From nobody Tue Dec 16 16:43:31 2025 Received: from mail-pj1-f52.google.com (mail-pj1-f52.google.com [209.85.216.52]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A69B24C97 for ; Wed, 10 Dec 2025 19:31:22 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.52 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1765395084; cv=none; b=k19QXei0h/8PzfNQKEzZuM0L1gJMMYoQmHHucwMq55M1cKzQCg9rIdzSD/ODjzQCdQil56CXMTEX40ccnt5srJbv3LM0SBP9myh43RBUAyHpN350NDJN3QOJKgvb17ZGpNF1kI16krDrnFW4NI6d2ZIAzW8SjeuVUJ5Qj2xfukQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1765395084; c=relaxed/simple; bh=jAI/cZ8/Risj2obasGTbiOljtvLuJxNQ2nILXsO9Bxg=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=ADEI3Wa+k+MEpaoHUZAy8UwYynFqbFAq7j8biEyla32zwGouukVvEv69eRXbwdvfrC4yRAPMlUTpJvf5IqISBOms0PB2hmGGZHAz5obbb2dM1yAmkir4DgqWUz2ypodCp2wXROHUSLeozy3zGnv8adj1CMIBdMqY0MlxXdsg5GY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=chromium.org; spf=pass smtp.mailfrom=chromium.org; dkim=pass (1024-bit key) header.d=chromium.org header.i=@chromium.org header.b=CUUyc3ib; arc=none smtp.client-ip=209.85.216.52 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=chromium.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=chromium.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=chromium.org header.i=@chromium.org header.b="CUUyc3ib" Received: by mail-pj1-f52.google.com with SMTP id 98e67ed59e1d1-3437ea05540so165551a91.0 for ; Wed, 10 Dec 2025 11:31:22 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; t=1765395082; x=1765999882; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=F6ybH5P0ZqP5MXm6M6ozs1e/SZAmwiNIl7gbv5z43yI=; b=CUUyc3ibGLDMI7LX2Jc5Iqs1fvDvfpERE667yXBBlcD/THB9Zf8s7CR+65F9jsYE+h nNn27DFBmNOPjlSA/oG3rMKHIjh16JncQwNhrU7zoXnWhY5QI4+ldFZSGCW1QNcE2gLE j+HHPP7IW+mpCsG3YxnF1SWHDlFiOE6efFFvs= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1765395082; x=1765999882; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=F6ybH5P0ZqP5MXm6M6ozs1e/SZAmwiNIl7gbv5z43yI=; b=clh1UziDWmNbC3l3A2CARBvGf5/gqcNeGrzVgQXYQvitFpNeOtS2nOY9ZWNvf+Ogdy 5bFUxndff80p1Os8FXngwfco50tKKAV7hFGjAWkI2WouW6Mv9TeWIMdbksAYC98G/wu3 XGOViZ86lGBAN0qn8DIyjs5rSaBK+Ufce25T72sSiHtMcO8jw8BeJKijLqKwKEU4f7GF HcJ6JbngdIOev+JZIz0l8IMDJcNOsqeSS2vhuxh2EadykppuRHbqOERw9qq2RrweURUT t3BvA9Edoph1gEi5e3N+Agcpd+HjlPZzWTy28YP2cwsf3Dz+GI2dPF5SDkNNcSnllPfN ADOg== X-Forwarded-Encrypted: i=1; AJvYcCW34ZWTzhnjXXkXxre11hYme+Br4LqS/+/YhJrjCNXIr5IlzIKiCGAkeV3Gko9L8BjhM/MXJlWGXuB9Mxg=@vger.kernel.org X-Gm-Message-State: AOJu0YyMJgcV+i2bZtCl7iVNzeuf0CieFxWSP7ClRWx+ljgX39fy1BDo tAN7JA0G2fSZQsHOTaMZDjyVVLguLuMQ4X3SFvuqVewyW0Eg1eeumBv31+JL3hlncg== X-Gm-Gg: ASbGncsWjTE7lTQ9KZfs0SmQVLWzrnBlIgEYfyQtU9AZSs4ilJj5JolzDwuQdwwLt+7 ems4VnAlpJIv7jAp+sybntr/6dWhEFTdDy/z9SzeXp+V8Hb+k0VGblhPrz7K0U7M03Yug/URoJE l9ExpiXon0fibc1vdoUaqavzrH+rqvo5HJYf8N/w2cQK2F3fyJ5rjApKhSAd93w5SwaJ5YjC/lG ByFGo+gfAi8bdF0v2RNgLbV2pF0mLzMOeitSaYQiq6as/OFQdKcyMbkLU0yrn/1G4pI3whT6h3k mL60HzZiwlJACGEopHTs+2aDqRv405AYabjF+TABoJW7ncr/vREOAFG2DEsbgH6tbkt5Z8YE7rw vdyQjeH7tzWzdEMNCMnksKDFVjtFdWTYJLXI9cA38euuNNVKsLx+z2mQb2WEu9Mu50isPwOOVrz AyDbq1KtUHp+8OIjxQozNzXQxAqy1s5BUhXLsXqRVUaR0mIL4shgJZC24i0SPfXYgT+O/2KGs= X-Google-Smtp-Source: AGHT+IHfmJbB7s5a1YoDz1FXkh0zlCZli9b00q9Np/CI/Vyd9tLtbPt7EUsePWimkahEhv0KewcvFQ== X-Received: by 2002:a05:7022:128d:b0:11b:9386:8255 with SMTP id a92af1059eb24-11f296b4370mr2779334c88.42.1765395081844; Wed, 10 Dec 2025 11:31:21 -0800 (PST) Received: from dianders.sjc.corp.google.com ([2a00:79e0:2e7c:8:2eae:c894:7aaa:937f]) by smtp.gmail.com with ESMTPSA id a92af1059eb24-11f2e1bb2f4sm972592c88.3.2025.12.10.11.31.20 