Bug fixes and refactoring patches related to locking

---
 arch/x86/kvm/vmx/posted_intr.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

arch/x86/kvm/vmx/posted_intr.c +4 -3

index 4a6d9a17da23..f8711b7b85a8 100644
@@ -164,6 +164,7 @@ static void pi_enable_wakeup_handler(struct kvm_vcpu *vcpu)
 	struct pi_desc *pi_desc = vcpu_to_pi_desc(vcpu);
 	struct vcpu_vt *vt = to_vt(vcpu);
 	struct pi_desc old, new;
+	raw_spinlock_t *wakeup_lock;
 
 	lockdep_assert_irqs_disabled();

@@ -179,11 +180,11 @@ static void pi_enable_wakeup_handler(struct kvm_vcpu *vcpu)
 	 * entirety of the sched_out critical section, i.e. the wakeup handler
 	 * can't run while the scheduler locks are held.
 	 */
-	raw_spin_lock_nested(&per_cpu(wakeup_vcpus_on_cpu_lock, vcpu->cpu),
-			     PI_LOCK_SCHED_OUT);
+	wakeup_lock = &per_cpu(wakeup_vcpus_on_cpu_lock, vcpu->cpu);
+	raw_spin_lock_nested(wakeup_lock, PI_LOCK_SCHED_OUT);
 	list_add_tail(&vt->pi_wakeup_list,
 		      &per_cpu(wakeup_vcpus_on_cpu, vcpu->cpu));
-	raw_spin_unlock(&per_cpu(wakeup_vcpus_on_cpu_lock, vcpu->cpu));
+	raw_spin_unlock(wakeup_lock);
 
 	WARN(pi_test_sn(pi_desc), "PI descriptor SN field set before blocking");

Bart Van Assche

author

2026-02-23 22:01 UTC #2 lore raw

PATCH 2/62 blk-ioc: Prepare for enabling thread-safety analysis

From: Bart Van Assche <[email protected]>

The Clang thread-safety analyzer does not support testing return values with "< 0". Hence change the "< 0" test into "!= 0". This is fine since the radix_tree_maybe_preload() return value is <= 0.

Cc Jens Axboe <[email protected]>

Cc Yu Kuai <[email protected]>

Cc Jan Kara <[email protected]>

---
 block/blk-ioc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

block/blk-ioc.c +1 -1

index d15918d7fabb..0bf78aebc887 100644
@@ -364,7 +364,7 @@ static struct io_cq *ioc_create_icq(struct request_queue *q)
 	if (!icq)
 		return NULL;
 
-	if (radix_tree_maybe_preload(GFP_ATOMIC) < 0) {
+	if (radix_tree_maybe_preload(GFP_ATOMIC) != 0) {
 		kmem_cache_free(et->icq_cache, icq);
 		return NULL;
 	}

Bart Van Assche

author

2026-02-23 22:01 UTC #3 lore raw

PATCH 3/62 drbd: Balance RCU calls in drbd_adm_dump_devices()

From: Bart Van Assche <[email protected]>

Make drbd_adm_dump_devices() call rcu_read_lock() before rcu_read_unlock() is called. This has been detected by the Clang thread-safety analyzer. Compile-tested only.

Cc Andreas Gruenbacher <[email protected]>

Fixes a55bbd375d18 ("drbd: Backport the "status" command")

---
 drivers/block/drbd/drbd_nl.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

drivers/block/drbd/drbd_nl.c +6 -2

index e201f0087a0f..728ecc431b38 100644
@@ -3378,8 +3378,10 @@ int drbd_adm_dump_devices(struct sk_buff *skb, struct netlink_callback *cb)
 		if (resource_filter) {
 			retcode = ERR_RES_NOT_KNOWN;
 			resource = drbd_find_resource(nla_data(resource_filter));
-			if (!resource)
+			if (!resource) {
+				rcu_read_lock();
 				goto put_result;
+			}
 			cb->args[0] = (long)resource;
 		}
 	}

@@ -3628,8 +3630,10 @@ int drbd_adm_dump_peer_devices(struct sk_buff *skb, struct netlink_callback *cb)
 		if (resource_filter) {
 			retcode = ERR_RES_NOT_KNOWN;
 			resource = drbd_find_resource(nla_data(resource_filter));
-			if (!resource)
+			if (!resource) {
+				rcu_read_lock();
 				goto put_result;
+			}
 		}
 		cb->args[0] = (long)resource;
 	}

Bart Van Assche

author

2026-02-23 22:01 UTC #4 lore raw

PATCH 4/62 dax/bus.c: Fix a locking bug

From: Bart Van Assche <[email protected]>

Only unlock dax_dev_rwsem if it has been locked. This locking bug was detected by the Clang thread-safety analyzer.

Cc Dan Williams <[email protected]>

Cc Vishal Verma <[email protected]>

Cc Dave Jiang <[email protected]>

Cc Alison Schofield <[email protected]>

Fixes c05ae9d85b47 ("dax/bus.c: replace driver-core lock usage by a local rwsem")

---
 drivers/dax/bus.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

drivers/dax/bus.c +1 -2

index c94c09622516..ebd3806c34e5 100644
@@ -1117,11 +1117,10 @@ static ssize_t size_store(struct device *dev, struct device_attribute *attr,
 	}
 	rc = down_write_killable(&dax_dev_rwsem);
 	if (rc)
-		goto err_dev;
+		goto err_region;
 
 	rc = dev_dax_resize(dax_region, dev_dax, val);
 
-err_dev:
 	up_write(&dax_dev_rwsem);
 err_region:
 	up_write(&dax_region_rwsem);

[email protected]

Reviewed-by on v1 4/62

2026-02-23 22:50 UTC #5 lore raw

Re: [PATCH 04/62] dax/bus.c: Fix a locking bug

Quoted 5 lines · Bart Van Assche

From: Bart Van Assche <[email protected]>
Only unlock dax_dev_rwsem if it has been locked. This locking bug was detected by the Clang thread-safety analyzer.

Quoted 8 lines

Cc Dan Williams <[email protected]>
Cc Vishal Verma <[email protected]>
Cc Dave Jiang <[email protected]>
Cc Alison Schofield <[email protected]>
Cc [email protected]
Cc [email protected]
Fixes c05ae9d85b47 ("dax/bus.c: replace driver-core lock usage by a local rwsem")
Signed-off-by Bart Van Assche <[email protected]>

Looks good,

Reviewed-by Dan Williams <[email protected]>

Jonathan Cameron

Reviewed-by

2026-02-24 12:45 UTC #6 lore raw

Re: [PATCH 04/62] dax/bus.c: Fix a locking bug

Quoted 15 lines · On Mon, 23 Feb 2026 14:50:49 -0800 <[email protected]> wrote:

Quoted 5 lines · Bart Van Assche
From: Bart Van Assche <[email protected]>
Only unlock dax_dev_rwsem if it has been locked. This locking bug was detected by the Clang thread-safety analyzer.
Quoted 8 lines
Cc Dan Williams <[email protected]>
Cc Vishal Verma <[email protected]>
Cc Dave Jiang <[email protected]>
Cc Alison Schofield <[email protected]>
Cc [email protected]
Cc [email protected]
Fixes c05ae9d85b47 ("dax/bus.c: replace driver-core lock usage by a local rwsem")
Signed-off-by Bart Van Assche <[email protected]>

Quoted 4 lines

Looks good,
Reviewed-by Dan Williams <[email protected]>

Agreed

Reviewed-by Jonathan Cameron <[email protected]>

Maybe worth some ACQUIRE() magic as a follow up.

Bart Van Assche

author

2026-02-23 22:01 UTC #7 lore raw

PATCH 5/62 dma-buf: Convert dma_buf_import_sync_file() to the early-return style

From: Bart Van Assche <[email protected]>

Before making changes in dma_buf_import_sync_file(), convert it to the early-return coding style. No functionality has been changed.

Cc Sumit Semwal <[email protected]>

Cc Christian König <[email protected]>

---
 drivers/dma-buf/dma-buf.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

drivers/dma-buf/dma-buf.c +6 -4

index 11711874a325..1666133ac8b8 100644
@@ -523,11 +523,13 @@ static long dma_buf_import_sync_file(struct dma_buf *dmabuf,
 		dma_resv_lock(dmabuf->resv, NULL);
 
 		ret = dma_resv_reserve_fences(dmabuf->resv, num_fences);
-		if (!ret) {
-			dma_fence_unwrap_for_each(f, &iter, fence)
-				dma_resv_add_fence(dmabuf->resv, f, usage);
-		}
+		if (ret)
+			goto unlock;
+
+		dma_fence_unwrap_for_each(f, &iter, fence)
+			dma_resv_add_fence(dmabuf->resv, f, usage);
 
+unlock:
 		dma_resv_unlock(dmabuf->resv);
 	}

Bart Van Assche

author

2026-02-23 22:01 UTC #8 lore raw

PATCH 6/62 dma-buf: Handle all dma_resv_lock() errors

From: Bart Van Assche <[email protected]>

Instead of assuming that dma_resv_lock() only returns 0 or -EDEADLK, handle all possible dma_resv_lock() return values. This patch prepares for enabling compile-time thread-safety analysis. This will cause the compiler to check whether all dma_resv_lock() return values are handled.

Cc Sumit Semwal <[email protected]>

Cc Christian König <[email protected]>

---
 drivers/dma-buf/dma-resv.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

drivers/dma-buf/dma-resv.c +5 -1

index bea3e9858aca..b4710f730e9b 100644
@@ -792,6 +792,8 @@ static int __init dma_resv_lockdep(void)
 	ret = dma_resv_lock(&obj, &ctx);
 	if (ret == -EDEADLK)
 		dma_resv_lock_slow(&obj, &ctx);
+	else if (ret)
+		goto fini;
 	fs_reclaim_acquire(GFP_KERNEL);
 	/* for unmap_mapping_range on trylocked buffer objects in shrinkers */
 	i_mmap_lock_write(&mapping);

@@ -805,12 +807,14 @@ static int __init dma_resv_lockdep(void)
 #endif
 	fs_reclaim_release(GFP_KERNEL);
 	ww_mutex_unlock(&obj.lock);
+
+fini:
 	ww_acquire_fini(&ctx);
 	mmap_read_unlock(mm);
 
 	mmput(mm);
 
-	return 0;
+	return ret;
 }
 subsys_initcall(dma_resv_lockdep);
 #endif

Bart Van Assche

author

2026-02-23 22:01 UTC #9 lore raw

PATCH 7/62 drm/amdgpu: Unlock a mutex before destroying it

From: Bart Van Assche <[email protected]>

Mutexes must be unlocked before these are destroyed. This has been detected by the Clang thread-safety analyzer.

