| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <CAPDyKFp32GafgWBEn=PbVex1MXRo+nBFcVSgLxrqxMtLXnRFSA@mail.gmail.com>
Date: Mon, 24 Nov 2025 11:16:41 +0100
From: Ulf Hansson <ulf.hansson@...aro.org>
To: AngeloGioacchino Del Regno <angelogioacchino.delregno@...labora.com>
Cc: matthias.bgg@...il.com, nfraprado@...labora.com,
irving-ch.lin@...iatek.com, wenst@...omium.org, linux-pm@...r.kernel.org,
linux-kernel@...r.kernel.org, linux-arm-kernel@...ts.infradead.org,
linux-mediatek@...ts.infradead.org, robh@...nel.org, krzk@...nel.org,
conor@...nel.org, kernel@...labora.com
Subject: Re: [PATCH - URGENT] pmdomains: mtk-pm-domains: Fix spinlock
recursion in probe
On Fri, 21 Nov 2025 at 13:52, AngeloGioacchino Del Regno
<angelogioacchino.delregno@...labora.com> wrote:
>
> For some reason, of_find_node_with_property() is creating a spinlock
> recursion issue along with fwnode_count_parents(), and this issue
> is making all MediaTek boards unbootable.
>
> As of kernel v6.18-rc6, there are only three users of this function,
> one of which is this driver.
>
> Migrate away from of_find_node_with_property() by adding a local
> scpsys_get_legacy_regmap_node() function, which acts similarly to
> of_find_node_with_property(), and calling the former in place of
> the latter.
>
> This resolves the following spinlock recursion issue:
>
> [ 1.773979] BUG: spinlock recursion on CPU#2, kworker/u24:1/60
> [ 1.790485] lock: devtree_lock+0x0/0x40, .magic: dead4ead, .owner: kworker/u24:1/60, .owner_cpu: 2
> [ 1.791644] CPU: 2 UID: 0 PID: 60 Comm: kworker/u24:1 Tainted: G W 6.18.0-rc6 #3 PREEMPT
> [ 1.791649] Tainted: [W]=WARN
> [ 1.791650] Hardware name: MediaTek Genio-510 EVK (DT)
> [ 1.791653] Workqueue: events_unbound deferred_probe_work_func
> [ 1.791658] Call trace:
> [ 1.791659] show_stack+0x18/0x30 (C)
> [ 1.791664] dump_stack_lvl+0x68/0x94
> [ 1.791668] dump_stack+0x18/0x24
> [ 1.791672] spin_dump+0x78/0x88
> [ 1.791678] do_raw_spin_lock+0x110/0x140
> [ 1.791684] _raw_spin_lock_irqsave+0x58/0x6c
> [ 1.791690] of_get_parent+0x28/0x74
> [ 1.791694] of_fwnode_get_parent+0x38/0x7c
> [ 1.791700] fwnode_count_parents+0x34/0xf0
> [ 1.791705] fwnode_full_name_string+0x28/0x120
> [ 1.791710] device_node_string+0x3e4/0x50c
> [ 1.791715] pointer+0x294/0x430
> [ 1.791718] vsnprintf+0x21c/0x5bc
> [ 1.791722] vprintk_store+0x108/0x47c
> [ 1.791728] vprintk_emit+0xc4/0x350
> [ 1.791732] vprintk_default+0x34/0x40
> [ 1.791736] vprintk+0x24/0x30
> [ 1.791740] _printk+0x60/0x8c
> [ 1.791744] of_node_release+0x154/0x194
> [ 1.791749] kobject_put+0xa0/0x120
> [ 1.791753] of_node_put+0x18/0x28
> [ 1.791756] of_find_node_with_property+0x74/0x100
> [ 1.791761] scpsys_probe+0x338/0x5e0
> [ 1.791765] platform_probe+0x5c/0xa4
> [ 1.791770] really_probe+0xbc/0x2ac
> [ 1.791774] __driver_probe_device+0x78/0x118
> [ 1.791779] driver_probe_device+0x3c/0x170
> [ 1.791783] __device_attach_driver+0xb8/0x150
> [ 1.791788] bus_for_each_drv+0x88/0xe8
> [ 1.791792] __device_attach+0x9c/0x1a0
> [ 1.791796] device_initial_probe+0x14/0x20
> [ 1.791801] bus_probe_device+0xa0/0xa4
> [ 1.791805] deferred_probe_work_func+0x88/0xd0
> [ 1.791809] process_one_work+0x1e8/0x448
> [ 1.791813] worker_thread+0x1ac/0x340
> [ 1.791816] kthread+0x138/0x220
> [ 1.791821] ret_from_fork+0x10/0x20
>
> Fixes: c29345fa5f66 ("pmdomain: mediatek: Refactor bus protection regmaps retrieval")
> Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@...labora.com>
Applied this for fixes, thanks!
