From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0AC1F26F288; Thu, 12 Mar 2026 20:26:22 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773347182; cv=none; b=h1GyKrL7vCnx2I6fLi9AePSjNg/xrFuvsQKpTyVjFD9XNjisAd5fzbPKTYsYrI2qe5y3xsU1W0tUIWbKYoAqsPUsTAJjg0VdEP77fBtiCfFLc+fYVCIa3nDqkDRF5F5aGGFAtGx9BVvyjZshEuKb9atQg9K/WTVJ2YAe+tMdwFw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773347182; c=relaxed/simple; bh=ZNxvh6+OUNyukB1yLJYsyXu2V0DJFsEbJutpXBazU7M=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=MGiH20/AzgRb06BTp7oa2E/XubUGmHvXL6aQQ3xmsy03fbZc+7MVf6Tndmt8IbKgNr4D77Wz5rMU6uvA1R5p0FEJzYHU8BTJUGVF7GJi+JxaD1LwwbknUE7BIM/43JA69asRjtyuSDnb0+Cqinnh0JVx0tkMcVBWu6BVFV+I5eM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=ZAFGYe0b; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="ZAFGYe0b" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2CA3DC4CEF7; Thu, 12 Mar 2026 20:26:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1773347181; bh=ZNxvh6+OUNyukB1yLJYsyXu2V0DJFsEbJutpXBazU7M=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ZAFGYe0b3GcyY1NVOn35QJWC7uNxlJ0BWNlumFLN5vpilaD0cwOpVSIQXn5+kGdf5 BDOI+eXd7QRiofGp3v7EgXf8BRZAsgKibVsuup0qvG+wR7IKbKQJcNjYFxJWRnDFmD fDuZKhmf4irJoDyVpHMGPGXnTe4DZog8dDELKK6E= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Alban Bedel , Marc Kleine-Budde , Sasha Levin Subject: [PATCH 6.12 194/265] can: mcp251x: fix deadlock in error path of mcp251x_open Date: Thu, 12 Mar 2026 21:09:41 +0100 Message-ID: <20260312201025.323619407@linuxfoundation.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260312201018.128816016@linuxfoundation.org> References: <20260312201018.128816016@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Alban Bedel [ Upstream commit ab3f894de216f4a62adc3b57e9191888cbf26885 ] The mcp251x_open() function call free_irq() in its error path with the mpc_lock mutex held. But if an interrupt already occurred the interrupt handler will be waiting for the mpc_lock and free_irq() will deadlock waiting for the handler to finish. This issue is similar to the one fixed in commit 7dd9c26bd6cf ("can: mcp251x: fix deadlock if an interrupt occurs during mcp251x_open") but for the error path. To solve this issue move the call to free_irq() after the lock is released. Setting `priv->force_quit = 1` beforehand ensure that the IRQ handler will exit right away once it acquired the lock. Signed-off-by: Alban Bedel Link: https://patch.msgid.link/20260209144706.2261954-1-alban.bedel@lht.dlh.de Fixes: bf66f3736a94 ("can: mcp251x: Move to threaded interrupts instead of workqueues.") Signed-off-by: Marc Kleine-Budde Signed-off-by: Sasha Levin --- drivers/net/can/spi/mcp251x.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/drivers/net/can/spi/mcp251x.c b/drivers/net/can/spi/mcp251x.c index ec5c64006a16f..74906aa98be3e 100644 --- a/drivers/net/can/spi/mcp251x.c +++ b/drivers/net/can/spi/mcp251x.c @@ -1201,6 +1201,7 @@ static int mcp251x_open(struct net_device *net) { struct mcp251x_priv *priv = netdev_priv(net); struct spi_device *spi = priv->spi; + bool release_irq = false; unsigned long flags = 0; int ret; @@ -1244,12 +1245,24 @@ static int mcp251x_open(struct net_device *net) return 0; out_free_irq: - free_irq(spi->irq, priv); + /* The IRQ handler might be running, and if so it will be waiting + * for the lock. But free_irq() must wait for the handler to finish + * so calling it here would deadlock. + * + * Setting priv->force_quit will let the handler exit right away + * without any access to the hardware. This make it safe to call + * free_irq() after the lock is released. + */ + priv->force_quit = 1; + release_irq = true; + mcp251x_hw_sleep(spi); out_close: mcp251x_power_enable(priv->transceiver, 0); close_candev(net); mutex_unlock(&priv->mcp_lock); + if (release_irq) + free_irq(spi->irq, priv); return ret; } -- 2.51.0