gpio IrqBusSyncUnlock Race

Vulnerability analysis

The PCA953x I2C GPIO expander driver disables regmap's internal locking and relies on a driver-level I2C bus lock to serialize all register access. The interrupt bus synchronization function acquired this lock only for a subset of its operations—specifically the interrupt mask write—leaving the direction register read unprotected. When two threads concurrently accessed the I2C bus, auto-increment addressing could interleave their transactions, causing data to be written to or read from the wrong register. The fix moves lock acquisition to the beginning of the synchronization function so it covers every regmap call, and splits the direction-input helper into locked and unlocked variants so the already-held lock is reused rather than re-acquired. The vulnerable path is reachable locally by any user who can trigger GPIO interrupt configuration on a system with a PCA953x-series I2C GPIO expander; no network access or special hardware interaction is needed beyond the presence of the chip.