,
if (nlanes != 4 && nlanes != 2 && nlanes != 1) {
dev_err(mhdp->dev, "invalid number of lanes: %u\n", nlanes);
- ret = -EINVAL;
- goto out;
+ return -EINVAL;
}
payload[0] = nlanes;
^ permalink raw reply related [flat|nested] 57+ messages in thread* [PATCH 10/62] drm: Make drm_read() easier to analyze
2026-02-23 22:00 [PATCH 00/62] Bug fixes and refactoring patches related to locking Bart Van Assche
` (8 preceding siblings ...)
2026-02-23 22:00 ` [PATCH 09/62] drm: bridge: cdns-mhdp8546: Fix a locking bug in an error path Bart Van Assche
@ 2026-02-23 22:00 ` Bart Van Assche
2026-02-23 22:00 ` [PATCH 11/62] drm/pagemap: Unlock cache->lock before freeing it Bart Van Assche
` (20 subsequent siblings)
30 siblings, 0 replies; 57+ messages in thread
From: Bart Van Assche @ 2026-02-23 22:00 UTC (permalink / raw)
To: Peter Zijlstra
Cc: Ingo Molnar, Will Deacon, Boqun Feng, Waiman Long, linux-kernel,
Marco Elver, Christoph Hellwig, Steven Rostedt, Nick Desaulniers,
Nathan Chancellor, Kees Cook, Jann Horn, Bart Van Assche,
Maarten Lankhorst, Maxime Ripard, Thomas Zimmermann
From: Bart Van Assche <bvanassche@acm.org>
Prepare for enabling the Clang thread-safety analyzer by duplicating a
return statement. No functionality has been changed.
Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Cc: Maxime Ripard <mripard@kernel.org>
Cc: Thomas Zimmermann <tzimmermann@suse.de>
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
---
drivers/gpu/drm/drm_file.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/drm_file.c b/drivers/gpu/drm/drm_file.c
index ec820686b302..200979d78452 100644
--- a/drivers/gpu/drm/drm_file.c
+++ b/drivers/gpu/drm/drm_file.c
@@ -572,8 +572,9 @@ ssize_t drm_read(struct file *filp, char __user *buffer,
mutex_unlock(&file_priv->event_read_lock);
ret = wait_event_interruptible(file_priv->event_wait,
!list_empty(&file_priv->event_list));
- if (ret >= 0)
- ret = mutex_lock_interruptible(&file_priv->event_read_lock);
+ if (ret < 0)
+ return ret;
+ ret = mutex_lock_interruptible(&file_priv->event_read_lock);
if (ret)
return ret;
} else {
^ permalink raw reply related [flat|nested] 57+ messages in thread* [PATCH 11/62] drm/pagemap: Unlock cache->lock before freeing it
2026-02-23 22:00 [PATCH 00/62] Bug fixes and refactoring patches related to locking Bart Van Assche
` (9 preceding siblings ...)
2026-02-23 22:00 ` [PATCH 10/62] drm: Make drm_read() easier to analyze Bart Van Assche
@ 2026-02-23 22:00 ` Bart Van Assche
2026-02-23 22:14 ` Matthew Brost
2026-02-23 22:00 ` [PATCH 12/62] drm/gpusvm.c: Fix a locking bug in an error path Bart Van Assche
` (19 subsequent siblings)
30 siblings, 1 reply; 57+ messages in thread
From: Bart Van Assche @ 2026-02-23 22:00 UTC (permalink / raw)
To: Peter Zijlstra
Cc: Ingo Molnar, Will Deacon, Boqun Feng, Waiman Long, linux-kernel,
Marco Elver, Christoph Hellwig, Steven Rostedt, Nick Desaulniers,
Nathan Chancellor, Kees Cook, Jann Horn, Bart Van Assche,
Maarten Lankhorst, Maxime Ripard, Thomas Zimmermann,
Thomas Hellström, Matthew Brost
From: Bart Van Assche <bvanassche@acm.org>
Although freeing a spinlock without unlocking it is fine, this confuses
static analyzers. Hence this patch.
Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Cc: Maxime Ripard <mripard@kernel.org>
Cc: Thomas Zimmermann <tzimmermann@suse.de>
Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Cc: Matthew Brost <matthew.brost@intel.com>
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
---
drivers/gpu/drm/drm_pagemap_util.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/gpu/drm/drm_pagemap_util.c b/drivers/gpu/drm/drm_pagemap_util.c
index 14ddb948a32e..50cb5f9cdac5 100644
--- a/drivers/gpu/drm/drm_pagemap_util.c
+++ b/drivers/gpu/drm/drm_pagemap_util.c
@@ -74,6 +74,8 @@ static void drm_pagemap_cache_fini(void *arg)
cache->dpagemap = NULL;
spin_unlock(&cache->lock);
drm_pagemap_destroy(dpagemap, false);
+ } else {
+ spin_unlock(&cache->lock);
}
out:
^ permalink raw reply related [flat|nested] 57+ messages in thread* Re: [PATCH 11/62] drm/pagemap: Unlock cache->lock before freeing it
2026-02-23 22:00 ` [PATCH 11/62] drm/pagemap: Unlock cache->lock before freeing it Bart Van Assche
@ 2026-02-23 22:14 ` Matthew Brost
2026-02-23 22:20 ` Bart Van Assche
0 siblings, 1 reply; 57+ messages in thread
From: Matthew Brost @ 2026-02-23 22:14 UTC (permalink / raw)
To: Bart Van Assche
Cc: Peter Zijlstra, Ingo Molnar, Will Deacon, Boqun Feng, Waiman Long,
linux-kernel, Marco Elver, Christoph Hellwig, Steven Rostedt,
Nick Desaulniers, Nathan Chancellor, Kees Cook, Jann Horn,
Bart Van Assche, Maarten Lankhorst, Maxime Ripard,
Thomas Zimmermann, Thomas Hellström
On Mon, Feb 23, 2026 at 02:00:11PM -0800, Bart Van Assche wrote:
> From: Bart Van Assche <bvanassche@acm.org>
>
> Although freeing a spinlock without unlocking it is fine, this confuses
Fine, but pretty bad practice.
> static analyzers. Hence this patch.
>
> Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
> Cc: Maxime Ripard <mripard@kernel.org>
> Cc: Thomas Zimmermann <tzimmermann@suse.de>
> Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
> Cc: Matthew Brost <matthew.brost@intel.com>
With that:
Reviewed-by: Matthew Brost <matthew.brost@intel.com>
We can apply this to the DRM branches and propagate this up to Linus
during 7.0 cycle if that works for you? Or if you have other plans to
merge, let us know.
Matt
> Signed-off-by: Bart Van Assche <bvanassche@acm.org>
> ---
> drivers/gpu/drm/drm_pagemap_util.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/drivers/gpu/drm/drm_pagemap_util.c b/drivers/gpu/drm/drm_pagemap_util.c
> index 14ddb948a32e..50cb5f9cdac5 100644
> --- a/drivers/gpu/drm/drm_pagemap_util.c
> +++ b/drivers/gpu/drm/drm_pagemap_util.c
> @@ -74,6 +74,8 @@ static void drm_pagemap_cache_fini(void *arg)
> cache->dpagemap = NULL;
> spin_unlock(&cache->lock);
> drm_pagemap_destroy(dpagemap, false);
> + } else {
> + spin_unlock(&cache->lock);
> }
>
> out:
^ permalink raw reply [flat|nested] 57+ messages in thread* Re: [PATCH 11/62] drm/pagemap: Unlock cache->lock before freeing it
2026-02-23 22:14 ` Matthew Brost
@ 2026-02-23 22:20 ` Bart Van Assche
2026-02-23 22:34 ` Matthew Brost
0 siblings, 1 reply; 57+ messages in thread
From: Bart Van Assche @ 2026-02-23 22:20 UTC (permalink / raw)
To: Matthew Brost, Bart Van Assche
Cc: Peter Zijlstra, Ingo Molnar, Will Deacon, Boqun Feng, Waiman Long,
linux-kernel, Marco Elver, Christoph Hellwig, Steven Rostedt,
Nick Desaulniers, Nathan Chancellor, Kees Cook, Jann Horn,
Maarten Lankhorst, Maxime Ripard, Thomas Zimmermann,
Thomas Hellström
On 2/23/26 2:14 PM, Matthew Brost wrote:
> On Mon, Feb 23, 2026 at 02:00:11PM -0800, Bart Van Assche wrote:
>> From: Bart Van Assche <bvanassche@acm.org>
>>
>> Although freeing a spinlock without unlocking it is fine, this confuses
>
> Fine, but pretty bad practice.
>
>> static analyzers. Hence this patch.
>>
>> Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
>> Cc: Maxime Ripard <mripard@kernel.org>
>> Cc: Thomas Zimmermann <tzimmermann@suse.de>
>> Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
>> Cc: Matthew Brost <matthew.brost@intel.com>
>
> With that:
> Reviewed-by: Matthew Brost <matthew.brost@intel.com>
>
> We can apply this to the DRM branches and propagate this up to Linus
> during 7.0 cycle if that works for you? Or if you have other plans to
> merge, let us know.
Peter asked me to split this series into one series per maintainer and
to send the patches directly to the respective maintainers. Feel free to
queue this patch in a DRM branch.
Thanks,
Bart.
^ permalink raw reply [flat|nested] 57+ messages in thread
* Re: [PATCH 11/62] drm/pagemap: Unlock cache->lock before freeing it
2026-02-23 22:20 ` Bart Van Assche
@ 2026-02-23 22:34 ` Matthew Brost
0 siblings, 0 replies; 57+ messages in thread
From: Matthew Brost @ 2026-02-23 22:34 UTC (permalink / raw)
To: Bart Van Assche
Cc: Bart Van Assche, Peter Zijlstra, Ingo Molnar, Will Deacon,
Boqun Feng, Waiman Long, linux-kernel, Marco Elver,
Christoph Hellwig, Steven Rostedt, Nick Desaulniers,
Nathan Chancellor, Kees Cook, Jann Horn, Maarten Lankhorst,
Maxime Ripard, Thomas Zimmermann, Thomas Hellström
On Mon, Feb 23, 2026 at 02:20:20PM -0800, Bart Van Assche wrote:
> On 2/23/26 2:14 PM, Matthew Brost wrote:
> > On Mon, Feb 23, 2026 at 02:00:11PM -0800, Bart Van Assche wrote:
> > > From: Bart Van Assche <bvanassche@acm.org>
> > >
> > > Although freeing a spinlock without unlocking it is fine, this confuses
> >
> > Fine, but pretty bad practice.
> >
> > > static analyzers. Hence this patch.
> > >
> > > Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
> > > Cc: Maxime Ripard <mripard@kernel.org>
> > > Cc: Thomas Zimmermann <tzimmermann@suse.de>
> > > Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
> > > Cc: Matthew Brost <matthew.brost@intel.com>
> >
> > With that:
> > Reviewed-by: Matthew Brost <matthew.brost@intel.com>
> >
> > We can apply this to the DRM branches and propagate this up to Linus
> > during 7.0 cycle if that works for you? Or if you have other plans to
> > merge, let us know.
> Peter asked me to split this series into one series per maintainer and
> to send the patches directly to the respective maintainers. Feel free to
> queue this patch in a DRM branch.
>
I've reposted the patch, retaining you as the author, to our lists [1],
since we pull patches from the lists when merging and to run our CI.
Let me know if anything looks wrong there, but I’ll merge once CI comes
back (might take a few days, as CI is currently broken after we rebased
on 7.0‑rc1). After that, it will be in the PR up to Linus during the
fixes phase.
Matt
[1] https://patchwork.freedesktop.org/series/162019/
> Thanks,
>
> Bart.
^ permalink raw reply [flat|nested] 57+ messages in thread
* [PATCH 12/62] drm/gpusvm.c: Fix a locking bug in an error path
2026-02-23 22:00 [PATCH 00/62] Bug fixes and refactoring patches related to locking Bart Van Assche
` (10 preceding siblings ...)
2026-02-23 22:00 ` [PATCH 11/62] drm/pagemap: Unlock cache->lock before freeing it Bart Van Assche
@ 2026-02-23 22:00 ` Bart Van Assche
2026-02-23 22:11 ` Matthew Brost
2026-02-23 22:00 ` [PATCH 13/62] drm/qxl: Fix a buffer leak " Bart Van Assche
` (18 subsequent siblings)
30 siblings, 1 reply; 57+ messages in thread
From: Bart Van Assche @ 2026-02-23 22:00 UTC (permalink / raw)
To: Peter Zijlstra
Cc: Ingo Molnar, Will Deacon, Boqun Feng, Waiman Long, linux-kernel,
Marco Elver, Christoph Hellwig, Steven Rostedt, Nick Desaulniers,
Nathan Chancellor, Kees Cook, Jann Horn, Bart Van Assche,
Thomas Hellström, Matthew Brost, Himal Prasad Ghimiray,
Maarten Lankhorst
From: Bart Van Assche <bvanassche@acm.org>
Only call drm_gpusvm_notifier_unlock() if drm_gpusvm_notifier_lock() was
called first. This has been detected by the Clang thread-safety
analyzer. Compile-tested only.
Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com>
Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Fixes: f1d08a586482 ("drm/gpusvm: Introduce a function to scan the current migration state")
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
---
drivers/gpu/drm/drm_gpusvm.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/drm_gpusvm.c b/drivers/gpu/drm/drm_gpusvm.c
index 24180bfdf5a2..e9b79ab2f83c 100644
--- a/drivers/gpu/drm/drm_gpusvm.c
+++ b/drivers/gpu/drm/drm_gpusvm.c
@@ -819,7 +819,7 @@ enum drm_gpusvm_scan_result drm_gpusvm_scan_mm(struct drm_gpusvm_range *range,
if (!(pfns[i] & HMM_PFN_VALID)) {
state = DRM_GPUSVM_SCAN_UNPOPULATED;
- goto err_free;
+ goto unlock;
}
page = hmm_pfn_to_page(pfns[i]);
@@ -856,9 +856,10 @@ enum drm_gpusvm_scan_result drm_gpusvm_scan_mm(struct drm_gpusvm_range *range,
i += 1ul << drm_gpusvm_hmm_pfn_to_order(pfns[i], i, npages);
}
-err_free:
+unlock:
drm_gpusvm_notifier_unlock(range->gpusvm);
+err_free:
kvfree(pfns);
return state;
}
^ permalink raw reply related [flat|nested] 57+ messages in thread* Re: [PATCH 12/62] drm/gpusvm.c: Fix a locking bug in an error path
2026-02-23 22:00 ` [PATCH 12/62] drm/gpusvm.c: Fix a locking bug in an error path Bart Van Assche
@ 2026-02-23 22:11 ` Matthew Brost
2026-02-23 22:16 ` Bart Van Assche
0 siblings, 1 reply; 57+ messages in thread
From: Matthew Brost @ 2026-02-23 22:11 UTC (permalink / raw)
To: Bart Van Assche
Cc: Peter Zijlstra, Ingo Molnar, Will Deacon, Boqun Feng, Waiman Long,
linux-kernel, Marco Elver, Christoph Hellwig, Steven Rostedt,
Nick Desaulniers, Nathan Chancellor, Kees Cook, Jann Horn,
Bart Van Assche, Thomas Hellström, Himal Prasad Ghimiray,
Maarten Lankhorst
On Mon, Feb 23, 2026 at 02:00:12PM -0800, Bart Van Assche wrote:
> From: Bart Van Assche <bvanassche@acm.org>
>
> Only call drm_gpusvm_notifier_unlock() if drm_gpusvm_notifier_lock() was
> called first. This has been detected by the Clang thread-safety
> analyzer. Compile-tested only.
>
> Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
> Cc: Matthew Brost <matthew.brost@intel.com>
> Cc: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com>
> Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
> Fixes: f1d08a586482 ("drm/gpusvm: Introduce a function to scan the current migration state")
> Signed-off-by: Bart Van Assche <bvanassche@acm.org>
> ---
> drivers/gpu/drm/drm_gpusvm.c | 5 +++--
> 1 file changed, 3 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/gpu/drm/drm_gpusvm.c b/drivers/gpu/drm/drm_gpusvm.c
> index 24180bfdf5a2..e9b79ab2f83c 100644
> --- a/drivers/gpu/drm/drm_gpusvm.c
> +++ b/drivers/gpu/drm/drm_gpusvm.c
> @@ -819,7 +819,7 @@ enum drm_gpusvm_scan_result drm_gpusvm_scan_mm(struct drm_gpusvm_range *range,
>
> if (!(pfns[i] & HMM_PFN_VALID)) {
> state = DRM_GPUSVM_SCAN_UNPOPULATED;
> - goto err_free;
> + goto unlock;
Indeed a problem but we have this fixed in drm-tip.
git format-patch -1 d287dee565c3c
'drm/gpusvm: Fix unbalanced unlock in drm_gpusvm_scan_mm'
Not sure which tree you are in but this should propagate up to Linus
during the 7.0 cycle.
Matt
> }
>
> page = hmm_pfn_to_page(pfns[i]);
> @@ -856,9 +856,10 @@ enum drm_gpusvm_scan_result drm_gpusvm_scan_mm(struct drm_gpusvm_range *range,
> i += 1ul << drm_gpusvm_hmm_pfn_to_order(pfns[i], i, npages);
> }
>
> -err_free:
> +unlock:
> drm_gpusvm_notifier_unlock(range->gpusvm);
>
> +err_free:
> kvfree(pfns);
> return state;
> }
^ permalink raw reply [flat|nested] 57+ messages in thread* Re: [PATCH 12/62] drm/gpusvm.c: Fix a locking bug in an error path
2026-02-23 22:11 ` Matthew Brost
@ 2026-02-23 22:16 ` Bart Van Assche
0 siblings, 0 replies; 57+ messages in thread
From: Bart Van Assche @ 2026-02-23 22:16 UTC (permalink / raw)
To: Matthew Brost, Bart Van Assche
Cc: Peter Zijlstra, Ingo Molnar, Will Deacon, Boqun Feng, Waiman Long,
linux-kernel, Marco Elver, Christoph Hellwig, Steven Rostedt,
Nick Desaulniers, Nathan Chancellor, Kees Cook, Jann Horn,
Thomas Hellström, Himal Prasad Ghimiray, Maarten Lankhorst
On 2/23/26 2:11 PM, Matthew Brost wrote:
> On Mon, Feb 23, 2026 at 02:00:12PM -0800, Bart Van Assche wrote:
>> From: Bart Van Assche <bvanassche@acm.org>
>>
>> Only call drm_gpusvm_notifier_unlock() if drm_gpusvm_notifier_lock() was
>> called first. This has been detected by the Clang thread-safety
>> analyzer. Compile-tested only.
>>
>> Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
>> Cc: Matthew Brost <matthew.brost@intel.com>
>> Cc: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com>
>> Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
>> Fixes: f1d08a586482 ("drm/gpusvm: Introduce a function to scan the current migration state")
>> Signed-off-by: Bart Van Assche <bvanassche@acm.org>
>> ---
>> drivers/gpu/drm/drm_gpusvm.c | 5 +++--
>> 1 file changed, 3 insertions(+), 2 deletions(-)
>>
>> diff --git a/drivers/gpu/drm/drm_gpusvm.c b/drivers/gpu/drm/drm_gpusvm.c
>> index 24180bfdf5a2..e9b79ab2f83c 100644
>> --- a/drivers/gpu/drm/drm_gpusvm.c
>> +++ b/drivers/gpu/drm/drm_gpusvm.c
>> @@ -819,7 +819,7 @@ enum drm_gpusvm_scan_result drm_gpusvm_scan_mm(struct drm_gpusvm_range *range,
>>
>> if (!(pfns[i] & HMM_PFN_VALID)) {
>> state = DRM_GPUSVM_SCAN_UNPOPULATED;
>> - goto err_free;
>> + goto unlock;
>
> Indeed a problem but we have this fixed in drm-tip.
>
> git format-patch -1 d287dee565c3c
>
> 'drm/gpusvm: Fix unbalanced unlock in drm_gpusvm_scan_mm'
>
> Not sure which tree you are in but this should propagate up to Linus
> during the 7.0 cycle.
Thanks Matt for the quick follow-up. This patch series is based on
Linus' master branch. Since a fix has already been queued in the drm-tip
branch, I will drop this patch.
Bart.
^ permalink raw reply [flat|nested] 57+ messages in thread
* [PATCH 13/62] drm/qxl: Fix a buffer leak in an error path
2026-02-23 22:00 [PATCH 00/62] Bug fixes and refactoring patches related to locking Bart Van Assche
` (11 preceding siblings ...)
2026-02-23 22:00 ` [PATCH 12/62] drm/gpusvm.c: Fix a locking bug in an error path Bart Van Assche
@ 2026-02-23 22:00 ` Bart Van Assche
2026-02-23 22:00 ` [PATCH 14/62] hwmon: (it87) Check the it87_lock() return value Bart Van Assche
` (17 subsequent siblings)
30 siblings, 0 replies; 57+ messages in thread
From: Bart Van Assche @ 2026-02-23 22:00 UTC (permalink / raw)
To: Peter Zijlstra
Cc: Ingo Molnar, Will Deacon, Boqun Feng, Waiman Long, linux-kernel,
Marco Elver, Christoph Hellwig, Steven Rostedt, Nick Desaulniers,
Nathan Chancellor, Kees Cook, Jann Horn, Bart Van Assche,
Dave Airlie, Gerd Hoffmann, virtualization
From: Bart Van Assche <bvanassche@acm.org>
If qxl_bo_reserve() succeeds, call qxl_bo_unreserve() instead of
skipping that call.
This has been detected by the Clang thread-safety analyzer.
Compile-tested only.
Cc: Dave Airlie <airlied@redhat.com>
Cc: Gerd Hoffmann <kraxel@redhat.com>
Cc: virtualization@lists.linux.dev
Fixes: f64122c1f6ad ("drm: add new QXL driver. (v1.4)")
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
---
drivers/gpu/drm/qxl/qxl_ioctl.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/qxl/qxl_ioctl.c b/drivers/gpu/drm/qxl/qxl_ioctl.c
index 4ee2b5acf2e0..5617811f3c9b 100644
--- a/drivers/gpu/drm/qxl/qxl_ioctl.c
+++ b/drivers/gpu/drm/qxl/qxl_ioctl.c
@@ -323,7 +323,7 @@ int qxl_update_area_ioctl(struct drm_device *dev, void *data, struct drm_file *f
qxl_ttm_placement_from_domain(qobj, qobj->type);
ret = ttm_bo_validate(&qobj->tbo, &qobj->placement, &ctx);
if (unlikely(ret))
- goto out;
+ goto out2;
}
ret = qxl_bo_check_id(qdev, qobj);
^ permalink raw reply related [flat|nested] 57+ messages in thread* [PATCH 14/62] hwmon: (it87) Check the it87_lock() return value
2026-02-23 22:00 [PATCH 00/62] Bug fixes and refactoring patches related to locking Bart Van Assche
` (12 preceding siblings ...)
2026-02-23 22:00 ` [PATCH 13/62] drm/qxl: Fix a buffer leak " Bart Van Assche
@ 2026-02-23 22:00 ` Bart Van Assche
2026-02-24 15:31 ` Guenter Roeck
2026-02-23 22:00 ` [PATCH 15/62] Input: synaptics-rmi4 - fix a locking bug in an error path Bart Van Assche
` (16 subsequent siblings)
30 siblings, 1 reply; 57+ messages in thread
From: Bart Van Assche @ 2026-02-23 22:00 UTC (permalink / raw)
To: Peter Zijlstra
Cc: Ingo Molnar, Will Deacon, Boqun Feng, Waiman Long, linux-kernel,
Marco Elver, Christoph Hellwig, Steven Rostedt, Nick Desaulniers,
Nathan Chancellor, Kees Cook, Jann Horn, Bart Van Assche,
Frank Crawford, Guenter Roeck, Jean Delvare, linux-hwmon
From: Bart Van Assche <bvanassche@acm.org>
Return early in it87_resume() if it87_lock() fails instead of ignoring the
return value of that function. This patch suppresses a Clang thread-safety
warning.
Cc: Frank Crawford <frank@crawford.emu.id.au>
Cc: Guenter Roeck <linux@roeck-us.net>
Cc: Jean Delvare <jdelvare@suse.com>
Cc: linux-hwmon@vger.kernel.org
Fixes: 376e1a937b30 ("hwmon: (it87) Add calls to smbus_enable/smbus_disable as required")
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
---
drivers/hwmon/it87.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/hwmon/it87.c b/drivers/hwmon/it87.c
index e233aafa8856..8e3935089fca 100644
--- a/drivers/hwmon/it87.c
+++ b/drivers/hwmon/it87.c
@@ -3593,7 +3593,9 @@ static int it87_resume(struct device *dev)
it87_resume_sio(pdev);
- it87_lock(data);
+ int err = it87_lock(data);
+ if (err)
+ return err;
it87_check_pwm(dev);
it87_check_limit_regs(data);
^ permalink raw reply related [flat|nested] 57+ messages in thread* Re: [PATCH 14/62] hwmon: (it87) Check the it87_lock() return value
2026-02-23 22:00 ` [PATCH 14/62] hwmon: (it87) Check the it87_lock() return value Bart Van Assche
@ 2026-02-24 15:31 ` Guenter Roeck
0 siblings, 0 replies; 57+ messages in thread
From: Guenter Roeck @ 2026-02-24 15:31 UTC (permalink / raw)
To: Bart Van Assche
Cc: Peter Zijlstra, Ingo Molnar, Will Deacon, Boqun Feng, Waiman Long,
linux-kernel, Marco Elver, Christoph Hellwig, Steven Rostedt,
Nick Desaulniers, Nathan Chancellor, Kees Cook, Jann Horn,
Bart Van Assche, Frank Crawford, Jean Delvare, linux-hwmon
On Mon, Feb 23, 2026 at 02:00:14PM -0800, Bart Van Assche wrote:
> From: Bart Van Assche <bvanassche@acm.org>
>
> Return early in it87_resume() if it87_lock() fails instead of ignoring the
> return value of that function. This patch suppresses a Clang thread-safety
> warning.
>
> Cc: Frank Crawford <frank@crawford.emu.id.au>
> Cc: Guenter Roeck <linux@roeck-us.net>
> Cc: Jean Delvare <jdelvare@suse.com>
> Cc: linux-hwmon@vger.kernel.org
> Fixes: 376e1a937b30 ("hwmon: (it87) Add calls to smbus_enable/smbus_disable as required")
> Signed-off-by: Bart Van Assche <bvanassche@acm.org>
> ---
> drivers/hwmon/it87.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/hwmon/it87.c b/drivers/hwmon/it87.c
> index e233aafa8856..8e3935089fca 100644
> --- a/drivers/hwmon/it87.c
> +++ b/drivers/hwmon/it87.c
> @@ -3593,7 +3593,9 @@ static int it87_resume(struct device *dev)
>
> it87_resume_sio(pdev);
>
> - it87_lock(data);
> + int err = it87_lock(data);
> + if (err)
> + return err;
checkpatch: missing empty line after declarations.
Oh, never mind, I'll fix that up and declare ret at the beginning of the
function, to match the rest of the driver.
Applied.
