From nobody Tue Apr 7 12:23:29 2026 Received: from smtp95.iad3b.emailsrvr.com (smtp95.iad3b.emailsrvr.com [146.20.161.95]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3B8223D3324 for ; Wed, 25 Feb 2026 14:01:59 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=146.20.161.95 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772028121; cv=none; b=j+AvO+WoPaqatmENsXmPbELOADV/qruDAHUWVhgT5/kSZFp6KO0BlRTg8f+I/0/cu65Dw/kAtCk3d3P8oVEzazZR60UxP0bljwTSaLBgZEcZTpUWAi1QFFOq5NPQLghB+pQE0f4aZz8SFTlIJNldVdahw9Es9yW/PFJjrdAVG4I= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772028121; c=relaxed/simple; bh=9P5pckf8La+WEjFL0QLcoHbJM+LEPELYbgZxXolscYk=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=oubr8m4eITlRhWJh77cptPXmGIiWUNiG2o1g042QQnNFciY4/pll1VGUDTUlJahoXTakQvDRT3nOfhiQcgC6I0fUuWcIV3ZfSrECg7sGGqv3uSe6u4DUBSUB24f5kmX3pHvm4eQhYze9Errqq1ibRK40Pp8HX1JyJmqfLl3/sFA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=mev.co.uk; spf=pass smtp.mailfrom=mev.co.uk; dkim=pass (1024-bit key) header.d=mev.co.uk header.i=@mev.co.uk header.b=kBKryIbG; arc=none smtp.client-ip=146.20.161.95 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=mev.co.uk Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=mev.co.uk Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=mev.co.uk header.i=@mev.co.uk header.b="kBKryIbG" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=mev.co.uk; s=20221208-6x11dpa4; t=1772025882; bh=9P5pckf8La+WEjFL0QLcoHbJM+LEPELYbgZxXolscYk=; h=From:To:Subject:Date:From; b=kBKryIbG4VdmzCFTiFmKgk7/jN3wua4N3BsgSfyqxTLjbTbVS05HeR8mMGH6T3aFp tvrTagAen/sfBSvywCyMlbzZkmwQy+2CRDzfeTfYXUHRZS6c/7Hv+PLCy4zYgRTQVQ TQGgnBeRsrDFHm/+VOYHKTPhXeyk7clg22O8RCSA= X-Auth-ID: abbotti@mev.co.uk Received: by smtp4.relay.iad3b.emailsrvr.com (Authenticated sender: abbotti-AT-mev.co.uk) with ESMTPSA id 5E1D9205B5; Wed, 25 Feb 2026 08:24:41 -0500 (EST) From: Ian Abbott To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , Ian Abbott , H Hartley Sweeten , syzbot+cc9f7f4a7df09f53c4a4@syzkaller.appspotmail.com Subject: [PATCH] comedi: Reinit dev->spinlock between attachments to low-level drivers Date: Wed, 25 Feb 2026 13:24:27 +0000 Message-ID: <20260225132427.86578-1-abbotti@mev.co.uk> X-Mailer: git-send-email 2.51.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Classification-ID: 02e7a1ef-efd4-4ba1-adb5-14cddf8d1df4-1-1 Content-Type: text/plain; charset="utf-8" `struct comedi_device` is the main controlling structure for a COMEDI device created by the COMEDI subsystem. It contains a member `spinlock` containing a spin-lock that is initialized by the COMEDI subsystem, but is reserved for use by a low-level driver attached to the COMEDI device (at least since commit 25436dc9d84f ("Staging: comedi: remove RT code")). Some COMEDI devices (those created on initialization of the COMEDI subsystem when the "comedi.comedi_num_legacy_minors" parameter is non-zero) can be attached to different low-level drivers over their lifetime using the `COMEDI_DEVCONFIG` ioctl command. This can result in inconsistent lock states being reported when there is a mismatch in the spin-lock locking levels used by each low-level driver to which the COMEDI device has been attached. Fix it by reinitializing `dev->spinlock` before calling the low-level driver's `attach` function pointer if `CONFIG_LOCKDEP` is enabled. Reported-by: syzbot+cc9f7f4a7df09f53c4a4@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=3Dcc9f7f4a7df09f53c4a4 Fixes: ed9eccbe8970 ("Staging: add comedi core") Signed-off-by: Ian Abbott --- drivers/comedi/drivers.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/comedi/drivers.c b/drivers/comedi/drivers.c index db225a3bf012..5ab96b5eefd1 100644 --- a/drivers/comedi/drivers.c +++ b/drivers/comedi/drivers.c @@ -1063,6 +1063,14 @@ int comedi_device_attach(struct comedi_device *dev, = struct comedi_devconfig *it) ret =3D -EIO; goto out; } + if (IS_ENABLED(CONFIG_LOCKDEP)) { + /* + * dev->spinlock is for private use by the attached low-level + * driver. Reinitialize it to stop lock-dependency tracking + * between attachments to different low-level drivers. + */ + spin_lock_init(&dev->spinlock); + } dev->driver =3D driv; dev->board_name =3D dev->board_ptr ? *(const char **)dev->board_ptr : dev->driver->driver_name; --=20 2.51.0