- Kernel - mailweb.openeuler.org

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION 91a0e2bd65755d19aaa1270a6298faab8e29643b
by kernel test robot 09 Jul '25

09 Jul '25

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 91a0e2bd65755d19aaa1270a6298faab8e29643b !17017 ipvlan: Fix out-of-bounds caused by unclear skb->cb in I2e mode Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202506182031.ldH7VynO-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202507030343.E83xAhC0-lkp@intel.com kernel/sched/core.c:5989:22: error: 'root_task_group' undeclared (first use in this function); did you mean 'task_group'? kernel/sched/core.c:5989:29: error: 'root_task_group' undeclared (first use in this function); did you mean 'task_group'? mm/mmu_gather.o: warning: objtool: missing symbol for section .text Unverified Error/Warning (likely false positive, kindly check if interested): drivers/gpu/drm/amd/amdgpu/amdgpu_ids.o: warning: objtool: amdgpu_vmid_grab()+0xd3e: unreachable instruction Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- include-asm-generic-bitops-non-atomic.h:error:array-subscript-long-unsigned-int-is-partly-outside-array-bounds-of-u32-aka-unsigned-int | |-- include-uapi-linux-sctp.h:error:alignment-of-struct-sctp_paddr_change-is-less-than | |-- include-uapi-linux-sctp.h:error:alignment-of-struct-sctp_paddrinfo-is-less-than | |-- include-uapi-linux-sctp.h:error:alignment-of-struct-sctp_paddrparams-is-less-than | |-- include-uapi-linux-sctp.h:error:alignment-of-struct-sctp_prim-is-less-than | |-- include-uapi-linux-sctp.h:error:alignment-of-struct-sctp_setpeerprim-is-less-than | |-- include-uapi-linux-sctp.h:error:spinfo_address-offset-in-struct-sctp_paddrinfo-isn-t-aligned-to | |-- include-uapi-linux-sctp.h:error:spp_address-offset-in-struct-sctp_paddrparams-isn-t-aligned-to | |-- include-uapi-linux-sctp.h:error:ssp_addr-offset-in-struct-sctp_prim-isn-t-aligned-to | |-- include-uapi-linux-sctp.h:error:sspp_addr-offset-in-struct-sctp_setpeerprim-isn-t-aligned-to | `-- mm-rodata_test.c:warning:no-previous-prototype-for-rodata_test |-- arm64-allnoconfig | |-- kernel-sched-core.c:error:root_task_group-undeclared-(first-use-in-this-function) | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa | |-- mm-rmap.c:warning:no-previous-prototype-for-is_vma_temporary_stack | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- arm64-randconfig-001-20250708 | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- kernel-sched-core.c:error:root_task_group-undeclared-(first-use-in-this-function) | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa | |-- mm-rmap.c:warning:no-previous-prototype-for-is_vma_temporary_stack | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- arm64-randconfig-002-20250708 | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- mm-rmap.c:warning:no-previous-prototype-for-is_vma_temporary_stack | |-- mm-rodata_test.c:warning:no-previous-prototype-for-rodata_test | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- arm64-randconfig-003-20250708 | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- drivers-tty-tty_buffer.c:error:implicit-declaration-of-function-printk_safe_enter | |-- drivers-tty-tty_buffer.c:error:implicit-declaration-of-function-printk_safe_exit | |-- kernel-sched-core.c:error:root_task_group-undeclared-(first-use-in-this-function) | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa | |-- mm-rmap.c:warning:no-previous-prototype-for-is_vma_temporary_stack | |-- mm-rodata_test.c:warning:no-previous-prototype-for-rodata_test | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- x86_64-allnoconfig | `-- mm-mmu_gather.o:warning:objtool:missing-symbol-for-section-.text |-- x86_64-allyesconfig | `-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union |-- x86_64-buildonly-randconfig-003-20250708 | `-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union |-- x86_64-buildonly-randconfig-005-20250708 | `-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union |-- x86_64-buildonly-randconfig-006-20250708 | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | `-- kernel-sched-core.c:error:use-of-undeclared-identifier-root_task_group |-- x86_64-defconfig | |-- include-asm-generic-bug.h:warning:mcu_ctrl-may-be-used-uninitialized-in-this-function | `-- mm-rmap.c:warning:no-previous-prototype-for-is_vma_temporary_stack |-- x86_64-randconfig-103-20250305 | `-- drivers-gpu-drm-amd-amdgpu-amdgpu_ids.o:warning:objtool:amdgpu_vmid_grab:unreachable-instruction |-- x86_64-randconfig-161-20250709 | `-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union `-- x86_64-rhel-9.4-rust |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union `-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool elapsed time: 826m configs tested: 16 configs skipped: 115 tested configs: arm64 allmodconfig gcc-15.1.0 arm64 allnoconfig gcc-15.1.0 arm64 randconfig-001-20250708 gcc-9.5.0 arm64 randconfig-002-20250708 gcc-10.5.0 arm64 randconfig-003-20250708 gcc-8.5.0 arm64 randconfig-004-20250708 gcc-6.5.0 x86_64 allnoconfig clang-20 x86_64 allyesconfig clang-20 x86_64 buildonly-randconfig-001-20250708 gcc-12 x86_64 buildonly-randconfig-002-20250708 gcc-12 x86_64 buildonly-randconfig-003-20250708 clang-20 x86_64 buildonly-randconfig-004-20250708 gcc-12 x86_64 buildonly-randconfig-005-20250708 clang-20 x86_64 buildonly-randconfig-006-20250708 clang-20 x86_64 defconfig gcc-11 x86_64 rhel-9.4-rust clang-21 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] platform/x86: dell_rbu: Fix list usage
by Huang Xiaojia 08 Jul '25