Yes, it seems like we may need some additional analysis/fix, but let's
look into that separately beyond this fix.
Kind regards
Uffe
> ---
>
> This might not be the best fix to perform, and I have Cc'ed Rob and
> Krzysztof for them to have a look at the spinlock recursion issue,
> as I think it either has to be fixed, or the affected function has
> to be removed (or both, actually - in any case, if not fixed, this
> could backfire, and I'm not sure that the only function that shows
> this issue is just only of_find_node_with_property() or if others
> also do; at least, nothing else on MediaTek machines as of now).
>
> Counting that this makes *all* MediaTek machines to be unbootable,
> I'd prefer this fix to get merged immediately - so that it lands
> in v6.18 (which is at rc6 at the time of writing).
>
> That - because I think that resolving the source of this issue will
> take a bit of time and research - and I really don't want the LTS
> kernel to be broken on all MediaTek devices.
>
> Note: When I initially tested the commit pointed out in the Fixes
> tag, it was working with no spinlock recursion - I don't clearly
> remember what kernel version was that, but I think it was some
> linux-next around v6.16 or v6.17.
>
> drivers/pmdomain/mediatek/mtk-pm-domains.c | 18 +++++++++++++++---
> 1 file changed, 15 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/pmdomain/mediatek/mtk-pm-domains.c b/drivers/pmdomain/mediatek/mtk-pm-domains.c
> index 407b4a7aba10..721224c89865 100644
> --- a/drivers/pmdomain/mediatek/mtk-pm-domains.c
> +++ b/drivers/pmdomain/mediatek/mtk-pm-domains.c
> @@ -1006,6 +1006,18 @@ static void scpsys_domain_cleanup(struct scpsys *scpsys)
> }
> }
>
> +static struct device_node *scpsys_get_legacy_regmap(struct device_node *np, const char *pn)
> +{
> + struct device_node *local_node;
> +
> + for_each_child_of_node(np, local_node) {
> + if (of_property_present(local_node, pn))
> + return local_node;
> + }
> +
> + return NULL;
> +}
> +
> static int scpsys_get_bus_protection_legacy(struct device *dev, struct scpsys *scpsys)
> {
> const u8 bp_blocks[3] = {
> @@ -1027,7 +1039,7 @@ static int scpsys_get_bus_protection_legacy(struct device *dev, struct scpsys *s
> * this makes it then possible to allocate the array of bus_prot
> * regmaps and convert all to the new style handling.
> */
> - node = of_find_node_with_property(np, "mediatek,infracfg");
> + node = scpsys_get_legacy_regmap(np, "mediatek,infracfg");
> if (node) {
> regmap[0] = syscon_regmap_lookup_by_phandle(node, "mediatek,infracfg");
> of_node_put(node);
> @@ -1040,7 +1052,7 @@ static int scpsys_get_bus_protection_legacy(struct device *dev, struct scpsys *s
> regmap[0] = NULL;
> }
>
> - node = of_find_node_with_property(np, "mediatek,smi");
> + node = scpsys_get_legacy_regmap(np, "mediatek,smi");
> if (node) {
> smi_np = of_parse_phandle(node, "mediatek,smi", 0);
> of_node_put(node);
> @@ -1058,7 +1070,7 @@ static int scpsys_get_bus_protection_legacy(struct device *dev, struct scpsys *s
> regmap[1] = NULL;
> }
>
> - node = of_find_node_with_property(np, "mediatek,infracfg-nao");
> + node = scpsys_get_legacy_regmap(np, "mediatek,infracfg-nao");
> if (node) {
> regmap[2] = syscon_regmap_lookup_by_phandle(node, "mediatek,infracfg-nao");
> num_regmaps++;
> --
> 2.51.2
>
Powered by blists - more mailing lists