Guenter
^ permalink raw reply [flat|nested] 57+ messages in thread
* [PATCH 15/62] Input: synaptics-rmi4 - fix a locking bug in an error path
2026-02-23 22:00 [PATCH 00/62] Bug fixes and refactoring patches related to locking Bart Van Assche
` (13 preceding siblings ...)
2026-02-23 22:00 ` [PATCH 14/62] hwmon: (it87) Check the it87_lock() return value Bart Van Assche
@ 2026-02-23 22:00 ` Bart Van Assche
2026-02-23 22:00 ` [PATCH 16/62] md: Make mddev_suspend() easier to analyze Bart Van Assche
` (15 subsequent siblings)
30 siblings, 0 replies; 57+ messages in thread
From: Bart Van Assche @ 2026-02-23 22:00 UTC (permalink / raw)
To: Peter Zijlstra
Cc: Ingo Molnar, Will Deacon, Boqun Feng, Waiman Long, linux-kernel,
Marco Elver, Christoph Hellwig, Steven Rostedt, Nick Desaulniers,
Nathan Chancellor, Kees Cook, Jann Horn, Bart Van Assche,
Dmitry Torokhov, Nick Dyer, linux-input
From: Bart Van Assche <bvanassche@acm.org>
Lock f54->data_mutex before the first 'goto error' statement since
jumping to the 'error' label causes that mutex to be unlocked.
This bug has been detected by the Clang thread-safety checker.
Cc: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Cc: Nick Dyer <nick@shmanahar.org>
Cc: linux-input@vger.kernel.org
Fixes: 3a762dbd5347 ("[media] Input: synaptics-rmi4 - add support for F54 diagnostics")
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
---
drivers/input/rmi4/rmi_f54.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/input/rmi4/rmi_f54.c b/drivers/input/rmi4/rmi_f54.c
index ac4041a69fcd..fd57ebb1cb50 100644
--- a/drivers/input/rmi4/rmi_f54.c
+++ b/drivers/input/rmi4/rmi_f54.c
@@ -539,6 +539,9 @@ static void rmi_f54_work(struct work_struct *work)
int i;
report_size = rmi_f54_get_report_size(f54);
+
+ mutex_lock(&f54->data_mutex);
+
if (report_size == 0) {
dev_err(&fn->dev, "Bad report size, report type=%d\n",
f54->report_type);
@@ -546,8 +549,6 @@ static void rmi_f54_work(struct work_struct *work)
goto error; /* retry won't help */
}
- mutex_lock(&f54->data_mutex);
-
/*
* Need to check if command has completed.
* If not try again later.
^ permalink raw reply related [flat|nested] 57+ messages in thread* [PATCH 16/62] md: Make mddev_suspend() easier to analyze
2026-02-23 22:00 [PATCH 00/62] Bug fixes and refactoring patches related to locking Bart Van Assche
` (14 preceding siblings ...)
2026-02-23 22:00 ` [PATCH 15/62] Input: synaptics-rmi4 - fix a locking bug in an error path Bart Van Assche
@ 2026-02-23 22:00 ` Bart Van Assche
2026-02-23 22:00 ` [PATCH 17/62] bnxt_en: Make bnxt_resume() " Bart Van Assche
` (14 subsequent siblings)
30 siblings, 0 replies; 57+ messages in thread
From: Bart Van Assche @ 2026-02-23 22:00 UTC (permalink / raw)
To: Peter Zijlstra
Cc: Ingo Molnar, Will Deacon, Boqun Feng, Waiman Long, linux-kernel,
Marco Elver, Christoph Hellwig, Steven Rostedt, Nick Desaulniers,
Nathan Chancellor, Kees Cook, Jann Horn, Bart Van Assche,
Song Liu, Yu Kuai, linux-raid
From: Bart Van Assche <bvanassche@acm.org>
Prepare for enabling Clang's thread-safety analysis by moving an
if-statement. No functionality has been changed.
Cc: Song Liu <song@kernel.org>
Cc: Yu Kuai <yukuai@fnnas.com>
Cc: linux-raid@vger.kernel.org
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
---
drivers/md/md.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 3ce6f9e9d38e..b0d260d03a7d 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -475,12 +475,13 @@ int mddev_suspend(struct mddev *mddev, bool interruptible)
*/
lockdep_assert_not_held(&mddev->reconfig_mutex);
- if (interruptible)
+ if (interruptible) {
err = mutex_lock_interruptible(&mddev->suspend_mutex);
- else
+ if (err)
+ return err;
+ } else {
mutex_lock(&mddev->suspend_mutex);
- if (err)
- return err;
+ }
if (mddev->suspended) {
WRITE_ONCE(mddev->suspended, mddev->suspended + 1);
^ permalink raw reply related [flat|nested] 57+ messages in thread* [PATCH 17/62] bnxt_en: Make bnxt_resume() easier to analyze
2026-02-23 22:00 [PATCH 00/62] Bug fixes and refactoring patches related to locking Bart Van Assche
` (15 preceding siblings ...)
2026-02-23 22:00 ` [PATCH 16/62] md: Make mddev_suspend() easier to analyze Bart Van Assche
@ 2026-02-23 22:00 ` Bart Van Assche
2026-02-23 22:00 ` [PATCH 18/62] bnxt_en: Fix bnxt_dl_reload_up() Bart Van Assche
` (13 subsequent siblings)
30 siblings, 0 replies; 57+ messages in thread
From: Bart Van Assche @ 2026-02-23 22:00 UTC (permalink / raw)
To: Peter Zijlstra
Cc: Ingo Molnar, Will Deacon, Boqun Feng, Waiman Long, linux-kernel,
Marco Elver, Christoph Hellwig, Steven Rostedt, Nick Desaulniers,
Nathan Chancellor, Kees Cook, Jann Horn, Bart Van Assche,
Shantiprasad Shettar, netdev
From: Bart Van Assche <bvanassche@acm.org>
Pass the same argument to netdev_lock() and netdev_unlock(). This patch
prepares for enabling the Clang thread-safety analysis functionality. No
functional change intended.
Cc: Shantiprasad Shettar <shantiprasad.shettar@broadcom.com>
Cc: netdev@vger.kernel.org
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
---
drivers/net/ethernet/broadcom/bnxt/bnxt.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index e062d5d400da..950708575268 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -17121,7 +17121,7 @@ static int bnxt_resume(struct device *device)
}
resume_exit:
- netdev_unlock(bp->dev);
+ netdev_unlock(dev);
bnxt_ulp_start(bp, rc);
if (!rc)
bnxt_reenable_sriov(bp);
^ permalink raw reply related [flat|nested] 57+ messages in thread* [PATCH 18/62] bnxt_en: Fix bnxt_dl_reload_up()
2026-02-23 22:00 [PATCH 00/62] Bug fixes and refactoring patches related to locking Bart Van Assche
` (16 preceding siblings ...)
2026-02-23 22:00 ` [PATCH 17/62] bnxt_en: Make bnxt_resume() " Bart Van Assche
@ 2026-02-23 22:00 ` Bart Van Assche
2026-02-23 22:00 ` [PATCH 19/62] ice: Fix a locking bug in an error path Bart Van Assche
` (12 subsequent siblings)
30 siblings, 0 replies; 57+ messages in thread
From: Bart Van Assche @ 2026-02-23 22:00 UTC (permalink / raw)
To: Peter Zijlstra
Cc: Ingo Molnar, Will Deacon, Boqun Feng, Waiman Long, linux-kernel,
Marco Elver, Christoph Hellwig, Steven Rostedt, Nick Desaulniers,
Nathan Chancellor, Kees Cook, Jann Horn, Bart Van Assche,
Jakub Kicinski, Shantiprasad Shettar, Stanislav Fomichev, netdev
From: Bart Van Assche <bvanassche@acm.org>
bnxt_dl_reload_down() calls rtnl_lock() and netdev_lock() if it returns
0. Hence, bnxt_dl_reload_up() should invoke the corresponding unlock
calls. This issue has been detected by the clang thread-sanitizer.
Compile-tested only.
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: Shantiprasad Shettar <shantiprasad.shettar@broadcom.com>
Cc: Stanislav Fomichev <sdf@fomichev.me>
Cc: netdev@vger.kernel.org
Fixes: 004b5008016a ("eth: bnxt: remove most dependencies on RTNL")
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
---
drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c
index 15de802bbac4..1e9a3454bb29 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c
@@ -562,6 +562,8 @@ static int bnxt_dl_reload_up(struct devlink *dl, enum devlink_reload_action acti
break;
}
default:
+ netdev_unlock(bp->dev);
+ rtnl_unlock();
return -EOPNOTSUPP;
}
^ permalink raw reply related [flat|nested] 57+ messages in thread* [PATCH 19/62] ice: Fix a locking bug in an error path
2026-02-23 22:00 [PATCH 00/62] Bug fixes and refactoring patches related to locking Bart Van Assche
` (17 preceding siblings ...)
2026-02-23 22:00 ` [PATCH 18/62] bnxt_en: Fix bnxt_dl_reload_up() Bart Van Assche
@ 2026-02-23 22:00 ` Bart Van Assche
2026-02-24 8:40 ` Przemek Kitszel
2026-02-23 22:00 ` [PATCH 20/62] octeontx2-pf: Fix locking " Bart Van Assche
` (11 subsequent siblings)
30 siblings, 1 reply; 57+ messages in thread
From: Bart Van Assche @ 2026-02-23 22:00 UTC (permalink / raw)
To: Peter Zijlstra
Cc: Ingo Molnar, Will Deacon, Boqun Feng, Waiman Long, linux-kernel,
Marco Elver, Christoph Hellwig, Steven Rostedt, Nick Desaulniers,
Nathan Chancellor, Kees Cook, Jann Horn, Bart Van Assche,
Tony Nguyen, Przemek Kitszel, intel-wired-lan
From: Bart Van Assche <bvanassche@acm.org>
Move the mutex_lock() call up to prevent that DCB settings change after
the ice_query_port_ets() call.
This patch fixes a bug in an error path. Without this patch pf->tc_mutex
may be unlocked in an error path without having been locked. This bug has
been detected by the clang thread-safety analyzer.
Cc: Tony Nguyen <anthony.l.nguyen@intel.com>
Cc: Przemek Kitszel <przemyslaw.kitszel@intel.com>
Cc: intel-wired-lan@lists.osuosl.org
Fixes: 242b5e068b25 ("ice: Fix DCB rebuild after reset")
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
---
drivers/net/ethernet/intel/ice/ice_dcb_lib.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/intel/ice/ice_dcb_lib.c b/drivers/net/ethernet/intel/ice/ice_dcb_lib.c
index bd77f1c001ee..78ded6876581 100644
--- a/drivers/net/ethernet/intel/ice/ice_dcb_lib.c
+++ b/drivers/net/ethernet/intel/ice/ice_dcb_lib.c
@@ -537,14 +537,14 @@ void ice_dcb_rebuild(struct ice_pf *pf)
struct ice_dcbx_cfg *err_cfg;
int ret;
+ mutex_lock(&pf->tc_mutex);
+
ret = ice_query_port_ets(pf->hw.port_info, &buf, sizeof(buf), NULL);
if (ret) {
dev_err(dev, "Query Port ETS failed\n");
goto dcb_error;
}
- mutex_lock(&pf->tc_mutex);
-
if (!pf->hw.port_info->qos_cfg.is_sw_lldp)
ice_cfg_etsrec_defaults(pf->hw.port_info);
^ permalink raw reply related [flat|nested] 57+ messages in thread* Re: [PATCH 19/62] ice: Fix a locking bug in an error path
2026-02-23 22:00 ` [PATCH 19/62] ice: Fix a locking bug in an error path Bart Van Assche
@ 2026-02-24 8:40 ` Przemek Kitszel
2026-02-24 17:43 ` Bart Van Assche
0 siblings, 1 reply; 57+ messages in thread
From: Przemek Kitszel @ 2026-02-24 8:40 UTC (permalink / raw)
To: Bart Van Assche, Bart Van Assche, Tony Nguyen
Cc: Ingo Molnar, Will Deacon, Boqun Feng, Waiman Long, linux-kernel,
Peter Zijlstra, Marco Elver, Christoph Hellwig, Steven Rostedt,
Nick Desaulniers, Nathan Chancellor, Kees Cook, Jann Horn,
intel-wired-lan
On 2/23/26 23:00, Bart Van Assche wrote:
> From: Bart Van Assche <bvanassche@acm.org>
>
> Move the mutex_lock() call up to prevent that DCB settings change after
> the ice_query_port_ets() call.
>
> This patch fixes a bug in an error path. Without this patch pf->tc_mutex
> may be unlocked in an error path without having been locked. This bug has
> been detected by the clang thread-safety analyzer.
Thank you. This is a good catch, and current error path is obviously
wrong, in the way you have described.
From the commit msg alone, it is not clear why moving the lock up,
instead moving the unlock to match the lock order, is right.
But from the code, I see that you are right - we call
ice_query_port_ets() again under the lock some 20 lines below (L566)
Let us know If you want to enhance your commit message (including the
subject), as it looks like a big quasi-automated series.