08 Jul '25

From: Stuart Hayes <stuart.w.hayes(a)gmail.com> stable inclusion from stable-v6.6.95 commit f3b840fb1508a80cd8a0efb5c886ae1995a88b24 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICK4SB CVE: CVE-2025-38197 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 61ce04601e0d8265ec6d2ffa6df5a7e1bce64854 ] Pass the correct list head to list_for_each_entry*() when looping through the packet list. Without this patch, reading the packet data via sysfs will show the data incorrectly (because it starts at the wrong packet), and clearing the packet list will result in a NULL pointer dereference. Fixes: d19f359fbdc6 ("platform/x86: dell_rbu: don't open code list_for_each_entry*()") Signed-off-by: Stuart Hayes <stuart.w.hayes(a)gmail.com> Link: https://lore.kernel.org/r/20250609184659.7210-3-stuart.w.hayes@gmail.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen(a)linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen(a)linux.intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Huang Xiaojia <huangxiaojia2(a)huawei.com> --- drivers/platform/x86/dell/dell_rbu.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/platform/x86/dell/dell_rbu.c b/drivers/platform/x86/dell/dell_rbu.c index 9f51e0fcab04..4d2b5f6dd513 100644 --- a/drivers/platform/x86/dell/dell_rbu.c +++ b/drivers/platform/x86/dell/dell_rbu.c @@ -292,7 +292,7 @@ static int packet_read_list(char *data, size_t * pread_length) remaining_bytes = *pread_length; bytes_read = rbu_data.packet_read_count; - list_for_each_entry(newpacket, (&packet_data_head.list)->next, list) { + list_for_each_entry(newpacket, &packet_data_head.list, list) { bytes_copied = do_packet_read(pdest, newpacket, remaining_bytes, bytes_read, &temp_count); remaining_bytes -= bytes_copied; @@ -315,7 +315,7 @@ static void packet_empty_list(void) { struct packet_data *newpacket, *tmp; - list_for_each_entry_safe(newpacket, tmp, (&packet_data_head.list)->next, list) { + list_for_each_entry_safe(newpacket, tmp, &packet_data_head.list, list) { list_del(&newpacket->list); /* -- 2.34.1

