Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/1.1/patches/2228938/?format=api
{ "id": 2228938, "url": "http://patchwork.ozlabs.org/api/1.1/patches/2228938/?format=api", "web_url": "http://patchwork.ozlabs.org/project/linux-gpio/patch/20260427135841.96266-5-tzungbi@kernel.org/", "project": { "id": 42, "url": "http://patchwork.ozlabs.org/api/1.1/projects/42/?format=api", "name": "Linux GPIO development", "link_name": "linux-gpio", "list_id": "linux-gpio.vger.kernel.org", "list_email": "linux-gpio@vger.kernel.org", "web_url": "", "scm_url": "", "webscm_url": "" }, "msgid": "<20260427135841.96266-5-tzungbi@kernel.org>", "date": "2026-04-27T13:58:36", "name": "[v9,4/9] gpio: cdev: Leverage revocable for accessing struct gpio_chip", "commit_ref": null, "pull_url": null, "state": "new", "archived": false, "hash": "8cfd3b13fd8dceae32ac674aa5ee588b719aeaa9", "submitter": { "id": 83557, "url": "http://patchwork.ozlabs.org/api/1.1/people/83557/?format=api", "name": "Tzung-Bi Shih", "email": "tzungbi@kernel.org" }, "delegate": null, "mbox": "http://patchwork.ozlabs.org/project/linux-gpio/patch/20260427135841.96266-5-tzungbi@kernel.org/mbox/", "series": [ { "id": 501655, "url": "http://patchwork.ozlabs.org/api/1.1/series/501655/?format=api", "web_url": "http://patchwork.ozlabs.org/project/linux-gpio/list/?series=501655", "date": "2026-04-27T13:58:32", "name": "drivers/base: Introduce revocable", "version": 9, "mbox": "http://patchwork.ozlabs.org/series/501655/mbox/" } ], "comments": "http://patchwork.ozlabs.org/api/patches/2228938/comments/", "check": "pending", "checks": "http://patchwork.ozlabs.org/api/patches/2228938/checks/", "tags": {}, "headers": { "Return-Path": "\n <linux-gpio+bounces-35577-incoming=patchwork.ozlabs.org@vger.kernel.org>", "X-Original-To": [ "incoming@patchwork.ozlabs.org", "linux-gpio@vger.kernel.org" ], "Delivered-To": "patchwork-incoming@legolas.ozlabs.org", "Authentication-Results": [ "legolas.ozlabs.org;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256\n header.s=k20201202 header.b=bn0I3Udy;\n\tdkim-atps=neutral", "legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org\n (client-ip=2600:3c0a:e001:db::12fc:5321; helo=sea.lore.kernel.org;\n envelope-from=linux-gpio+bounces-35577-incoming=patchwork.ozlabs.org@vger.kernel.org;\n receiver=patchwork.ozlabs.org)", "smtp.subspace.kernel.org;\n\tdkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org\n header.b=\"bn0I3Udy\"", "smtp.subspace.kernel.org;\n arc=none smtp.client-ip=10.30.226.201" ], "Received": [ "from sea.lore.kernel.org (sea.lore.kernel.org\n [IPv6:2600:3c0a:e001:db::12fc:5321])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4g452502qxz1xvV\n\tfor <incoming@patchwork.ozlabs.org>; Tue, 28 Apr 2026 00:05:48 +1000 (AEST)", "from smtp.subspace.kernel.org (conduit.subspace.kernel.org\n [100.90.174.1])\n\tby sea.lore.kernel.org (Postfix) with ESMTP id D122B30D595B\n\tfor <incoming@patchwork.ozlabs.org>; Mon, 27 Apr 2026 13:59:47 +0000 (UTC)", "from localhost.localdomain (localhost.localdomain [127.0.0.1])\n\tby smtp.subspace.kernel.org (Postfix) with ESMTP id 835543D1CA2;\n\tMon, 27 Apr 2026 13:59:47 +0000 (UTC)", "from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org\n [10.30.226.201])\n\t(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby smtp.subspace.kernel.org (Postfix) with ESMTPS id 407E13D091F;\n\tMon, 27 Apr 2026 13:59:45 +0000 (UTC)", "by smtp.kernel.org (Postfix) with ESMTPSA id 5B68CC2BCB4;\n\tMon, 27 Apr 2026 13:59:41 +0000 (UTC)" ], "ARC-Seal": "i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;\n\tt=1777298387; cv=none;\n b=OAIeE5DtBfbnvpod0+cZbgy7dxJCcQAOdMtBQEHRv7NnebyxfM3jBvby/hbDVKCquXklODJqfpJYHaNdWRzbR5y+ezo9sVENhauBNFwjKBx0wCz5GCwCYEEAqpVFKQlfmNmFDJXEZUdXTmK9XCyijULW0A2yu3HZ1nJNfx7cWgk=", "ARC-Message-Signature": "i=1; a=rsa-sha256; d=subspace.kernel.org;\n\ts=arc-20240116; t=1777298387; c=relaxed/simple;\n\tbh=OM3WPfhr6XveZRZOOniv3jQCbT/6cAnqplsNoeix1Kc=;\n\th=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:\n\t MIME-Version;\n b=LnidhlXzTywcyrsM2QevU7FFNspmeIZ0aPAvd/fmW6+Tc+tOIQliwH/f119+iamrBcodW7fJ6qdoPPo2wNikqkGnaWhe77V8x9us16tf9H0Z9NxMLquwW6H69RZguNsAIqZkga76DkPbxGfZk6zNOivdQGweFGvyqjJqGJakR10=", "ARC-Authentication-Results": "i=1; smtp.subspace.kernel.org;\n dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org\n header.b=bn0I3Udy; arc=none smtp.client-ip=10.30.226.201", "DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org;\n\ts=k20201202; t=1777298384;\n\tbh=OM3WPfhr6XveZRZOOniv3jQCbT/6cAnqplsNoeix1Kc=;\n\th=From:To:Cc:Subject:Date:In-Reply-To:References:From;\n\tb=bn0I3UdyTLl44mMRSaHgxTxJ6OYnTdO+b9+JyL66viYh5OBjv9cL+uCKu6B3fjseh\n\t 5O8ZtvNc94Z/kP+5HIWGF8vZkRQLEyRSc/HD8dTzP0m3rJqUwj4b4mNupSxdhLT02m\n\t U9rob/enAEkNgrul0LjHL4sGlkOla+Mjn7vtJUk99ohCdepxLnaSVuu2l7eyacMOth\n\t nwmYgydtMur/FSUg2xQDNBf2FOZWceXMS1CA4qEYC7h3MKLxGOZ8hQGLiFG0csmT3C\n\t cmMsbe/sEOfe2AcXf6dvBfJlXtF16mg2AEz6FwQm3NXYd4cFTWZ3sjOeTXjJCPPERd\n\t O8p5gT6t/8FfQ==", "From": "Tzung-Bi Shih <tzungbi@kernel.org>", "To": "Arnd Bergmann <arnd@arndb.de>,\n\tGreg Kroah-Hartman <gregkh@linuxfoundation.org>,\n\tBartosz Golaszewski <brgl@kernel.org>,\n\tLinus Walleij <linusw@kernel.org>", "Cc": "Benson Leung <bleung@chromium.org>,\n\ttzungbi@kernel.org,\n\tlinux-kernel@vger.kernel.org,\n\tchrome-platform@lists.linux.dev,\n\tdriver-core@lists.linux.dev,\n\tlinux-doc@vger.kernel.org,\n\tlinux-gpio@vger.kernel.org,\n\t\"Rafael J. Wysocki\" <rafael@kernel.org>,\n\tDanilo Krummrich <dakr@kernel.org>,\n\tJonathan