From nobody Sun Feb 8 23:26:26 2026 Received: from mta-65-227.siemens.flowmailer.net (mta-65-227.siemens.flowmailer.net [185.136.65.227]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 12400355058 for ; Tue, 27 Jan 2026 16:05:28 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=185.136.65.227 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1769529932; cv=none; b=lxYW5wIS+5LUmrGxjalqUOlCxUytejiGIZAbJObgY9CMKaY1H/Fexn9BV0xGJ3kStgi5cP3LWXEGlZJeenm7HwlWW4nLRzyFhyc1eYsbDRhi9EJgUpIgNHp17q+Ohc2mmzWErm9SSb5lXgwMGq7EAZq0AEL00NVo21KA3zC3qV8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1769529932; c=relaxed/simple; bh=WyvhLAWRi2HrTThtGboe7xBjhcjaMbZRhzWiqFsw1Rs=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=Fw6N4M75702zZk+J/BHVbqC8D6/P3EUbRPo0nl8d8PQbd5veKuAKP2RavstwIOmv0E1eMyDgSMN7wiCSDVl2UJWyI2K86xpPLMSgv6kvrql/y8vxtlpRo/6oRJpbrav1IzQU7yqUbGoP8uDMn8rmcLiAo6zvIZ9p9VnH01RzDNM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=siemens.com; spf=pass smtp.mailfrom=rts-flowmailer.siemens.com; dkim=pass (2048-bit key) header.d=siemens.com header.i=alexander.sverdlin@siemens.com header.b=V9b5kVjE; arc=none smtp.client-ip=185.136.65.227 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=siemens.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=rts-flowmailer.siemens.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=siemens.com header.i=alexander.sverdlin@siemens.com header.b="V9b5kVjE" Received: by mta-65-227.siemens.flowmailer.net with ESMTPSA id 202601271605201d0111589a000207cf for ; Tue, 27 Jan 2026 17:05:21 +0100 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm1; d=siemens.com; i=alexander.sverdlin@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc; bh=oQCqsTNT8hrYuZAc2yQgKDdUTceItemN1akukJur82E=; b=V9b5kVjE6aXvZ6xUqtyXfBQuci0PWgz0Nl6/2GDmYUrJ25052a22aTIDTyrR9At9T5vHpf xjieco7dfyhxg3clSc9b7/0u84DNjKAbN1om9r7eaA59+qnbcPI+/j8u4V/j4AbygTP4X9rB M2jdeQxDEoewQmZxiwZRAJxp5LxR3MBE2r5U12RAYYSMDPaoZQ+BMYAi2oQdnAwHrlne94Od ToObOxkBXUfPFFVe/JQY7qUfXnG3ahEcMHDrH2QqXbOr5oxJyhserkc0xnY99xihTB0+8Mtc 8NJvvb7CkYpsL2Qm3V8QJXhmwQ7YdZx5tkCj4J+/3niNrwCuMxbCbjOw==; From: "A. Sverdlin" To: Vijai Kumar K , linux-kernel@vger.kernel.org Cc: Alexander Sverdlin , Krzysztof Kozlowski , MyungJoo Ham , Chanwoo Choi , stable@vger.kernel.org Subject: [PATCH] extcon: ptn5150: Avoid IRQ vs probe race and drop mutex Date: Tue, 27 Jan 2026 17:05:06 +0100 Message-ID: <20260127160512.577735-1-alexander.sverdlin@siemens.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-456497:519-21489:flowmailer Content-Type: text/plain; charset="utf-8" From: Alexander Sverdlin The IRQ is being requested quite early in probe sequence, where neither mutex has been taken, nor info->edev has been set yet. From this point on one shall expect the handler to be called. The corresponding test for !info->edev looks pointless being not protected by the mutex. Moving the IRQ request to the end of probe sequence avoids the race against ptn5150_check_state() and other init steps (devm_extcon_dev_allocate(), devm_extcon_dev_register()). Finally it becomes obvious that the worker function doesn't run concurrently with anything else and we can drop the mutex completely. The change has