Re: BUG: drivers/pinctrl/core: races in pinctrl_groups and deferred probing

[H. Nikolaus Schaller]

Hi Tony,

> Am 15.06.2018 um 13:13 schrieb Tony Lindgren <tony@xxxxxxxxxxx>:
> 
> * Tony Lindgren <tony@xxxxxxxxxxx> [180615 07:00]:
>> * H. Nikolaus Schaller <hns@xxxxxxxxxxxxx> [180614 12:15]:
>>> Hi Tony,
>>> 
>>>> Am 14.06.2018 um 14:01 schrieb Tony Lindgren <tony@xxxxxxxxxxx>:
>>>> 
>>>> * H. Nikolaus Schaller <hns@xxxxxxxxxxxxx> [180613 12:41]:
>>>>> 
>>>>> Now if I look into pinctrl_generic_add_group() and pinctrl_generic_get_group_name(),
>>>>> pctldev->num_groups++ is not protected if pinctrl_generic_add_group() may be called by
>>>>> two threads in parallel for the same pctldev. Hence a second thread may try to insert
>>>>> a different node into the radix tree at the same selector index. This fails but there
>>>>> is no error check - and the second entry is completely missing (but probably assumed to
>>>>> be there).
>>>> 
>>>> Sounds like pinctrl-single.c is missing mutex around calls to
>>>> pinctrl_generic_add_group()?
>>> 
>>> Yes, that could be. I didn't research the call path, just the one of
>>> devm_pinctrl_get(). That uses a mutex in
>> 
>> In addition to missing mutex lock around the generic pinctrl functions
>> we also have racy helpers pinctrl_generic_remove_last_group() and
>> pinmux_generic_remove_last_function() like you pointed out. I'll post
>> a patch for you later on today to test.
> 
> OK I posted a series to fix these issues hopefully as thread
> "[PATCH 0/5] pinctrl fixes for generic functions and groups".

Fine, I have located them.

> 
> Can you please test and see if that is enough to fix the issues
> you're seeing?

Yes, I'll try asap.

BR and thanks,
Nikolaus