* [PATCH] regmap: debugfs: fix race condition in dummy name allocation @ 2026-04-08 13:11 Zxyan Zhu 2026-04-08 13:33 ` Greg KH 0 siblings, 1 reply; 6+ messages in thread From: Zxyan Zhu @ 2026-04-08 13:11 UTC (permalink / raw) To: Mark Brown; +Cc: linux-kernel, gregkh, Zxyan Zhu Use IDA instead of a simple counter for generating unique dummy names. The previous implementation used dummy_index++ which is not atomic, leading to potential duplicate names when multiple threads call regmap_debugfs_init() concurrently with name="dummy". --- drivers/base/regmap/internal.h | 1 + drivers/base/regmap/regmap-debugfs.c | 21 ++++++++++++++++----- 2 files changed, 17 insertions(+), 5 deletions(-) diff --git a/drivers/base/regmap/internal.h b/drivers/base/regmap/internal.h index 5bf993165438..e067890866c1 100644 --- a/drivers/base/regmap/internal.h +++ b/drivers/base/regmap/internal.h @@ -84,6 +84,7 @@ struct regmap { bool debugfs_disable; struct dentry *debugfs; const char *debugfs_name; + int debugfs_dummy_id; unsigned int debugfs_reg_len; unsigned int debugfs_val_len; diff --git a/drivers/base/regmap/regmap-debugfs.c b/drivers/base/regmap/regmap-debugfs.c index 5a46ce5fee72..18f1c60749fe 100644 --- a/drivers/base/regmap/regmap-debugfs.c +++ b/drivers/base/regmap/regmap-debugfs.c @@ -12,6 +12,7 @@ #include <linux/uaccess.h> #include <linux/device.h> #include <linux/list.h> +#include <linux/idr.h> #include "internal.h" @@ -20,7 +21,7 @@ struct regmap_debugfs_node { struct list_head link; }; -static unsigned int dummy_index; +static DEFINE_IDA(dummy_ida); static struct dentry *regmap_debugfs_root; static LIST_HEAD(regmap_debugfs_early_list); static DEFINE_MUTEX(regmap_debugfs_early_lock); @@ -539,6 +540,7 @@ void regmap_debugfs_init(struct regmap *map) struct regmap_range_node *range_node; const char *devname = "dummy"; const char *name = map->name; + int id; /* * Userspace can initiate reads from the hardware over debugfs. @@ -567,6 +569,7 @@ void regmap_debugfs_init(struct regmap *map) INIT_LIST_HEAD(&map->debugfs_off_cache); mutex_init(&map->cache_lock); + map->debugfs_dummy_id = -1; if (map->dev) devname = dev_name(map->dev); @@ -585,12 +588,16 @@ void regmap_debugfs_init(struct regmap *map) if (!strcmp(name, "dummy")) { kfree(map->debugfs_name); - map->debugfs_name = kasprintf(GFP_KERNEL, "dummy%d", - dummy_index); - if (!map->debugfs_name) + id = ida_alloc(&dummy_ida, GFP_KERNEL); + if (id < 0) return; + map->debugfs_name = kasprintf(GFP_KERNEL, "dummy%d", id); + if (!map->debugfs_name) { + ida_free(&dummy_ida, id); + return; + } + map->debugfs_dummy_id = id; name = map->debugfs_name; - dummy_index++; } map->debugfs = debugfs_create_dir(name, regmap_debugfs_root); @@ -660,6 +667,10 @@ void regmap_debugfs_exit(struct regmap *map) mutex_lock(&map->cache_lock); regmap_debugfs_free_dump_cache(map); mutex_unlock(&map->cache_lock); + if (map->debugfs_dummy_id >= 0) { + ida_free(&dummy_ida, map->debugfs_dummy_id); + map->debugfs_dummy_id = -1; + } kfree(map->debugfs_name); map->debugfs_name = NULL; } else { -- 2.34.1 ^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH] regmap: debugfs: fix race condition in dummy name allocation 2026-04-08 13:11 [PATCH] regmap: debugfs: fix race condition in dummy name allocation Zxyan Zhu @ 2026-04-08 13:33 ` Greg KH 2026-04-09 3:50 ` [PATCH v2] " Zxyan Zhu 2026-04-09 6:10 ` [PATCH] " zhu xin 0 siblings, 2 replies; 6+ messages in thread From: Greg KH @ 2026-04-08 13:33 UTC (permalink / raw) To: Zxyan Zhu; +Cc: Mark Brown, linux-kernel On Wed, Apr 08, 2026 at 09:11:55PM +0800, Zxyan Zhu wrote: > Use IDA instead of a simple counter for generating unique dummy names. > The previous implementation used dummy_index++ which is not atomic, > leading to potential duplicate names when multiple