linux-kernel - Re: [PATCH v1] gpio: gpio-grgpio: call request_irq after incrementing the reference count

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAMRc=Mcj3YpHqFqdGPF7YXRHz=56J73TV2oPm70SHUmgXRAy=A@mail.gmail.com>
Date: Wed, 1 Oct 2025 05:24:01 -0700
From: Bartosz Golaszewski <brgl@...ev.pl>
To: Alex Tran <alex.t.tran@...il.com>
Cc: Bartosz Golaszewski <brgl@...ev.pl>, linux-gpio@...r.kernel.org, linux-kernel@...r.kernel.org, 
	Linus Walleij <linus.walleij@...aro.org>
Subject: Re: [PATCH v1] gpio: gpio-grgpio: call request_irq after incrementing
 the reference count

On Sun, 28 Sep 2025 07:40:19 +0200, Alex Tran <alex.t.tran@...il.com> said:
> Remove extraneous dropping of the lock just to call 'request_irq'
> and locking again afterwards. Increment reference count
> before calling 'request_irq'. Rollback reference count if
> 'request_irq' fails.
>
> Signed-off-by: Alex Tran <alex.t.tran@...il.com>
> ---
>  drivers/gpio/gpio-grgpio.c | 25 ++++++++++++-------------
>  1 file changed, 12 insertions(+), 13 deletions(-)
>
> diff --git a/drivers/gpio/gpio-grgpio.c b/drivers/gpio/gpio-grgpio.c
> index 0c0f97fa14fc..18d972fddfac 100644
> --- a/drivers/gpio/gpio-grgpio.c
> +++ b/drivers/gpio/gpio-grgpio.c
> @@ -227,6 +227,7 @@ static int grgpio_irq_map(struct irq_domain *d, unsigned int irq,
>  	struct grgpio_priv *priv = d->host_data;
>  	struct grgpio_lirq *lirq;
>  	struct grgpio_uirq *uirq;
> +	bool needs_req = false;
>  	unsigned long flags;
>  	int offset = hwirq;
>  	int ret = 0;
> @@ -242,30 +243,28 @@ static int grgpio_irq_map(struct irq_domain *d, unsigned int irq,
>  		irq, offset);
>
>  	gpio_generic_chip_lock_irqsave(&priv->chip, flags);
> -
> -	/* Request underlying irq if not already requested */
>  	lirq->irq = irq;
>  	uirq = &priv->uirqs[lirq->index];
> -	if (uirq->refcnt == 0) {
> -		/*
> -		 * FIXME: This is not how locking works at all, you can't just
> -		 * release the lock for a moment to do something that can't
> -		 * sleep...
> -		 */
> -		gpio_generic_chip_unlock_irqrestore(&priv->chip, flags);
> +	needs_req = (uirq->refcnt == 0);
> +	uirq->refcnt++;

Any chance this could be made to use atomic_t instead?

Like:

if (atomic_fetch_add(1, &priv->uirqs) == 0) {
	request_irq()
	...
}

?

Bart

> +	gpio_generic_chip_unlock_irqrestore(&priv->chip, flags);
> +
> +	/* Request underlying irq if not already requested */
> +	if (needs_req) {
>  		ret = request_irq(uirq->uirq, grgpio_irq_handler, 0,
>  				  dev_name(priv->dev), priv);
>  		if (ret) {
>  			dev_err(priv->dev,
>  				"Could not request underlying irq %d\n",
>  				uirq->uirq);
> +
> +			// rollback
> +			gpio_generic_chip_lock_irqsave(&priv->chip, flags);
> +			uirq->refcnt--;
> +			gpio_generic_chip_unlock_irqrestore(&priv->chip, flags);
>  			return ret;
>  		}
> -		gpio_generic_chip_lock_irqsave(&priv->chip, flags);
>  	}
> -	uirq->refcnt++;
> -
> -	gpio_generic_chip_unlock_irqrestore(&priv->chip, flags);
>
>  	/* Setup irq  */
>  	irq_set_chip_data(irq, priv);
> --
> 2.51.0
>
>