pinctrl: avoid reload of p state in list iteration

commit 4198a9b571065978632276264e01d71d68000ac5 upstream.

When in the list_for_each_entry iteration, reload of p->state->settings
with a local setting from old_state will turn the list iteration into an
infinite loop.

The typical symptom when the issue happens, will be a printk message like:

  "not freeing pin xx (xxx) as part of deactivating group xxx - it is
already used for some other setting".

This is a compiler-dependent problem, one instance occurred using Clang
version 10.0 on the arm64 architecture with linux version 4.19.

Fixes: 6e5e959dde0d ("pinctrl: API changes to support multiple states per device")
Signed-off-by: Maria Yu <quic_aiquny@quicinc.com>
Cc:  <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20231115102824.23727-1-quic_aiquny@quicinc.com
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/pinctrl/core.c b/drivers/pinctrl/core.c
index 83f439906d3168dee10b5aa0ee3d2972bfa09f51..7069f5d651990332b8a41d7e5d1dcf7af67f074c 100644 (file)
--- a/drivers/pinctrl/core.c
+++ b/drivers/pinctrl/core.c
@@ -1196,17 +1196,17 @@ EXPORT_SYMBOL_GPL(pinctrl_lookup_state);
 static int pinctrl_commit_state(struct pinctrl *p, struct pinctrl_state *state)
 {
        struct pinctrl_setting *setting, *setting2;
-       struct pinctrl_state *old_state = p->state;
+       struct pinctrl_state *old_state = READ_ONCE(p->state);
        int ret;
 
-       if (p->state) {
+       if (old_state) {
                /*
                 * For each pinmux setting in the old state, forget SW's record
                 * of mux owner for that pingroup. Any pingroups which are
                 * still owned by the new state will be re-acquired by the call
                 * to pinmux_enable_setting() in the loop below.
                 */
-               list_for_each_entry(setting, &p->state->settings, node) {
+               list_for_each_entry(setting, &old_state->settings, node) {
                        if (setting->type != PIN_MAP_TYPE_MUX_GROUP)
                                continue;
                        pinmux_disable_setting(setting);