Cc Alex Deucher <[email protected]>

Cc Christian König <[email protected]>

Cc Yang Wang <[email protected]>

Cc Hawking Zhang <[email protected]>

Fixes f5e4cc8461c4 ("drm/amdgpu: implement RAS ACA driver framework")

---
 drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c | 1 +
 1 file changed, 1 insertion(+)

drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c +1 -0

index afe5ca81beec..db7858fe0c3d 100644
@@ -641,6 +641,7 @@ static void aca_error_fini(struct aca_error *aerr)
 		aca_bank_error_remove(aerr, bank_error);
 
 out_unlock:
+	mutex_unlock(&aerr->lock);
 	mutex_destroy(&aerr->lock);
 }

Wang, Yang(Kevin)

Reviewed-by on v1 7/62

2026-02-24 02:41 UTC #10 lore raw

RE: [PATCH 07/62] drm/amdgpu: Unlock a mutex before destroying it

[AMD Official Use Only - AMD Internal Distribution Only]

Reviewed-by Yang Wang <[email protected]>

Best Regards,
Kevin

-----Original Message-----
From: Bart Van Assche <[email protected]>
Sent: Tuesday, February 24, 2026 6:00 AM
To: Peter Zijlstra <[email protected]>
Cc: Ingo Molnar <[email protected]>; Will Deacon <[email protected]>; Boqun Feng <[email protected]>; Waiman Long <[email protected]>; [email protected]; Marco Elver <[email protected]>; Christoph Hellwig <[email protected]>; Steven Rostedt <[email protected]>; Nick Desaulniers <[email protected]>; Nathan Chancellor <[email protected]>; Kees Cook <[email protected]>; Jann Horn <[email protected]>; Bart Van Assche <[email protected]>; Deucher, Alexander <[email protected]>; Koenig, Christian <[email protected]>; Wang, Yang(Kevin) <[email protected]>; Zhang, Hawking <[email protected]>; [email protected]
Subject: [PATCH 07/62] drm/amdgpu: Unlock a mutex before destroying it

[You don't often get email from [email protected]. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]

From: Bart Van Assche <[email protected]>

Mutexes must be unlocked before these are destroyed. This has been detected by the Clang thread-safety analyzer.

Cc Alex Deucher <[email protected]>

Cc Christian König <[email protected]>

Cc Yang Wang <[email protected]>

Cc Hawking Zhang <[email protected]>

Fixes f5e4cc8461c4 ("drm/amdgpu: implement RAS ACA driver framework")

---
 drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c | 1 +
 1 file changed, 1 insertion(+)

drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c +1 -0

index afe5ca81beec..db7858fe0c3d 100644
@@ -641,6 +641,7 @@ static void aca_error_fini(struct aca_error *aerr)
                aca_bank_error_remove(aerr, bank_error);
 
 out_unlock:
+       mutex_unlock(&aerr->lock);
        mutex_destroy(&aerr->lock);
 }

Alex Deucher

Applied

2026-02-24 14:25 UTC #11 lore raw

Re: [PATCH 07/62] drm/amdgpu: Unlock a mutex before destroying it

Applied. Thanks!

Quoted 44 lines · Yang(Kevin)

[AMD Official Use Only - AMD Internal Distribution Only]
Reviewed-by Yang Wang <[email protected]>
Best Regards,
Kevin
-----Original Message-----
From: Bart Van Assche <[email protected]>
Sent: Tuesday, February 24, 2026 6:00 AM
To: Peter Zijlstra <[email protected]>
Cc: Ingo Molnar <[email protected]>; Will Deacon <[email protected]>; Boqun Feng <[email protected]>; Waiman Long <[email protected]>; [email protected]; Marco Elver <[email protected]>; Christoph Hellwig <[email protected]>; Steven Rostedt <[email protected]>; Nick Desaulniers <[email protected]>; Nathan Chancellor <[email protected]>; Kees Cook <[email protected]>; Jann Horn <[email protected]>; Bart Van Assche <[email protected]>; Deucher, Alexander <[email protected]>; Koenig, Christian <[email protected]>; Wang, Yang(Kevin) <[email protected]>; Zhang, Hawking <[email protected]>; [email protected]
Subject: [PATCH 07/62] drm/amdgpu: Unlock a mutex before destroying it
[You don't often get email from [email protected]. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]
From: Bart Van Assche <[email protected]>
Mutexes must be unlocked before these are destroyed. This has been detected by the Clang thread-safety analyzer.
Cc Alex Deucher <[email protected]>
Cc Christian König <[email protected]>
Cc Yang Wang <[email protected]>
Cc Hawking Zhang <[email protected]>
Cc [email protected]
Fixes f5e4cc8461c4 ("drm/amdgpu: implement RAS ACA driver framework")
Signed-off-by Bart Van Assche <[email protected]>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c | 1 +
 1 file changed, 1 insertion(+)
drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c +1 -0
index afe5ca81beec..db7858fe0c3d 100644
@@ -641,6 +641,7 @@ static void aca_error_fini(struct aca_error *aerr)
                aca_bank_error_remove(aerr, bank_error);
 
 out_unlock:
+       mutex_unlock(&aerr->lock);
        mutex_destroy(&aerr->lock);
 }
 

Bart Van Assche

author

2026-02-23 22:01 UTC #12 lore raw

PATCH 8/62 drm/amdgpu: Fix locking bugs in error paths

From: Bart Van Assche <[email protected]>

Do not unlock psp->ras_context.mutex if it has not been locked. This has been detected by the Clang thread-safety analyzer.

Cc Alex Deucher <[email protected]>

Cc Christian König <[email protected]>

Cc YiPeng Chai <[email protected]>

Cc Hawking Zhang <[email protected]>

Fixes b3fb79cda568 ("drm/amdgpu: add mutex to protect ras shared memory")

---
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp_ta.c | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

drivers/gpu/drm/amd/amdgpu/amdgpu_psp_ta.c +7 -5

index 6e8aad91bcd3..0d3c18f04ac3 100644
@@ -332,13 +332,13 @@ static ssize_t ta_if_invoke_debugfs_write(struct file *fp, const char *buf, size
 	if (!context || !context->initialized) {
 		dev_err(adev->dev, "TA is not initialized\n");
 		ret = -EINVAL;
-		goto err_free_shared_buf;
+		goto free_shared_buf;
 	}
 
 	if (!psp->ta_funcs || !psp->ta_funcs->fn_ta_invoke) {
 		dev_err(adev->dev, "Unsupported function to invoke TA\n");
 		ret = -EOPNOTSUPP;
-		goto err_free_shared_buf;
+		goto free_shared_buf;
 	}
 
 	context->session_id = ta_id;

@@ -346,7 +346,7 @@ static ssize_t ta_if_invoke_debugfs_write(struct file *fp, const char *buf, size
 	mutex_lock(&psp->ras_context.mutex);
 	ret = prep_ta_mem_context(&context->mem_context, shared_buf, shared_buf_len);
 	if (ret)
-		goto err_free_shared_buf;
+		goto unlock;
 
 	ret = psp_fn_ta_invoke(psp, cmd_id);
 	if (ret || context->resp_status) {

@@ -354,15 +354,17 @@ static ssize_t ta_if_invoke_debugfs_write(struct file *fp, const char *buf, size
 			ret, context->resp_status);
 		if (!ret) {
 			ret = -EINVAL;
-			goto err_free_shared_buf;
+			goto unlock;
 		}
 	}
 
 	if (copy_to_user((char *)&buf[copy_pos], context->mem_context.shared_buf, shared_buf_len))
 		ret = -EFAULT;
 
-err_free_shared_buf:
+unlock:
 	mutex_unlock(&psp->ras_context.mutex);
+
+free_shared_buf:
 	kfree(shared_buf);
 
 	return ret;

Bart Van Assche

author

2026-02-23 22:01 UTC #13 lore raw

PATCH 9/62 drm: bridge: cdns-mhdp8546: Fix a locking bug in an error path

From: Bart Van Assche <[email protected]>

Do not unlock mhdp->mbox_mutex if it has not been locked.

This bug has been detected by the Clang thread-safety analyzer.

Cc Andrzej Hajda <[email protected]>

Cc Neil Armstrong <[email protected]>

Cc Robert Foss <[email protected]>

Cc Laurent Pinchart <[email protected]>

Cc Jonas Karlman <[email protected]>

Cc Jernej Skrabec <[email protected]>

Cc Swapnil Jakhade <[email protected]>

Cc Tomi Valkeinen <[email protected]>

Fixes fb43aa0acdfd ("drm: bridge: Add support for Cadence MHDP8546 DPI/DP bridge")

---
 drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c +1 -2

index 9392c226ff5b..ce4516de11d8 100644
@@ -502,8 +502,7 @@ int cdns_mhdp_adjust_lt(struct cdns_mhdp_device *mhdp, unsigned int nlanes,
 
 	if (nlanes != 4 && nlanes != 2 && nlanes != 1) {
 		dev_err(mhdp->dev, "invalid number of lanes: %u\n", nlanes);
-		ret = -EINVAL;
-		goto out;
+		return -EINVAL;
 	}
 
 	payload[0] = nlanes;

Bart Van Assche

author

2026-02-23 22:01 UTC #14 lore raw

PATCH 10/62 drm: Make drm_read() easier to analyze

From: Bart Van Assche <[email protected]>

Prepare for enabling the Clang thread-safety analyzer by duplicating a return statement. No functionality has been changed.

Cc Maarten Lankhorst <[email protected]>

Cc Maxime Ripard <[email protected]>

Cc Thomas Zimmermann <[email protected]>

---
 drivers/gpu/drm/drm_file.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

drivers/gpu/drm/drm_file.c +3 -2

index ec820686b302..200979d78452 100644
@@ -572,8 +572,9 @@ ssize_t drm_read(struct file *filp, char __user *buffer,
 			mutex_unlock(&file_priv->event_read_lock);
 			ret = wait_event_interruptible(file_priv->event_wait,
 						       !list_empty(&file_priv->event_list));
-			if (ret >= 0)
-				ret = mutex_lock_interruptible(&file_priv->event_read_lock);
+			if (ret < 0)
+				return ret;
+			ret = mutex_lock_interruptible(&file_priv->event_read_lock);
 			if (ret)
 				return ret;
 		} else {

Bart Van Assche

author

2026-02-23 22:01 UTC #15 lore raw

PATCH 11/62 drm/pagemap: Unlock cache->lock before freeing it

From: Bart Van Assche <[email protected]>

Although freeing a spinlock without unlocking it is fine, this confuses static analyzers. Hence this patch.

