diff options
| author | Hagar Hemdan <hagarhem@amazon.com> | 2024-06-04 08:58:38 +0000 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2024-07-05 09:08:26 +0200 |
| commit | 420ce1261907e5dbeda1e4daffd5b6c76f8188c0 (patch) | |
| tree | 03c4c4790659d9f9e1c7b8a7e9e2f48c4acafc2e /drivers/pinctrl | |
| parent | 6290b2cc564d4ff13e730d41d5f31d5a93c04c1b (diff) | |
| download | linux-stable-420ce1261907e5dbeda1e4daffd5b6c76f8188c0.tar.gz linux-stable-420ce1261907e5dbeda1e4daffd5b6c76f8188c0.tar.bz2 linux-stable-420ce1261907e5dbeda1e4daffd5b6c76f8188c0.zip | |
pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER
[ Upstream commit adec57ff8e66aee632f3dd1f93787c13d112b7a1 ]
In create_pinctrl(), pinctrl_maps_mutex is acquired before calling
add_setting(). If add_setting() returns -EPROBE_DEFER, create_pinctrl()
calls pinctrl_free(). However, pinctrl_free() attempts to acquire
pinctrl_maps_mutex, which is already held by create_pinctrl(), leading to
a potential deadlock.
This patch resolves the issue by releasing pinctrl_maps_mutex before
calling pinctrl_free(), preventing the deadlock.
This bug was discovered and resolved using Coverity Static Analysis
Security Testing (SAST) by Synopsys, Inc.
Fixes: 42fed7ba44e4 ("pinctrl: move subsystem mutex to pinctrl_dev struct")
Suggested-by: Maximilian Heyne <mheyne@amazon.de>
Signed-off-by: Hagar Hemdan <hagarhem@amazon.com>
Link: https://lore.kernel.org/r/20240604085838.3344-1-hagarhem@amazon.com
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'drivers/pinctrl')
| -rw-r--r-- | drivers/pinctrl/core.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/pinctrl/core.c b/drivers/pinctrl/core.c index 44802e501794..1d8324e220fc 100644 --- a/drivers/pinctrl/core.c +++ b/drivers/pinctrl/core.c @@ -1090,8 +1090,8 @@ static struct pinctrl *create_pinctrl(struct device *dev, * an -EPROBE_DEFER later, as that is the worst case. */ if (ret == -EPROBE_DEFER) { - pinctrl_free(p, false); mutex_unlock(&pinctrl_maps_mutex); + pinctrl_free(p, false); return ERR_PTR(ret); } } |