Corbet <corbet@lwn.net>,\n\tShuah Khan <shuah@kernel.org>,\n\tLaurent Pinchart <laurent.pinchart@ideasonboard.com>,\n\tWolfram Sang <wsa+renesas@sang-engineering.com>,\n\tJason Gunthorpe <jgg@nvidia.com>,\n\tJohan Hovold <johan@kernel.org>,\n\t\"Paul E . McKenney\" <paulmck@kernel.org>,\n\tDan Williams <dan.j.williams@intel.com>", "Subject": "[PATCH v9 4/9] gpio: cdev: Leverage revocable for accessing struct\n gpio_chip", "Date": "Mon, 27 Apr 2026 21:58:36 +0800", "Message-ID": "<20260427135841.96266-5-tzungbi@kernel.org>", "X-Mailer": "git-send-email 2.51.0", "In-Reply-To": "<20260427135841.96266-1-tzungbi@kernel.org>", "References": "<20260427135841.96266-1-tzungbi@kernel.org>", "Precedence": "bulk", "X-Mailing-List": "linux-gpio@vger.kernel.org", "List-Id": "<linux-gpio.vger.kernel.org>", "List-Subscribe": "<mailto:linux-gpio+subscribe@vger.kernel.org>", "List-Unsubscribe": "<mailto:linux-gpio+unsubscribe@vger.kernel.org>", "MIME-Version": "1.0", "Content-Transfer-Encoding": "8bit" }, "content": "Struct gpio_device now provides a revocable provider to the underlying\nstruct gpio_chip. Leverage revocable for accessing the struct\ngpio_chip.\n\nSigned-off-by: Tzung-Bi Shih <tzungbi@kernel.org>\n---\nv9:\n- New to the series.\n- Rename \"chip_rp\" -> \"chip_rev\".\n\nv4 - v8:\n- Doesn't exist.\n\nv3: https://lore.kernel.org/all/20260213092958.864411-9-tzungbi@kernel.org\n- Change revocable API usages accordingly.\n\nv2: https://lore.kernel.org/all/20260203061059.975605-9-tzungbi@kernel.org\n- Change usages accordingly after applying\n https://lore.kernel.org/all/20260129143733.45618-4-tzungbi@kernel.org.\n - Preserve a local storage for `struct revocable`.\n- Combine multiple patches (see \"v1:\").\n- Fix a race condition reported in\n https://lore.kernel.org/all/CAMRc=McDaipt85OHm0MksLkuf6E79dY1uNSqqbcJnoQTUs81Pw@mail.gmail.com/\n and analyzed in\n https://lore.kernel.org/all/aXEEUWwkxHZzCnaI@tzungbi-laptop/.\n In v1, the blocking_notifier_chain_unregister() will be skipped if the\n chip has been removed, leading an UAF in gpiolib_cdev_unregister().\n In v2, it won't skip blocking_notifier_chain_unregister().\n\nv1:\n- https://lore.kernel.org/all/20260116081036.352286-14-tzungbi@kernel.org\n- https://lore.kernel.org/all/20260116081036.352286-15-tzungbi@kernel.org\n- https://lore.kernel.org/all/20260116081036.352286-16-tzungbi@kernel.org\n- https://lore.kernel.org/all/20260116081036.352286-17-tzungbi@kernel.org\n- https://lore.kernel.org/all/20260116081036.352286-18-tzungbi@kernel.org\n\n---\n drivers/gpio/gpiolib-cdev.c | 68 ++++++++++++++-----------------------\n 1 file changed, 26 insertions(+), 42 deletions(-)", "diff": "diff --git a/drivers/gpio/gpiolib-cdev.c b/drivers/gpio/gpiolib-cdev.c\nindex