Cc Maarten Lankhorst <[email protected]>

Cc Maxime Ripard <[email protected]>

Cc Thomas Zimmermann <[email protected]>

Cc Thomas Hellström <[email protected]>

Cc Matthew Brost <[email protected]>

---
 drivers/gpu/drm/drm_pagemap_util.c | 2 ++
 1 file changed, 2 insertions(+)

drivers/gpu/drm/drm_pagemap_util.c +2 -0

index 14ddb948a32e..50cb5f9cdac5 100644
@@ -74,6 +74,8 @@ static void drm_pagemap_cache_fini(void *arg)
 		cache->dpagemap = NULL;
 		spin_unlock(&cache->lock);
 		drm_pagemap_destroy(dpagemap, false);
+	} else {
+		spin_unlock(&cache->lock);
 	}
 
 out:

Matthew Brost

maintainer Reviewed-by on v1 11/62

2026-02-23 22:14 UTC #16 lore raw

Re: [PATCH 11/62] drm/pagemap: Unlock cache->lock before freeing it

Quoted 3 lines · Bart Van Assche

From: Bart Van Assche <[email protected]>
Although freeing a spinlock without unlocking it is fine, this confuses

Fine, but pretty bad practice.

Quoted 7 lines

static analyzers. Hence this patch.
Cc Maarten Lankhorst <[email protected]>
Cc Maxime Ripard <[email protected]>
Cc Thomas Zimmermann <[email protected]>
Cc Thomas Hellström <[email protected]>
Cc Matthew Brost <[email protected]>

With that:

Reviewed-by Matthew Brost <[email protected]>

We can apply this to the DRM branches and propagate this up to Linus during 7.0 cycle if that works for you? Or if you have other plans to merge, let us know.

Matt

Quoted 18 lines

[1] https://patchwork.freedesktop.org/series/162019/

---
 drivers/gpu/drm/drm_pagemap_util.c | 2 ++
 1 file changed, 2 insertions(+)

drivers/gpu/drm/drm_pagemap_util.c +2 -0

index 14ddb948a32e..50cb5f9cdac5 100644
@@ -74,6 +74,8 @@ static void drm_pagemap_cache_fini(void *arg)
 		cache->dpagemap = NULL;
 		spin_unlock(&cache->lock);
 		drm_pagemap_destroy(dpagemap, false);
+	} else {
+		spin_unlock(&cache->lock);
 	}
 
 out:

Bart Van Assche

2026-02-23 22:20 UTC #17 lore raw

Re: [PATCH 11/62] drm/pagemap: Unlock cache->lock before freeing it

Quoted 15 lines · Matthew Brost

Quoted 3 lines · Bart Van Assche
From: Bart Van Assche <[email protected]>
Although freeing a spinlock without unlocking it is fine, this confuses
Fine, but pretty bad practice.
Quoted 7 lines
static analyzers. Hence this patch.
Cc Maarten Lankhorst <[email protected]>
Cc Maxime Ripard <[email protected]>
Cc Thomas Zimmermann <[email protected]>
Cc Thomas Hellström <[email protected]>
Cc Matthew Brost <[email protected]>

Quoted 6 lines

With that:
Reviewed-by Matthew Brost <[email protected]>
We can apply this to the DRM branches and propagate this up to Linus during 7.0 cycle if that works for you? Or if you have other plans to merge, let us know.

Peter asked me to split this series into one series per maintainer and to send the patches directly to the respective maintainers. Feel free to queue this patch in a DRM branch.

Thanks,

Bart.

Matthew Brost

maintainer

2026-02-23 22:34 UTC #18 lore raw

Re: [PATCH 11/62] drm/pagemap: Unlock cache->lock before freeing it

Quoted 19 lines · Bart Van Assche

Quoted 18 lines · Matthew Brost
Quoted 3 lines · Bart Van Assche
From: Bart Van Assche <[email protected]>
Although freeing a spinlock without unlocking it is fine, this confuses
Fine, but pretty bad practice.
Quoted 7 lines
static analyzers. Hence this patch.
Cc Maarten Lankhorst <[email protected]>
Cc Maxime Ripard <[email protected]>
Cc Thomas Zimmermann <[email protected]>
Cc Thomas Hellström <[email protected]>
Cc Matthew Brost <[email protected]>
With that:
Reviewed-by Matthew Brost <[email protected]>

Quoted 7 lines

Quoted 3 lines
We can apply this to the DRM branches and propagate this up to Linus during 7.0 cycle if that works for you? Or if you have other plans to merge, let us know.
Peter asked me to split this series into one series per maintainer and to send the patches directly to the respective maintainers. Feel free to queue this patch in a DRM branch.

I've reposted the patch, retaining you as the author, to our lists [1], since we pull patches from the lists when merging and to run our CI.

Let me know if anything looks wrong there, but I’ll merge once CI comes back (might take a few days, as CI is currently broken after we rebased on 7.0‑rc1). After that, it will be in the PR up to Linus during the fixes phase.

Matt

Quoted 3 lines

Thanks,
Bart.

Bart Van Assche

author

2026-02-23 22:02 UTC #19 lore raw

PATCH 12/62 drm/gpusvm.c: Fix a locking bug in an error path

From: Bart Van Assche <[email protected]>

Only call drm_gpusvm_notifier_unlock() if drm_gpusvm_notifier_lock() was called first. This has been detected by the Clang thread-safety analyzer. Compile-tested only.

Cc Thomas Hellström <[email protected]>

Cc Matthew Brost <[email protected]>

Cc Himal Prasad Ghimiray <[email protected]>

Cc Maarten Lankhorst <[email protected]>

Fixes f1d08a586482 ("drm/gpusvm: Introduce a function to scan the current migration state")

---
 drivers/gpu/drm/drm_gpusvm.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

drivers/gpu/drm/drm_gpusvm.c +3 -2

index 24180bfdf5a2..e9b79ab2f83c 100644
@@ -819,7 +819,7 @@ enum drm_gpusvm_scan_result drm_gpusvm_scan_mm(struct drm_gpusvm_range *range,
 
 		if (!(pfns[i] & HMM_PFN_VALID)) {
 			state = DRM_GPUSVM_SCAN_UNPOPULATED;
-			goto err_free;
+			goto unlock;
 		}
 
 		page = hmm_pfn_to_page(pfns[i]);

@@ -856,9 +856,10 @@ enum drm_gpusvm_scan_result drm_gpusvm_scan_mm(struct drm_gpusvm_range *range,
 		i += 1ul << drm_gpusvm_hmm_pfn_to_order(pfns[i], i, npages);
 	}
 
-err_free:
+unlock:
 	drm_gpusvm_notifier_unlock(range->gpusvm);
 
+err_free:
 	kvfree(pfns);
 	return state;
 }

Matthew Brost

maintainer

2026-02-23 22:11 UTC #20 lore raw

Re: [PATCH 12/62] drm/gpusvm.c: Fix a locking bug in an error path

Quoted 21 lines · Bart Van Assche

From: Bart Van Assche <[email protected]>
Only call drm_gpusvm_notifier_unlock() if drm_gpusvm_notifier_lock() was called first. This has been detected by the Clang thread-safety analyzer. Compile-tested only.
Cc Thomas Hellström <[email protected]>
Cc Matthew Brost <[email protected]>
Cc Himal Prasad Ghimiray <[email protected]>
Cc Maarten Lankhorst <[email protected]>
Fixes f1d08a586482 ("drm/gpusvm: Introduce a function to scan the current migration state")
Signed-off-by Bart Van Assche <[email protected]>
---
 drivers/gpu/drm/drm_gpusvm.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/gpu/drm/drm_gpusvm.c +0 -0
index 24180bfdf5a2..e9b79ab2f83c 100644

drivers/gpu/drm/drm_gpusvm.c enum drm_gpusvm_scan_result drm_gpusvm_scan_mm(struct drm_gpusvm_range *range, · line 822

Quoted 5 lines

drivers/gpu/drm/drm_gpusvm.c +1 -1

@@ -819,7 +819,7 @@ enum drm_gpusvm_scan_result drm_gpusvm_scan_mm(struct drm_gpusvm_range *range,
 
 		if (!(pfns[i] & HMM_PFN_VALID)) {
 			state = DRM_GPUSVM_SCAN_UNPOPULATED;
-			goto err_free;
+			goto unlock;

Indeed a problem but we have this fixed in drm-tip.

git format-patch -1 d287dee565c3c

'drm/gpusvm: Fix unbalanced unlock in drm_gpusvm_scan_mm'

Not sure which tree you are in but this should propagate up to Linus during the 7.0 cycle.

Matt

Quoted 15 lines

drivers/gpu/drm/drm_gpusvm.c +2 -1

 		}
 
 		page = hmm_pfn_to_page(pfns[i]);

@@ -856,9 +856,10 @@ enum drm_gpusvm_scan_result drm_gpusvm_scan_mm(struct drm_gpusvm_range *range,
 		i += 1ul << drm_gpusvm_hmm_pfn_to_order(pfns[i], i, npages);
 	}
 
-err_free:
+unlock:
 	drm_gpusvm_notifier_unlock(range->gpusvm);
 
+err_free:
 	kvfree(pfns);
 	return state;
 }

Bart Van Assche

2026-02-23 22:16 UTC #21 lore raw

Re: [PATCH 12/62] drm/gpusvm.c: Fix a locking bug in an error path

Quoted 30 lines · Matthew Brost

Quoted 21 lines · Bart Van Assche
From: Bart Van Assche <[email protected]>
Only call drm_gpusvm_notifier_unlock() if drm_gpusvm_notifier_lock() was called first. This has been detected by the Clang thread-safety analyzer. Compile-tested only.
Cc Thomas Hellström <[email protected]>
Cc Matthew Brost <[email protected]>
Cc Himal Prasad Ghimiray <[email protected]>
Cc Maarten Lankhorst <[email protected]>
Fixes f1d08a586482 ("drm/gpusvm: Introduce a function to scan the current migration state")
Signed-off-by Bart Van Assche <[email protected]>
---
  drivers/gpu/drm/drm_gpusvm.c | 5 +++--
  1 file changed, 3 insertions(+), 2 deletions(-)
drivers/gpu/drm/drm_gpusvm.c +0 -0
index 24180bfdf5a2..e9b79ab2f83c 100644
drivers/gpu/drm/drm_gpusvm.c enum drm_gpusvm_scan_result drm_gpusvm_scan_mm(struct drm_gpusvm_range *range, · line 822
Quoted 5 lines
drivers/gpu/drm/drm_gpusvm.c +1 -1
@@ -819,7 +819,7 @@ enum drm_gpusvm_scan_result drm_gpusvm_scan_mm(struct drm_gpusvm_range *range,
 
  		if (!(pfns[i] & HMM_PFN_VALID)) {
  			state = DRM_GPUSVM_SCAN_UNPOPULATED;
-			goto err_free;
+			goto unlock;
Indeed a problem but we have this fixed in drm-tip.

