linux-kernel - [PATCH] gpio: shared: fix a false-positive sharing detection with reset-gpios

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20260108-gpio-shared-false-positive-v1-1-5dbf8d1b2f7d@oss.qualcomm.com>
Date: Thu, 08 Jan 2026 14:39:19 +0100
From: Bartosz Golaszewski <bartosz.golaszewski@....qualcomm.com>
To: Linus Walleij <linusw@...nel.org>, Bartosz Golaszewski <brgl@...nel.org>
Cc: linux-gpio@...r.kernel.org, linux-kernel@...r.kernel.org,
        Bartosz Golaszewski <bartosz.golaszewski@....qualcomm.com>
Subject: [PATCH] gpio: shared: fix a false-positive sharing detection with
 reset-gpios

After scanning the devicetree, we remove all entries that have only one
reference, while creating GPIO shared proxies for the remaining, shared
entries. However: for the reset-gpio corner-case, we will have two
references for a "reset-gpios" pin that's not really shared. In this
case one will come from the actual consumer fwnode and the other from
the potential auxiliary reset-gpio device. This causes the GPIO core to
create unnecessary GPIO shared proxy devices for pins that are not
really shared.

Add a function that can detect this situation and remove entries that
have exactly two references but one of them is a reset-gpio.

Fixes: 7b78b26757e0 ("gpio: shared: handle the reset-gpios corner case")
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@....qualcomm.com>
---
 drivers/gpio/gpiolib-shared.c | 34 ++++++++++++++++++++++++++++++++--
 1 file changed, 32 insertions(+), 2 deletions(-)

diff --git a/drivers/gpio/gpiolib-shared.c b/drivers/gpio/gpiolib-shared.c
index 076d8642675c2723c8938cbd22b1b51014c23871..17343fdc9758402b3cc7c8d61ee908591c977539 100644
--- a/drivers/gpio/gpiolib-shared.c
+++ b/drivers/gpio/gpiolib-shared.c
@@ -41,6 +41,7 @@ struct gpio_shared_ref {
 	struct lock_class_key lock_key;
 	struct auxiliary_device adev;
 	struct gpiod_lookup_table *lookup;
+	bool is_reset_gpio;
 };
 
 /* Represents a single GPIO pin. */
@@ -112,7 +113,8 @@ static int gpio_shared_setup_reset_proxy(struct gpio_shared_entry *entry,
 	struct gpio_shared_ref *ref;
 
 	list_for_each_entry(ref, &entry->refs, list) {
-		if (!ref->fwnode && ref->con_id && strcmp(ref->con_id, "reset") == 0)
+		if (ref->is_reset_gpio)
+			/* Already set-up. */
 			return 0;
 	}
 
@@ -120,6 +122,8 @@ static int gpio_shared_setup_reset_proxy(struct gpio_shared_entry *entry,
 	if (!ref)
 		return -ENOMEM;
 
+	ref->is_reset_gpio = true;
+
 	list_add_tail(&ref->list, &entry->refs);
 
 	pr_debug("Created a secondary shared GPIO reference for potential reset-gpio device for GPIO %u at %s\n",
@@ -714,12 +718,38 @@ static void __init gpio_shared_teardown(void)
 	}
 }
 
+static bool gpio_shared_entry_is_really_shared(struct gpio_shared_entry *entry)
+{
+	size_t num_nodes = list_count_nodes(&entry->refs);
+	struct gpio_shared_ref *ref;
+
+	if (num_nodes <= 1)
+		return false;
+
+	if (num_nodes > 2)
+		return true;
+
+	/* Exactly two references: */
+	list_for_each_entry(ref, &entry->refs, list) {
+		/*
+		 * Corner-case: the second reference comes from the potential
+		 * reset-gpio instance. However, this pin is not really shared
+		 * as it would have three references in this case. Avoid
+		 * creating unnecessary proxies.
+		 */
+		if (ref->is_reset_gpio)
+			return false;
+	}
+
+	return true;
+}
+
 static void gpio_shared_free_exclusive(void)
 {
 	struct gpio_shared_entry *entry, *epos;
 
 	list_for_each_entry_safe(entry, epos, &gpio_shared_list, list) {
-		if (list_count_nodes(&entry->refs) > 1)
+		if (gpio_shared_entry_is_really_shared(entry))
 			continue;
 
 		gpio_shared_drop_ref(list_first_entry(&entry->refs,

---
base-commit: fc4e91c639c0af93d63c3d5bc0ee45515dd7504a
change-id: 20260108-gpio-shared-false-positive-9e08379aa6cd

Best regards,
-- 
Bartosz Golaszewski <bartosz.golaszewski@....qualcomm.com>