From: Greg Kroah-Hartman Date: Thu, 25 Jun 2026 11:25:59 +0000 (+0100) Subject: 5.10-stable patches X-Git-Tag: v6.18.37~23 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=415a203d4126c8523b8c589ee439ac40664439bf;p=thirdparty%2Fkernel%2Fstable-queue.git 5.10-stable patches added patches: regulator-core-fix-locking-in-regulator_resolve_supply-error-path.patch --- diff --git a/queue-5.10/regulator-core-fix-locking-in-regulator_resolve_supply-error-path.patch b/queue-5.10/regulator-core-fix-locking-in-regulator_resolve_supply-error-path.patch new file mode 100644 index 0000000000..82e509cbdd --- /dev/null +++ b/queue-5.10/regulator-core-fix-locking-in-regulator_resolve_supply-error-path.patch @@ -0,0 +1,66 @@ +From 497330b203d2c59c5ff3fa4c34d14494d7203bc3 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Andr=C3=A9=20Draszik?= +Date: Fri, 9 Jan 2026 08:38:38 +0000 +Subject: regulator: core: fix locking in regulator_resolve_supply() error path +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: André Draszik + +commit 497330b203d2c59c5ff3fa4c34d14494d7203bc3 upstream. + +If late enabling of a supply regulator fails in +regulator_resolve_supply(), the code currently triggers a lockdep +warning: + + WARNING: drivers/regulator/core.c:2649 at _regulator_put+0x80/0xa0, CPU#6: kworker/u32:4/596 + ... + Call trace: + _regulator_put+0x80/0xa0 (P) + regulator_resolve_supply+0x7cc/0xbe0 + regulator_register_resolve_supply+0x28/0xb8 + +as the regulator_list_mutex must be held when calling _regulator_put(). + +To solve this, simply switch to using regulator_put(). + +While at it, we should also make sure that no concurrent access happens +to our rdev while we clear out the supply pointer. Add appropriate +locking to ensure that. + +While the code in question will be removed altogether in a follow-up +commit, I believe it is still beneficial to have this corrected before +removal for future reference. + +Fixes: 36a1f1b6ddc6 ("regulator: core: Fix memory leak in regulator_resolve_supply()") +Fixes: 8e5356a73604 ("regulator: core: Clear the supply pointer if enabling fails") +Signed-off-by: André Draszik +Link: https://patch.msgid.link/20260109-regulators-defer-v2-2-1a25dc968e60@linaro.org +Signed-off-by: Mark Brown +Signed-off-by: Nazar Kalashnikov +Signed-off-by: Greg Kroah-Hartman +--- + drivers/regulator/core.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +--- a/drivers/regulator/core.c ++++ b/drivers/regulator/core.c +@@ -2036,8 +2036,16 @@ static int regulator_resolve_supply(stru + if (rdev->use_count) { + ret = regulator_enable(rdev->supply); + if (ret < 0) { +- _regulator_put(rdev->supply); ++ struct regulator *supply; ++ ++ regulator_lock_two(rdev, rdev->supply->rdev, &ww_ctx); ++ ++ supply = rdev->supply; + rdev->supply = NULL; ++ ++ regulator_unlock_two(rdev, supply->rdev, &ww_ctx); ++ ++ regulator_put(supply); + goto out; + } + } diff --git a/queue-5.10/series b/queue-5.10/series index ca1895eddb..cb879e1db3 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -23,3 +23,4 @@ rdma-bnxt_re-zero-shared-page-before-exposing-to-userspace.patch i2c-stub-reject-i2c-block-transfers-with-invalid-length.patch net-qualcomm-rmnet-fix-endpoint-use-after-free-in-rmnet_dellink.patch agp-amd64-fix-broken-error-propagation-in-agp_amd64_probe.patch +regulator-core-fix-locking-in-regulator_resolve_supply-error-path.patch