Quoted 6 lines

git format-patch -1 d287dee565c3c
'drm/gpusvm: Fix unbalanced unlock in drm_gpusvm_scan_mm'
Not sure which tree you are in but this should propagate up to Linus during the 7.0 cycle.

Thanks Matt for the quick follow-up. This patch series is based on Linus' master branch. Since a fix has already been queued in the drm-tip branch, I will drop this patch.

Bart.

Bart Van Assche

author

2026-02-23 22:02 UTC #22 lore raw

PATCH 13/62 drm/qxl: Fix a buffer leak in an error path

From: Bart Van Assche <[email protected]>

If qxl_bo_reserve() succeeds, call qxl_bo_unreserve() instead of skipping that call.

This has been detected by the Clang thread-safety analyzer. Compile-tested only.

Cc Dave Airlie <[email protected]>

Cc Gerd Hoffmann <[email protected]>

Fixes f64122c1f6ad ("drm: add new QXL driver. (v1.4)")

---
 drivers/gpu/drm/qxl/qxl_ioctl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

drivers/gpu/drm/qxl/qxl_ioctl.c +1 -1

index 4ee2b5acf2e0..5617811f3c9b 100644
@@ -323,7 +323,7 @@ int qxl_update_area_ioctl(struct drm_device *dev, void *data, struct drm_file *f
 		qxl_ttm_placement_from_domain(qobj, qobj->type);
 		ret = ttm_bo_validate(&qobj->tbo, &qobj->placement, &ctx);
 		if (unlikely(ret))
-			goto out;
+			goto out2;
 	}
 
 	ret = qxl_bo_check_id(qdev, qobj);

Bart Van Assche

author

2026-02-23 22:02 UTC #23 lore raw

PATCH 14/62 hwmon: (it87) Check the it87_lock() return value

From: Bart Van Assche <[email protected]>

Return early in it87_resume() if it87_lock() fails instead of ignoring the return value of that function. This patch suppresses a Clang thread-safety warning.

Cc Frank Crawford <[email protected]>

Cc Guenter Roeck <[email protected]>

Cc Jean Delvare <[email protected]>

Fixes 376e1a937b30 ("hwmon: (it87) Add calls to smbus_enable/smbus_disable as required")

---
 drivers/hwmon/it87.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

drivers/hwmon/it87.c +3 -1

index e233aafa8856..8e3935089fca 100644
@@ -3593,7 +3593,9 @@ static int it87_resume(struct device *dev)
 
 	it87_resume_sio(pdev);
 
-	it87_lock(data);
+	int err = it87_lock(data);
+	if (err)
+		return err;
 
 	it87_check_pwm(dev);
 	it87_check_limit_regs(data);

Guenter Roeck

maintainer Applied

2026-02-24 15:31 UTC #24 lore raw

Re: [PATCH 14/62] hwmon: (it87) Check the it87_lock() return value

Quoted 21 lines · Bart Van Assche

From: Bart Van Assche <[email protected]>
Return early in it87_resume() if it87_lock() fails instead of ignoring the return value of that function. This patch suppresses a Clang thread-safety warning.
Cc Frank Crawford <[email protected]>
Cc Guenter Roeck <[email protected]>
Cc Jean Delvare <[email protected]>
Cc [email protected]
Fixes 376e1a937b30 ("hwmon: (it87) Add calls to smbus_enable/smbus_disable as required")
Signed-off-by Bart Van Assche <[email protected]>
---
 drivers/hwmon/it87.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/hwmon/it87.c +0 -0
index e233aafa8856..8e3935089fca 100644

drivers/hwmon/it87.c static int it87_resume(struct device *dev) · line 3598

Quoted 7 lines

drivers/hwmon/it87.c +3 -1

@@ -3593,7 +3593,9 @@ static int it87_resume(struct device *dev)
 
 	it87_resume_sio(pdev);
 
-	it87_lock(data);
+	int err = it87_lock(data);
+	if (err)
+		return err;

checkpatch: missing empty line after declarations.

Oh, never mind, I'll fix that up and declare ret at the beginning of the function, to match the rest of the driver.

Applied.

Guenter

Bart Van Assche

author

2026-02-23 22:02 UTC #25 lore raw

PATCH 15/62 Input: synaptics-rmi4 - fix a locking bug in an error path

From: Bart Van Assche <[email protected]>

Lock f54->data_mutex before the first 'goto error' statement since jumping to the 'error' label causes that mutex to be unlocked.

This bug has been detected by the Clang thread-safety checker.

Cc Dmitry Torokhov <[email protected]>

Cc Nick Dyer <[email protected]>

Fixes 3a762dbd5347 ("[media] Input: synaptics-rmi4 - add support for F54 diagnostics")

---
 drivers/input/rmi4/rmi_f54.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

drivers/input/rmi4/rmi_f54.c +3 -2

index ac4041a69fcd..fd57ebb1cb50 100644
@@ -539,6 +539,9 @@ static void rmi_f54_work(struct work_struct *work)
 	int i;
 
 	report_size = rmi_f54_get_report_size(f54);
+
+	mutex_lock(&f54->data_mutex);
+
 	if (report_size == 0) {
 		dev_err(&fn->dev, "Bad report size, report type=%d\n",
 				f54->report_type);

@@ -546,8 +549,6 @@ static void rmi_f54_work(struct work_struct *work)
 		goto error;     /* retry won't help */
 	}
 
-	mutex_lock(&f54->data_mutex);
-
 	/*
 	 * Need to check if command has completed.
 	 * If not try again later.

Bart Van Assche

author

2026-02-23 22:02 UTC #26 lore raw

PATCH 16/62 md: Make mddev_suspend() easier to analyze

From: Bart Van Assche <[email protected]>

Prepare for enabling Clang's thread-safety analysis by moving an if-statement. No functionality has been changed.

Cc Song Liu <[email protected]>

Cc Yu Kuai <[email protected]>

---
 drivers/md/md.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

drivers/md/md.c +5 -4

index 3ce6f9e9d38e..b0d260d03a7d 100644
@@ -475,12 +475,13 @@ int mddev_suspend(struct mddev *mddev, bool interruptible)
 	 */
 	lockdep_assert_not_held(&mddev->reconfig_mutex);
 
-	if (interruptible)
+	if (interruptible) {
 		err = mutex_lock_interruptible(&mddev->suspend_mutex);
-	else
+		if (err)
+			return err;
+	} else {
 		mutex_lock(&mddev->suspend_mutex);
-	if (err)
-		return err;
+	}
 
 	if (mddev->suspended) {
 		WRITE_ONCE(mddev->suspended, mddev->suspended + 1);

Bart Van Assche

author

2026-02-23 22:02 UTC #27 lore raw

PATCH 17/62 bnxt_en: Make bnxt_resume() easier to analyze

From: Bart Van Assche <[email protected]>

Pass the same argument to netdev_lock() and netdev_unlock(). This patch prepares for enabling the Clang thread-safety analysis functionality. No functional change intended.

Cc Shantiprasad Shettar <[email protected]>

---
 drivers/net/ethernet/broadcom/bnxt/bnxt.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

drivers/net/ethernet/broadcom/bnxt/bnxt.c +1 -1

index e062d5d400da..950708575268 100644
@@ -17121,7 +17121,7 @@ static int bnxt_resume(struct device *device)
 	}
 
 resume_exit:
-	netdev_unlock(bp->dev);
+	netdev_unlock(dev);
 	bnxt_ulp_start(bp, rc);
 	if (!rc)
 		bnxt_reenable_sriov(bp);

Bart Van Assche

author

2026-02-23 22:02 UTC #28 lore raw

PATCH 18/62 bnxt_en: Fix bnxt_dl_reload_up()

From: Bart Van Assche <[email protected]>

bnxt_dl_reload_down() calls rtnl_lock() and netdev_lock() if it returns
0. Hence, bnxt_dl_reload_up() should invoke the corresponding unlock calls. This issue has been detected by the clang thread-sanitizer. Compile-tested only.

Cc Jakub Kicinski <[email protected]>

Cc Shantiprasad Shettar <[email protected]>

Cc Stanislav Fomichev <[email protected]>

Fixes 004b5008016a ("eth: bnxt: remove most dependencies on RTNL")

---
 drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c | 2 ++
 1 file changed, 2 insertions(+)

drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c +2 -0

index 15de802bbac4..1e9a3454bb29 100644
@@ -562,6 +562,8 @@ static int bnxt_dl_reload_up(struct devlink *dl, enum devlink_reload_action acti
 		break;
 	}
 	default:
+		netdev_unlock(bp->dev);
+		rtnl_unlock();
 		return -EOPNOTSUPP;
 	}

Bart Van Assche

author

2026-02-23 22:02 UTC #29 lore raw

PATCH 19/62 ice: Fix a locking bug in an error path

From: Bart Van Assche <[email protected]>

Move the mutex_lock() call up to prevent that DCB settings change after the ice_query_port_ets() call.

This patch fixes a bug in an error path. Without this patch pf->tc_mutex may be unlocked in an error path without having been locked. This bug has been detected by the clang thread-safety analyzer.

Cc Tony Nguyen <[email protected]>

Cc Przemek Kitszel <[email protected]>

Fixes 242b5e068b25 ("ice: Fix DCB rebuild after reset")

---
 drivers/net/ethernet/intel/ice/ice_dcb_lib.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

drivers/net/ethernet/intel/ice/ice_dcb_lib.c +2 -2

index bd77f1c001ee..78ded6876581 100644
@@ -537,14 +537,14 @@ void ice_dcb_rebuild(struct ice_pf *pf)
 	struct ice_dcbx_cfg *err_cfg;
 	int ret;
 
+	mutex_lock(&pf->tc_mutex);
+
 	ret = ice_query_port_ets(pf->hw.port_info, &buf, sizeof(buf), NULL);
 	if (ret) {
 		dev_err(dev, "Query Port ETS failed\n");
 		goto dcb_error;
 	}
 
-	mutex_lock(&pf->tc_mutex);
-
 	if (!pf->hw.port_info->qos_cfg.is_sw_lldp)
 		ice_cfg_etsrec_defaults(pf->hw.port_info);

Przemek Kitszel

maintainer

2026-02-24 08:41 UTC #30 lore raw

Re: [PATCH 19/62] ice: Fix a locking bug in an error path

Quoted 8 lines · Bart Van Assche

From: Bart Van Assche <[email protected]>
Move the mutex_lock() call up to prevent that DCB settings change after the ice_query_port_ets() call.
This patch fixes a bug in an error path. Without this patch pf->tc_mutex may be unlocked in an error path without having been locked. This bug has been detected by the clang thread-safety analyzer.