2 1

[PATCH OLK-5.10 00/11] RDMA/hns: Stability and Security Fixes and Improvements
by huangdonghua 08 Jul '25

08 Jul '25

Fixes issues such as memory leaks, invalid access, information leakage, and parameter errors. Improves parameter validation and resource initialization to enhance driver stability and security. Chengchang Tang (1): RDMA/hns: Fix accessing invalid dip_ctx during destroying QP Junxian Huang (6): RDMA/hns: Add check between dca_min_size and dca_max_size RDMA/hns: Fix accessing uninitialized resources RDMA/hns: Fix poe memory leak in error flow RDMA/hns: Fix descriptions of stars api RDMA/hns: Fix divide-by-zero error in dca debugfs RDMA/hns: Use __free_page() to free pages allocated with alloc_page() Yuyu Li (2): RDMA/hns: Fix congestion control algorithm parameter range RDMA/hns: Fix scc_param failed logic judgments wenglianfa (2): RDMA/hns: Fix address information leakage of DCA memory RDMA/hns: Fix double destruction of rsv_qp drivers/infiniband/hw/hns/hns_roce_dca.c | 5 +-- drivers/infiniband/hw/hns/hns_roce_debugfs.c | 7 ++++ drivers/infiniband/hw/hns/hns_roce_device.h | 2 ++ drivers/infiniband/hw/hns/hns_roce_ext.h | 22 ++++++++++++- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 34 ++++++++++++-------- drivers/infiniband/hw/hns/hns_roce_hw_v2.h | 22 +++++++++---- drivers/infiniband/hw/hns/hns_roce_main.c | 20 ++++-------- drivers/infiniband/hw/hns/hns_roce_qp.c | 2 ++ drivers/infiniband/hw/hns/hns_roce_sysfs.c | 3 +- 9 files changed, 79 insertions(+), 38 deletions(-) -- 2.33.0

2 12

[PATCH OLK-5.10 00/11] RDMA/hns: Stability and Security Fixes and Improvements
by huangdonghua 08 Jul '25

08 Jul '25

Fixes issues such as memory leaks, invalid access, information leakage, and parameter errors. Improves parameter validation and resource initialization to enhance driver stability and security. Chengchang Tang (1): RDMA/hns: Fix accessing invalid dip_ctx during destroying QP Junxian Huang (6): RDMA/hns: Add check between dca_min_size and dca_max_size RDMA/hns: Fix accessing uninitialized resources RDMA/hns: Fix poe memory leak in error flow RDMA/hns: Fix descriptions of stars api RDMA/hns: Fix divide-by-zero error in dca debugfs RDMA/hns: Use __free_page() to free pages allocated with alloc_page() Yuyu Li (2): RDMA/hns: Fix congestion control algorithm parameter range RDMA/hns: Fix scc_param failed logic judgments wenglianfa (2): RDMA/hns: Fix address information leakage of DCA memory RDMA/hns: Fix double destruction of rsv_qp drivers/infiniband/hw/hns/hns_roce_dca.c | 5 +-- drivers/infiniband/hw/hns/hns_roce_debugfs.c | 7 ++++ drivers/infiniband/hw/hns/hns_roce_device.h | 2 ++ drivers/infiniband/hw/hns/hns_roce_ext.h | 22 ++++++++++++- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 34 ++++++++++++-------- drivers/infiniband/hw/hns/hns_roce_hw_v2.h | 22 +++++++++---- drivers/infiniband/hw/hns/hns_roce_main.c | 20 ++++-------- drivers/infiniband/hw/hns/hns_roce_qp.c | 2 ++ drivers/infiniband/hw/hns/hns_roce_sysfs.c | 3 +- 9 files changed, 79 insertions(+), 38 deletions(-) -- 2.33.0

