From 259ee8e2556d9be1b8164bd0fafa9cb62ea6b598 Mon Sep 17 00:00:00 2001 From: Takashi Sakamoto Date: Sun, 20 Sep 2026 16:15:00 +0900 Subject: [PATCH] firewire: cdev: add annotations and comments about race condition of bus_reset_closure There is a race condition involving the bus_reset_closure member of the fw_cdev_event_bus_reset structure, which was addressed by commit 93b37905f70 ("firewire: cdev: prevent race between first get_info ioctl and bus reset event queuing"). Add code comments and annotations to document it. Link: https://lore.kernel.org/r/20260920071501.77785-5-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto --- drivers/firewire/core-cdev.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/firewire/core-cdev.c b/drivers/firewire/core-cdev.c index ed5ac59507cc..3d7217620106 100644 --- a/drivers/firewire/core-cdev.c +++ b/drivers/firewire/core-cdev.c @@ -398,7 +398,12 @@ static ssize_t fw_device_op_read(struct file *file, char __user *buffer, static void fill_bus_reset_event(struct fw_cdev_event_bus_reset *event, struct client *client) +__must_hold(&client->device->client_list_mutex) { + lockdep_assert_held(&client->device->client_list_mutex); + + // This member is related to the above mutex. In detail, see 93b37905f70 ("firewire: cdev: + // prevent race between first get_info ioctl and bus reset event queuing"). event->closure = client->bus_reset_closure; event->type = FW_CDEV_EVENT_BUS_RESET; @@ -508,6 +513,9 @@ static int ioctl_get_info(struct client *client, union ioctl_arg *arg) } scoped_guard(mutex, &client->device->client_list_mutex) { + // Coordinate concurrent access to this member with bus reset event handling, see + // 93b37905f70 ("firewire: cdev: prevent race between first get_info ioctl and bus + // reset event queuing"). client->bus_reset_closure = a->bus_reset_closure; if (a->bus_reset != 0) {