Re: [PATCH v2] hwmon: (occ) unregister sysfs devices outside occ lock

[Guenter Roeck]

On Fri, Jun 19, 2026 at 09:59:38AM +0800, Runyu Xiao wrote:
> occ_active(false) and occ_shutdown() unregister sysfs-backed devices while
> occ->lock is held.  hwmon_device_unregister() and sysfs_remove_group() can
> wait for active sysfs callbacks to drain, and those callbacks can enter the
> OCC update path and try to take occ->lock again.  That gives the unregister
> paths the lock ordering occ->lock -> sysfs callback drain, while a callback
> has the opposite edge sysfs callback -> occ->lock.
> 
> This issue was found by our static analysis tool and then manually
> reviewed against the current tree.
> 
> The grounded PoC kept the real unregister and callback carrier:
> 
>   occ_shutdown()
>   hwmon_device_unregister()
>   occ_show_temp_1()
>   occ_update_response()
> 
> Lockdep reported the circular dependency with occ_shutdown() already
> holding the OCC mutex and hwmon_device_unregister() waiting on the sysfs
> side:
> 
>   WARNING: possible circular locking dependency detected
>   ... (sysfs_lock) ... at: hwmon_device_unregister+0x12/0x30 [vuln_msv]
>   ... (&test_occ.lock) ... at: occ_shutdown.constprop.0+0xe/0x40 [vuln_msv]
>   occ_update_response.isra.0+0xb/0x20 [vuln_msv]
>   occ_show_temp_1.constprop.0.isra.0+0x23/0x40 [vuln_msv]
>   *** DEADLOCK ***
> 
> Serialize hwmon registration and removal with a separate hwmon_lock.
> Under that lock, detach occ->hwmon and update occ->active while occ->lock
> is held so concurrent OCC state changes still see a stable state, then
> drop occ->lock before calling hwmon_device_unregister().  Remove the
> driver sysfs group before taking occ->lock in occ_shutdown(), so draining
> the driver attributes cannot wait while the OCC mutex is held.  Also make
> OCC update callbacks return -ENODEV after deactivation, so callbacks that
> already passed sysfs active protection do not poll the hardware after
> teardown has detached the hwmon device.
> 
> Fixes: 849b0156d996 ("hwmon: (occ) Delay hwmon registration until user request")
> Fixes: ac6888ac5a11 ("hwmon: (occ) Lock mutex in shutdown to prevent race with occ_active")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Runyu Xiao <runyu.xiao@xxxxxxxxxx>

Applied.

Thanks,
Guenter