2 12

[PATCH openEuler-1.0-LTS v2 0/6] net: Fix CVE-2025-38000
by Dong Chenchen 08 Jul '25

08 Jul '25

Fix CVE-2025-38000 Cong Wang (4): sch_drr: make drr_qlen_notify() idempotent sch_hfsc: make hfsc_qlen_notify() idempotent sch_qfq: make qfq_qlen_notify() idempotent sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() Dong Chenchen (1): sch_cbq: make cbq_qlen_notify() idempotent Lion Ackermann (1): net/sched: Always pass notifications when child class becomes empty net/sched/sch_api.c | 19 +++++-------------- net/sched/sch_cbq.c | 3 ++- net/sched/sch_drr.c | 7 ++++--- net/sched/sch_hfsc.c | 14 +++++++++----- net/sched/sch_qfq.c | 7 +++++-- 5 files changed, 25 insertions(+), 25 deletions(-) -- 2.25.1

2 7

[PATCH OLK-5.10] arm64: Fix a typo in xcall_init_task()
by Jinjie Ruan 08 Jul '25

08 Jul '25

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/release-management/issues/IC9Q31 -------------------------------- In xcall_init_task(), it should copy the original xcall enable bitmap to the new process. Fixes: f22baea0113c ("arm64: Reserve a kabi in task_struct exclusively for xcall") Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- arch/arm64/kernel/xcall.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/arm64/kernel/xcall.c b/arch/arm64/kernel/xcall.c index fd62b8dd3020..f778671c21cf 100644 --- a/arch/arm64/kernel/xcall.c +++ b/arch/arm64/kernel/xcall.c @@ -19,7 +19,7 @@ int xcall_init_task(struct task_struct *p, struct task_struct *orig) return -ENOMEM; if (orig->xinfo) { - bitmap_copy(TASK_XINFO(p)->xcall_enable, TASK_XINFO(p)->xcall_enable, + bitmap_copy(TASK_XINFO(p)->xcall_enable, TASK_XINFO(orig)->xcall_enable, __NR_syscalls); #ifdef CONFIG_XCALL_PREFETCH TASK_XINFO(p)->prefetch = TASK_XINFO(orig)->prefetch; -- 2.34.1

2 1

[PATCH OLK-5.10 00/12] RDMA/hns: Stability and Security Fixes and Improvements
by huangdonghua 08 Jul '25

08 Jul '25

Fixes issues such as memory leaks, invalid access, information leakage, and parameter errors. Improves parameter validation and resource initialization to enhance driver stability and security. Chengchang Tang (1): RDMA/hns: Fix accessing invalid dip_ctx during destroying QP Junxian Huang (7): RDMA/hns: Add check between dca_min_size and dca_max_size RDMA/hns: Fix accessing uninitialized resources RDMA/hns: Fix poe memory leak in error flow RDMA/hns: Fix descriptions of stars api RDMA/hns: Fix divide-by-zero error in dca debugfs RDMA/hns: Use __free_page() to free pages allocated with alloc_page() RDMA/hns: Fix unmatched condition in error flow Yuyu Li (2): RDMA/hns: Fix congestion control algorithm parameter range RDMA/hns: Fix scc_param failed logic judgments wenglianfa (2): RDMA/hns: Fix address information leakage of DCA memory RDMA/hns: Fix double destruction of rsv_qp drivers/infiniband/hw/hns/hns_roce_dca.c | 5 +-- drivers/infiniband/hw/hns/hns_roce_debugfs.c | 7 ++++ drivers/infiniband/hw/hns/hns_roce_device.h | 2 ++ drivers/infiniband/hw/hns/hns_roce_ext.h | 22 ++++++++++++- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 34 ++++++++++++-------- drivers/infiniband/hw/hns/hns_roce_hw_v2.h | 22 +++++++++---- drivers/infiniband/hw/hns/hns_roce_main.c | 20 ++++-------- drivers/infiniband/hw/hns/hns_roce_qp.c | 2 ++ drivers/infiniband/hw/hns/hns_roce_sysfs.c | 3 +- 9 files changed, 79 insertions(+), 38 deletions(-) -- 2.33.0