Thank you. This is a good catch, and current error path is obviously wrong, in the way you have described.

From the commit msg alone, it is not clear why moving the lock up, instead moving the unlock to match the lock order, is right. But from the code, I see that you are right - we call ice_query_port_ets() again under the lock some 20 lines below (L566)

Let us know If you want to enhance your commit message (including the subject), as it looks like a big quasi-automated series.

Quoted 31 lines

Cc Tony Nguyen <[email protected]>

Cc Przemek Kitszel <[email protected]>

Fixes 242b5e068b25 ("ice: Fix DCB rebuild after reset")

---
  drivers/net/ethernet/intel/ice/ice_dcb_lib.c | 4 ++--
  1 file changed, 2 insertions(+), 2 deletions(-)

drivers/net/ethernet/intel/ice/ice_dcb_lib.c +2 -2

index bd77f1c001ee..78ded6876581 100644
@@ -537,14 +537,14 @@ void ice_dcb_rebuild(struct ice_pf *pf)
  	struct ice_dcbx_cfg *err_cfg;
  	int ret;
 
+	mutex_lock(&pf->tc_mutex);
+
  	ret = ice_query_port_ets(pf->hw.port_info, &buf, sizeof(buf), NULL);
  	if (ret) {
  		dev_err(dev, "Query Port ETS failed\n");
  		goto dcb_error;
  	}
 
-	mutex_lock(&pf->tc_mutex);
-
  	if (!pf->hw.port_info->qos_cfg.is_sw_lldp)
  		ice_cfg_etsrec_defaults(pf->hw.port_info);

Bart Van Assche

2026-02-24 17:43 UTC #31 lore raw

Re: [PATCH 19/62] ice: Fix a locking bug in an error path

Quoted 10 lines · Przemek Kitszel

Quoted 8 lines · Bart Van Assche
From: Bart Van Assche <[email protected]>
Move the mutex_lock() call up to prevent that DCB settings change after the ice_query_port_ets() call.
This patch fixes a bug in an error path. Without this patch pf->tc_mutex may be unlocked in an error path without having been locked. This bug has been detected by the clang thread-safety analyzer.

Quoted 5 lines

Thank you. This is a good catch, and current error path is obviously wrong, in the way you have described.
From the commit msg alone, it is not clear why moving the lock up, instead moving the unlock to match the lock order, is right.

Please take a look at the prior discussion of this change, available here: https://lore.kernel.org/all/[email protected]/

Quoted 5 lines

But from the code, I see that you are right - we call ice_query_port_ets() again under the lock some 20 lines below (L566)
Let us know If you want to enhance your commit message (including the subject), as it looks like a big quasi-automated series.

I have been asked to split this patch series and to send it directly to the maintainers of the modified subsystems. Suggestions for how to improve the patch description are welcome.

Thanks,

Bart.

Przemek Kitszel

maintainer

2026-02-25 13:16 UTC #32 lore raw

Re: [PATCH 19/62] ice: Fix a locking bug in an error path

Quoted 6 lines · Bart Van Assche

Quoted 5 lines · Przemek Kitszel
Quoted 4 lines · Bart Van Assche
From: Bart Van Assche <[email protected]>
Move the mutex_lock() call up to prevent that DCB settings change after the ice_query_port_ets() call.

s/./, as the other call in ice_dcb_rebuild() is/

Quoted 3 lines

Quoted 3 lines
Quoted 3 lines
This patch fixes a bug in an error path. Without this patch pf->tc_mutex may be unlocked in an error path without having been locked.

suggestion:
This also fixes a bug in an error path, as before taking the first "goto dcb_error" in the function jumped over mutex_lock() to mutex_unlock()

This bug

Quoted 14 lines

Quoted 8 lines
Quoted 2 lines
has
been detected by the clang thread-safety analyzer.
Thank you. This is a good catch, and current error path is obviously wrong, in the way you have described.
From the commit msg alone, it is not clear why moving the lock up, instead moving the unlock to match the lock order, is right.
Please take a look at the prior discussion of this change, available here: https://lore.kernel.org/all/61e3cc7a-af79-48e4- [email protected]/
Quoted 3 lines
But from the code, I see that you are right - we call ice_query_port_ets() again under the lock some 20 lines below (L566)

Quoted 6 lines

Quoted 2 lines
Let us know If you want to enhance your commit message (including the subject), as it looks like a big quasi-automated series.
I have been asked to split this patch series and to send it directly to the maintainers of the modified subsystems. Suggestions for how to improve the patch description are welcome.

ok, that aligns with what I wanted too,

see my suggestions inline above, and update Subject, perhaps:

Subject: ice: fix locking in ice_dcb_rebuild()

please send with the "iwl-net" prefix, as a separate single-patch series

Quoted 5 lines

Thanks,
Bart.

Bart Van Assche

author

2026-02-23 22:02 UTC #33 lore raw

PATCH 20/62 octeontx2-pf: Fix locking in an error path

From: Bart Van Assche <[email protected]>

Only unlock pf->mbox.lock if it has been locked by otx2_do_set_vf_vlan(). This bug has been detected by the Clang thread-safety analyzer.

Cc Naveen Mamindlapalli <[email protected]>

Cc Jakub Kicinski <[email protected]>

Cc Sunil Goutham <[email protected]>

Cc Geetha sowjanya <[email protected]>

Cc Subbaraya Sundeep <[email protected]>

Cc hariprasad <[email protected]>

Cc Bharat Bhushan <[email protected]>

Fixes f0c2982aaf98 ("octeontx2-pf: Add support for SR-IOV management functions")

---
 drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c +1 -1

index ee623476e5ff..8c9f08ed90fd 100644
@@ -2588,7 +2588,7 @@ static int otx2_do_set_vf_vlan(struct otx2_nic *pf, int vf, u16 vlan, u8 qos,
 	config = &pf->vf_configs[vf];
 
 	if (!vlan && !config->vlan)
-		goto out;
+		return err;
 
 	mutex_lock(&pf->mbox.lock);

Bart Van Assche

author

2026-02-23 22:02 UTC #34 lore raw

PATCH 21/62 qed: Make _qed_mcp_cmd_and_union() easier to analyze

From: Bart Van Assche <[email protected]>

Make the implementation of this function compatible with clang's compile-time thread-safety analysis by moving error-handling code to the end of this function. No functionality has been changed.

Cc Manish Chopra <[email protected]>

---
 drivers/net/ethernet/qlogic/qed/qed_mcp.c | 56 ++++++++++++-----------
 1 file changed, 30 insertions(+), 26 deletions(-)

drivers/net/ethernet/qlogic/qed/qed_mcp.c +30 ~~-26~~

index 7e37fe631a58..462e758c5890 100644
@@ -467,7 +467,7 @@ _qed_mcp_cmd_and_union(struct qed_hwfn *p_hwfn,
 	int rc = 0;
 
 	/* Wait until the mailbox is non-occupied */
-	do {
+	for (;;) {
 		/* Exit the loop if there is no pending command, or if the
 		 * pending command is completed during this iteration.
 		 * The spinlock stays locked until the command is sent.

@@ -486,18 +486,14 @@ _qed_mcp_cmd_and_union(struct qed_hwfn *p_hwfn,
 
 		spin_unlock_bh(&p_hwfn->mcp_info->cmd_lock);
 
+		if (++cnt >= QED_DRV_MB_MAX_RETRIES)
+			goto retries_exceeded_1;
+
 		if (QED_MB_FLAGS_IS_SET(p_mb_params, CAN_SLEEP))
 			usleep_range(QED_MCP_RESP_ITER_US,
 				     QED_MCP_RESP_ITER_US * 2);
 		else
 			udelay(QED_MCP_RESP_ITER_US);
-	} while (++cnt < QED_DRV_MB_MAX_RETRIES);
-
-	if (cnt >= QED_DRV_MB_MAX_RETRIES) {
-		DP_NOTICE(p_hwfn,
-			  "The MFW mailbox is occupied by an uncompleted command. Failed to send command 0x%08x [param 0x%08x].\n",
-			  p_mb_params->cmd, p_mb_params->param);
-		return -EAGAIN;
 	}
 
 	/* Send the mailbox command */

@@ -513,7 +509,7 @@ _qed_mcp_cmd_and_union(struct qed_hwfn *p_hwfn,
 	spin_unlock_bh(&p_hwfn->mcp_info->cmd_lock);
 
 	/* Wait for the MFW response */
-	do {
+	for (;;) {
 		/* Exit the loop if the command is already completed, or if the
 		 * command is completed during this iteration.
 		 * The spinlock stays locked until the list element is removed.