threads call > regmap_debugfs_init() concurrently with name="dummy". What code does that? Why not fix that? Also, you did not sign off on this, so it can't be taken, sorry. greg k-h ^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH v2] regmap: debugfs: fix race condition in dummy name allocation 2026-04-08 13:33 ` Greg KH @ 2026-04-09 3:50 ` Zxyan Zhu 2026-04-09 5:39 ` Greg Kroah-Hartman 2026-04-09 19:51 ` Mark Brown 2026-04-09 6:10 ` [PATCH] " zhu xin 1 sibling, 2 replies; 6+ messages in thread From: Zxyan Zhu @ 2026-04-09 3:50 UTC (permalink / raw) To: Mark Brown, Greg Kroah-Hartman Cc: Rafael J . Wysocki, Danilo Krummrich, linux-kernel, driver-core, Zxyan Zhu Use IDA instead of a simple counter for generating unique dummy names. The previous implementation used dummy_index++ which is not atomic, leading to potential duplicate names when multiple threads call regmap_debugfs_init() concurrently with name="dummy". Signed-off-by: Zxyan Zhu <zxyan0222@gmail.com> --- drivers/base/regmap/internal.h | 1 + drivers/base/regmap/regmap-debugfs.c | 21 ++++++++++++++++----- 2 files changed, 17 insertions(+), 5 deletions(-) diff --git a/drivers/base/regmap/internal.h b/drivers/base/regmap/internal.h index 5bf993165438..e067890866c1 100644 --- a/drivers/base/regmap/internal.h +++ b/drivers/base/regmap/internal.h @@ -84,6 +84,7 @@ struct regmap { bool debugfs_disable; struct dentry *debugfs; const char *debugfs_name; + int debugfs_dummy_id; unsigned int debugfs_reg_len; unsigned int debugfs_val_len; diff --git a/drivers/base/regmap/regmap-debugfs.c b/drivers/base/regmap/regmap-debugfs.c index 5a46ce5fee72..18f1c60749fe 100644 --- a/drivers/base/regmap/regmap-debugfs.c +++ b/drivers/base/regmap/regmap-debugfs.c @@ -12,6 +12,7 @@ #include <linux/uaccess.h> #include <linux/device.h> #include <linux/list.h> +#include <linux/idr.h> #include "internal.h" @@ -20,7 +21,7 @@ struct regmap_debugfs_node { struct list_head link; }; -static unsigned int dummy_index; +static DEFINE_IDA(dummy_ida); static struct dentry *regmap_debugfs_root; static LIST_HEAD(regmap_debugfs_early_list); static DEFINE_MUTEX(regmap_debugfs_early_lock); @@ -539,6 +540,7 @@ void regmap_debugfs_init(struct regmap *map) struct regmap_range_node *range_node; const char *devname = "dummy"; const char *name = map->name; + int id; /* * Userspace can initiate reads from the hardware over debugfs. @@ -567,6 +569,7 @@ void regmap_debugfs_init(struct regmap *map) INIT_LIST_HEAD(&map->debugfs_off_cache); mutex_init(&map->cache_lock); + map->debugfs_dummy_id = -1; if (map->dev) devname = dev_name(map->dev); @@ -585,12 +588,16 @@ void regmap_debugfs_init(struct regmap *map) if (!strcmp(name, "dummy")) { kfree(map->debugfs_name); - map->debugfs_name = kasprintf(GFP_KERNEL, "dummy%d", - dummy_index); - if (!map->debugfs_name) + id = ida_alloc(&dummy_ida, GFP_KERNEL); + if (id < 0) return; + map->debugfs_name = kasprintf(GFP_KERNEL, "dummy%d", id); + if (!map->debugfs_name) { + ida_free(&dummy_ida, id); + return; + } + map->debugfs_dummy_id = id; name = map->debugfs_name; - dummy_index++; } map->debugfs = debugfs_create_dir(name, regmap_debugfs_root); @@ -660,6 +667,10 @@ void regmap_debugfs_exit(struct regmap *map) mutex_lock(&map->cache_lock); regmap_debugfs_free_dump_cache(map); mutex_unlock(&map->cache_lock); + if (map->debugfs_dummy_id >= 0) { + ida_free(&dummy_ida, map->debugfs_dummy_id); + map->debugfs_dummy_id = -1; + } kfree(map->debugfs_name); map->debugfs_name = NULL; } else { -- 2.34.1 ^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH v2] regmap: debugfs: fix race condition in dummy name allocation 2026-04-09 3:50 ` [PATCH v2] " Zxyan Zhu @ 2026-04-09 5:39 ` Greg Kroah-Hartman 2026-04-09 19:51 ` Mark Brown 1 sibling, 0 replies; 6+ messages in thread