mirror of https://lore.kernel.org/lkml/
 help / color / mirror / Atom feed
From: Lee Jones <lee@kernel.org>
To: lee@kernel.org, Pavel Machek <pavel@kernel.org>,
	Nikita Travkin <nikitos.tr@gmail.com>,
	linux-leds@vger.kernel.org, linux-kernel@vger.kernel.org
Cc: stable@vger.kernel.org
Subject: [PATCH 18/21] leds: aw2013: Unlock chip mutex before registering LEDs
Date: Wed, 21 Oct 2026 12:32:27 +0000	[thread overview]
Message-ID: <20261021123406.3163547-19-lee@kernel.org> (raw)
In-Reply-To: <20261021123406.3163547-1-lee@kernel.org>

aw2013_probe() holds chip->mutex across aw2013_probe_dt(), which calls
devm_led_classdev_register_ext().  When a default trigger such as
"timer" is configured on an LED in the Device Tree, the LED core
synchronously activates the trigger during registration and invokes
aw2013_blink_set() on the same thread, which attempts to acquire
chip->mutex and deadlocks.

Reset the chip, disable the regulators, and release chip->mutex in
aw2013_probe() before calling aw2013_probe_dt(), and update
chip->num_leds before each LED is registered so trigger callbacks can
enable the chip cleanly during registration.

Fixes: 59ea3c9faf32 ("leds: add aw2013 driver")
Closes: https://sashiko.dev/#/bug/linux-5e2c9083-b95b-4aa4-aa0a-b0be8865ff12
Cc: stable@vger.kernel.org
Signed-off-by: Lee Jones <lee@kernel.org>
---
 drivers/leds/leds-aw2013.c | 54 ++++++++++++++++++++++----------------
 1 file changed, 32 insertions(+), 22 deletions(-)

diff --git a/drivers/leds/leds-aw2013.c b/drivers/leds/leds-aw2013.c
index dfeac8b2993f..c947cd068963 100644
--- a/drivers/leds/leds-aw2013.c
+++ b/drivers/leds/leds-aw2013.c
@@ -271,8 +271,6 @@ static int aw2013_probe_dt(struct aw2013 *chip)
 	if (!count || count > AW2013_MAX_LEDS)
 		return -EINVAL;
 
-	regmap_write(chip->regmap, AW2013_RSTR, AW2013_RSTR_RESET);
-
 	for_each_available_child_of_node_scoped(np, child) {
 		struct led_init_data init_data = {};
 		u32 source;
@@ -305,19 +303,29 @@ static int aw2013_probe_dt(struct aw2013 *chip)
 		led->cdev.brightness_set_blocking = aw2013_brightness_set;
 		led->cdev.blink_set = aw2013_blink_set;
 
+		mutex_lock(&chip->mutex);
+		chip->num_leds = ++i;
+		if (chip->enabled) {
+			ret = regmap_update_bits(chip->regmap,
+						 AW2013_LCFG(led->num),
+						 AW2013_LCFG_IMAX_MASK,
+						 led->imax);
+			if (ret) {
+				mutex_unlock(&chip->mutex);
+				return ret;
+			}
+		}
+		mutex_unlock(&chip->mutex);
+
 		ret = devm_led_classdev_register_ext(&chip->client->dev,
 						     &led->cdev, &init_data);
 		if (ret < 0)
 			return ret;
-
-		i++;
 	}
 
 	if (!count)
 		return -EINVAL;
 
-	chip->num_leds = i;
-
 	return 0;
 }
 
@@ -393,25 +401,27 @@ static int aw2013_probe(struct i2c_client *client)
 		goto error_reg;
 	}
 
+	ret = regmap_write(chip->regmap, AW2013_RSTR, AW2013_RSTR_RESET);
+	if (ret) {
+		dev_err(&client->dev, "Failed to reset chip: %d\n", ret);
+		goto error_reg;
+	}
+
+	ret = regulator_bulk_disable(ARRAY_SIZE(chip->regulators),
+				     chip->regulators);
+	if (ret) {
+		dev_err(&client->dev,
+			"Failed to disable regulators: %d\n", ret);
+		goto error;
+	}
+
+	mutex_unlock(&chip->mutex);
+
 	ret = devm_add_action(&client->dev, aw2013_chip_disable_action, chip);
 	if (ret)
-		goto error_reg;
+		return ret;
 