f36b7c06996d..d8a7ccb406a5 100644\n--- a/drivers/gpio/gpiolib-cdev.c\n+++ b/drivers/gpio/gpiolib-cdev.c\n@@ -22,6 +22,7 @@\n #include <linux/overflow.h>\n #include <linux/pinctrl/consumer.h>\n #include <linux/poll.h>\n+#include <linux/revocable.h>\n #include <linux/seq_file.h>\n #include <linux/spinlock.h>\n #include <linux/string.h>\n@@ -210,11 +211,9 @@ static long linehandle_ioctl(struct file *file, unsigned int cmd,\n \tDECLARE_BITMAP(vals, GPIOHANDLES_MAX);\n \tunsigned int i;\n \tint ret;\n+\tstruct gpio_chip *gc;\n \n-\tguard(srcu)(&lh->gdev->srcu);\n-\n-\tif (!rcu_access_pointer(lh->gdev->chip))\n-\t\treturn -ENODEV;\n+\trevocable_try_access_or_return(&lh->gdev->chip_rev, gc);\n \n \tswitch (cmd) {\n \tcase GPIOHANDLE_GET_LINE_VALUES_IOCTL:\n@@ -1432,11 +1431,9 @@ static long linereq_ioctl(struct file *file, unsigned int cmd,\n {\n \tstruct linereq *lr = file->private_data;\n \tvoid __user *ip = (void __user *)arg;\n+\tstruct gpio_chip *gc;\n \n-\tguard(srcu)(&lr->gdev->srcu);\n-\n-\tif (!rcu_access_pointer(lr->gdev->chip))\n-\t\treturn -ENODEV;\n+\trevocable_try_access_or_return(&lr->gdev->chip_rev, gc);\n \n \tswitch (cmd) {\n \tcase GPIO_V2_LINE_GET_VALUES_IOCTL:\n@@ -1463,10 +1460,10 @@ static __poll_t linereq_poll(struct file *file,\n {\n \tstruct linereq *lr = file->private_data;\n \t__poll_t events = 0;\n+\tstruct gpio_chip *gc;\n \n-\tguard(srcu)(&lr->gdev->srcu);\n-\n-\tif (!rcu_access_pointer(lr->gdev->chip))\n+\trevocable_try_access_with(&lr->gdev->chip_rev, gc);\n+\tif (!gc)\n \t\treturn EPOLLHUP | EPOLLERR;\n \n \tpoll_wait(file, &lr->wait, wait);\n@@ -1485,11 +1482,9 @@ static ssize_t linereq_read(struct file *file, char __user *buf,\n \tstruct gpio_v2_line_event le;\n \tssize_t bytes_read = 0;\n \tint ret;\n+\tstruct gpio_chip *gc;\n \n-\tguard(srcu)(&lr->gdev->srcu);\n-\n-\tif (!rcu_access_pointer(lr->gdev->chip))\n-\t\treturn -ENODEV;\n+\trevocable_try_access_or_return(&lr->gdev->chip_rev, gc);\n \n \tif (count < sizeof(le))\n \t\treturn -EINVAL;\n@@ -1759,10 +1754,10 @@ static __poll_t lineevent_poll(struct file *file,\n {\n \tstruct lineevent_state *le = file->private_data;\n \t__poll_t events = 0;\n+\tstruct gpio_chip *gc;\n \n-\tguard(srcu)(&le->gdev->srcu);\n-\n-\tif (!rcu_access_pointer(le->gdev->chip))\n+\trevocable_try_access_with(&le->gdev->chip_rev, gc);\n+\tif (!gc)\n \t\treturn EPOLLHUP | EPOLLERR;\n \n \tpoll_wait(file, &le->wait, wait);\n@@ -1797,11 +1792,9 @@ static ssize_t lineevent_read(struct file *file, char __user *buf,\n \tssize_t bytes_read = 0;\n \tssize_t ge_size;\n \tint ret;\n+\tstruct gpio_chip *gc;\n \n-\tguard(srcu)(&le->gdev->srcu);\n-\n-\tif (!rcu_access_pointer(le->gdev->chip))\n-\t\treturn -ENODEV;\n+\trevocable_try_access_or_return(&le->gdev->chip_rev, gc);\n \n \t/*\n \t * When compatible system call is being used the struct gpioevent_data,\n@@ -1879,11 +1872,9 @@ static long lineevent_ioctl(struct file *file, unsigned int cmd,\n \tstruct lineevent_state *le = file->private_data;\n \tvoid __user *ip = (void __user *)arg;\n \tstruct gpiohandle_data ghd;\n+\tstruct gpio_chip *gc;\n \n-\tguard(srcu)(&le->gdev->srcu);\n-\n-\tif (!rcu_access_pointer(le->gdev->chip))\n-\t\treturn -ENODEV;\n+\trevocable_try_access_or_return(&le->gdev->chip_rev, gc);\n \n \t/*\n \t * We can get the value for an event line but not set it,\n@@ -2385,12 +2376,10 @@ static long gpio_ioctl(struct file *file, unsigned int cmd, unsigned long arg)\n \tstruct gpio_chardev_data *cdev = file->private_data;\n \tstruct gpio_device *gdev = cdev->gdev;\n \tvoid __user *ip = (void __user *)arg;\n-\n-\tguard(srcu)(&gdev->srcu);\n+\tstruct gpio_chip *gc;\n \n \t/* We fail any subsequent ioctl():s when the chip is gone */\n-\tif (!rcu_access_pointer(gdev->chip))\n-\t\treturn -ENODEV;\n+\trevocable_try_access_or_return(&gdev->chip_rev, gc);\n \n \t/* Fill in the struct and pass to userspace */\n \tswitch (cmd) {\n@@ -2448,12 +2437,9 @@ static void lineinfo_changed_func(struct work_struct *work)\n \t\t * Pin functions are in general much more static and while it's\n \t\t * not 100% bullet-proof, it's good enough for most cases.\n \t\t */\n-\t\tscoped_guard(srcu, &ctx->gdev->srcu) {\n-\t\t\tgc = srcu_dereference(ctx->gdev->chip, &ctx->gdev->srcu);\n-\t\t\tif (gc &&\n-\t\t\t !pinctrl_gpio_can_use_line(gc, ctx->chg.info.offset))\n+\t\trevocable_try_access_or_skip_scoped(&ctx->gdev->chip_rev, gc)\n+\t\t\tif (!pinctrl_gpio_can_use_line(gc, ctx->chg.info.offset))\n \t\t\t\tctx->chg.info.flags |= GPIO_V2_LINE_FLAG_USED;\n-\t\t}\n \t}\n \n \tret = kfifo_in_spinlocked(&ctx->cdev->events, &ctx->chg, 1,\n@@ -2534,10 +2520,10 @@ static __poll_t lineinfo_watch_poll(struct file *file,\n {\n \tstruct gpio_chardev_data *cdev = file->private_data;\n \t__poll_t events = 0;\n+\tstruct gpio_chip *gc;\n \n-\tguard(srcu)(&cdev->gdev->srcu);\n-\n-\tif (!rcu_access_pointer(cdev->gdev->chip))\n+\trevocable_try_access_with(&cdev->gdev->chip_rev, gc);\n+\tif (!gc)\n \t\treturn EPOLLHUP | EPOLLERR;\n \n \tpoll_wait(file, &cdev->wait, pollt);\n@@ -2557,11 +2543,9 @@ static ssize_t lineinfo_watch_read(struct file *file, char __user *buf,\n \tssize_t bytes_read = 0;\n \tint ret;\n \tsize_t event_size;\n+\tstruct gpio_chip *gc;\n \n-\tguard(srcu)(&cdev->gdev->srcu);\n-\n-\tif (!rcu_access_pointer(cdev->gdev->chip))\n-\t\treturn -ENODEV;\n+\trevocable_try_access_or_return(&cdev->gdev->chip_rev, gc);\n \n #ifndef CONFIG_GPIO_CDEV_V1\n \tevent_size = sizeof(struct gpio_v2_line_info_changed);\n", "prefixes": [ "v9", "4/9" ] }