From: Greg Kroah-Hartman @ 2026-04-09 5:39 UTC (permalink / raw) To: Zxyan Zhu Cc: Mark Brown, Rafael J . Wysocki, Danilo Krummrich, linux-kernel, driver-core On Thu, Apr 09, 2026 at 11:50:15AM +0800, Zxyan Zhu wrote: > Use IDA instead of a simple counter for generating unique dummy names. > The previous implementation used dummy_index++ which is not atomic, > leading to potential duplicate names when multiple threads call > regmap_debugfs_init() concurrently with name="dummy". > > Signed-off-by: Zxyan Zhu <zxyan0222@gmail.com> > --- > drivers/base/regmap/internal.h | 1 + > drivers/base/regmap/regmap-debugfs.c | 21 ++++++++++++++++----- > 2 files changed, 17 insertions(+), 5 deletions(-) > > diff --git a/drivers/base/regmap/internal.h b/drivers/base/regmap/internal.h > index 5bf993165438..e067890866c1 100644 > --- a/drivers/base/regmap/internal.h > +++ b/drivers/base/regmap/internal.h > @@ -84,6 +84,7 @@ struct regmap { > bool debugfs_disable; > struct dentry *debugfs; > const char *debugfs_name; > + int debugfs_dummy_id; > > unsigned int debugfs_reg_len; > unsigned int debugfs_val_len; > diff --git a/drivers/base/regmap/regmap-debugfs.c b/drivers/base/regmap/regmap-debugfs.c > index 5a46ce5fee72..18f1c60749fe 100644 > --- a/drivers/base/regmap/regmap-debugfs.c > +++ b/drivers/base/regmap/regmap-debugfs.c > @@ -12,6 +12,7 @@ > #include <linux/uaccess.h> > #include <linux/device.h> > #include <linux/list.h> > +#include <linux/idr.h> > > #include "internal.h" > > @@ -20,7 +21,7 @@ struct regmap_debugfs_node { > struct list_head link; > }; > > -static unsigned int dummy_index; > +static DEFINE_IDA(dummy_ida); > static struct dentry *regmap_debugfs_root; > static LIST_HEAD(regmap_debugfs_early_list); > static DEFINE_MUTEX(regmap_debugfs_early_lock); > @@ -539,6 +540,7 @@ void regmap_debugfs_init(struct regmap *map) > struct regmap_range_node *range_node; > const char *devname = "dummy"; > const char *name = map->name; > + int id; > > /* > * Userspace can initiate reads from the hardware over debugfs. > @@ -567,6 +569,7 @@ void regmap_debugfs_init(struct regmap *map) > > INIT_LIST_HEAD(&map->debugfs_off_cache); > mutex_init(&map->cache_lock); > + map->debugfs_dummy_id = -1; > > if (map->dev) > devname = dev_name(map->dev); > @@ -585,12 +588,16 @@ void regmap_debugfs_init(struct regmap *map) > > if (!strcmp(name, "dummy")) { > kfree(map->debugfs_name); > - map->debugfs_name = kasprintf(GFP_KERNEL, "dummy%d", > - dummy_index); > - if (!map->debugfs_name) > + id = ida_alloc(&dummy_ida, GFP_KERNEL); > + if (id < 0) > return; > + map->debugfs_name = kasprintf(GFP_KERNEL, "dummy%d", id); > + if (!map->debugfs_name) { > + ida_free(&dummy_ida, id); > + return; > + } > + map->debugfs_dummy_id = id; > name = map->debugfs_name; > - dummy_index++; > } > > map->debugfs = debugfs_create_dir(name, regmap_debugfs_root); > @@ -660,6 +667,10 @@ void regmap_debugfs_exit(struct regmap *map) > mutex_lock(&map->cache_lock); > regmap_debugfs_free_dump_cache(map); > mutex_unlock(&map->cache_lock); > + if (map->debugfs_dummy_id >= 0) { > + ida_free(&dummy_ida, map->debugfs_dummy_id); > + map->debugfs_dummy_id = -1; > + } > kfree(map->debugfs_name); > map->debugfs_name = NULL; > } else { > -- > 2.34.1 > > Hi, This is the friendly patch-bot of Greg Kroah-Hartman. You have sent him a patch that has triggered this response. He used to manually respond to these common problems, but in order to save his sanity (he kept writing the same thing over and over, yet to different people), I was created. Hopefully you will not take offence and will fix the problem in your patch and resubmit it so that it can be accepted into the Linux kernel tree. You are receiving this message because of the following common error(s) as indicated below: - This looks like