2 13

[PATCH openEuler-1.0-LTS] net: ch9200: fix uninitialised access during mii_nway_restart
by Zhang Changzhong 08 Jul '25

08 Jul '25

From: Qasim Ijaz <qasdev00(a)gmail.com> mainline inclusion from mainline-v6.16-rc1 commit 9ad0452c0277b816a435433cca601304cfac7c21 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICIQAB CVE: CVE-2025-38086 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In mii_nway_restart() the code attempts to call mii->mdio_read which is ch9200_mdio_read(). ch9200_mdio_read() utilises a local buffer called "buff", which is initialised with control_read(). However "buff" is conditionally initialised inside control_read(): if (err == size) { memcpy(data, buf, size); } If the condition of "err == size" is not met, then "buff" remains uninitialised. Once this happens the uninitialised "buff" is accessed and returned during ch9200_mdio_read(): return (buff[0] | buff[1] << 8); The problem stems from the fact that ch9200_mdio_read() ignores the return value of control_read(), leading to uinit-access of "buff". To fix this we should check the return value of control_read() and return early on error. Reported-by: syzbot <syzbot+3361c2d6f78a3e0892f9(a)syzkaller.appspotmail.com> Closes: https://syzkaller.appspot.com/bug?extid=3361c2d6f78a3e0892f9 Tested-by: syzbot <syzbot+3361c2d6f78a3e0892f9(a)syzkaller.appspotmail.com> Fixes: 4a476bd6d1d9 ("usbnet: New driver for QinHeng CH9200 devices") Cc: stable(a)vger.kernel.org Signed-off-by: Qasim Ijaz <qasdev00(a)gmail.com> Link: https://patch.msgid.link/20250526183607.66527-1-qasdev00@gmail.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- drivers/net/usb/ch9200.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/net/usb/ch9200.c b/drivers/net/usb/ch9200.c index 9df3c1f..52d73b7 100644 --- a/drivers/net/usb/ch9200.c +++ b/drivers/net/usb/ch9200.c @@ -180,6 +180,7 @@ static int ch9200_mdio_read(struct net_device *netdev, int phy_id, int loc) { struct usbnet *dev = netdev_priv(netdev); unsigned char buff[2]; + int ret; netdev_dbg(netdev, "ch9200_mdio_read phy_id:%02x loc:%02x\n", phy_id, loc); @@ -187,8 +188,10 @@ static int ch9200_mdio_read(struct net_device *netdev, int phy_id, int loc) if (phy_id != 0) return -ENODEV; - control_read(dev, REQUEST_READ, 0, loc * 2, buff, 0x02, - CONTROL_TIMEOUT_MS); + ret = control_read(dev, REQUEST_READ, 0, loc * 2, buff, 0x02, + CONTROL_TIMEOUT_MS); + if (ret < 0) + return ret; return (buff[0] | buff[1] << 8); } -- 2.9.5

2 1

[PATCH OLK-6.6] iio: light: opt3001: fix deadlock due to concurrent flag access
by Ye Bin 08 Jul '25

