From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 814B832ED40; Mon, 17 Aug 2026 13:39:09 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786973950; cv=none; b=ijw5Dv2h8IsErYVl7mNQ8aoV6PsD2+VDiYNiFIbEKfLXVHQdHXCgfYPX+M8rWn8QA0HEPKTufJYvfb/kxupHB3LDQhaxEbdqePqjaoljTg2fFVrJE2cKmNlUyBlsmuMaaC44Fexrx6LiB9nWKHuY5728ny/qvSbp4+wAbUf2zY8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786973950; c=relaxed/simple; bh=9O89SkqjrHGpKyFFEO6co3HTONhYN2oJy83VFdZ77LE=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=QItKGffUw4jhFccpIHf9T5k3Lcwmo/gpeE2kcpPiIRZSUy6Fs26Ighx2fV0RjR4BWmAvOlB5c0KA1rgwKV2BkwwHhyTRvulIWQ5VeJRqTcYGm+2PDT9Y4rW5E5c7OkqeTGkWbfaUkyVdvmo2ZSUDac2jVEr4L0IdTdansbSlpco= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=LJlU7piq; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="LJlU7piq" Received: by smtp.kernel.org (Postfix) with ESMTPSA id DACA11F000E9; Mon, 17 Aug 2026 13:39:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1786973949; bh=mMMrtwFR1WbWLsxsJsGj4AHIh8BdWQ+AQxxAhGoqLyA=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=LJlU7piqza1xE+HwF+XvgrQyMzEnMnaAw+MYMq6S8Rue0nKKe5o7j0KGpHs99sXU4 Ks8S1rw9zirgqiZV7VwPLQEIdMkQA3yR4VVAc3Euza0qDYz8WDtXDVupSzsX3lBqg6 10DhoAu36HoxdU/lkpehv6ewB7mGegjPb70oT6UY= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Mark Tomlinson , Bartosz Golaszewski , Sasha Levin Subject: [PATCH 7.1 004/271] gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock Date: Mon, 17 Aug 2026 15:28:49 +0200 Message-ID: <20260817132536.933568254@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260817132536.752504388@linuxfoundation.org> References: <20260817132536.752504388@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 7.1-stable review patch. If anyone has any objections, please let me know. ------------------ From: Mark Tomlinson [ Upstream commit 9dc325327babe7f159e84cbe9380a45342da0585 ] Locking is disabled in the regmap config as this driver uses its own lock. This means that all calls to regmap functions (read or write) must hold the i2c_lock. The function pca953x_irq_bus_sync_unlock() did not do this, and it was therefore possible that multiple threads could cause an incorrect register to be read/written. A previous patch partly fixed this, but only protected the write to the interrupt mask register, and not the read from the direction register. Fixes: bfc6444b57dc ("gpio: pca953x: fix pca953x_irq_bus_sync_unlock race") Cc: stable@vger.kernel.org Signed-off-by: Mark Tomlinson Link: https://patch.msgid.link/20260709045116.2304246-1-mark.tomlinson@alliedtelesis.co.nz Signed-off-by: Bartosz Golaszewski (cherry picked from commit 9dc325327babe7f159e84cbe9380a45342da0585) Signed-off-by: Sasha Levin --- drivers/gpio/gpio-pca953x.c | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-) diff --git a/drivers/gpio/gpio-pca953x.c b/drivers/gpio/gpio-pca953x.c index 69c5bd9aaee7c..cb282b35fb58d 100644 --- a/drivers/gpio/gpio-pca953x.c +++ b/drivers/gpio/gpio-pca953x.c @@ -605,20 +605,28 @@ static int pca953x_read_regs(struct pca953x_chip *chip, int reg, unsigned long * return 0; } -static int pca953x_gpio_direction_input(struct gpio_chip *gc, unsigned off) +static int pca953x_gpio_direction_input_unlocked(struct gpio_chip *gc, + unsigned int off) { struct pca953x_chip *chip = gpiochip_get_data(gc); u8 dirreg = chip->recalc_addr(chip, chip->regs->direction, off); u8 bit = pca953x_get_bit_mask(chip, off); - guard(mutex)(&chip->i2c_lock); - if (PCA_CHIP_TYPE(chip->driver_data) == TCA6418_TYPE) return regmap_update_bits(chip->regmap, dirreg, bit, 0); return regmap_update_bits(chip->regmap, dirreg, bit, bit); } +static int pca953x_gpio_direction_input(struct gpio_chip *gc, unsigned int off) +{ + struct pca953x_chip *chip = gpiochip_get_data(gc); + + guard(mutex)(&chip->i2c_lock); + + return pca953x_gpio_direction_input_unlocked(gc, off); +} + static int pca953x_gpio_direction_output(struct gpio_chip *gc, unsigned off, int val) { @@ -856,9 +864,10 @@ static void pca953x_irq_bus_sync_unlock(struct irq_data *d) DECLARE_BITMAP(reg_direction, MAX_LINE); int level; + guard(mutex)(&chip->i2c_lock); + if (chip->driver_data & PCA_PCAL) { DECLARE_BITMAP(latched_inputs, MAX_LINE); - guard(mutex)(&chip->i2c_lock); /* Enable latch on edge-triggered interrupt-enabled inputs */ bitmap_or(latched_inputs, chip->irq_trig_fall, chip->irq_trig_raise, gc->ngpio); @@ -882,7 +891,7 @@ static void pca953x_irq_bus_sync_unlock(struct irq_data *d) /* Look for any newly setup interrupt */ for_each_set_bit(level, irq_mask, gc->ngpio) - pca953x_gpio_direction_input(&chip->gpio_chip, level); + pca953x_gpio_direction_input_unlocked(&chip->gpio_chip, level); mutex_unlock(&chip->irq_lock); } -- 2.53.0