@@ -537,24 +533,9 @@ _qed_mcp_cmd_and_union(struct qed_hwfn *p_hwfn,
 			goto err;
 
 		spin_unlock_bh(&p_hwfn->mcp_info->cmd_lock);
-	} while (++cnt < QED_DRV_MB_MAX_RETRIES);
-
-	if (cnt >= QED_DRV_MB_MAX_RETRIES) {
-		DP_NOTICE(p_hwfn,
-			  "The MFW failed to respond to command 0x%08x [param 0x%08x].\n",
-			  p_mb_params->cmd, p_mb_params->param);
-		qed_mcp_print_cpu_info(p_hwfn, p_ptt);
-
-		spin_lock_bh(&p_hwfn->mcp_info->cmd_lock);
-		qed_mcp_cmd_del_elem(p_hwfn, p_cmd_elem);
-		spin_unlock_bh(&p_hwfn->mcp_info->cmd_lock);
 
-		if (!QED_MB_FLAGS_IS_SET(p_mb_params, AVOID_BLOCK))
-			qed_mcp_cmd_set_blocking(p_hwfn, true);
-
-		qed_hw_err_notify(p_hwfn, p_ptt,
-				  QED_HW_ERR_MFW_RESP_FAIL, NULL);
-		return -EAGAIN;
+		if (++cnt >= QED_DRV_MB_MAX_RETRIES)
+			goto retries_exceeded_2;
 	}
 
 	qed_mcp_cmd_del_elem(p_hwfn, p_cmd_elem);

@@ -576,6 +557,29 @@ _qed_mcp_cmd_and_union(struct qed_hwfn *p_hwfn,
 err:
 	spin_unlock_bh(&p_hwfn->mcp_info->cmd_lock);
 	return rc;
+
+retries_exceeded_1:
+	DP_NOTICE(p_hwfn,
+		  "The MFW mailbox is occupied by an uncompleted command. Failed to send command 0x%08x [param 0x%08x].\n",
+		  p_mb_params->cmd, p_mb_params->param);
+	return -EAGAIN;
+
+retries_exceeded_2:
+	DP_NOTICE(p_hwfn,
+		  "The MFW failed to respond to command 0x%08x [param 0x%08x].\n",
+		  p_mb_params->cmd, p_mb_params->param);
+	qed_mcp_print_cpu_info(p_hwfn, p_ptt);
+
+	spin_lock_bh(&p_hwfn->mcp_info->cmd_lock);
+	qed_mcp_cmd_del_elem(p_hwfn, p_cmd_elem);
+	spin_unlock_bh(&p_hwfn->mcp_info->cmd_lock);
+
+	if (!QED_MB_FLAGS_IS_SET(p_mb_params, AVOID_BLOCK))
+		qed_mcp_cmd_set_blocking(p_hwfn, true);
+
+	qed_hw_err_notify(p_hwfn, p_ptt,
+			  QED_HW_ERR_MFW_RESP_FAIL, NULL);
+	return -EAGAIN;
 }
 
 static int qed_mcp_cmd_and_union(struct qed_hwfn *p_hwfn,

Bart Van Assche

author

2026-02-23 22:02 UTC #35 lore raw

PATCH 22/62 mctp i3c: Fix locking in error paths

From: Bart Van Assche <[email protected]>

Only unlock mi->lock if it has been locked. This bug has been detected by the Clang thread-safety analyzer.

Cc Leo Yang <[email protected]>

Cc Paolo Abeni <[email protected]>

Cc Jeremy Kerr <[email protected]>

Cc Matt Johnston <[email protected]>

Fixes 2d2d4f60ed26 ("mctp i3c: fix MCTP I3C driver multi-thread issue")

---
 drivers/net/mctp/mctp-i3c.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

drivers/net/mctp/mctp-i3c.c +4 -1

index 6d2bbae7477b..d4a29912c7e1 100644
@@ -112,7 +112,7 @@ static int mctp_i3c_read(struct mctp_i3c_device *mi)
 	if (!skb) {
 		stats->rx_dropped++;
 		rc = -ENOMEM;
-		goto err;
+		goto free_skb;
 	}
 
 	skb->protocol = htons(ETH_P_MCTP);

@@ -170,8 +170,11 @@ static int mctp_i3c_read(struct mctp_i3c_device *mi)
 
 	mutex_unlock(&mi->lock);
 	return 0;
+
 err:
 	mutex_unlock(&mi->lock);
+
+free_skb:
 	kfree_skb(skb);
 	return rc;
 }

Matt Johnston

maintainer Acked-by on v1 22/62

2026-02-25 04:27 UTC #36 lore raw

Re: [PATCH 22/62] mctp i3c: Fix locking in error paths

Hi Bart,

Quoted 4 lines · Bart Van Assche

From: Bart Van Assche <[email protected]>
Only unlock mi->lock if it has been locked. This bug has been detected by the Clang thread-safety analyzer.

Thanks for the fix.

Acked-by Matt Johnston <[email protected]>

Cheers,
Matt

Bart Van Assche

author

2026-02-23 22:02 UTC #37 lore raw

PATCH 23/62 net: phy: mxl-86110: Fix locking in an error path

From: Bart Van Assche <[email protected]>

Only call phy_unlock_mdio_bus() if phy_lock_mdio_bus() has been called first. This has been detected by the Clang thread-safety analyzer.

Cc Daniel Golle <[email protected]>

Cc Andrew Lunn <[email protected]>

Cc Jakub Kicinski <[email protected]>

Cc Xu Liang <[email protected]>

Fixes 3d1b3f4ffc0a ("net: phy: mxl-86110: add basic support for MxL86111 PHY")

---
 drivers/net/phy/mxl-86110.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

drivers/net/phy/mxl-86110.c +1 -1

index 42a5fe3f115f..d010b023f7b9 100644
@@ -891,7 +891,7 @@ static int mxl86111_config_inband(struct phy_device *phydev, unsigned int modes)
 			       MII_BMCR, BMCR_ANENABLE,
 			       (modes == LINK_INBAND_DISABLE) ? 0 : BMCR_ANENABLE);
 	if (ret < 0)
-		goto out;
+		return ret;
 
 	phy_lock_mdio_bus(phydev);

Daniel Golle

Reviewed-by on v1 23/62

2026-02-23 23:12 UTC #38 lore raw

Re: [PATCH 23/62] net: phy: mxl-86110: Fix locking in an error path

Quoted 5 lines · Bart Van Assche

From: Bart Van Assche <[email protected]>
Only call phy_unlock_mdio_bus() if phy_lock_mdio_bus() has been called first. This has been detected by the Clang thread-safety analyzer.

Quoted 7 lines

Cc Daniel Golle <[email protected]>
Cc Andrew Lunn <[email protected]>
Cc Jakub Kicinski <[email protected]>
Cc Xu Liang <[email protected]>
Cc [email protected]
Fixes 3d1b3f4ffc0a ("net: phy: mxl-86110: add basic support for MxL86111 PHY")
Signed-off-by Bart Van Assche <[email protected]>

Reviewed-by Daniel Golle <[email protected]>

Quoted 17 lines

---
 drivers/net/phy/mxl-86110.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

drivers/net/phy/mxl-86110.c +1 -1

index 42a5fe3f115f..d010b023f7b9 100644
@@ -891,7 +891,7 @@ static int mxl86111_config_inband(struct phy_device *phydev, unsigned int modes)
 			       MII_BMCR, BMCR_ANENABLE,
 			       (modes == LINK_INBAND_DISABLE) ? 0 : BMCR_ANENABLE);
 	if (ret < 0)
-		goto out;
+		return ret;
 
 	phy_lock_mdio_bus(phydev);

Andrew Lunn

maintainer Reviewed-by on v1 23/62

2026-02-24 00:19 UTC #39 lore raw

Re: [PATCH 23/62] net: phy: mxl-86110: Fix locking in an error path

Quoted 5 lines · Bart Van Assche

From: Bart Van Assche <[email protected]>
Only call phy_unlock_mdio_bus() if phy_lock_mdio_bus() has been called first. This has been detected by the Clang thread-safety analyzer.

Quoted 7 lines

Cc Daniel Golle <[email protected]>
Cc Andrew Lunn <[email protected]>
Cc Jakub Kicinski <[email protected]>
Cc Xu Liang <[email protected]>
Cc [email protected]
Fixes 3d1b3f4ffc0a ("net: phy: mxl-86110: add basic support for MxL86111 PHY")
Signed-off-by Bart Van Assche <[email protected]>

Reviewed-by Andrew Lunn <[email protected]>

Andrew

Bart Van Assche

author

2026-02-23 22:02 UTC #40 lore raw

PATCH 24/62 net/cw1200: Fix locking in error paths

From: Bart Van Assche <[email protected]>

cw1200_wow_suspend() must only return with priv->conf_mutex locked if it returns zero. This mutex must be unlocked if an error is returned. Add mutex_unlock() calls to the error paths from which that call is missing. This has been detected by the Clang thread-safety analyzer.

Cc Kalle Valo <[email protected]>

Cc Johannes Berg <[email protected]>

Fixes a910e4a94f69 ("cw1200: add driver for the ST-E CW1100 & CW1200 WLAN chipsets")

---
 drivers/net/wireless/st/cw1200/pm.c | 2 ++
 1 file changed, 2 insertions(+)

drivers/net/wireless/st/cw1200/pm.c +2 -0

index 120f0379f81d..84eb15d729c7 100644
@@ -264,12 +264,14 @@ int cw1200_wow_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
 		wiphy_err(priv->hw->wiphy,
 			  "PM request failed: %d. WoW is disabled.\n", ret);
 		cw1200_wow_resume(hw);
+		mutex_unlock(&priv->conf_mutex);
 		return -EBUSY;
 	}
 
 	/* Force resume if event is coming from the device. */
 	if (atomic_read(&priv->bh_rx)) {
 		cw1200_wow_resume(hw);
+		mutex_unlock(&priv->conf_mutex);
 		return -EAGAIN;
 	}

Johannes Berg

2026-03-02 11:08 UTC #41 lore raw

Re: [PATCH 24/62] net/cw1200: Fix locking in error paths

Quoted 10 lines · Bart Van Assche

From: Bart Van Assche <[email protected]>
cw1200_wow_suspend() must only return with priv->conf_mutex locked if it returns zero. This mutex must be unlocked if an error is returned. Add mutex_unlock() calls to the error paths from which that call is missing. This has been detected by the Clang thread-safety analyzer.
Cc Kalle Valo <[email protected]>
Cc Johannes Berg <[email protected]>
Cc [email protected]

This, and 25, are part of a larger series and I didn't get a cover letter, so not sure what's supposed to happen with it.

johannes

Bart Van Assche

2026-03-02 20:59 UTC #42 lore raw

Re: [PATCH 24/62] net/cw1200: Fix locking in error paths

Quoted 8 lines · Johannes Berg

Quoted 7 lines · Bart Van Assche
From: Bart Van Assche <[email protected]>
cw1200_wow_suspend() must only return with priv->conf_mutex locked if it returns zero. This mutex must be unlocked if an error is returned. Add mutex_unlock() calls to the error paths from which that call is missing. This has been detected by the Clang thread-safety analyzer.

Quoted 6 lines

Quoted 3 lines
Cc Kalle Valo <[email protected]>
Cc Johannes Berg <[email protected]>
Cc [email protected]
This, and 25, are part of a larger series and I didn't get a cover letter, so not sure what's supposed to happen with it.

Peter Zijlstra prefers that subsystem maintainers queue these patches as one can see here:
https://lore.kernel.org/lkml/[email protected]/

I plan to resend the patches from this series that have not yet been queued by subsystem maintainers to the respective maintainers.

Thanks,

Bart.

Bart Van Assche

author

2026-02-23 22:02 UTC #43 lore raw

PATCH 25/62 wlcore: Fix a locking bug

From: Bart Van Assche <[email protected]>

Make sure that wl->mutex is locked before it is unlocked. This has been detected by the Clang thread-safety analyzer.