a new version of a previously submitted patch, but you did not list below the --- line any changes from the previous version. Please read the section entitled "The canonical patch format" in the kernel file, Documentation/process/submitting-patches.rst for what needs to be done here to properly describe this. If you wish to discuss this problem further, or you have questions about how to resolve this issue, please feel free to respond to this email and Greg will reply once he has dug out from the pending patches received from other developers. thanks, greg k-h's patch email bot ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v2] regmap: debugfs: fix race condition in dummy name allocation 2026-04-09 3:50 ` [PATCH v2] " Zxyan Zhu 2026-04-09 5:39 ` Greg Kroah-Hartman @ 2026-04-09 19:51 ` Mark Brown 1 sibling, 0 replies; 6+ messages in thread From: Mark Brown @ 2026-04-09 19:51 UTC (permalink / raw) To: Greg Kroah-Hartman, Zxyan Zhu Cc: Rafael J . Wysocki, Danilo Krummrich, linux-kernel, driver-core On Thu, 09 Apr 2026 11:50:15 +0800, Zxyan Zhu wrote: > regmap: debugfs: fix race condition in dummy name allocation Applied to https://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap.git for-7.1 Thanks! [1/1] regmap: debugfs: fix race condition in dummy name allocation https://git.kernel.org/broonie/regmap/c/7d696210cf36 All being well this means that it will be integrated into the linux-next tree (usually sometime in the next 24 hours) and sent to Linus during the next merge window (or sooner if it is a bug fix), however if problems are discovered then the patch may be dropped or reverted. You may get further e-mails resulting from automated or manual testing and review of the tree, please engage with people reporting problems and send followup patches addressing any issues that are reported if needed. If any updates are required or you are submitting further changes they should be sent as incremental updates against current git, existing patches will not be replaced. Please add any relevant lists and maintainers to the CCs when replying to this mail. Thanks, Mark ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] regmap: debugfs: fix race condition in dummy name allocation 2026-04-08 13:33 ` Greg KH 2026-04-09 3:50 ` [PATCH v2] " Zxyan Zhu @ 2026-04-09 6:10 ` zhu xin 1 sibling, 0 replies; 6+ messages in thread From: zhu xin @ 2026-04-09 6:10 UTC (permalink / raw) To: Greg KH Cc: Mark Brown, Rafael J. Wysocki, Danilo Krummrich, linux-kernel, driver-core Sorry, I missed adding Cc in the previous send. Resending the correct v2 patch below. On Wed, Apr 08, 2026 at 09:11:55PM +0800, Greg Kroah-Hartman wrote: > What code does that? Why not fix that? Multiple drivers using regmap can probe in parallel, leading to concurrent calls to regmap_debugfs_init() with name=NULL and dev=NULL. The dummy_index is a global static variable inside regmap-debugfs.c, not something the callers have knowledge of or control over. Using IDA is the appropriate fix for this internal concurrency issue. > Also, you did not sign off on this, so it can't be taken, sorry. Apologies for missing the Signed-off-by line. Added in v2. From 7f7d322d6605a1b2c3d4e5f6g7h8i9j0k1l2m3n4 Mon Sep 17 00:00:00 2001 From: Zxyan Zhu <zxyan0222@gmail.com> Date: Thu, 9 Apr 2026 13:40:11 +0800 Subject: [PATCH v2] regmap: debugfs: fix race condition in dummy name allocation When multiple drivers using regmap probe in parallel, they may call regmap_debugfs_init() concurrently with name=NULL and dev=NULL, resulting in concurrent access to the global dummy_index counter. This could lead to duplicate debugfs directory names like "dummy0" being created, causing debugfs_create_dir() to fail. Fix this by replacing the non-atomic dummy_index counter with