diff mbox series

[1/2] mtd: spi-nor: Fix deadlock in spi_nor_rww_start_exclusive()

Message ID 46e4e2e31f051f64c120307216ce2766c004d9af.1788404586.git.tze.yee.ng@altera.com
State New
Headers show
Series mtd: spi-nor: Fix unbind deadlock and use-after-free | expand

Commit Message

NG, TZE YEE Sept. 3, 2026, 3:14 a.m. UTC 
From: Tze Yee Ng <tze.yee.ng@altera.com>

spi_nor_rww_start_exclusive() takes nor->lock with a bare mutex_lock()
and returns with it held, while its counterpart
spi_nor_rww_end_exclusive() re-acquires nor->lock via guard(mutex). Any
exclusive operation on a read-while-write (SNOR_F_RWW) part thus
deadlocks against itself.

The exclusive section is serialized by the rww ongoing_io/rd/pe flags,
so take nor->lock with guard(mutex) like the sibling start helpers.

Fixes: 03e7bb864d9a9 ("mtd: spi-nor: use scope-based mutex cleanup helpers")
Cc: stable@vger.kernel.org
Signed-off-by: Tze Yee Ng <tze.yee.ng@altera.com>
---
 drivers/mtd/spi-nor/core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/drivers/mtd/spi-nor/core.c b/drivers/mtd/spi-nor/core.c
index ccf4396cdcd0..8bc117b46e02 100644
--- a/drivers/mtd/spi-nor/core.c
+++ b/drivers/mtd/spi-nor/core.c
@@ -1310,7 +1310,7 @@  static bool spi_nor_rww_start_exclusive(struct spi_nor *nor)
 {
 	struct spi_nor_rww *rww = &nor->rww;
 
-	mutex_lock(&nor->lock);
+	guard(mutex)(&nor->lock);
 
 	if (rww->ongoing_io || rww->ongoing_rd || rww->ongoing_pe)
 		return false;