Cc Johannes Berg <[email protected]>

Cc Eyal Reizer <[email protected]>

Cc Tony Lindgren <[email protected]>

Cc Kalle Valo <[email protected]>

Fixes 45aa7f071b06 ("wlcore: Use generic runtime pm calls for wowlan elp configuration")

---
 drivers/net/wireless/ti/wlcore/main.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

drivers/net/wireless/ti/wlcore/main.c +2 -2

index 17dd417756f2..1c340a4a0930 100644
@@ -1875,6 +1875,8 @@ static int __maybe_unused wl1271_op_resume(struct ieee80211_hw *hw)
 		     wl->wow_enabled);
 	WARN_ON(!wl->wow_enabled);
 
+	mutex_lock(&wl->mutex);
+
 	ret = pm_runtime_force_resume(wl->dev);
 	if (ret < 0) {
 		wl1271_error("ELP wakeup failure!");

@@ -1891,8 +1893,6 @@ static int __maybe_unused wl1271_op_resume(struct ieee80211_hw *hw)
 		run_irq_work = true;
 	spin_unlock_irqrestore(&wl->wl_lock, flags);
 
-	mutex_lock(&wl->mutex);
-
 	/* test the recovery flag before calling any SDIO functions */
 	pending_recovery = test_bit(WL1271_FLAG_RECOVERY_IN_PROGRESS,
 				    &wl->flags);

Bart Van Assche

author

2026-02-23 22:02 UTC #44 lore raw

PATCH 26/62 misc: nsm: Fix a locking bug in an error path

From: Bart Van Assche <[email protected]>

If nsm->lock has not been locked, do not unlock it from any error path. This bug has been detected by the Clang thread-safety analyzer.

Cc Krzysztof Kozlowski <[email protected]>

Cc Michael S. Tsirkin <[email protected]>

Cc Alexander Graf <[email protected]>

Cc The AWS Nitro Enclaves Team <[email protected]>

Fixes b9873755a6c8 ("misc: Add Nitro Secure Module driver")

---
 drivers/misc/nsm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

drivers/misc/nsm.c +1 -1

index ef7b32742340..185900cdad4a 100644
@@ -367,7 +367,7 @@ static long nsm_dev_ioctl(struct file *file, unsigned int cmd,
 	/* Copy user argument struct to kernel argument struct */
 	r = -EFAULT;
 	if (copy_from_user(&raw, argp, _IOC_SIZE(cmd)))
-		goto out;
+		return r;
 
 	mutex_lock(&nsm->lock);

Alexander Graf

maintainer Reviewed-by on v1 26/62

2026-02-23 22:17 UTC #45 lore raw

Re: [PATCH 26/62] misc: nsm: Fix a locking bug in an error path

Quoted 5 lines · Bart Van Assche

From: Bart Van Assche <[email protected]>
If nsm->lock has not been locked, do not unlock it from any error path. This bug has been detected by the Clang thread-safety analyzer.

Quoted 7 lines

Cc Krzysztof Kozlowski <[email protected]>
Cc Michael S. Tsirkin <[email protected]>
Cc Alexander Graf <[email protected]>
Cc The AWS Nitro Enclaves Team <[email protected]>
Cc [email protected]
Fixes b9873755a6c8 ("misc: Add Nitro Secure Module driver")
Signed-off-by Bart Van Assche <[email protected]>

Thanks for catching this!

Reviewed-by Alexander Graf <[email protected]>

Alex

Amazon Web Services Development Center Germany GmbH Tamara-Danz-Str. 13
10243 Berlin
Geschaeftsfuehrung: Christof Hellmis, Andreas Stieger Eingetragen am Amtsgericht Charlottenburg unter HRB 257764 B
Sitz: Berlin
Ust-ID: DE 365 538 597

Bart Van Assche

author

2026-02-23 22:03 UTC #46 lore raw

PATCH 27/62 pci: Fix locking in pci_do_resource_release_and_resize() error paths

From: Bart Van Assche <[email protected]>

Make sure that down(&pci_bus_sem) has been called before up(&pci_bus_sem) is called. This has been detected by the Clang thread-safety analyzer. Compile-tested only.

Cc Bjorn Helgaas <[email protected]>

Cc Ilpo Järvinen <[email protected]>

Fixes 337b1b566db0 ("PCI: Fix restoring BARs on BAR resize rollback path")

---
 drivers/pci/setup-bus.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

drivers/pci/setup-bus.c +1 -1

index 61f769aaa2f6..3bb8cd9a581e 100644
@@ -2346,6 +2346,7 @@ int pci_do_resource_release_and_resize(struct pci_dev *pdev, int resno, int size
 	if (ret)
 		return ret;
 
+	down_read(&pci_bus_sem);
 	pci_dev_for_each_resource(pdev, r, i) {
 		if (i >= PCI_BRIDGE_RESOURCES)
 			break;

@@ -2367,7 +2368,6 @@ int pci_do_resource_release_and_resize(struct pci_dev *pdev, int resno, int size
 	if (!bus->self)
 		goto out;
 
-	down_read(&pci_bus_sem);
 	ret = pbus_reassign_bridge_resources(bus, res, &saved);
 	if (ret)
 		goto restore;

Ilpo Järvinen

2026-02-24 08:22 UTC #47 lore raw

Re: [PATCH 27/62] pci: Fix locking in pci_do_resource_release_and_resize() error paths

Quoted 4 lines · Bart Van Assche

From: Bart Van Assche <[email protected]>
Make sure that down(&pci_bus_sem) has been called before up(&pci_bus_sem) is called.

Before explaining the solution, it would be useful to mention how this problem can manifest itself (taking one of the early gotos).

Quoted 6 lines

This has been detected by the Clang
thread-safety analyzer. Compile-tested only.
Cc Bjorn Helgaas <[email protected]>
Cc Ilpo Järvinen <[email protected]>
Cc [email protected]

These (obvious) Ccs are not needed in the commit message, if your workflow requires having them, please place them below the --- line so that the maintainer's tools remove them while applying the patch.

Quoted 26 lines

Fixes 337b1b566db0 ("PCI: Fix restoring BARs on BAR resize rollback path")

---
 drivers/pci/setup-bus.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

drivers/pci/setup-bus.c +1 -1

index 61f769aaa2f6..3bb8cd9a581e 100644
@@ -2346,6 +2346,7 @@ int pci_do_resource_release_and_resize(struct pci_dev *pdev, int resno, int size
 	if (ret)
 		return ret;
 
+	down_read(&pci_bus_sem);
 	pci_dev_for_each_resource(pdev, r, i) {
 		if (i >= PCI_BRIDGE_RESOURCES)
 			break;

@@ -2367,7 +2368,6 @@ int pci_do_resource_release_and_resize(struct pci_dev *pdev, int resno, int size
 	if (!bus->self)
 		goto out;
 
-	down_read(&pci_bus_sem);
 	ret = pbus_reassign_bridge_resources(bus, res, &saved);
 	if (ret)
 		goto restore;

Signature · 1 line

i.

Bart Van Assche

author

2026-02-23 22:03 UTC #48 lore raw

PATCH 28/62 PNP: isapnp: Check the isapnp_cfg_begin() return value

From: Bart Van Assche <[email protected]>

Instead of ignoring isapnp_cfg_begin() failures, propagate the value returned by this function in case of a failure. This patch prepares for enabling thread-safety analysis since isapnp_cfg_begin() only locks a particular mutex if it returns zero.

Cc Jaroslav Kysela <[email protected]>

Cc Adam Belay <[email protected]>

Cc Rafael J. Wysocki <[email protected]>

Fixes f72e5c5c861c ("[PATCH] PnP Rewrite V0.9 - 2.5.43")

---
 drivers/pnp/isapnp/core.c | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

drivers/pnp/isapnp/core.c +12 -4

index 219f96f2aaaf..3591a2791c1a 100644
@@ -853,7 +853,9 @@ static int isapnp_get_resources(struct pnp_dev *dev)
 
 	pnp_dbg(&dev->dev, "get resources\n");
 	pnp_init_resources(dev);
-	isapnp_cfg_begin(dev->card->number, dev->number);
+	ret = isapnp_cfg_begin(dev->card->number, dev->number);
+	if (ret)
+		return ret;
 	dev->active = isapnp_read_byte(ISAPNP_CFG_ACTIVATE);
 	if (!dev->active)
 		goto __end;

@@ -887,10 +889,12 @@ static int isapnp_get_resources(struct pnp_dev *dev)
 static int isapnp_set_resources(struct pnp_dev *dev)
 {
 	struct resource *res;
-	int tmp;
+	int tmp, ret;
 
 	pnp_dbg(&dev->dev, "set resources\n");
-	isapnp_cfg_begin(dev->card->number, dev->number);
+	ret = isapnp_cfg_begin(dev->card->number, dev->number);
+	if (ret)
+		return ret;
 	dev->active = 1;
 	for (tmp = 0; tmp < ISAPNP_MAX_PORT; tmp++) {
 		res = pnp_get_resource(dev, IORESOURCE_IO, tmp);

@@ -936,9 +940,13 @@ static int isapnp_set_resources(struct pnp_dev *dev)
 
 static int isapnp_disable_resources(struct pnp_dev *dev)
 {
+	int ret;
+
 	if (!dev->active)
 		return -EINVAL;
-	isapnp_cfg_begin(dev->card->number, dev->number);
+	ret = isapnp_cfg_begin(dev->card->number, dev->number);
+	if (ret)
+		return ret;
 	isapnp_deactivate(dev->number);
 	dev->active = 0;
 	isapnp_cfg_end();

Rafael J. Wysocki

maintainer Acked-by on v1 28/62

2026-02-24 12:17 UTC #49 lore raw

Re: [PATCH 28/62] PNP: isapnp: Check the isapnp_cfg_begin() return value

Quoted 8 lines · Bart Van Assche

From: Bart Van Assche <[email protected]>
Instead of ignoring isapnp_cfg_begin() failures, propagate the value returned by this function in case of a failure. This patch prepares for enabling thread-safety analysis since isapnp_cfg_begin() only locks a particular mutex if it returns zero.