IDA, which provides thread-safe ID allocation. Signed-off-by: Zxyan Zhu <zxyan0222@gmail.com> --- Changes in v2: - Add missing Signed-off-by line - Improve commit message with detailed problem description --- drivers/base/regmap/internal.h | 1 + drivers/base/regmap/regmap-debugfs.c | 21 ++++++++++++++++----- 2 files changed, 17 insertions(+), 5 deletions(-) diff --git a/drivers/base/regmap/internal.h b/drivers/base/regmap/internal.h index 5bf993165438..e067890866c1 100644 --- a/drivers/base/regmap/internal.h +++ b/drivers/base/regmap/internal.h @@ -84,6 +84,7 @@ struct regmap { bool debugfs_disable; struct dentry *debugfs; const char *debugfs_name; + int debugfs_dummy_id; unsigned int debugfs_reg_len; unsigned int debugfs_val_len; diff --git a/drivers/base/regmap/regmap-debugfs.c b/drivers/base/regmap/regmap-debugfs.c index 5a46ce5fee72..18f1c60749fe 100644 --- a/drivers/base/regmap/regmap-debugfs.c +++ b/drivers/base/regmap/regmap-debugfs.c @@ -12,6 +12,7 @@ #include <linux/uaccess.h> #include <linux/device.h> #include <linux/list.h> +#include <linux/idr.h> #include "internal.h" @@ -20,7 +21,7 @@ struct regmap_debugfs_node { struct list_head link; }; -static unsigned int dummy_index; +static DEFINE_IDA(dummy_ida); static struct dentry *regmap_debugfs_root; static LIST_HEAD(regmap_debugfs_early_list); static DEFINE_MUTEX(regmap_debugfs_early_lock); @@ -539,6 +540,7 @@ void regmap_debugfs_init(struct regmap *map) struct regmap_range_node *range_node; const char *devname = "dummy"; const char *name = map->name; + int id; /* * Userspace can initiate reads from the hardware over debugfs. @@ -567,6 +569,7 @@ void regmap_debugfs_init(struct regmap *map) INIT_LIST_HEAD(&map->debugfs_off_cache); mutex_init(&map->cache_lock); + map->debugfs_dummy_id = -1; if (map->dev) devname = dev_name(map->dev); @@ -585,12 +588,16 @@ void regmap_debugfs_init(struct regmap *map) if (!strcmp(name, "dummy")) { kfree(map->debugfs_name); - map->debugfs_name = kasprintf(GFP_KERNEL, "dummy%d", - dummy_index); - if (!map->debugfs_name) + id = ida_alloc(&dummy_ida, GFP_KERNEL); + if (id < 0) return; + map->debugfs_name = kasprintf(GFP_KERNEL, "dummy%d", id); + if (!map->debugfs_name) { + ida_free(&dummy_ida, id); + return; + } + map->debugfs_dummy_id = id; name = map->debugfs_name; - dummy_index++; } map->debugfs = debugfs_create_dir(name, regmap_debugfs_root); @@ -660,6 +667,10 @@ void regmap_debugfs_exit(struct regmap *map) mutex_lock(&map->cache_lock); regmap_debugfs_free_dump_cache(map); mutex_unlock(&map->cache_lock); + if (map->debugfs_dummy_id >= 0) { + ida_free(&dummy_ida, map->debugfs_dummy_id); + map->debugfs_dummy_id = -1; + } kfree(map->debugfs_name); map->debugfs_name = NULL; } else { -- 2.34.1 On Wed, Apr 8, 2026 at 9:33 PM Greg KH <gregkh@linuxfoundation.org> wrote: > > On Wed, Apr 08, 2026 at 09:11:55PM +0800, Zxyan Zhu wrote: > > Use IDA instead of a simple counter for generating unique dummy names. > > The previous implementation used dummy_index++ which is not atomic, > > leading to potential duplicate names when multiple threads call > > regmap_debugfs_init() concurrently with name="dummy". > > What code does that? Why not fix that? > > Also, you did not sign off on this, so it can't be taken, sorry. > > greg k-h ^ permalink raw reply related [flat|nested] 6+ messages in thread
end of thread, other threads:[~2026-04-09 22:35 UTC | newest] Thread overview: 6+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2026-04-08 13:11 [PATCH] regmap: debugfs: fix race condition in dummy name allocation Zxyan Zhu 2026-04-08 13:33 ` Greg KH 2026-04-09 3:50 ` [PATCH v2] " Zxyan Zhu 2026-04-09 5:39 ` Greg Kroah-Hartman 2026-04-09 19:51 ` Mark Brown 2026-04-09 6:10 ` [PATCH] " zhu xin
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox