From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-oa1-f44.google.com (mail-oa1-f44.google.com [209.85.160.44]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C124B142E83 for ; Sat, 13 Jun 2026 00:58:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.160.44 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781312297; cv=none; b=MeE9FgF5ZQ6jkUik8tPqkljsuioTnA28QnFCdTGoRdXz2tlW9r5V8Lp+2wz9B01unl8Ra1nTleXCfq0+xUtWNcjZQp9CWaoVX0r+uptKA6LZaujBFfXfmVXenGHo8ILRFrNMsxI6KNp7MU9nlABJfjqylDu8PHup6dHuu1i7pE8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781312297; c=relaxed/simple; bh=Z9R14y/b/INRO5sVutV5vQh2oKTubF9vHDewgR71Plk=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=UyZwprHFYk6Xs1GcCGW1efWRypsYNSTKDY4v4sN0Ic9UziLTuU8mvNLcIu2H7PVrWS3jVg8wUEoG3Ed7NTPKI/D5cUIeawE3u8N1C0dXRT+vOubvVLg7+jh+eJbOs2YkoiOKA17D1fDFKB/9T85X3v9h/BNONumJpCA9wVdnUek= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=IaCSRKSn; arc=none smtp.client-ip=209.85.160.44 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="IaCSRKSn" Received: by mail-oa1-f44.google.com with SMTP id 586e51a60fabf-44104dac6f5so2015009fac.0 for ; Fri, 12 Jun 2026 17:58:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1781312295; x=1781917095; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=/aaaLGtGMdloDgmx4w88ZqZn+UMMDoCbT7BG6Ejcd2Y=; b=IaCSRKSnTI81CxrhC337sSoFeLghrwWUrC2L9bihrGAhlD/e4ZSKTBnsBQD7OZHbxB tDF15ONrZSDInXRBvL6txU8I5Z4P9bFsUaUnztnFk1mxoNJvNaUmgUc0crLzmTBrJeNJ 6Wwot24f5jzC0yAN+kIQemaZkpCiE0r0f04qoP6xt0wT1cUd7GsTz/TdctuGpkb20nbJ nuExzLKlblPHVSoAkf60H1Mh6k9P19mIbw8arfrN0om+eqIb7eoIDpMqd7WyDwp17y42 jgfNoXzAQDg/mi7s6w/mdhRpHku8bGFDNBavaVjGKcT6nSf1QUx7RJKvL3g4ZHd+e2fe 5BTQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781312295; x=1781917095; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=/aaaLGtGMdloDgmx4w88ZqZn+UMMDoCbT7BG6Ejcd2Y=; b=K7lwvp0pU0ic+K2wn7NsrGMEwsKExnBPzdBrDZvY9w27ZapnZEQ0gZRaZTDHbbQa5P kWlPz7z8R2CLJ/XlGxHcpvn5J6JQTl7FTLmBEtoMCmEF49gzFtvi+ERo7BxCfKN11PaT LQijSwP9l7tXXPKk8S5uJq65i6pVVd9xLO77YrVE+a0HBPQmzxuYc51Do3Xhr1HvrTmG p9Rx8Rg0JMQrGt6VmeDVTxat0EVCEwloiaRdcJq66uc/EPmIq29MinzFgT7PzsByqWPj JH9nXUhZ3SrIsEDpLiWbk7RpONczG8WzlYi+tTsqUDAM52/DNPa+vTr8o7rnyXLYsegt xEjA== X-Forwarded-Encrypted: i=1; AFNElJ+Pkvf/Y2kzcxH34lybFDwQmKff+HvM7zGlGG5Nzg/k5thkSOWlNfLNfiIdgfuYwUoq6V4ZmZIeCtgTVzM=@vger.kernel.org X-Gm-Message-State: AOJu0YyJz+Aofwu4KRF10/5QzM7n8RPhNrTb4onJr0SGLmDPoF4EHBBG oMmqHNB2YM4rCC9LyrtoQCo1Bm8JGRhpJpCRtPAd0d2CNY6Oc/hwiwct0A4ElR27MVk= X-Gm-Gg: Acq92OEaWksM6GSD9NFuTlixtmlN44+nHXBkjjGNnSEVttkEH8k4UUkt+6DLYk0i3eY dB1n+KH63Mnh5OYbbAZd25Hb9H0yf8TrrIrNt/NiAJdcKWv5z55CHCx65yyDkFvcLDljkWIqnGk GjoX9lQyZkhRVbZVM/VhXQJTkoWdChOdnXujPsD/5I6Gxqq+0LrOvjQa05sCfZpsn7S1C7f3tQ1 1waxBljBjYVMFMhbicJtJq83LxTl5MiUUQ3+/npXVbwEUezmSyKF7wDQ0SgqOcymYxuYoJ3DqiP uz+xBF7tgSAvCL6e1kLEvtExCNH6ktb+UzZoBjXuLV3uKM1UZiXfHnFNsP/yz2kzdK0v0z6VQrX K5ygeE05gHa3nneeAClfPnGwRLmr8nrJXxnAfQgpd34OUSp/X+X04LYCtw1OF88WDeqocLnXaD/ NRfyZpEBLHfkMN+mB4Iu4BEOgG7/oN7BTLnDd949DfBAWOMVCFInahde8/Jg== X-Received: by 2002:a05:6820:211:b0:69e:3868:a739 with SMTP id 006d021491bc7-69edd76b56emr2093232eaf.24.1781312294619; Fri, 12 Jun 2026 17:58:14 -0700 (PDT) Received: from linuxescape.lan (23-88-128-2.fttp.usinternet.com. [23.88.128.2]) by smtp.gmail.com with ESMTPSA id 586e51a60fabf-4426abf260dsm3150731fac.6.2026.06.12.17.58.13 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 12 Jun 2026 17:58:13 -0700 (PDT) From: Maxwell Doose To: Jonathan Cameron , David Lechner , =?UTF-8?q?Nuno=20S=C3=A1?