Quoted 6 lines

Cc Jaroslav Kysela <[email protected]>
Cc Adam Belay <[email protected]>
Cc Rafael J. Wysocki <[email protected]>
Cc [email protected]
Fixes f72e5c5c861c ("[PATCH] PnP Rewrite V0.9 - 2.5.43")
Signed-off-by Bart Van Assche <[email protected]>

Acked-by Rafael J. Wysocki (Intel) <[email protected]>

Quoted 49 lines

---
 drivers/pnp/isapnp/core.c | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

drivers/pnp/isapnp/core.c +12 -4

index 219f96f2aaaf..3591a2791c1a 100644
@@ -853,7 +853,9 @@ static int isapnp_get_resources(struct pnp_dev *dev)
 
        pnp_dbg(&dev->dev, "get resources\n");
        pnp_init_resources(dev);
-       isapnp_cfg_begin(dev->card->number, dev->number);
+       ret = isapnp_cfg_begin(dev->card->number, dev->number);
+       if (ret)
+               return ret;
        dev->active = isapnp_read_byte(ISAPNP_CFG_ACTIVATE);
        if (!dev->active)
                goto __end;

@@ -887,10 +889,12 @@ static int isapnp_get_resources(struct pnp_dev *dev)
 static int isapnp_set_resources(struct pnp_dev *dev)
 {
        struct resource *res;
-       int tmp;
+       int tmp, ret;
 
        pnp_dbg(&dev->dev, "set resources\n");
-       isapnp_cfg_begin(dev->card->number, dev->number);
+       ret = isapnp_cfg_begin(dev->card->number, dev->number);
+       if (ret)
+               return ret;
        dev->active = 1;
        for (tmp = 0; tmp < ISAPNP_MAX_PORT; tmp++) {
                res = pnp_get_resource(dev, IORESOURCE_IO, tmp);

@@ -936,9 +940,13 @@ static int isapnp_set_resources(struct pnp_dev *dev)
 
 static int isapnp_disable_resources(struct pnp_dev *dev)
 {
+       int ret;
+
        if (!dev->active)
                return -EINVAL;
-       isapnp_cfg_begin(dev->card->number, dev->number);
+       ret = isapnp_cfg_begin(dev->card->number, dev->number);
+       if (ret)
+               return ret;
        isapnp_deactivate(dev->number);
        dev->active = 0;
        isapnp_cfg_end();

Bart Van Assche

author

2026-02-23 22:03 UTC #50 lore raw

PATCH 29/62 fnic: Make fnic_queuecommand() easier to analyze

From: Bart Van Assche <[email protected]>

Move a spin_unlock_irqrestore() call such that the io_lock_acquired variable can be eliminated. This patch prepares for enabling the Clang thread-safety analyzer.

Cc Satish Kharat <[email protected]>

Cc Sesidhar Baddela <[email protected]>

Cc Karan Tilak Kumar <[email protected]>

Cc James E.J. Bottomley <[email protected]>

Cc Martin K. Petersen <[email protected]>

---
 drivers/scsi/fnic/fnic_scsi.c | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

drivers/scsi/fnic/fnic_scsi.c +3 -6

index 29d7aca06958..f47c92dfbfd0 100644
@@ -471,7 +471,6 @@ enum scsi_qc_status fnic_queuecommand(struct Scsi_Host *shost,
 	int sg_count = 0;
 	unsigned long flags = 0;
 	unsigned long ptr;
-	int io_lock_acquired = 0;
 	uint16_t hwq = 0;
 	struct fnic_tport_s *tport = NULL;
 	struct rport_dd_data_s *rdd_data;

@@ -636,7 +635,6 @@ enum scsi_qc_status fnic_queuecommand(struct Scsi_Host *shost,
 	spin_lock_irqsave(&fnic->wq_copy_lock[hwq], flags);
 
 	/* initialize rest of io_req */
-	io_lock_acquired = 1;
 	io_req->port_id = rport->port_id;
 	io_req->start_time = jiffies;
 	fnic_priv(sc)->state = FNIC_IOREQ_CMD_PENDING;

@@ -689,6 +687,9 @@ enum scsi_qc_status fnic_queuecommand(struct Scsi_Host *shost,
 		/* REVISIT: Use per IO lock in the final code */
 		fnic_priv(sc)->flags |= FNIC_IO_ISSUED;
 	}
+
+	spin_unlock_irqrestore(&fnic->wq_copy_lock[hwq], flags);
+
 out:
 	cmd_trace = ((u64)sc->cmnd[0] << 56 | (u64)sc->cmnd[7] << 40 |
 			(u64)sc->cmnd[8] << 32 | (u64)sc->cmnd[2] << 24 |

@@ -699,10 +700,6 @@ enum scsi_qc_status fnic_queuecommand(struct Scsi_Host *shost,
 		   mqtag, sc, io_req, sg_count, cmd_trace,
 		   fnic_flags_and_state(sc));
 
-	/* if only we issued IO, will we have the io lock */
-	if (io_lock_acquired)
-		spin_unlock_irqrestore(&fnic->wq_copy_lock[hwq], flags);
-
 	atomic_dec(&fnic->in_flight);
 	atomic_dec(&tport->in_flight);

Karan Tilak Kumar (kartilak)

maintainer Reviewed-by on v1 29/62

2026-02-24 19:31 UTC #51 lore raw

RE: [PATCH 29/62] fnic: Make fnic_queuecommand() easier to analyze

Quoted 49 lines · Bart Van Assche

Move a spin_unlock_irqrestore() call such that the io_lock_acquired variable can be eliminated. This patch prepares for enabling the Clang thread-safety analyzer.

Cc Satish Kharat <[email protected]>

Cc Sesidhar Baddela <[email protected]>

Cc Karan Tilak Kumar <[email protected]>

Cc James E.J. Bottomley <[email protected]>

Cc Martin K. Petersen <[email protected]>

---
 drivers/scsi/fnic/fnic_scsi.c | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

drivers/scsi/fnic/fnic_scsi.c +3 -2

index 29d7aca06958..f47c92dfbfd0 100644
@@ -471,7 +471,6 @@ enum scsi_qc_status fnic_queuecommand(struct Scsi_Host *shost,
      int sg_count = 0;
      unsigned long flags = 0;
      unsigned long ptr;
-     int io_lock_acquired = 0;
      uint16_t hwq = 0;
      struct fnic_tport_s *tport = NULL;
      struct rport_dd_data_s *rdd_data;

@@ -636,7 +635,6 @@ enum scsi_qc_status fnic_queuecommand(struct Scsi_Host *shost,
      spin_lock_irqsave(&fnic->wq_copy_lock[hwq], flags);
 
      /* initialize rest of io_req */
-     io_lock_acquired = 1;
      io_req->port_id = rport->port_id;
      io_req->start_time = jiffies;
      fnic_priv(sc)->state = FNIC_IOREQ_CMD_PENDING;

@@ -689,6 +687,9 @@ enum scsi_qc_status fnic_queuecommand(struct Scsi_Host *shost,
              /* REVISIT: Use per IO lock in the final code */
              fnic_priv(sc)->flags |= FNIC_IO_ISSUED;
      }
+
+     spin_unlock_irqrestore(&fnic->wq_copy_lock[hwq], flags);
+
 out:
      cmd_trace = ((u64)sc->cmnd[0] << 56 | (u64)sc->cmnd[7] << 40 |
                      (u64)sc->cmnd[8] << 32 | (u64)sc->cmnd[2] << 24 |

drivers/scsi/fnic/fnic_scsi.c enum scsi_qc_status fnic_queuecommand(struct Scsi_Host *shost, · line 705

Quoted 10 lines

drivers/scsi/fnic/fnic_scsi.c +0 -4

@@ -699,10 +700,6 @@ enum scsi_qc_status fnic_queuecommand(struct Scsi_Host *shost,
                 mqtag, sc, io_req, sg_count, cmd_trace,
                 fnic_flags_and_state(sc));
 
-     /* if only we issued IO, will we have the io lock */
-     if (io_lock_acquired)
-             spin_unlock_irqrestore(&fnic->wq_copy_lock[hwq], flags);
-
      atomic_dec(&fnic->in_flight);
      atomic_dec(&tport->in_flight);

Thanks for this change, Bart.

Reviewed-by Karan Tilak Kumar <[email protected]>

Regards,
Karan

Martin K. Petersen

Applied

2026-02-24 21:44 UTC #52 lore raw

Re: [PATCH 29/62] fnic: Make fnic_queuecommand() easier to analyze

Bart,

Quoted 3 lines

Move a spin_unlock_irqrestore() call such that the io_lock_acquired variable can be eliminated. This patch prepares for enabling the Clang thread-safety analyzer.

Applied to 7.1/scsi-staging, thanks!

Signature · 1 line

Martin K. Petersen

Bart Van Assche

author

2026-02-23 22:03 UTC #53 lore raw

PATCH 30/62 megaraid: Protect more code with instance->reset_mutex

From: Bart Van Assche <[email protected]>

megasas_get_device_list() and megasas_get_snapdump_properties() may unlock instance->reset_mutex indirectly. Hence, hold reset_mutex while calling these functions.

Cc Kashyap Desai <[email protected]>

Cc Sumit Saxena <[email protected]>

Cc Shivasharan S <[email protected]>

Cc Chandrakanth patil <[email protected]>

Cc James E.J. Bottomley <[email protected]>

Cc Martin K. Petersen <[email protected]>

---
 drivers/scsi/megaraid/megaraid_sas_base.c | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

drivers/scsi/megaraid/megaraid_sas_base.c +9 -6

index ac71ea4898b2..ecd365d78ae3 100644
@@ -6365,11 +6365,13 @@ static int megasas_init_fw(struct megasas_instance *instance)
 
 	megasas_setup_jbod_map(instance);
 
-	if (megasas_get_device_list(instance) != SUCCESS) {
-		dev_err(&instance->pdev->dev,
-			"%s: megasas_get_device_list failed\n",
-			__func__);
-		goto fail_get_ld_pd_list;
+	scoped_guard(mutex, &instance->reset_mutex) {
+		if (megasas_get_device_list(instance) != SUCCESS) {
+			dev_err(&instance->pdev->dev,
+				"%s: megasas_get_device_list failed\n",
+				__func__);
+			goto fail_get_ld_pd_list;
+		}
 	}
 
 	/* stream detection initialization */

@@ -6468,7 +6470,8 @@ static int megasas_init_fw(struct megasas_instance *instance)
 	}
 
 	if (instance->snapdump_wait_time) {
-		megasas_get_snapdump_properties(instance);
+		scoped_guard(mutex, &instance->reset_mutex)
+			megasas_get_snapdump_properties(instance);
 		dev_info(&instance->pdev->dev, "Snap dump wait time\t: %d\n",
 			 instance->snapdump_wait_time);
 	}

Martin K. Petersen

Applied

2026-02-28 22:23 UTC #54 lore raw

Re: (subset) [PATCH 00/62] Bug fixes and refactoring patches related to locking