| Message ID | 20240604085838.3344-1-hagarhem@amazon.com |
|---|---|
| State | New |
| Headers | show |
| Series | [v2] pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER | expand |
On Tue, Jun 4, 2024 at 10:58 AM Hagar Hemdan <hagarhem@amazon.com> wrote: > In create_pinctrl(), pinctrl_maps_mutex is acquired before calling > add_setting(). If add_setting() returns -EPROBE_DEFER, create_pinctrl() > calls pinctrl_free(). However, pinctrl_free() attempts to acquire > pinctrl_maps_mutex, which is already held by create_pinctrl(), leading to > a potential deadlock. > > This patch resolves the issue by releasing pinctrl_maps_mutex before > calling pinctrl_free(), preventing the deadlock. > > This bug was discovered and resolved using Coverity Static Analysis > Security Testing (SAST) by Synopsys, Inc. > > Fixes: 42fed7ba44e4 ("pinctrl: move subsystem mutex to pinctrl_dev struct") > Suggested-by: Maximilian Heyne <mheyne@amazon.de> > Signed-off-by: Hagar Hemdan <hagarhem@amazon.com> Looks like a real issue so patch applied for fixes. Yours, Linus Walleij
diff --git a/drivers/pinctrl/core.c b/drivers/pinctrl/core.c index cffeb869130d..f424a57f0013 100644 --- a/drivers/pinctrl/core.c +++ b/drivers/pinctrl/core.c @@ -1106,8 +1106,8 @@ static struct pinctrl *create_pinctrl(struct device *dev, * an -EPROBE_DEFER later, as that is the worst case. */ if (ret == -EPROBE_DEFER) { - pinctrl_free(p, false); mutex_unlock(&pinctrl_maps_mutex); + pinctrl_free(p, false); return ERR_PTR(ret); } }
In create_pinctrl(), pinctrl_maps_mutex is acquired before calling add_setting(). If add_setting() returns -EPROBE_DEFER, create_pinctrl() calls pinctrl_free(). However, pinctrl_free() attempts to acquire pinctrl_maps_mutex, which is already held by create_pinctrl(), leading to a potential deadlock. This patch resolves the issue by releasing pinctrl_maps_mutex before calling pinctrl_free(), preventing the deadlock. This bug was discovered and resolved using Coverity Static Analysis Security Testing (SAST) by Synopsys, Inc. Fixes: 42fed7ba44e4 ("pinctrl: move subsystem mutex to pinctrl_dev struct") Suggested-by: Maximilian Heyne <mheyne@amazon.de> Signed-off-by: Hagar Hemdan <hagarhem@amazon.com> --- only compile tested v2: Updated the commit msg. --- drivers/pinctrl/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)