>
> Cc: Tony Nguyen <anthony.l.nguyen@intel.com>
> Cc: Przemek Kitszel <przemyslaw.kitszel@intel.com>
> Cc: intel-wired-lan@lists.osuosl.org
> Fixes: 242b5e068b25 ("ice: Fix DCB rebuild after reset")
> Signed-off-by: Bart Van Assche <bvanassche@acm.org>
> ---
> drivers/net/ethernet/intel/ice/ice_dcb_lib.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/net/ethernet/intel/ice/ice_dcb_lib.c b/drivers/net/ethernet/intel/ice/ice_dcb_lib.c
> index bd77f1c001ee..78ded6876581 100644
> --- a/drivers/net/ethernet/intel/ice/ice_dcb_lib.c
> +++ b/drivers/net/ethernet/intel/ice/ice_dcb_lib.c
> @@ -537,14 +537,14 @@ void ice_dcb_rebuild(struct ice_pf *pf)
> struct ice_dcbx_cfg *err_cfg;
> int ret;
>
> + mutex_lock(&pf->tc_mutex);
> +
> ret = ice_query_port_ets(pf->hw.port_info, &buf, sizeof(buf), NULL);
> if (ret) {
> dev_err(dev, "Query Port ETS failed\n");
> goto dcb_error;
> }
>
> - mutex_lock(&pf->tc_mutex);
> -
> if (!pf->hw.port_info->qos_cfg.is_sw_lldp)
> ice_cfg_etsrec_defaults(pf->hw.port_info);
>
^ permalink raw reply [flat|nested] 57+ messages in thread* Re: [PATCH 19/62] ice: Fix a locking bug in an error path
2026-02-24 8:40 ` Przemek Kitszel
@ 2026-02-24 17:43 ` Bart Van Assche
2026-02-25 13:16 ` Przemek Kitszel
0 siblings, 1 reply; 57+ messages in thread
From: Bart Van Assche @ 2026-02-24 17:43 UTC (permalink / raw)
To: Przemek Kitszel, Bart Van Assche, Tony Nguyen
Cc: Ingo Molnar, Will Deacon, Boqun Feng, Waiman Long, linux-kernel,
Peter Zijlstra, Marco Elver, Christoph Hellwig, Steven Rostedt,
Nick Desaulniers, Nathan Chancellor, Kees Cook, Jann Horn,
intel-wired-lan
On 2/24/26 12:40 AM, Przemek Kitszel wrote:
> On 2/23/26 23:00, Bart Van Assche wrote:
>> From: Bart Van Assche <bvanassche@acm.org>
>>
>> Move the mutex_lock() call up to prevent that DCB settings change after
>> the ice_query_port_ets() call.
>>
>> This patch fixes a bug in an error path. Without this patch pf->tc_mutex
>> may be unlocked in an error path without having been locked. This bug has
>> been detected by the clang thread-safety analyzer.
>
> Thank you. This is a good catch, and current error path is obviously
> wrong, in the way you have described.
>
> From the commit msg alone, it is not clear why moving the lock up,
> instead moving the unlock to match the lock order, is right.
Please take a look at the prior discussion of this change, available
here:
https://lore.kernel.org/all/61e3cc7a-af79-48e4-acb6-8ac7c8d2552c@intel.com/
> But from the code, I see that you are right - we call
> ice_query_port_ets() again under the lock some 20 lines below (L566)
>
> Let us know If you want to enhance your commit message (including the
> subject), as it looks like a big quasi-automated series.
I have been asked to split this patch series and to send it directly to
the maintainers of the modified subsystems. Suggestions for how to
improve the patch description are welcome.
Thanks,
Bart.
^ permalink raw reply [flat|nested] 57+ messages in thread
* Re: [PATCH 19/62] ice: Fix a locking bug in an error path
2026-02-24 17:43 ` Bart Van Assche
@ 2026-02-25 13:16 ` Przemek Kitszel
0 siblings, 0 replies; 57+ messages in thread
From: Przemek Kitszel @ 2026-02-25 13:16 UTC (permalink / raw)
To: Bart Van Assche, Bart Van Assche, Tony Nguyen
Cc: Ingo Molnar, Will Deacon, Boqun Feng, Waiman Long, linux-kernel,
Peter Zijlstra, Marco Elver, Christoph Hellwig, Steven Rostedt,
Nick Desaulniers, Nathan Chancellor, Kees Cook, Jann Horn,
intel-wired-lan
On 2/24/26 18:43, Bart Van Assche wrote:
> On 2/24/26 12:40 AM, Przemek Kitszel wrote:
>> On 2/23/26 23:00, Bart Van Assche wrote:
>>> From: Bart Van Assche <bvanassche@acm.org>
>>>
>>> Move the mutex_lock() call up to prevent that DCB settings change after
>>> the ice_query_port_ets() call.
s/./, as the other call in ice_dcb_rebuild() is/
>>>
>>> This patch fixes a bug in an error path. Without this patch pf->tc_mutex
>>> may be unlocked in an error path without having been locked.
suggestion:
This also fixes a bug in an error path, as before taking the first
"goto dcb_error" in the function jumped over mutex_lock() to
mutex_unlock()
This bug
>>> has
>>> been detected by the clang thread-safety analyzer.
>>
>> Thank you. This is a good catch, and current error path is obviously
>> wrong, in the way you have described.
>>
>> From the commit msg alone, it is not clear why moving the lock up,
>> instead moving the unlock to match the lock order, is right.
>
> Please take a look at the prior discussion of this change, available
> here: https://lore.kernel.org/all/61e3cc7a-af79-48e4-
> acb6-8ac7c8d2552c@intel.com/
>
>> But from the code, I see that you are right - we call
>> ice_query_port_ets() again under the lock some 20 lines below (L566)
>>
>> Let us know If you want to enhance your commit message (including the
>> subject), as it looks like a big quasi-automated series.
>
> I have been asked to split this patch series and to send it directly to
> the maintainers of the modified subsystems. Suggestions for how to
> improve the patch description are welcome.
ok, that aligns with what I wanted too,
see my suggestions inline above, and update Subject, perhaps:
Subject: ice: fix locking in ice_dcb_rebuild()
please send with the "iwl-net" prefix, as a separate single-patch series
>
> Thanks,
>
> Bart.
>
^ permalink raw reply [flat|nested] 57+ messages in thread
* [PATCH 20/62] octeontx2-pf: Fix locking in an error path
2026-02-23 22:00 [PATCH 00/62] Bug fixes and refactoring patches related to locking Bart Van Assche
` (18 preceding siblings ...)
2026-02-23 22:00 ` [PATCH 19/62] ice: Fix a locking bug in an error path Bart Van Assche
@ 2026-02-23 22:00 ` Bart Van Assche
2026-02-23 22:00 ` [PATCH 21/62] qed: Make _qed_mcp_cmd_and_union() easier to analyze Bart Van Assche
` (10 subsequent siblings)
30 siblings, 0 replies; 57+ messages in thread
From: Bart Van Assche @ 2026-02-23 22:00 UTC (permalink / raw)
To: Peter Zijlstra
Cc: Ingo Molnar, Will Deacon, Boqun Feng, Waiman Long, linux-kernel,
Marco Elver, Christoph Hellwig, Steven Rostedt, Nick Desaulniers,
Nathan Chancellor, Kees Cook, Jann Horn, Bart Van Assche,
Naveen Mamindlapalli, Jakub Kicinski, Sunil Goutham,
Geetha sowjanya, Subbaraya Sundeep, hariprasad, Bharat Bhushan,
netdev
From: Bart Van Assche <bvanassche@acm.org>
Only unlock pf->mbox.lock if it has been locked by otx2_do_set_vf_vlan().
This bug has been detected by the Clang thread-safety analyzer.
Cc: Naveen Mamindlapalli <naveenm@marvell.com>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: Sunil Goutham <sgoutham@marvell.com>
Cc: Geetha sowjanya <gakula@marvell.com>
Cc: Subbaraya Sundeep <sbhatta@marvell.com>
Cc: hariprasad <hkelam@marvell.com>
Cc: Bharat Bhushan <bbhushan2@marvell.com>
Cc: netdev@vger.kernel.org
Fixes: f0c2982aaf98 ("octeontx2-pf: Add support for SR-IOV management functions")
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
---
drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c
index ee623476e5ff..8c9f08ed90fd 100644
--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c
+++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c
@@ -2588,7 +2588,7 @@ static int otx2_do_set_vf_vlan(struct otx2_nic *pf, int vf, u16 vlan, u8 qos,
config = &pf->vf_configs[vf];
if (!vlan && !config->vlan)
- goto out;
+ return err;
mutex_lock(&pf->mbox.lock);
^ permalink raw reply related [flat|nested] 57+ messages in thread* [PATCH 21/62] qed: Make _qed_mcp_cmd_and_union() easier to analyze
2026-02-23 22:00 [PATCH 00/62] Bug fixes and refactoring patches related to locking Bart Van Assche
` (19 preceding siblings ...)
2026-02-23 22:00 ` [PATCH 20/62] octeontx2-pf: Fix locking " Bart Van Assche
@ 2026-02-23 22:00 ` Bart Van Assche
2026-02-23 22:00 ` [PATCH 22/62] mctp i3c: Fix locking in error paths Bart Van Assche
` (9 subsequent siblings)
30 siblings, 0 replies; 57+ messages in thread
From: Bart Van Assche @ 2026-02-23 22:00 UTC (permalink / raw)
To: Peter Zijlstra
Cc: Ingo Molnar, Will Deacon, Boqun Feng, Waiman Long, linux-kernel,
Marco Elver, Christoph Hellwig, Steven Rostedt, Nick Desaulniers,
Nathan Chancellor, Kees Cook, Jann Horn, Bart Van Assche,
Manish Chopra, netdev
From: Bart Van Assche <bvanassche@acm.org>
Make the implementation of this function compatible with clang's
compile-time thread-safety analysis by moving error-handling code to the
end of this function. No functionality has been changed.
Cc: Manish Chopra <manishc@marvell.com>
Cc: netdev@vger.kernel.org
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
---
drivers/net/ethernet/qlogic/qed/qed_mcp.c | 56 ++++++++++++-----------
1 file changed, 30 insertions(+), 26 deletions(-)
diff --git a/drivers/net/ethernet/qlogic/qed/qed_mcp.c b/drivers/net/ethernet/qlogic/qed/qed_mcp.c
index 7e37fe631a58..462e758c5890 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_mcp.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_mcp.c
@@ -467,7 +467,7 @@ _qed_mcp_cmd_and_union(struct qed_hwfn *p_hwfn,
int rc = 0;
/* Wait until the mailbox is non-occupied */
- do {
+ for (;;) {
/* Exit the loop if there is no pending command, or if the
* pending command is completed during this iteration.
* The spinlock stays locked until the command is sent.
@@ -486,18 +486,14 @@ _qed_mcp_cmd_and_union(struct qed_hwfn *p_hwfn,
spin_unlock_bh(&p_hwfn->mcp_info->cmd_lock);
+ if (++cnt >= QED_DRV_MB_MAX_RETRIES)
+ goto retries_exceeded_1;
+
if (QED_MB_FLAGS_IS_SET(p_mb_params, CAN_SLEEP))
usleep_range(QED_MCP_RESP_ITER_US,
QED_MCP_RESP_ITER_US * 2);
else
udelay(QED_MCP_RESP_ITER_US);
- } while (++cnt < QED_DRV_MB_MAX_RETRIES);
-
- if (cnt >= QED_DRV_MB_MAX_RETRIES) {
- DP_NOTICE(p_hwfn,
- "The MFW mailbox is occupied by an uncompleted command. Failed to send command 0x%08x [param 0x%08x].\n",
- p_mb_params->cmd, p_mb_params->param);
- return -EAGAIN;
}
/* Send the mailbox command */
@@ -513,7 +509,7 @@ _qed_mcp_cmd_and_union(struct qed_hwfn *p_hwfn,
spin_unlock_bh(&p_hwfn->mcp_info->cmd_lock);
/* Wait for the MFW response */
- do {
+ for (;;) {
/* Exit the loop if the command is already completed, or if the
* command is completed during this iteration.
* The spinlock stays locked until the list element is removed.
@@ -537,24 +533,9 @@ _qed_mcp_cmd_and_union(struct qed_hwfn *p_hwfn,
goto err;
spin_unlock_bh(&p_hwfn->mcp_info->cmd_lock);
- } while (++cnt < QED_DRV_MB_MAX_RETRIES);
-
- if (cnt >= QED_DRV_MB_MAX_RETRIES) {
- DP_NOTICE(p_hwfn,
- "The MFW failed to respond to command 0x%08x [param 0x%08x].\n",
- p_mb_params->cmd, p_mb_params->param);
- qed_mcp_print_cpu_info(p_hwfn, p_ptt);
-
- spin_lock_bh(&p_hwfn->mcp_info->cmd_lock);
- qed_mcp_cmd_del_elem(p_hwfn, p_cmd_elem);
- spin_unlock_bh(&p_hwfn->mcp_info->cmd_lock);
- if (!QED_MB_FLAGS_IS_SET(p_mb_params, AVOID_BLOCK))
- qed_mcp_cmd_set_blocking(p_hwfn, true);
-
- qed_hw_err_notify(p_hwfn, p_ptt,
- QED_HW_ERR_MFW_RESP_FAIL, NULL);
- return -EAGAIN;
+ if (++cnt >= QED_DRV_MB_MAX_RETRIES)
+ goto retries_exceeded_2;
}
qed_mcp_cmd_del_elem(p_hwfn, p_cmd_elem);
@@ -576,6 +557,29 @@ _qed_mcp_cmd_and_union(struct qed_hwfn *p_hwfn,
err:
spin_unlock_bh(&p_hwfn->mcp_info->cmd_lock);
return rc;
+
+retries_exceeded_1:
+ DP_NOTICE(p_hwfn,
+ "The MFW mailbox is occupied by an uncompleted command. Failed to send command 0x%08x [param 0x%08x].\n",
+ p_mb_params->cmd, p_mb_params->param);
+ return -EAGAIN;
+
+retries_exceeded_2:
+ DP_NOTICE(p_hwfn,
+ "The MFW failed to respond to command 0x%08x [param 0x%08x].\n",
+ p_mb_params->cmd, p_mb_params->param);
+ qed_mcp_print_cpu_info(p_hwfn, p_ptt);
+
+ spin_lock_bh(&p_hwfn->mcp_info->cmd_lock);
+ qed_mcp_cmd_del_elem(p_hwfn, p_cmd_elem);
+ spin_unlock_bh(&p_hwfn->mcp_info->cmd_lock);
+
+ if (!QED_MB_FLAGS_IS_SET(p_mb_params, AVOID_BLOCK))
+ qed_mcp_cmd_set_blocking(p_hwfn, true);
+
+ qed_hw_err_notify(p_hwfn, p_ptt,
+ QED_HW_ERR_MFW_RESP_FAIL, NULL);
+ return -EAGAIN;
}
static int qed_mcp_cmd_and_union(struct qed_hwfn *p_hwfn,
^ permalink raw reply related [flat|nested] 57+ messages in thread* [PATCH 22/62] mctp i3c: Fix locking in error paths
2026-02-23 22:00 [PATCH 00/62] Bug fixes and refactoring patches related to locking Bart Van Assche
` (20 preceding siblings ...)