been motivated by the following crash: Unable to handle kernel paging request at virtual address 006c727400353434 CPU: 1 UID: 0 PID: 74 Comm: kworker/1:2 6.18.0-next-20251212 Workqueue: events ptn5150_irq_work [extcon_ptn5150] pc : 0x6c727400353434 lr : notifier_call_chain+0x80 Call trace: 0x6c727400353434 (P) raw_notifier_call_chain+0x20 extcon_sync+0xd0 extcon_set_state_sync+0x3c ptn5150_check_state+0xf8 [extcon_ptn5150] ptn5150_irq_work [extcon_ptn5150] process_one_work worker_thread kthread ret_from_fork Kernel panic - not syncing: Oops: Fatal exception Cc: stable@vger.kernel.org Fixes: 4ed754de2d66 ("extcon: Add support for ptn5150 extcon driver") Signed-off-by: Alexander Sverdlin --- drivers/extcon/extcon-ptn5150.c | 38 ++++++++++----------------------- 1 file changed, 11 insertions(+), 27 deletions(-) diff --git a/drivers/extcon/extcon-ptn5150.c b/drivers/extcon/extcon-ptn515= 0.c index eca1b140aeb0f..cb5646bf91c5e 100644 --- a/drivers/extcon/extcon-ptn5150.c +++ b/drivers/extcon/extcon-ptn5150.c @@ -57,7 +57,6 @@ struct ptn5150_info { struct gpio_desc *vbus_gpiod; int irq; struct work_struct irq_work; - struct mutex mutex; struct typec_switch *orient_sw; struct usb_role_switch *role_sw; }; @@ -144,16 +143,10 @@ static void ptn5150_irq_work(struct work_struct *work) int ret =3D 0; unsigned int int_status; =20 - if (!info->edev) - return; - - mutex_lock(&info->mutex); - /* Clear interrupt. Read would clear the register */ ret =3D regmap_read(info->regmap, PTN5150_REG_INT_STATUS, &int_status); if (ret) { dev_err(info->dev, "failed to read INT STATUS %d\n", ret); - mutex_unlock(&info->mutex); return; } =20 @@ -188,14 +181,9 @@ static void ptn5150_irq_work(struct work_struct *work) /* Clear interrupt. Read would clear the register */ ret =3D regmap_read(info->regmap, PTN5150_REG_INT_REG_STATUS, &int_status); - if (ret) { + if (ret) dev_err(info->dev, "failed to read INT REG STATUS %d\n", ret); - mutex_unlock(&info->mutex); - return; - } - - mutex_unlock(&info->mutex); } =20 =20 @@ -281,8 +269,6 @@ static int ptn5150_i2c_probe(struct i2c_client *i2c) } } =20 - mutex_init(&info->mutex); - INIT_WORK(&info->irq_work, ptn5150_irq_work); =20 info->regmap =3D devm_regmap_init_i2c(i2c, &ptn5150_regmap_config); @@ -307,16 +293,6 @@ static int ptn5150_i2c_probe(struct i2c_client *i2c) } } =20 - ret =3D devm_request_threaded_irq(dev, info->irq, NULL, - ptn5150_irq_handler, - IRQF_TRIGGER_FALLING | - IRQF_ONESHOT, - i2c->name, info); - if (ret < 0) { - dev_err(dev, "failed to request handler for INTB IRQ\n"); - return ret; - } - /* Allocate extcon device */ info->edev =3D devm_extcon_dev_allocate(info->dev, ptn5150_extcon_cable); if (IS_ERR(info->edev)) { @@ -366,9 +342,17 @@ static int ptn5150_i2c_probe(struct i2c_client *i2c) * Update current extcon state if for example OTG connection was there * before the probe */ - mutex_lock(&info->mutex); ptn5150_check_state(info); - mutex_unlock(&info->mutex); + + ret =3D devm_request_threaded_irq(dev, info->irq, NULL, + ptn5150_irq_handler, + IRQF_TRIGGER_FALLING | + IRQF_ONESHOT, + i2c->name, info); + if (ret < 0) { + dev_err(dev, "failed to request handler for INTB IRQ\n"); + return ret; + } =20 return 0; } --=20 2.52.0