Re: [PATCH] reset: fix racy acquisition of exclusive reset controls
From: Philipp Zabel
Date: Mon Oct 26 2026 - 05:46:26 EST
On Do, 2026-10-22 at 20:06 +0200, Alvin Šipraga wrote:
> A given reset line may only be acquired by up to one exclusive reset
> control at a time. If two tasks with their own exclusive controls race
> to acquire a currently released line, only one may succeed.
>
> Since the blamed commit, which introduced more granular locking, this
> guarantee has been lost. The mutex rstc->lock was introduced to
> serialize the internals of reset_control_acquire(), but since this lock
> is local to a given reset control, it achieves no synchronization
> between distinct reset controls, even though they may refer to the same
> underlying reset line.
>
> As it happens, there is already sufficient synchronization in this
> function through the rcdev->lock mutex, which protects the controller's
> reset control list. Under this lock, the acquisition logic correctly
> validates that the line is not acquired by another control. But the
> control is marked as acquired only after the lock is freed, wherein
> another task may race to the same point and mark itself acquired too.
>
> This is easy to fix: just mark acquisition while the rcdev->lock mutex
> is still held. And since the rstc->lock is only used here, and achieves
> nothing, it can be disposed of.
>
> Tested under QEMU (-M ast2600-evb -smp 2) with some driver hacks to
> provoke the race. With this fix, the race is no longer reproducible.
>
> Fixes: 8c91302a29bc ("reset: protect struct reset_control with its own mutex")
> Link: https://lore.kernel.org/lkml/atnZWUA9bc1btCix@xxxxxxxxxx/
> Signed-off-by: Alvin Šipraga <alvin.sipraga@xxxxxxxxxx>
Reviewed-by: Philipp Zabel <p.zabel@xxxxxxxxxxxxxx>
> ---
> Philipp, this will probably conflict with Shengjiu's fix for the shared
> reset race. If you want, I'll gladly resend after that fix has been
> applied. Just putting out for you to check now.
> ---
That's fine, the conflict is trivial to resolve. I'll pick up both into
next after -rc1.
regards
Philipp