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 10 Dec 2025 11:31:20 -0800 (PST) From: Douglas Anderson To: Lee Jones Cc: Douglas Anderson , stable@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH] mfd: core: Add locking around `mfd_of_node_list` Date: Wed, 10 Dec 2025 11:30:03 -0800 Message-ID: <20251210113002.1.I6ceaca2cfb7eb25737012b166671f516696be4fd@changeid> X-Mailer: git-send-email 2.52.0.223.gf5cc29aaa4-goog Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Manipulating a list in the kernel isn't safe without some sort of mutual exclusion. Add a mutex any time we access / modify `mfd_of_node_list` to prevent possible crashes. Cc: Fixes: 466a62d7642f ("mfd: core: Make a best effort attempt to match device= s with the correct of_nodes") Signed-off-by: Douglas Anderson --- While I have no definitive way to reproduce the crash we've been seeing, it's clear that the `mfd_of_node_list` isn't right at the time of the crash. Code inspection shows the lack of locking. drivers/mfd/mfd-core.c | 36 ++++++++++++++++++++++-------------- 1 file changed, 22 insertions(+), 14 deletions(-) diff --git a/drivers/mfd/mfd-core.c b/drivers/mfd/mfd-core.c index 7d14a1e7631e..c55223ce4327 100644 --- a/drivers/mfd/mfd-core.c +++ b/drivers/mfd/mfd-core.c @@ -22,6 +22,7 @@ #include =20 static LIST_HEAD(mfd_of_node_list); +static DEFINE_MUTEX(mfd_of_node_mutex); =20 struct mfd_of_node_entry { struct list_head list; @@ -105,9 +106,11 @@ static int mfd_match_of_node_to_dev(struct platform_de= vice *pdev, u64 of_node_addr; =20 /* Skip if OF node has previously been allocated to a device */ - list_for_each_entry(of_entry, &mfd_of_node_list, list) - if (of_entry->np =3D=3D np) - return -EAGAIN; + scoped_guard(mutex, &mfd_of_node_mutex) { + list_for_each_entry(of_entry, &mfd_of_node_list, list) + if (of_entry->np =3D=3D np) + return -EAGAIN; + } =20 if (!cell->use_of_reg) /* No of_reg defined - allocate first free compatible match */ @@ -129,7 +132,8 @@ static int mfd_match_of_node_to_dev(struct platform_dev= ice *pdev, =20 of_entry->dev =3D &pdev->dev; of_entry->np =3D np; - list_add_tail(&of_entry->list, &mfd_of_node_list); + scoped_guard(mutex, &mfd_of_node_mutex) + list_add_tail(&of_entry->list, &mfd_of_node_list); =20 of_node_get(np); device_set_node(&pdev->dev, of_fwnode_handle(np)); @@ -286,11 +290,13 @@ static int mfd_add_device(struct device *parent, int = id, if (cell->swnode) device_remove_software_node(&pdev->dev); fail_of_entry: - list_for_each_entry_safe(of_entry, tmp, &mfd_of_node_list, list) - if (of_entry->dev =3D=3D &pdev->dev) { - list_del(&of_entry->list); - kfree(of_entry); - } + scoped_guard(mutex, &mfd_of_node_mutex) { + list_for_each_entry_safe(of_entry, tmp, &mfd_of_node_list, list) + if (of_entry->dev =3D=3D &pdev->dev) { + list_del(&of_entry->list); + kfree(of_entry); + } + } fail_alias: regulator_bulk_unregister_supply_alias(&pdev->dev, cell->parent_supplies, @@ -360,11 +366,13 @@ static int mfd_remove_devices_fn(struct device *dev, = void *data) if (cell->swnode) device_remove_software_node(&pdev->dev); =20 - list_for_each_entry_safe(of_entry, tmp, &mfd_of_node_list, list) - if (of_entry->dev =3D=3D &pdev->dev) { - list_del(&of_entry->list); - kfree(of_entry); - } + scoped_guard(mutex, &mfd_of_node_mutex) { + list_for_each_entry_safe(of_entry, tmp, &mfd_of_node_list, list) + if (of_entry->dev =3D=3D &pdev->dev) { + list_del(&of_entry->list); + kfree(of_entry); + } + } =20 regulator_bulk_unregister_supply_alias(dev, cell->parent_supplies, cell->num_parent_supplies); --=20 2.52.0.223.gf5cc29aaa4-goog