From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793117101; b=YcOsnl4bIxrIlVHrg+fIyP5W4KQIJZJcydH9UDbGDCkNI+C1Blv5X72wiDmSJztd8Z2f TfFfRnh6zpMQGmw7OnQ+hk84AMQABOmq1RBvd2NJNLkKCa0XYs0apsEqnbS9/nRmClvdo 6ULcablh+ZKEO21kkRiCO2qUObo/Pr1+bGNnPWAIIZwXu7huXym4+lJWrYKgrc4SgxDRr V19RzWcEP7tJaXK5sL/gox+bfzY4UirFW2aMmNdyBkJGsdyfwPQVjYMN7KB1vPPpiEGdx AUDcrSZRQ1exuZc7u6PHGoXf9MSUAirSAN5MIKsgEWm6BNnsjsOjJzZG5FkfhnHVqvQ== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793117101; h=Received:DKIM-Signature:From:Date:Subject:MIME-Version:Content-Type: Content-Transfer-Encoding:Message-Id:References:In-Reply-To:To:Cc: X-Mailer:X-Developer-Signature:X-Developer-Key; bh=aSUBd0EYmrq7zlFbtM3BP+ameb93hPBg8VZloLoSB9s=; b=wLrcJ9s7qxG1c+tZoSGNNXTookFK5mmBjvQN4/aimGAWB/Vkg7eHGnqU2SgrhLzYyPtl fhyXKqnTU66gW5DSd1LJ6rTT0ArOsGShOHltkYpd/0Pz4HnAb/MAR5UAv1FOAOg8ag8z+ k/FhRwTXOEkMSVaythsnwzwGNxD8Sxep8lR05DBr76e7l1n5axf7UA48jztlrlc/bCEAe qv546EE5FTnVbaACZgPFgjPurJZMVjIdoapwIZHmOiO7MWpVbZO+3mVLtTM/E7LxbhUVF Y0SOi3J9n5w/koG3fUBYySFdWL8OuT7w3Uiimzes8J1uADG3hcySVihasvmvDK1RFEg== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=jj5bMBC1; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E46AD60A3808 for ; Tue, 27 Oct 2026 16:05:00 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key, unprotected) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=jj5bMBC1 Received: by smtp.kernel.org (Postfix) with ESMTPSA id E93121F01306; Tue, 27 Oct 2026 16:04:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1793117100; bh=aSUBd0EYmrq7zlFbtM3BP+ameb93hPBg8VZloLoSB9s=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=jj5bMBC1rzzCVfgpKrnaqdN7NdcV0BgXZClp+z8ha3PoIlSNqvPlRMBnhRyAIAe2I vyZ9EMnGIe3M62awxI6JLN/AEpnbt5RKzC8FsLspvrsqJW26uP3P2vx8M8m/UiaPir HZdoBU+X5b1MuoKbswsABg2m96jI+2xp3ADKcV8Q= From: Greg Kroah-Hartman Date: Tue, 27 Oct 2026 17:04:39 +0100 Subject: [PATCH 6/9] w1: netlink: drop the slave after the bus is unlocked X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-Id: <20261027-llm-char-misc-w1-v1-6-d2e6bfafb6a4@linuxfoundation.org> References: <20261027-llm-char-misc-w1-v1-0-d2e6bfafb6a4@linuxfoundation.org> In-Reply-To: <20261027-llm-char-misc-w1-v1-0-d2e6bfafb6a4@linuxfoundation.org> To: Krzysztof Kozlowski Cc: Josef Bacik , linux-kernel@vger.kernel.org, Greg Kroah-Hartman , stable X-Mailer: b4 0.17-dev-e5168 X-Developer-Signature: v=1; a=openpgp-sha256; l=1941; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=tjxch7vEyL+Ins4BUyI6jV3N3ZPuPyjc5EfJaH//hPA=; b=owGbwMvMwCRo6H6F97bub03G02pJDFkPTs/MbX3JnBd6wbqXNSsuaFMx09HJGrKc4rq9Oezdw eu5j8d1xLIwCDIxyIopsnzZxnN0f8UhRS9D29Mwc1iZQIYwcHEKwESY5jPM4akrXmjp9f1umNyq zX8ttzUt3bmjmmGu4OkNmpu42fd+vTb/u9kSE0/+a5bKAA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 From: Josef Bacik w1_process_cb() executes the commands of a netlink message with bus_mutex held, and drops the reference to the slave which the message was addressed to before it unlocks the mutex. If the slave has been detached in the meantime, this is the last reference, and w1_unref_slave() tears the slave down on the spot. That waits - in device_unregister(), for the sysfs callbacks of the slave which are running, and - in w1_therm_remove_slave(), for the readers which have taken a reference to the family data, and both kinds take bus_mutex to talk to the slave. Whoever is waiting for the mutex at that moment is never going to finish, and neither is the thread of the bus master. Unlock the bus first. The reference keeps the slave, and with it the master, alive until then. Fixes: d3a8a9dbb903 ("w1: hold bus_mutex in netlink and search") Cc: stable Signed-off-by: Josef Bacik Signed-off-by: Greg Kroah-Hartman --- drivers/w1/w1_netlink.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/drivers/w1/w1_netlink.c b/drivers/w1/w1_netlink.c index e6b59d921076..40fbb96a793e 100644 --- a/drivers/w1/w1_netlink.c +++ b/drivers/w1/w1_netlink.c @@ -478,15 +478,17 @@ static void w1_process_cb(struct w1_master *dev, struct w1_async_cmd *async_cmd) if (!cmd || err) w1_netlink_queue_status(node->block, node->msg, cmd, err); + dev->priv = NULL; + mutex_unlock(&dev->bus_mutex); + /* ref taken in w1_search_slave or w1_search_master_id when building - * the block + * the block. If it is the last one, the slave is removed, which waits + * for users of the bus. */ if (sl) w1_unref_slave(sl); else atomic_dec(&dev->refcnt); - dev->priv = NULL; - mutex_unlock(&dev->bus_mutex); mutex_lock(&dev->list_mutex); list_del(&async_cmd->async_entry); -- 2.56.0