= , Andy Shevchenko , Vladimir Zapolskiy , Piotr Wojtaszczyk , Hartmut Knaack , linux-iio@vger.kernel.org (open list:IIO SUBSYSTEM AND DRIVERS), linux-arm-kernel@lists.infradead.org (moderated list:ARM/LPC32XX SOC SUPPORT), linux-kernel@vger.kernel.org (open list) Cc: Sangyun Kim , Kyungwook Boo , Jaeyoung Chung Subject: [PATCH 0/2] iio: adc: Initialize completions before requesting IRQs Date: Fri, 12 Jun 2026 19:58:09 -0500 Message-ID: <20260613005812.160572-1-m32285159@gmail.com> X-Mailer: git-send-email 2.54.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Hi all, This short patch series fixes the issues raised by Jaeyoung Chung, Sangyun Kim, and Kyungwook Boo regarding init_completion() and spurious IRQs. The report is linked below [1], but I will also put it here inline: "lpc32xx_adc_probe() in drivers/iio/adc/lpc32xx_adc.c and spear_adc_probe() in drivers/iio/adc/spear_adc.c register their interrupt handler with devm_request_irq() before they initialize st->completion with init_completion(). If an interrupt arrives after devm_request_irq() and before init_completion(), the handler calls complete() on an uninitialized completion, causing a kernel panic. The probe path, in lpc32xx_adc_probe(): iodev = devm_iio_device_alloc(&pdev->dev, sizeof(*st)); /* st kzalloc-zeroed */ ... retval = devm_request_irq(&pdev->dev, irq, lpc32xx_adc_isr, 0, LPC32XXAD_NAME, st); /* register handler */ ... init_completion(&st->completion); /* initialize completion */ spear_adc_probe() has the same ordering: devm_request_irq() for spear_adc_isr() before init_completion(&st->completion). Both interrupt handlers, lpc32xx_adc_isr() and spear_adc_isr(), call complete(): complete(&st->completion); If the device raises an interrupt before init_completion() runs, complete() acquires the uninitialized wait.lock and walks the zeroed task_list in swake_up_locked(). The zeroed task_list makes list_empty() return false, so swake_up_locked() dereferences a NULL list entry, triggering a KASAN wild-memory-access. Suggested fix: move init_completion(&st->completion) above devm_request_irq(), so the completion is valid before the handler can run. Reported-by: Sangyun Kim Reported-by: Kyungwook Boo " + Reported-by: Jaeyoung Chung Quick note, I ended up editing the report a little in the individual commits to match the driver we were fixing. [1] Link: https://lore.kernel.org/linux-iio/20260610115700.774689-1-jjy600901@snu.ac.kr/ Maxwell Doose (2): iio: adc: lpc32xx: Initialize completion before requesting IRQ iio: adc: spear: Initialize completion before requesting IRQ drivers/iio/adc/lpc32xx_adc.c | 4 ++-- drivers/iio/adc/spear_adc.c | 3 +-- 2 files changed, 3 insertions(+), 4 deletions(-) -- 2.54.0