2026-02-23 22:00 ` [PATCH 21/62] qed: Make _qed_mcp_cmd_and_union() easier to analyze Bart Van Assche
@ 2026-02-23 22:00 ` Bart Van Assche
2026-02-25 4:27 ` Matt Johnston
2026-02-23 22:00 ` [PATCH 23/62] net: phy: mxl-86110: Fix locking in an error path Bart Van Assche
` (8 subsequent siblings)
30 siblings, 1 reply; 57+ messages in thread
From: Bart Van Assche @ 2026-02-23 22:00 UTC (permalink / raw)
To: Peter Zijlstra
Cc: Ingo Molnar, Will Deacon, Boqun Feng, Waiman Long, linux-kernel,
Marco Elver, Christoph Hellwig, Steven Rostedt, Nick Desaulniers,
Nathan Chancellor, Kees Cook, Jann Horn, Bart Van Assche,
Leo Yang, Paolo Abeni, Jeremy Kerr, Matt Johnston, netdev
From: Bart Van Assche <bvanassche@acm.org>
Only unlock mi->lock if it has been locked. This bug has been detected by
the Clang thread-safety analyzer.
Cc: Leo Yang <Leo-Yang@quantatw.com>
Cc: Paolo Abeni <pabeni@redhat.com>
Cc: Jeremy Kerr <jk@codeconstruct.com.au>
Cc: Matt Johnston <matt@codeconstruct.com.au>
Cc: netdev@vger.kernel.org
Fixes: 2d2d4f60ed26 ("mctp i3c: fix MCTP I3C driver multi-thread issue")
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
---
drivers/net/mctp/mctp-i3c.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/net/mctp/mctp-i3c.c b/drivers/net/mctp/mctp-i3c.c
index 6d2bbae7477b..d4a29912c7e1 100644
--- a/drivers/net/mctp/mctp-i3c.c
+++ b/drivers/net/mctp/mctp-i3c.c
@@ -112,7 +112,7 @@ static int mctp_i3c_read(struct mctp_i3c_device *mi)
if (!skb) {
stats->rx_dropped++;
rc = -ENOMEM;
- goto err;
+ goto free_skb;
}
skb->protocol = htons(ETH_P_MCTP);
@@ -170,8 +170,11 @@ static int mctp_i3c_read(struct mctp_i3c_device *mi)
mutex_unlock(&mi->lock);
return 0;
+
err:
mutex_unlock(&mi->lock);
+
+free_skb:
kfree_skb(skb);
return rc;
}
^ permalink raw reply related [flat|nested] 57+ messages in thread* Re: [PATCH 22/62] mctp i3c: Fix locking in error paths
2026-02-23 22:00 ` [PATCH 22/62] mctp i3c: Fix locking in error paths Bart Van Assche
@ 2026-02-25 4:27 ` Matt Johnston
0 siblings, 0 replies; 57+ messages in thread
From: Matt Johnston @ 2026-02-25 4:27 UTC (permalink / raw)
To: Bart Van Assche, Peter Zijlstra
Cc: Ingo Molnar, Will Deacon, Boqun Feng, Waiman Long, linux-kernel,
Marco Elver, Christoph Hellwig, Steven Rostedt, Nick Desaulniers,
Nathan Chancellor, Kees Cook, Jann Horn, Bart Van Assche,
Leo Yang, Paolo Abeni, Jeremy Kerr, netdev
Hi Bart,
On Mon, 2026-02-23 at 14:00 -0800, Bart Van Assche wrote:
> From: Bart Van Assche <bvanassche@acm.org>
>
> Only unlock mi->lock if it has been locked. This bug has been detected by
> the Clang thread-safety analyzer.
Thanks for the fix.
Acked-by: Matt Johnston <matt@codeconstruct.com.au>
Cheers,
Matt
^ permalink raw reply [flat|nested] 57+ messages in thread
* [PATCH 23/62] net: phy: mxl-86110: Fix locking in an error path
2026-02-23 22:00 [PATCH 00/62] Bug fixes and refactoring patches related to locking Bart Van Assche
` (21 preceding siblings ...)
2026-02-23 22:00 ` [PATCH 22/62] mctp i3c: Fix locking in error paths Bart Van Assche
@ 2026-02-23 22:00 ` Bart Van Assche
2026-02-23 23:12 ` Daniel Golle
2026-02-24 0:19 ` Andrew Lunn
2026-02-23 22:00 ` [PATCH 24/62] net/cw1200: Fix locking in error paths Bart Van Assche
` (7 subsequent siblings)
30 siblings, 2 replies; 57+ messages in thread
From: Bart Van Assche @ 2026-02-23 22:00 UTC (permalink / raw)
To: Peter Zijlstra
Cc: Ingo Molnar, Will Deacon, Boqun Feng, Waiman Long, linux-kernel,
Marco Elver, Christoph Hellwig, Steven Rostedt, Nick Desaulniers,
Nathan Chancellor, Kees Cook, Jann Horn, Bart Van Assche,
Daniel Golle, Andrew Lunn, Jakub Kicinski, Xu Liang, netdev
From: Bart Van Assche <bvanassche@acm.org>
Only call phy_unlock_mdio_bus() if phy_lock_mdio_bus() has been called
first. This has been detected by the Clang thread-safety analyzer.
Cc: Daniel Golle <daniel@makrotopia.org>
Cc: Andrew Lunn <andrew@lunn.ch>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: Xu Liang <lxu@maxlinear.com>
Cc: netdev@vger.kernel.org
Fixes: 3d1b3f4ffc0a ("net: phy: mxl-86110: add basic support for MxL86111 PHY")
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
---
drivers/net/phy/mxl-86110.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/phy/mxl-86110.c b/drivers/net/phy/mxl-86110.c
index 42a5fe3f115f..d010b023f7b9 100644
--- a/drivers/net/phy/mxl-86110.c
+++ b/drivers/net/phy/mxl-86110.c
@@ -891,7 +891,7 @@ static int mxl86111_config_inband(struct phy_device *phydev, unsigned int modes)
MII_BMCR, BMCR_ANENABLE,
(modes == LINK_INBAND_DISABLE) ? 0 : BMCR_ANENABLE);
if (ret < 0)
- goto out;
+ return ret;
phy_lock_mdio_bus(phydev);
^ permalink raw reply related [flat|nested] 57+ messages in thread* Re: [PATCH 23/62] net: phy: mxl-86110: Fix locking in an error path
2026-02-23 22:00 ` [PATCH 23/62] net: phy: mxl-86110: Fix locking in an error path Bart Van Assche
@ 2026-02-23 23:12 ` Daniel Golle
2026-02-24 0:19 ` Andrew Lunn
1 sibling, 0 replies; 57+ messages in thread
From: Daniel Golle @ 2026-02-23 23:12 UTC (permalink / raw)
To: Bart Van Assche
Cc: Peter Zijlstra, Ingo Molnar, Will Deacon, Boqun Feng, Waiman Long,
linux-kernel, Marco Elver, Christoph Hellwig, Steven Rostedt,
Nick Desaulniers, Nathan Chancellor, Kees Cook, Jann Horn,
Bart Van Assche, Andrew Lunn, Jakub Kicinski, Xu Liang, netdev
On Mon, Feb 23, 2026 at 02:00:23PM -0800, Bart Van Assche wrote:
> From: Bart Van Assche <bvanassche@acm.org>
>
> Only call phy_unlock_mdio_bus() if phy_lock_mdio_bus() has been called
> first. This has been detected by the Clang thread-safety analyzer.
>
> Cc: Daniel Golle <daniel@makrotopia.org>
> Cc: Andrew Lunn <andrew@lunn.ch>
> Cc: Jakub Kicinski <kuba@kernel.org>
> Cc: Xu Liang <lxu@maxlinear.com>
> Cc: netdev@vger.kernel.org
> Fixes: 3d1b3f4ffc0a ("net: phy: mxl-86110: add basic support for MxL86111 PHY")
> Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Reviewed-by: Daniel Golle <daniel@makrotopia.org>
> ---
> drivers/net/phy/mxl-86110.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/net/phy/mxl-86110.c b/drivers/net/phy/mxl-86110.c
> index 42a5fe3f115f..d010b023f7b9 100644
> --- a/drivers/net/phy/mxl-86110.c
> +++ b/drivers/net/phy/mxl-86110.c
> @@ -891,7 +891,7 @@ static int mxl86111_config_inband(struct phy_device *phydev, unsigned int modes)
> MII_BMCR, BMCR_ANENABLE,
> (modes == LINK_INBAND_DISABLE) ? 0 : BMCR_ANENABLE);
> if (ret < 0)
> - goto out;
> + return ret;
>
> phy_lock_mdio_bus(phydev);
>
^ permalink raw reply [flat|nested] 57+ messages in thread* Re: [PATCH 23/62] net: phy: mxl-86110: Fix locking in an error path
2026-02-23 22:00 ` [PATCH 23/62] net: phy: mxl-86110: Fix locking in an error path Bart Van Assche
2026-02-23 23:12 ` Daniel Golle
@ 2026-02-24 0:19 ` Andrew Lunn
1 sibling, 0 replies; 57+ messages in thread
From: Andrew Lunn @ 2026-02-24 0:19 UTC (permalink / raw)
To: Bart Van Assche
Cc: Peter Zijlstra, Ingo Molnar, Will Deacon, Boqun Feng, Waiman Long,
linux-kernel, Marco Elver, Christoph Hellwig, Steven Rostedt,
Nick Desaulniers, Nathan Chancellor, Kees Cook, Jann Horn,
Bart Van Assche, Daniel Golle, Jakub Kicinski, Xu Liang, netdev
On Mon, Feb 23, 2026 at 02:00:23PM -0800, Bart Van Assche wrote:
> From: Bart Van Assche <bvanassche@acm.org>
>
> Only call phy_unlock_mdio_bus() if phy_lock_mdio_bus() has been called
> first. This has been detected by the Clang thread-safety analyzer.
>
> Cc: Daniel Golle <daniel@makrotopia.org>
> Cc: Andrew Lunn <andrew@lunn.ch>
> Cc: Jakub Kicinski <kuba@kernel.org>
> Cc: Xu Liang <lxu@maxlinear.com>
> Cc: netdev@vger.kernel.org
> Fixes: 3d1b3f4ffc0a ("net: phy: mxl-86110: add basic support for MxL86111 PHY")
> Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Andrew
^ permalink raw reply [flat|nested] 57+ messages in thread
* [PATCH 24/62] net/cw1200: Fix locking in error paths
2026-02-23 22:00 [PATCH 00/62] Bug fixes and refactoring patches related to locking Bart Van Assche
` (22 preceding siblings ...)
2026-02-23 22:00 ` [PATCH 23/62] net: phy: mxl-86110: Fix locking in an error path Bart Van Assche
@ 2026-02-23 22:00 ` Bart Van Assche
2026-03-02 11:08 ` Johannes Berg
2026-02-23 22:00 ` [PATCH 25/62] wlcore: Fix a locking bug Bart Van Assche
` (6 subsequent siblings)
30 siblings, 1 reply; 57+ messages in thread
From: Bart Van Assche @ 2026-02-23 22:00 UTC (permalink / raw)
To: Peter Zijlstra
Cc: Ingo Molnar, Will Deacon, Boqun Feng, Waiman Long, linux-kernel,
Marco Elver, Christoph Hellwig, Steven Rostedt, Nick Desaulniers,
Nathan Chancellor, Kees Cook, Jann Horn, Bart Van Assche,
Kalle Valo, Johannes Berg, linux-wireless
From: Bart Van Assche <bvanassche@acm.org>
cw1200_wow_suspend() must only return with priv->conf_mutex locked if it
returns zero. This mutex must be unlocked if an error is returned. Add
mutex_unlock() calls to the error paths from which that call is missing.
This has been detected by the Clang thread-safety analyzer.
Cc: Kalle Valo <kvalo@codeaurora.org>
Cc: Johannes Berg <johannes@sipsolutions.net>
Cc: linux-wireless@vger.kernel.org
Fixes: a910e4a94f69 ("cw1200: add driver for the ST-E CW1100 & CW1200 WLAN chipsets")
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
---
drivers/net/wireless/st/cw1200/pm.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/net/wireless/st/cw1200/pm.c b/drivers/net/wireless/st/cw1200/pm.c
index 120f0379f81d..84eb15d729c7 100644
--- a/drivers/net/wireless/st/cw1200/pm.c
+++ b/drivers/net/wireless/st/cw1200/pm.c
@@ -264,12 +264,14 @@ int cw1200_wow_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
wiphy_err(priv->hw->wiphy,
"PM request failed: %d. WoW is disabled.\n", ret);
cw1200_wow_resume(hw);
+ mutex_unlock(&priv->conf_mutex);
return -EBUSY;
}
/* Force resume if event is coming from the device. */
if (atomic_read(&priv->bh_rx)) {
cw1200_wow_resume(hw);
+ mutex_unlock(&priv->conf_mutex);
return -EAGAIN;
}
^ permalink raw reply related [flat|nested] 57+ messages in thread* Re: [PATCH 24/62] net/cw1200: Fix locking in error paths
2026-02-23 22:00 ` [PATCH 24/62] net/cw1200: Fix locking in error paths Bart Van Assche
@ 2026-03-02 11:08 ` Johannes Berg
2026-03-02 20:59 ` Bart Van Assche
0 siblings, 1 reply; 57+ messages in thread
From: Johannes Berg @ 2026-03-02 11:08 UTC (permalink / raw)
To: Bart Van Assche, Peter Zijlstra
Cc: Ingo Molnar, Will Deacon, Boqun Feng, Waiman Long, linux-kernel,
Marco Elver, Christoph Hellwig, Steven Rostedt, Nick Desaulniers,
Nathan Chancellor, Kees Cook, Jann Horn, Bart Van Assche,
Kalle Valo, linux-wireless
On Mon, 2026-02-23 at 14:00 -0800, Bart Van Assche wrote:
> From: Bart Van Assche <bvanassche@acm.org>
>
> cw1200_wow_suspend() must only return with priv->conf_mutex locked if it
> returns zero. This mutex must be unlocked if an error is returned. Add
> mutex_unlock() calls to the error paths from which that call is missing.
> This has been detected by the Clang thread-safety analyzer.
>
> Cc: Kalle Valo <kvalo@codeaurora.org>
> Cc: Johannes Berg <johannes@sipsolutions.net>
> Cc: linux-wireless@vger.kernel.org
This, and 25, are part of a larger series and I didn't get a cover
letter, so not sure what's supposed to happen with it.
johannes
^ permalink raw reply [flat|nested] 57+ messages in thread
* Re: [PATCH 24/62] net/cw1200: Fix locking in error paths
2026-03-02 11:08 ` Johannes Berg
@ 2026-03-02 20:59 ` Bart Van Assche
0 siblings, 0 replies; 57+ messages in thread
From: Bart Van Assche @ 2026-03-02 20:59 UTC (permalink / raw)
To: Johannes Berg, Bart Van Assche, Peter Zijlstra
Cc: Ingo Molnar, Will Deacon, Boqun Feng, Waiman Long, linux-kernel,
Marco Elver, Christoph Hellwig, Steven Rostedt, Nick Desaulniers,
Nathan Chancellor, Kees Cook, Jann Horn, Kalle Valo,
linux-wireless
On 3/2/26 3:08 AM, Johannes Berg wrote:
> On Mon, 2026-02-23 at 14:00 -0800, Bart Van Assche wrote:
>> From: Bart Van Assche <bvanassche@acm.org>
>>
>> cw1200_wow_suspend() must only return with priv->conf_mutex locked if it
>> returns zero. This mutex must be unlocked if an error is returned. Add
>> mutex_unlock() calls to the error paths from which that call is missing.
>> This has been detected by the Clang thread-safety analyzer.
>>
>> Cc: Kalle Valo <kvalo@codeaurora.org>
>> Cc: Johannes Berg <johannes@sipsolutions.net>
>> Cc: linux-wireless@vger.kernel.org
>
> This, and 25, are part of a larger series and I didn't get a cover
> letter, so not sure what's supposed to happen with it.
Peter Zijlstra prefers that subsystem maintainers queue these patches as
one can see here:
https://lore.kernel.org/lkml/20260223220117.GT1282955@noisy.programming.kicks-ass.net/
I plan to resend the patches from this series that have not yet been
queued by subsystem maintainers to the respective maintainers.
Thanks,
Bart.
^ permalink raw reply [flat|nested] 57+ messages in thread
* [PATCH 25/62] wlcore: Fix a locking bug
2026-02-23 22:00 [PATCH 00/62] Bug fixes and refactoring patches related to locking Bart Van Assche
` (23 preceding siblings ...)
2026-02-23 22:00 ` [PATCH 24/62] net/cw1200: Fix locking in error paths Bart Van Assche
@ 2026-02-23 22:00 ` Bart Van Assche
2026-02-23 22:00 ` [PATCH 26/62] misc: nsm: Fix a locking bug in an error path Bart Van Assche
` (5 subsequent siblings)
30 siblings, 0 replies; 57+ messages in thread
From: Bart Van Assche @ 2026-02-23 22:00 UTC (permalink / raw)
To: Peter Zijlstra
Cc: Ingo Molnar, Will Deacon, Boqun Feng, Waiman Long, linux-kernel,
Marco Elver, Christoph Hellwig, Steven Rostedt, Nick Desaulniers,
Nathan Chancellor, Kees Cook, Jann Horn, Bart Van Assche,
Johannes Berg, Eyal Reizer, Tony Lindgren, Kalle Valo,
linux-wireless
From: Bart Van Assche <bvanassche@acm.org>
Make sure that wl->mutex is locked before it is unlocked. This has been
detected by the Clang thread-safety analyzer.
Cc: Johannes Berg <johannes@sipsolutions.net>
Cc: Eyal Reizer <eyalr@ti.com>
Cc: Tony Lindgren <tony@atomide.com>
Cc: Kalle Valo <kvalo@codeaurora.org>
Cc: linux-wireless@vger.kernel.org
Fixes: 45aa7f071b06 ("wlcore: Use generic runtime pm calls for wowlan elp configuration")
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
---
drivers/net/wireless/ti/wlcore/main.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/ti/wlcore/main.c b/drivers/net/wireless/ti/wlcore/main.c
index 17dd417756f2..1c340a4a0930 100644
--- a/drivers/net/wireless/ti/wlcore/main.c
+++ b/drivers/net/wireless/ti/wlcore/main.c
@@ -1875,6 +1875,8 @@ static int __maybe_unused wl1271_op_resume(struct ieee80211_hw *hw)
wl->wow_enabled);
WARN_ON(!wl->wow_enabled);
+ mutex_lock(&wl->mutex);
+
ret = pm_runtime_force_resume(wl->dev);
if (ret < 0) {
wl1271_error("ELP wakeup failure!");
@@ -1891,8 +1893,6 @@ static int __maybe_unused wl1271_op_resume(struct ieee80211_hw *hw)
run_irq_work = true;
spin_unlock_irqrestore(&wl->wl_lock, flags);
- mutex_lock(&wl->mutex);
-
/* test the recovery flag before calling any SDIO functions */
pending_recovery = test_bit(WL1271_FLAG_RECOVERY_IN_PROGRESS,
&wl->flags);
^ permalink raw reply related [flat|nested] 57+ messages in thread* [PATCH 26/62] misc: nsm: Fix a locking bug in an error path
2026-02-23 22:00 [PATCH 00/62] Bug fixes and refactoring patches related to locking Bart Van Assche
` (24 preceding siblings ...)
2026-02-23 22:00 ` [PATCH 25/62] wlcore: Fix a locking bug Bart Van Assche
@ 2026-02-23 22:00 ` Bart Van Assche
2026-02-23 22:17 ` Alexander Graf
2026-02-23 22:00 ` [PATCH 27/62] pci: Fix locking in pci_do_resource_release_and_resize() error paths Bart Van Assche
` (4 subsequent siblings)
30 siblings, 1 reply; 57+ messages in thread
From: Bart Van Assche @ 2026-02-23 22:00 UTC (permalink / raw)
To: Peter Zijlstra
Cc: Ingo Molnar, Will Deacon, Boqun Feng, Waiman Long, linux-kernel,
Marco Elver, Christoph Hellwig, Steven Rostedt, Nick Desaulniers,
Nathan Chancellor, Kees Cook, Jann Horn, Bart Van Assche,
Krzysztof Kozlowski, Michael S. Tsirkin, Alexander Graf,
The AWS Nitro Enclaves Team
From: Bart Van Assche <bvanassche@acm.org>
If nsm->lock has not been locked, do not unlock it from any error path.
This bug has been detected by the Clang thread-safety analyzer.
Cc: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Cc: Michael S. Tsirkin <mst@redhat.com>
Cc: Alexander Graf <graf@amazon.com>
Cc: The AWS Nitro Enclaves Team <aws-nitro-enclaves-devel@amazon.com>
Cc: linux-kernel@vger.kernel.org
Fixes: b9873755a6c8 ("misc: Add Nitro Secure Module driver")
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
---
drivers/misc/nsm.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/misc/nsm.c b/drivers/misc/nsm.c
index ef7b32742340..185900cdad4a 100644
--- a/drivers/misc/nsm.c
+++ b/drivers/misc/nsm.c
@@ -367,7 +367,7 @@ static long nsm_dev_ioctl(struct file *file, unsigned int cmd,
/* Copy user argument struct to kernel argument struct */
r = -EFAULT;
if (copy_from_user(&raw, argp, _IOC_SIZE(cmd)))
- goto out;
+ return r;
mutex_lock(&nsm->lock);
^ permalink raw reply related [flat|nested] 57+ messages in thread* Re: [PATCH 26/62] misc: nsm: Fix a locking bug in an error path
2026-02-23 22:00 ` [PATCH 26/62] misc: nsm: Fix a locking bug in an error path Bart Van Assche
@ 2026-02-23 22:17 ` Alexander Graf
0 siblings, 0 replies; 57+ messages in thread
From: Alexander Graf @ 2026-02-23 22:17 UTC (permalink / raw)
To: Bart Van Assche, Peter Zijlstra
Cc: Ingo Molnar, Will Deacon, Boqun Feng, Waiman Long, linux-kernel,
Marco Elver, Christoph Hellwig, Steven Rostedt, Nick Desaulniers,
Nathan Chancellor, Kees Cook, Jann Horn, Bart Van Assche,
Krzysztof Kozlowski, Michael S. Tsirkin,
The AWS Nitro Enclaves Team
On 23.02.26 23:00, Bart Van Assche wrote:
> From: Bart Van Assche <bvanassche@acm.org>
>
> If nsm->lock has not been locked, do not unlock it from any error path.
> This bug has been detected by the Clang thread-safety analyzer.
>
> Cc: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> Cc: Michael S. Tsirkin <mst@redhat.com>
> Cc: Alexander Graf <graf@amazon.com>
> Cc: The AWS Nitro Enclaves Team <aws-nitro-enclaves-devel@amazon.com>
> Cc: linux-kernel@vger.kernel.org
> Fixes: b9873755a6c8 ("misc: Add Nitro Secure Module driver")
> Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Thanks for catching this!
Reviewed-by: Alexander Graf <graf@amazon.com>
Alex
Amazon Web Services Development Center Germany GmbH
Tamara-Danz-Str. 13
10243 Berlin
Geschaeftsfuehrung: Christof Hellmis, Andreas Stieger
Eingetragen am Amtsgericht Charlottenburg unter HRB 257764 B
Sitz: Berlin
Ust-ID: DE 365 538 597
^ permalink raw reply [flat|nested] 57+ messages in thread
* [PATCH 27/62] pci: Fix locking in pci_do_resource_release_and_resize() error paths
2026-02-23 22:00 [PATCH 00/62] Bug fixes and refactoring patches related to locking Bart Van Assche
` (25 preceding siblings ...)
2026-02-23 22:00 ` [PATCH 26/62] misc: nsm: Fix a locking bug in an error path Bart Van Assche
@ 2026-02-23 22:00 ` Bart Van Assche
2026-02-24 8:21 ` Ilpo Järvinen
2026-02-23 22:00 ` [PATCH 28/62] PNP: isapnp: Check the isapnp_cfg_begin() return value Bart Van Assche
` (3 subsequent siblings)
30 siblings, 1 reply; 57+ messages in thread
From: Bart Van Assche @ 2026-02-23 22:00 UTC (permalink / raw)
To: Peter Zijlstra
Cc: Ingo Molnar, Will Deacon, Boqun Feng, Waiman Long, linux-kernel,
Marco Elver, Christoph Hellwig, Steven Rostedt, Nick Desaulniers,
Nathan Chancellor, Kees Cook, Jann Horn, Bart Van Assche,
Bjorn Helgaas, Ilpo Järvinen, linux-pci
From: Bart Van Assche <bvanassche@acm.org>
Make sure that down(&pci_bus_sem) has been called before
up(&pci_bus_sem) is called. This has been detected by the Clang
thread-safety analyzer. Compile-tested only.
Cc: Bjorn Helgaas <bhelgaas@google.com>
Cc: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Cc: linux-pci@vger.kernel.org
Fixes: 337b1b566db0 ("PCI: Fix restoring BARs on BAR resize rollback path")
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
---
drivers/pci/setup-bus.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/pci/setup-bus.c b/drivers/pci/setup-bus.c
index 61f769aaa2f6..3bb8cd9a581e 100644
--- a/drivers/pci/setup-bus.c
+++ b/drivers/pci/setup-bus.c
@@ -2346,6 +2346,7 @@ int pci_do_resource_release_and_resize(struct pci_dev *pdev, int resno, int size
if (ret)
return ret;
+ down_read(&pci_bus_sem);
pci_dev_for_each_resource(pdev, r, i) {
if (i >= PCI_BRIDGE_RESOURCES)
break;
@@ -2367,7 +2368,6 @@ int pci_do_resource_release_and_resize(struct pci_dev *pdev, int resno, int size
if (!bus->self)
goto out;
- down_read(&pci_bus_sem);
ret = pbus_reassign_bridge_resources(bus, res, &saved);
if (ret)
goto restore;
^ permalink raw reply related [flat|nested] 57+ messages in thread* Re: [PATCH 27/62] pci: Fix locking in pci_do_resource_release_and_resize() error paths
2026-02-23 22:00 ` [PATCH 27/62] pci: Fix locking in pci_do_resource_release_and_resize() error paths Bart Van Assche
@ 2026-02-24 8:21 ` Ilpo Järvinen
0 siblings, 0 replies; 57+ messages in thread
From: Ilpo Järvinen @ 2026-02-24 8:21 UTC (permalink / raw)
To: Bart Van Assche
Cc: Peter Zijlstra, Ingo Molnar, Will Deacon, Boqun Feng, Waiman Long,
LKML, Marco Elver, Christoph Hellwig, Steven Rostedt,
Nick Desaulniers, Nathan Chancellor, Kees Cook, Jann Horn,
Bart Van Assche, Bjorn Helgaas, linux-pci
[-- Attachment #1: Type: text/plain, Size: 1719 bytes --]
On Mon, 23 Feb 2026, Bart Van Assche wrote:
> From: Bart Van Assche <bvanassche@acm.org>
>
> Make sure that down(&pci_bus_sem) has been called before
> up(&pci_bus_sem) is called.