08 Jul '25

From: Luca Ceresoli <luca.ceresoli(a)bootlin.com> mainline inclusion from mainline-v6.15-rc6 commit f063a28002e3350088b4577c5640882bf4ea17ea category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC992V CVE: CVE-2025-37968 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The threaded IRQ function in this driver is reading the flag twice: once to lock a mutex and once to unlock it. Even though the code setting the flag is designed to prevent it, there are subtle cases where the flag could be true at the mutex_lock stage and false at the mutex_unlock stage. This results in the mutex not being unlocked, resulting in a deadlock. Fix it by making the opt3001_irq() code generally more robust, reading the flag into a variable and using the variable value at both stages. Fixes: 94a9b7b1809f ("iio: light: add support for TI's opt3001 light sensor") Cc: stable(a)vger.kernel.org Signed-off-by: Luca Ceresoli <luca.ceresoli(a)bootlin.com> Link: https://patch.msgid.link/20250321-opt3001-irq-fix-v1-1-6c520d851562@bootlin… Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> Conflicts: drivers/iio/light/opt3001.c [As context diff] Signed-off-by: Ye Bin <yebin10(a)huawei.com> --- drivers/iio/light/opt3001.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/iio/light/opt3001.c b/drivers/iio/light/opt3001.c index dc529cbe3805..25a45c4251fb 100644 --- a/drivers/iio/light/opt3001.c +++ b/drivers/iio/light/opt3001.c @@ -692,8 +692,9 @@ static irqreturn_t opt3001_irq(int irq, void *_iio) struct opt3001 *opt = iio_priv(iio); int ret; bool wake_result_ready_queue = false; + bool ok_to_ignore_lock = opt->ok_to_ignore_lock; - if (!opt->ok_to_ignore_lock) + if (!ok_to_ignore_lock) mutex_lock(&opt->lock); ret = i2c_smbus_read_word_swapped(opt->client, OPT3001_CONFIGURATION); @@ -730,7 +731,7 @@ static irqreturn_t opt3001_irq(int irq, void *_iio) } out: - if (!opt->ok_to_ignore_lock) + if (!ok_to_ignore_lock) mutex_unlock(&opt->lock); if (wake_result_ready_queue) -- 2.34.1

2 1

[PATCH OLK-5.10] iio: light: opt3001: fix deadlock due to concurrent flag access
by Ye Bin 08 Jul '25

08 Jul '25

From: Luca Ceresoli <luca.ceresoli(a)bootlin.com> mainline inclusion from mainline-v6.15-rc6 commit f063a28002e3350088b4577c5640882bf4ea17ea category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC992V CVE: CVE-2025-37968 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The threaded IRQ function in this driver is reading the flag twice: once to lock a mutex and once to unlock it. Even though the code setting the flag is designed to prevent it, there are subtle cases where the flag could be true at the mutex_lock stage and false at the mutex_unlock stage. This results in the mutex not being unlocked, resulting in a deadlock. Fix it by making the opt3001_irq() code generally more robust, reading the flag into a variable and using the variable value at both stages. Fixes: 94a9b7b1809f ("iio: light: add support for TI's opt3001 light sensor") Cc: stable(a)vger.kernel.org Signed-off-by: Luca Ceresoli <luca.ceresoli(a)bootlin.com> Link: https://patch.msgid.link/20250321-opt3001-irq-fix-v1-1-6c520d851562@bootlin… Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> Conflicts: drivers/iio/light/opt3001.c [As context diff] Signed-off-by: Ye Bin <yebin10(a)huawei.com> --- drivers/iio/light/opt3001.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/iio/light/opt3001.c b/drivers/iio/light/opt3001.c index ff776259734a..a6823130d387 100644 --- a/drivers/iio/light/opt3001.c +++ b/drivers/iio/light/opt3001.c @@ -688,8 +688,9 @@ static irqreturn_t opt3001_irq(int irq, void *_iio) struct opt3001 *opt = iio_priv(iio); int ret; bool wake_result_ready_queue = false; + bool ok_to_ignore_lock = opt->ok_to_ignore_lock; - if (!opt->ok_to_ignore_lock) + if (!ok_to_ignore_lock) mutex_lock(&opt->lock); ret = i2c_smbus_read_word_swapped(opt->client, OPT3001_CONFIGURATION); @@ -726,7 +727,7 @@ static irqreturn_t opt3001_irq(int irq, void *_iio) } out: - if (!opt->ok_to_ignore_lock) + if (!ok_to_ignore_lock) mutex_unlock(&opt->lock); if (wake_result_ready_queue) -- 2.34.1

2 1