regmap: Fix race condition in hwspinlock irqsave routine

Cheng-Yu Lee · broonie · commit 4b58aac989c1 · 2026-01-12T12:25:29.000Z
Previously, the address of the shared member '&map->spinlock_flags' was passed directly to 'hwspin_lock_timeout_irqsave'. This creates a race condition where multiple contexts contending for the lock could overwrite the shared flags variable, potentially corrupting the state for the current lock owner. Fix this by using a local stack variable 'flags' to store the IRQ state temporarily. Fixes: 8698b93 ("regmap: Add hardware spinlock support") Signed-off-by: Cheng-Yu Lee <cylee12@realtek.com> Co-developed-by: Yu-Chun Lin <eleanor.lin@realtek.com> Signed-off-by: Yu-Chun Lin <eleanor.lin@realtek.com> Link: https://patch.msgid.link/20260109032633.8732-1-eleanor.lin@realtek.com Signed-off-by: Mark Brown <broonie@kernel.org>
diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
@@ -408,9 +408,11 @@ static void regmap_lock_hwlock_irq(void *__map)
 static void regmap_lock_hwlock_irqsave(void *__map)
 {
 	struct regmap *map = __map;
+	unsigned long flags = 0;
 
 	hwspin_lock_timeout_irqsave(map->hwlock, UINT_MAX,
-				    &map->spinlock_flags);
+				    &flags);
+	map->spinlock_flags = flags;
 }
 
 static void regmap_unlock_hwlock(void *__map)

Original file line number	Diff line number	Diff line change
`@@ -408,9 +408,11 @@ static void regmap_lock_hwlock_irq(void *__map)`
`408`	`408`	`static void regmap_lock_hwlock_irqsave(void *__map)`
`409`	`409`	`{`
`410`	`410`	`struct regmap *map = __map;`
	`411`	`+ unsigned long flags = 0;`
`411`	`412`
`412`	`413`	`hwspin_lock_timeout_irqsave(map->hwlock, UINT_MAX,`
`413`		`- &map->spinlock_flags);`
	`414`	`+ &flags);`
	`415`	`+ map->spinlock_flags = flags;`
`414`	`416`	`}`
`415`	`417`
`416`	`418`	`static void regmap_unlock_hwlock(void *__map)`