Before explaining the solution, it would be useful to mention how this
problem can manifest itself (taking one of the early gotos).
> This has been detected by the Clang
> thread-safety analyzer. Compile-tested only.
>
> Cc: Bjorn Helgaas <bhelgaas@google.com>
> Cc: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
> Cc: linux-pci@vger.kernel.org
These (obvious) Ccs are not needed in the commit message, if your workflow
requires having them, please place them below the --- line so that the
maintainer's tools remove them while applying the patch.
> Fixes: 337b1b566db0 ("PCI: Fix restoring BARs on BAR resize rollback path")
> Signed-off-by: Bart Van Assche <bvanassche@acm.org>
> ---
> drivers/pci/setup-bus.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/pci/setup-bus.c b/drivers/pci/setup-bus.c
> index 61f769aaa2f6..3bb8cd9a581e 100644
> --- a/drivers/pci/setup-bus.c
> +++ b/drivers/pci/setup-bus.c
> @@ -2346,6 +2346,7 @@ int pci_do_resource_release_and_resize(struct pci_dev *pdev, int resno, int size
> if (ret)
> return ret;
>
> + down_read(&pci_bus_sem);
> pci_dev_for_each_resource(pdev, r, i) {
> if (i >= PCI_BRIDGE_RESOURCES)
> break;
> @@ -2367,7 +2368,6 @@ int pci_do_resource_release_and_resize(struct pci_dev *pdev, int resno, int size
> if (!bus->self)
> goto out;
>
> - down_read(&pci_bus_sem);
> ret = pbus_reassign_bridge_resources(bus, res, &saved);
> if (ret)
> goto restore;
--
i.
^ permalink raw reply [flat|nested] 57+ messages in thread
* [PATCH 28/62] PNP: isapnp: Check the isapnp_cfg_begin() return value
2026-02-23 22:00 [PATCH 00/62] Bug fixes and refactoring patches related to locking Bart Van Assche
` (26 preceding siblings ...)
2026-02-23 22:00 ` [PATCH 27/62] pci: Fix locking in pci_do_resource_release_and_resize() error paths Bart Van Assche
@ 2026-02-23 22:00 ` Bart Van Assche
2026-02-24 12:17 ` Rafael J. Wysocki
2026-02-23 22:00 ` [PATCH 29/62] fnic: Make fnic_queuecommand() easier to analyze Bart Van Assche
` (2 subsequent siblings)
30 siblings, 1 reply; 57+ messages in thread
From: Bart Van Assche @ 2026-02-23 22:00 UTC (permalink / raw)
To: Peter Zijlstra
Cc: Ingo Molnar, Will Deacon, Boqun Feng, Waiman Long, linux-kernel,
Marco Elver, Christoph Hellwig, Steven Rostedt, Nick Desaulniers,
Nathan Chancellor, Kees Cook, Jann Horn, Bart Van Assche,
Jaroslav Kysela, Adam Belay, Rafael J. Wysocki, linux-acpi
From: Bart Van Assche <bvanassche@acm.org>
Instead of ignoring isapnp_cfg_begin() failures, propagate the value
returned by this function in case of a failure. This patch prepares
for enabling thread-safety analysis since isapnp_cfg_begin() only locks
a particular mutex if it returns zero.
Cc: Jaroslav Kysela <perex@perex.cz>
Cc: Adam Belay <ambx1@neo.rr.com>
Cc: Rafael J. Wysocki <rafael@kernel.org>
Cc: linux-acpi@vger.kernel.org
Fixes: f72e5c5c861c ("[PATCH] PnP Rewrite V0.9 - 2.5.43")
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
---
drivers/pnp/isapnp/core.c | 16 ++++++++++++----
1 file changed, 12 insertions(+), 4 deletions(-)
diff --git a/drivers/pnp/isapnp/core.c b/drivers/pnp/isapnp/core.c
index 219f96f2aaaf..3591a2791c1a 100644
--- a/drivers/pnp/isapnp/core.c
+++ b/drivers/pnp/isapnp/core.c
@@ -853,7 +853,9 @@ static int isapnp_get_resources(struct pnp_dev *dev)
pnp_dbg(&dev->dev, "get resources\n");
pnp_init_resources(dev);
- isapnp_cfg_begin(dev->card->number, dev->number);
+ ret = isapnp_cfg_begin(dev->card->number, dev->number);
+ if (ret)
+ return ret;
dev->active = isapnp_read_byte(ISAPNP_CFG_ACTIVATE);
if (!dev->active)
goto __end;
@@ -887,10 +889,12 @@ static int isapnp_get_resources(struct pnp_dev *dev)
static int isapnp_set_resources(struct pnp_dev *dev)
{
struct resource *res;
- int tmp;
+ int tmp, ret;
pnp_dbg(&dev->dev, "set resources\n");
- isapnp_cfg_begin(dev->card->number, dev->number);
+ ret = isapnp_cfg_begin(dev->card->number, dev->number);
+ if (ret)
+ return ret;
dev->active = 1;
for (tmp = 0; tmp < ISAPNP_MAX_PORT; tmp++) {
res = pnp_get_resource(dev, IORESOURCE_IO, tmp);
@@ -936,9 +940,13 @@ static int isapnp_set_resources(struct pnp_dev *dev)
static int isapnp_disable_resources(struct pnp_dev *dev)
{
+ int ret;
+
if (!dev->active)
return -EINVAL;
- isapnp_cfg_begin(dev->card->number, dev->number);
+ ret = isapnp_cfg_begin(dev->card->number, dev->number);
+ if (ret)
+ return ret;
isapnp_deactivate(dev->number);
dev->active = 0;
isapnp_cfg_end();
^ permalink raw reply related [flat|nested] 57+ messages in thread* Re: [PATCH 28/62] PNP: isapnp: Check the isapnp_cfg_begin() return value
2026-02-23 22:00 ` [PATCH 28/62] PNP: isapnp: Check the isapnp_cfg_begin() return value Bart Van Assche
@ 2026-02-24 12:17 ` Rafael J. Wysocki
0 siblings, 0 replies; 57+ messages in thread
From: Rafael J. Wysocki @ 2026-02-24 12:17 UTC (permalink / raw)
To: Bart Van Assche
Cc: Peter Zijlstra, Ingo Molnar, Will Deacon, Boqun Feng, Waiman Long,
linux-kernel, Marco Elver, Christoph Hellwig, Steven Rostedt,
Nick Desaulniers, Nathan Chancellor, Kees Cook, Jann Horn,
Bart Van Assche, Jaroslav Kysela, Adam Belay, Rafael J. Wysocki,
linux-acpi
On Mon, Feb 23, 2026 at 11:03 PM Bart Van Assche
<bart.vanassche@linux.dev> wrote:
>
> From: Bart Van Assche <bvanassche@acm.org>
>
> Instead of ignoring isapnp_cfg_begin() failures, propagate the value
> returned by this function in case of a failure. This patch prepares
> for enabling thread-safety analysis since isapnp_cfg_begin() only locks
> a particular mutex if it returns zero.
>
> Cc: Jaroslav Kysela <perex@perex.cz>
> Cc: Adam Belay <ambx1@neo.rr.com>
> Cc: Rafael J. Wysocki <rafael@kernel.org>
> Cc: linux-acpi@vger.kernel.org
> Fixes: f72e5c5c861c ("[PATCH] PnP Rewrite V0.9 - 2.5.43")
> Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Acked-by: Rafael J. Wysocki (Intel) <rafael@kernel.org>
> ---
> drivers/pnp/isapnp/core.c | 16 ++++++++++++----
> 1 file changed, 12 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/pnp/isapnp/core.c b/drivers/pnp/isapnp/core.c
> index 219f96f2aaaf..3591a2791c1a 100644
> --- a/drivers/pnp/isapnp/core.c
> +++ b/drivers/pnp/isapnp/core.c
> @@ -853,7 +853,9 @@ static int isapnp_get_resources(struct pnp_dev *dev)
>
> pnp_dbg(&dev->dev, "get resources\n");
> pnp_init_resources(dev);
> - isapnp_cfg_begin(dev->card->number, dev->number);
> + ret = isapnp_cfg_begin(dev->card->number, dev->number);
> + if (ret)
> + return ret;
> dev->active = isapnp_read_byte(ISAPNP_CFG_ACTIVATE);
> if (!dev->active)
> goto __end;
> @@ -887,10 +889,12 @@ static int isapnp_get_resources(struct pnp_dev *dev)
> static int isapnp_set_resources(struct pnp_dev *dev)
> {
> struct resource *res;
> - int tmp;
> + int tmp, ret;
>
> pnp_dbg(&dev->dev, "set resources\n");
> - isapnp_cfg_begin(dev->card->number, dev->number);
> + ret = isapnp_cfg_begin(dev->card->number, dev->number);
> + if (ret)
> + return ret;
> dev->active = 1;
> for (tmp = 0; tmp < ISAPNP_MAX_PORT; tmp++) {
> res = pnp_get_resource(dev, IORESOURCE_IO, tmp);
> @@ -936,9 +940,13 @@ static int isapnp_set_resources(struct pnp_dev *dev)
>
> static int isapnp_disable_resources(struct pnp_dev *dev)
> {
> + int ret;
> +
> if (!dev->active)
> return -EINVAL;
> - isapnp_cfg_begin(dev->card->number, dev->number);
> + ret = isapnp_cfg_begin(dev->card->number, dev->number);
> + if (ret)
> + return ret;
> isapnp_deactivate(dev->number);
> dev->active = 0;
> isapnp_cfg_end();
^ permalink raw reply [flat|nested] 57+ messages in thread
* [PATCH 29/62] fnic: Make fnic_queuecommand() easier to analyze
2026-02-23 22:00 [PATCH 00/62] Bug fixes and refactoring patches related to locking Bart Van Assche
` (27 preceding siblings ...)
2026-02-23 22:00 ` [PATCH 28/62] PNP: isapnp: Check the isapnp_cfg_begin() return value Bart Van Assche
@ 2026-02-23 22:00 ` Bart Van Assche
2026-02-24 19:31 ` Karan Tilak Kumar (kartilak)
2026-02-24 21:43 ` Martin K. Petersen
2026-02-23 22:00 ` [PATCH 30/62] megaraid: Protect more code with instance->reset_mutex Bart Van Assche
2026-02-28 22:22 ` (subset) [PATCH 00/62] Bug fixes and refactoring patches related to locking Martin K. Petersen
30 siblings, 2 replies; 57+ messages in thread
From: Bart Van Assche @ 2026-02-23 22:00 UTC (permalink / raw)
To: Peter Zijlstra
Cc: Ingo Molnar, Will Deacon, Boqun Feng, Waiman Long, linux-kernel,
Marco Elver, Christoph Hellwig, Steven Rostedt, Nick Desaulniers,
Nathan Chancellor, Kees Cook, Jann Horn, Bart Van Assche,
Satish Kharat, Sesidhar Baddela, Karan Tilak Kumar,
James E.J. Bottomley, Martin K. Petersen, linux-scsi
From: Bart Van Assche <bvanassche@acm.org>
Move a spin_unlock_irqrestore() call such that the io_lock_acquired
variable can be eliminated. This patch prepares for enabling the Clang
thread-safety analyzer.