-	ret = aw2013_probe_dt(chip);
-	if (ret < 0)
-		goto error_reg;
-
-	ret = regulator_bulk_disable(ARRAY_SIZE(chip->regulators),
-				     chip->regulators);
-	if (ret) {
-		dev_err(&client->dev,
-			"Failed to disable regulators: %d\n", ret);
-		goto error;
-	}
-
-	mutex_unlock(&chip->mutex);
-
-	return 0;
+	return aw2013_probe_dt(chip);
 
 error_reg:
 	regulator_bulk_disable(ARRAY_SIZE(chip->regulators),
-- 
2.56.0.218.g1ec904b173-goog


  parent reply	other threads:[~2026-10-21 12:36 UTC|newest]

Thread overview: 22+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-10-21 12:32 [PATCH 00/21] leds: Assorted bug fixes across core, flash, trigger, and drivers Lee Jones
2026-10-21 12:32 ` [PATCH 01/21] leds: lm3532: Propagate error from devm_regulator_get() Lee Jones
2026-10-21 12:32 ` [PATCH 02/21] leds: lm3532: Use dev_err_probe() when lm3532_parse_node() fails Lee Jones
2026-10-21 12:32 ` [PATCH 03/21] leds: trigger: netdev: Hold RTNL lock across hw_control_get_device() in activate Lee Jones
2026-10-21 12:32 ` [PATCH 04/21] leds: aw2013: Guard LED array index in aw2013_probe_dt() Lee Jones
2026-10-21 12:32 ` [PATCH 05/21] leds: pca955x: Take a reference on the child firmware node Lee Jones
2026-10-21 12:32 ` [PATCH 06/21] leds: lp50xx: Guard sub-LED count in lp50xx_probe_dt() Lee Jones
2026-10-21 12:32 ` [PATCH 07/21] leds: trigger: netdev: Serialise work cancellation and state updates Lee Jones
2026-10-21 12:32 ` [PATCH 08/21] leds: sgm3140: Replace powerdown timer with delayed work Lee Jones
2026-10-21 12:32 ` [PATCH 09/21] leds: sgm3140: Cancel powerdown work via devres after LED unregistration Lee Jones
2026-10-21 12:32 ` [PATCH 10/21] leds: class: Initialise trigger_lock before exposing sysfs attributes Lee Jones
2026-10-21 12:32 ` [PATCH 11/21] leds: class: Unlock led_access before unregistering device on error Lee Jones
2026-10-21 12:32 ` [PATCH 12/21] leds: aat1290: Retain child device_node reference for device lifetime Lee Jones
2026-10-21 12:32 ` [PATCH 13/21] leds: aat1290: Prevent out-of-bounds read in aat1290_brightness_to_intensity() Lee Jones
2026-10-21 12:32 ` [PATCH 14/21] leds: flash: Avoid divide-by-zero in led_clamp_align() Lee Jones
2026-10-21 12:32 ` [PATCH 15/21] leds: lm3532: Validate LED string indices in lm3532_parse_node() Lee Jones
2026-10-21 12:32 ` [PATCH 16/21] leds: lm3532: Clamp full-scale current to minimum bound Lee Jones
2026-10-21 12:32 ` [PATCH 17/21] leds: aat1290: Avoid leaking devres pinctrl handles on strobe source changes Lee Jones
2026-10-21 12:32 ` Lee Jones [this message]
2026-10-21 12:32 ` [PATCH 19/21] leds: is31fl32xx: Clamp channel current limit in is31fl3293_reset() Lee Jones
2026-10-21 12:32 ` [PATCH 20/21] leds: flash: Terminate sysfs_groups array with NULL Lee Jones
2026-10-21 12:32 ` [PATCH 21/21] leds: lm3692x: Use devm_mutex_init() to avoid premature mutex destruction Lee Jones

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20261021123406.3163547-19-lee@kernel.org \
    --to=lee@kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-leds@vger.kernel.org \
    --cc=nikitos.tr@gmail.com \
    --cc=pavel@kernel.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox

all inboxes | Powered by JetHome®