linux-kernel - [PATCH v1] gpio: gpio-grgpio: call request_irq after incrementing the reference count

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20250928054019.1189591-1-alex.t.tran@gmail.com>
Date: Sat, 27 Sep 2025 22:40:19 -0700
From: Alex Tran <alex.t.tran@...il.com>
To: Linus Walleij <linus.walleij@...aro.org>
Cc: Bartosz Golaszewski <brgl@...ev.pl>,
	linux-gpio@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	Alex Tran <alex.t.tran@...il.com>
Subject: [PATCH v1] gpio: gpio-grgpio: call request_irq after incrementing the reference count

Remove extraneous dropping of the lock just to call 'request_irq'
and locking again afterwards. Increment reference count
before calling 'request_irq'. Rollback reference count if
'request_irq' fails.

Signed-off-by: Alex Tran <alex.t.tran@...il.com>
---
 drivers/gpio/gpio-grgpio.c | 25 ++++++++++++-------------
 1 file changed, 12 insertions(+), 13 deletions(-)

diff --git a/drivers/gpio/gpio-grgpio.c b/drivers/gpio/gpio-grgpio.c
index 0c0f97fa14fc..18d972fddfac 100644
--- a/drivers/gpio/gpio-grgpio.c
+++ b/drivers/gpio/gpio-grgpio.c
@@ -227,6 +227,7 @@ static int grgpio_irq_map(struct irq_domain *d, unsigned int irq,
 	struct grgpio_priv *priv = d->host_data;
 	struct grgpio_lirq *lirq;
 	struct grgpio_uirq *uirq;
+	bool needs_req = false;
 	unsigned long flags;
 	int offset = hwirq;
 	int ret = 0;
@@ -242,30 +243,28 @@ static int grgpio_irq_map(struct irq_domain *d, unsigned int irq,
 		irq, offset);
 
 	gpio_generic_chip_lock_irqsave(&priv->chip, flags);
-
-	/* Request underlying irq if not already requested */
 	lirq->irq = irq;
 	uirq = &priv->uirqs[lirq->index];
-	if (uirq->refcnt == 0) {
-		/*
-		 * FIXME: This is not how locking works at all, you can't just
-		 * release the lock for a moment to do something that can't
-		 * sleep...
-		 */
-		gpio_generic_chip_unlock_irqrestore(&priv->chip, flags);
+	needs_req = (uirq->refcnt == 0);
+	uirq->refcnt++;
+	gpio_generic_chip_unlock_irqrestore(&priv->chip, flags);
+
+	/* Request underlying irq if not already requested */
+	if (needs_req) {
 		ret = request_irq(uirq->uirq, grgpio_irq_handler, 0,
 				  dev_name(priv->dev), priv);
 		if (ret) {
 			dev_err(priv->dev,
 				"Could not request underlying irq %d\n",
 				uirq->uirq);
+
+			// rollback
+			gpio_generic_chip_lock_irqsave(&priv->chip, flags);
+			uirq->refcnt--;
+			gpio_generic_chip_unlock_irqrestore(&priv->chip, flags);
 			return ret;
 		}
-		gpio_generic_chip_lock_irqsave(&priv->chip, flags);
 	}
-	uirq->refcnt++;
-
-	gpio_generic_chip_unlock_irqrestore(&priv->chip, flags);
 
 	/* Setup irq  */
 	irq_set_chip_data(irq, priv);
-- 
2.51.0