Cc: Satish Kharat <satishkh@cisco.com>
Cc: Sesidhar Baddela <sebaddel@cisco.com>
Cc: Karan Tilak Kumar <kartilak@cisco.com>
Cc: James E.J. Bottomley <James.Bottomley@HansenPartnership.com>
Cc: Martin K. Petersen <martin.petersen@oracle.com>
Cc: linux-scsi@vger.kernel.org
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
---
drivers/scsi/fnic/fnic_scsi.c | 9 +++------
1 file changed, 3 insertions(+), 6 deletions(-)
diff --git a/drivers/scsi/fnic/fnic_scsi.c b/drivers/scsi/fnic/fnic_scsi.c
index 29d7aca06958..f47c92dfbfd0 100644
--- a/drivers/scsi/fnic/fnic_scsi.c
+++ b/drivers/scsi/fnic/fnic_scsi.c
@@ -471,7 +471,6 @@ enum scsi_qc_status fnic_queuecommand(struct Scsi_Host *shost,
int sg_count = 0;
unsigned long flags = 0;
unsigned long ptr;
- int io_lock_acquired = 0;
uint16_t hwq = 0;
struct fnic_tport_s *tport = NULL;
struct rport_dd_data_s *rdd_data;
@@ -636,7 +635,6 @@ enum scsi_qc_status fnic_queuecommand(struct Scsi_Host *shost,
spin_lock_irqsave(&fnic->wq_copy_lock[hwq], flags);
/* initialize rest of io_req */
- io_lock_acquired = 1;
io_req->port_id = rport->port_id;
io_req->start_time = jiffies;
fnic_priv(sc)->state = FNIC_IOREQ_CMD_PENDING;
@@ -689,6 +687,9 @@ enum scsi_qc_status fnic_queuecommand(struct Scsi_Host *shost,
/* REVISIT: Use per IO lock in the final code */
fnic_priv(sc)->flags |= FNIC_IO_ISSUED;
}
+
+ spin_unlock_irqrestore(&fnic->wq_copy_lock[hwq], flags);
+
out:
cmd_trace = ((u64)sc->cmnd[0] << 56 | (u64)sc->cmnd[7] << 40 |
(u64)sc->cmnd[8] << 32 | (u64)sc->cmnd[2] << 24 |
@@ -699,10 +700,6 @@ enum scsi_qc_status fnic_queuecommand(struct Scsi_Host *shost,
mqtag, sc, io_req, sg_count, cmd_trace,
fnic_flags_and_state(sc));
- /* if only we issued IO, will we have the io lock */
- if (io_lock_acquired)
- spin_unlock_irqrestore(&fnic->wq_copy_lock[hwq], flags);
-
atomic_dec(&fnic->in_flight);
atomic_dec(&tport->in_flight);
^ permalink raw reply related [flat|nested] 57+ messages in thread* RE: [PATCH 29/62] fnic: Make fnic_queuecommand() easier to analyze
2026-02-23 22:00 ` [PATCH 29/62] fnic: Make fnic_queuecommand() easier to analyze Bart Van Assche
@ 2026-02-24 19:31 ` Karan Tilak Kumar (kartilak)
2026-02-24 21:43 ` Martin K. Petersen
1 sibling, 0 replies; 57+ messages in thread
From: Karan Tilak Kumar (kartilak) @ 2026-02-24 19:31 UTC (permalink / raw)
To: Bart Van Assche, Peter Zijlstra
Cc: Ingo Molnar, Will Deacon, Boqun Feng, Waiman Long,
linux-kernel@vger.kernel.org, Marco Elver, Christoph Hellwig,
Steven Rostedt, Nick Desaulniers, Nathan Chancellor, Kees Cook,
Jann Horn, Bart Van Assche, Satish Kharat (satishkh),
Sesidhar Baddela (sebaddel), James E.J. Bottomley,
Martin K. Petersen, linux-scsi@vger.kernel.org
On Monday, February 23, 2026 2:00 PM, Bart Van Assche <bart.vanassche@linux.dev> wrote:
>
>
> Move a spin_unlock_irqrestore() call such that the io_lock_acquired
> variable can be eliminated. This patch prepares for enabling the Clang
> thread-safety analyzer.
>
> Cc: Satish Kharat <satishkh@cisco.com>
> Cc: Sesidhar Baddela <sebaddel@cisco.com>
> Cc: Karan Tilak Kumar <kartilak@cisco.com>
> Cc: James E.J. Bottomley <James.Bottomley@HansenPartnership.com>
> Cc: Martin K. Petersen <martin.petersen@oracle.com>
> Cc: linux-scsi@vger.kernel.org
> Signed-off-by: Bart Van Assche <bvanassche@acm.org>
> ---
> drivers/scsi/fnic/fnic_scsi.c | 9 +++------
> 1 file changed, 3 insertions(+), 6 deletions(-)
>
> diff --git a/drivers/scsi/fnic/fnic_scsi.c b/drivers/scsi/fnic/fnic_scsi.c
> index 29d7aca06958..f47c92dfbfd0 100644
> --- a/drivers/scsi/fnic/fnic_scsi.c
> +++ b/drivers/scsi/fnic/fnic_scsi.c
> @@ -471,7 +471,6 @@ enum scsi_qc_status fnic_queuecommand(struct Scsi_Host *shost,
> int sg_count = 0;
> unsigned long flags = 0;
> unsigned long ptr;
> - int io_lock_acquired = 0;
> uint16_t hwq = 0;
> struct fnic_tport_s *tport = NULL;
> struct rport_dd_data_s *rdd_data;
> @@ -636,7 +635,6 @@ enum scsi_qc_status fnic_queuecommand(struct Scsi_Host *shost,
> spin_lock_irqsave(&fnic->wq_copy_lock[hwq], flags);
>
> /* initialize rest of io_req */
> - io_lock_acquired = 1;
> io_req->port_id = rport->port_id;
> io_req->start_time = jiffies;
> fnic_priv(sc)->state = FNIC_IOREQ_CMD_PENDING;
> @@ -689,6 +687,9 @@ enum scsi_qc_status fnic_queuecommand(struct Scsi_Host *shost,
> /* REVISIT: Use per IO lock in the final code */
> fnic_priv(sc)->flags |= FNIC_IO_ISSUED;
> }
> +
> + spin_unlock_irqrestore(&fnic->wq_copy_lock[hwq], flags);
> +
> out:
> cmd_trace = ((u64)sc->cmnd[0] << 56 | (u64)sc->cmnd[7] << 40 |
> (u64)sc->cmnd[8] << 32 | (u64)sc->cmnd[2] << 24 |
> @@ -699,10 +700,6 @@ enum scsi_qc_status fnic_queuecommand(struct Scsi_Host *shost,
> mqtag, sc, io_req, sg_count, cmd_trace,
> fnic_flags_and_state(sc));
>
> - /* if only we issued IO, will we have the io lock */
> - if (io_lock_acquired)
> - spin_unlock_irqrestore(&fnic->wq_copy_lock[hwq], flags);
> -
> atomic_dec(&fnic->in_flight);
> atomic_dec(&tport->in_flight);
>
>
Thanks for this change, Bart.
Reviewed-by: Karan Tilak Kumar <kartilak@cisco.com>
Regards,
Karan
^ permalink raw reply [flat|nested] 57+ messages in thread
* Re: [PATCH 29/62] fnic: Make fnic_queuecommand() easier to analyze
2026-02-23 22:00 ` [PATCH 29/62] fnic: Make fnic_queuecommand() easier to analyze Bart Van Assche
2026-02-24 19:31 ` Karan Tilak Kumar (kartilak)
@ 2026-02-24 21:43 ` Martin K. Petersen
1 sibling, 0 replies; 57+ messages in thread
From: Martin K. Petersen @ 2026-02-24 21:43 UTC (permalink / raw)
To: Bart Van Assche
Cc: Peter Zijlstra, Ingo Molnar, Will Deacon, Boqun Feng, Waiman Long,
linux-kernel, Marco Elver, Christoph Hellwig, Steven Rostedt,
Nick Desaulniers, Nathan Chancellor, Kees Cook, Jann Horn,
Bart Van Assche, Satish Kharat, Sesidhar Baddela,
Karan Tilak Kumar, James E.J. Bottomley, Martin K. Petersen,
linux-scsi
Bart,
> Move a spin_unlock_irqrestore() call such that the io_lock_acquired
> variable can be eliminated. This patch prepares for enabling the Clang
> thread-safety analyzer.
Applied to 7.1/scsi-staging, thanks!
--
Martin K. Petersen
^ permalink raw reply [flat|nested] 57+ messages in thread
* [PATCH 30/62] megaraid: Protect more code with instance->reset_mutex
2026-02-23 22:00 [PATCH 00/62] Bug fixes and refactoring patches related to locking Bart Van Assche
` (28 preceding siblings ...)
2026-02-23 22:00 ` [PATCH 29/62] fnic: Make fnic_queuecommand() easier to analyze Bart Van Assche
@ 2026-02-23 22:00 ` Bart Van Assche
2026-02-28 22:22 ` (subset) [PATCH 00/62] Bug fixes and refactoring patches related to locking Martin K. Petersen
30 siblings, 0 replies; 57+ messages in thread
From: Bart Van Assche @ 2026-02-23 22:00 UTC (permalink / raw)
To: Peter Zijlstra
Cc: Ingo Molnar, Will Deacon, Boqun Feng, Waiman Long, linux-kernel,
Marco Elver, Christoph Hellwig, Steven Rostedt, Nick Desaulniers,
Nathan Chancellor, Kees Cook, Jann Horn, Bart Van Assche,
Kashyap Desai, Sumit Saxena, Shivasharan S, Chandrakanth patil,
James E.J. Bottomley, Martin K. Petersen, megaraidlinux.pdl,
linux-scsi
From: Bart Van Assche <bvanassche@acm.org>
megasas_get_device_list() and megasas_get_snapdump_properties() may
unlock instance->reset_mutex indirectly. Hence, hold reset_mutex while
calling these functions.
Cc: Kashyap Desai <kashyap.desai@broadcom.com>
Cc: Sumit Saxena <sumit.saxena@broadcom.com>
Cc: Shivasharan S <shivasharan.srikanteshwara@broadcom.com>
Cc: Chandrakanth patil <chandrakanth.patil@broadcom.com>
Cc: James E.J. Bottomley <James.Bottomley@HansenPartnership.com>
Cc: Martin K. Petersen <martin.petersen@oracle.com>
Cc: megaraidlinux.pdl@broadcom.com
Cc: linux-scsi@vger.kernel.org
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
---
drivers/scsi/megaraid/megaraid_sas_base.c | 15 +++++++++------
1 file changed, 9 insertions(+), 6 deletions(-)
diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
index ac71ea4898b2..ecd365d78ae3 100644
--- a/drivers/scsi/megaraid/megaraid_sas_base.c
+++ b/drivers/scsi/megaraid/megaraid_sas_base.c
@@ -6365,11 +6365,13 @@ static int megasas_init_fw(struct megasas_instance *instance)
megasas_setup_jbod_map(instance);
- if (megasas_get_device_list(instance) != SUCCESS) {
- dev_err(&instance->pdev->dev,
- "%s: megasas_get_device_list failed\n",
- __func__);
- goto fail_get_ld_pd_list;
+ scoped_guard(mutex, &instance->reset_mutex) {
+ if (megasas_get_device_list(instance) != SUCCESS) {
+ dev_err(&instance->pdev->dev,
+ "%s: megasas_get_device_list failed\n",
+ __func__);
+ goto fail_get_ld_pd_list;
+ }
}
/* stream detection initialization */
@@ -6468,7 +6470,8 @@ static int megasas_init_fw(struct megasas_instance *instance)
}
if (instance->snapdump_wait_time) {
- megasas_get_snapdump_properties(instance);
+ scoped_guard(mutex, &instance->reset_mutex)
+ megasas_get_snapdump_properties(instance);
dev_info(&instance->pdev->dev, "Snap dump wait time\t: %d\n",
instance->snapdump_wait_time);
}
^ permalink raw reply related [flat|nested] 57+ messages in thread* Re: (subset) [PATCH 00/62] Bug fixes and refactoring patches related to locking
2026-02-23 22:00 [PATCH 00/62] Bug fixes and refactoring patches related to locking Bart Van Assche
` (29 preceding siblings ...)
2026-02-23 22:00 ` [PATCH 30/62] megaraid: Protect more code with instance->reset_mutex Bart Van Assche
@ 2026-02-28 22:22 ` Martin K. Petersen
2026-03-01 2:16 ` Martin K. Petersen
30 siblings, 1 reply; 57+ messages in thread
From: Martin K. Petersen @ 2026-02-28 22:22 UTC (permalink / raw)
To: Peter Zijlstra, Bart Van Assche
Cc: Martin K . Petersen, Ingo Molnar, Will Deacon, Boqun Feng,
Waiman Long, linux-kernel, Marco Elver, Christoph Hellwig,
Steven Rostedt, Nathan Chancellor, Kees Cook, Jann Horn,
Bart Van Assche, Nick Desaulniers
On Mon, 23 Feb 2026 14:00:00 -0800, Bart Van Assche wrote:
> Annotating all source files in the kernel tree with lock context annotations
> led to the discovery of a significant number of locking bugs. This patch
> series includes fixes for the discovered bugs. Additionally, multiple
> refactoring patches have been included that make it easier for the compiler
> to verify correctness of locking operations. Please consider this patch series
> for the next merge window.
>
> [...]
Applied to 7.1/scsi-queue, thanks!
[30/62] megaraid: Protect more code with instance->reset_mutex
https://git.kernel.org/mkp/scsi/c/e521b7768836
--
Martin K. Petersen
^ permalink raw reply [flat|nested] 57+ messages in thread* Re: (subset) [PATCH 00/62] Bug fixes and refactoring patches related to locking
2026-02-28 22:22 ` (subset) [PATCH 00/62] Bug fixes and refactoring patches related to locking Martin K. Petersen
@ 2026-03-01 2:16 ` Martin K. Petersen
0 siblings, 0 replies; 57+ messages in thread
From: Martin K. Petersen @ 2026-03-01 2:16 UTC (permalink / raw)
To: Peter Zijlstra, Bart Van Assche
Cc: Martin K . Petersen, Ingo Molnar, Will Deacon, Boqun Feng,
Waiman Long, linux-kernel, Marco Elver, Christoph Hellwig,
Steven Rostedt, Nathan Chancellor, Kees Cook, Jann Horn,
Bart Van Assche, Nick Desaulniers
On Mon, 23 Feb 2026 14:00:00 -0800, Bart Van Assche wrote:
> Annotating all source files in the kernel tree with lock context annotations
> led to the discovery of a significant number of locking bugs. This patch
> series includes fixes for the discovered bugs. Additionally, multiple
> refactoring patches have been included that make it easier for the compiler
> to verify correctness of locking operations. Please consider this patch series
> for the next merge window.
>
> [...]
Applied to 7.1/scsi-queue, thanks!
[30/62] megaraid: Protect more code with instance->reset_mutex
https://git.kernel.org/mkp/scsi/c/e521b7768836
--
Martin K. Petersen
^ permalink raw reply [flat|nested] 57+ messages in thread