kernel/linux.git/drivers/gpio/gpio-virtuser.c, branch linux-7.1.y

gpio: virtuser: Fix uninitialized data bug in gpio_virtuser_direction_do_write()

2026-05-28T13:23:40+00:00

If *ppos is non-zero (user-space write split over multiple calls to write()) then simple_write_to_buffer() won't initialize the start of the buffer. Really, non-zero values for *ppos aren't going to work at all. Check for that and return -EINVAL at the start of the function. Fixes: 91581c4b3f29 ("gpio: virtuser: new virtual testing driver for the GPIO API") Signed-off-by: Dan Carpenter Link: https://patch.msgid.link/ahP3BJWWy-m_qI0X@stanley.mountain Signed-off-by: Bartosz Golaszewski

gpio: virtuser: lock device when calling device_is_bound()

2026-05-21T12:36:07+00:00

The kerneldoc for device_is_bound() says it must be called with the device lock taken. Add missing synchronization to this driver. Fixes: c3e2a8aef28c ("gpio: virtuser: stop using dev-sync-probe") Link: https://patch.msgid.link/20260518-gpio-dev-lock-v1-3-cc4736f3ff0b@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski

gpio: virtuser: stop using dev-sync-probe

2026-04-07T10:32:28+00:00

dev-err-probe is an overengineered solution to a simple problem. Use a combination of wait_for_probe() and device_is_bound() to synchronously wait for the platform device to probe. Reviewed-by: Linus Walleij Link: https://patch.msgid.link/20260327-gpio-kill-dev-sync-probe-v1-3-efac254f1a1d@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski

Convert more 'alloc_obj' cases to default GFP_KERNEL arguments

2026-02-22T04:03:00+00:00

This converts some of the visually simpler cases that have been split over multiple lines. I only did the ones that are easy to verify the resulting diff by having just that final GFP_KERNEL argument on the next line. Somebody should probably do a proper coccinelle script for this, but for me the trivial script actually resulted in an assertion failure in the middle of the script. I probably had made it a bit _too_ trivial. So after fighting that far a while I decided to just do some of the syntactically simpler cases with variations of the previous 'sed' scripts. The more syntactically complex multi-line cases would mostly really want whitespace cleanup anyway. Signed-off-by: Linus Torvalds

Convert 'alloc_flex' family to use the new default GFP_KERNEL argument

2026-02-22T01:09:51+00:00

This is the exact same thing as the 'alloc_obj()' version, only much smaller because there are a lot fewer users of the *alloc_flex() interface. As with alloc_obj() version, this was done entirely with mindless brute force, using the same script, except using 'flex' in the pattern rather than 'objs*'. Signed-off-by: Linus Torvalds

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-22T01:09:51+00:00

This was done entirely with mindless brute force, using git grep -l '\

treewide: Replace kmalloc with kmalloc_obj for non-scalar types

2026-02-21T09:02:28+00:00

This is the result of running the Coccinelle script from scripts/coccinelle/api/kmalloc_objs.cocci. The script is designed to avoid scalar types (which need careful case-by-case checking), and instead replace kmalloc-family calls that allocate struct or union object instances: Single allocations: kmalloc(sizeof(TYPE), ...) are replaced with: kmalloc_obj(TYPE, ...) Array allocations: kmalloc_array(COUNT, sizeof(TYPE), ...) are replaced with: kmalloc_objs(TYPE, COUNT, ...) Flex array allocations: kmalloc(struct_size(PTR, FAM, COUNT), ...) are replaced with: kmalloc_flex(*PTR, FAM, COUNT, ...) (where TYPE may also be *VAR) The resulting allocations no longer return "void *", instead returning "TYPE *". Signed-off-by: Kees Cook

Merge tag 'gpio-updates-for-v7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux

2026-02-11T18:53:39+00:00

Pull gpio updates from Bartosz Golaszewski: "There are two new drivers and some changes to GPIO core but mostly just GPIO driver updates across a wide array of files, adding support for new models as well as various refactoring changes. Nothing controversial and everything has spent a good measure of time in linux-next. GPIOLIB core: - shrink the GPIO bus driver stub code - rework software node support for "undefined" software nodes - provide and use devm_fwnode_gpiod_get_optional() - only compile the OF quirk for MT2701 when needed New drivers: - add the GPIO driver for ROHM bd72720 - add the gpio-line-mux driver providing 1-to-many mapping for a single real GPIO Driver changes: - refactor gpio-pca9570: use lock guard, add missing headers, use devres consistently - add support for a new model (G7 Aspeed sgpiom) to the aspeed-sgpio driver along with some prerequisite refactoring - use device_get_match_data() where applicable and save some lines - add support for more models to gpio-cadence - add the compatible property to reset-gpio and use it in shared GPIO management - drop unnecessary use of irqd_get_trigger_type() in gpio-max77759 - add support for a new variant to gpio-pca953x - extend build coverage with COMPILE_TEST for more drivers - constify configfs structures in gpio-sim and gpio-virtuser - add support for the K3 SoC to gpio-spacemit - implement the missing .get_direction() callback in gpio-max77620 - add support for Tegra264 to gpio-tegra186 - drop unneeded MODULE_ALIAS() from gpio-menz127 DT bindings: - document support for the opencores GPIO controller in gpio-mmio - document new variants for gpio-pca953x Documentation: - extensively describe interrupt source detection for gpio-pca953x and add more models to the list of supported variants" * tag 'gpio-updates-for-v7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: (59 commits) gpio: tegra186: Add support for Tegra264 dt-bindings: gpio: Add Tegra264 support gpio: spacemit-k1: Use PDR for pin direction, not SDR/CDR gpio: max77620: Implement .get_direction() callback gpio: aspeed-sgpio: Support G7 Aspeed sgpiom controller dt-bindings: gpio: aspeed,sgpio: Support ast2700 gpio: aspeed-sgpio: Convert IRQ functions to use llops callbacks gpio: aspeed-sgpio: Create llops to handle hardware access gpio: aspeed-sgpio: Remove unused bank name field gpio: aspeed-sgpio: Change the macro to support deferred probe regulator: bd71815: switch to devm_fwnode_gpiod_get_optional gpiolib: introduce devm_fwnode_gpiod_get_optional() wrapper gpio: mmio: Add compatible for opencores GPIO dt-bindings: gpio-mmio: Correct opencores GPIO gpio: pca9570: use lock guards gpio: pca9570: Don't use "proxy" headers gpio: pca9570: Use devm_mutex_init() for mutex initialization MAINTAINERS: Add ROHM BD72720 PMIC power: supply: bd71828-power: Support ROHM BD72720 power: supply: bd71828: Support wider register addresses ...

gpio: virtuser: fix UAF in configfs release path

2026-01-27T19:27:59+00:00

The gpio-virtuser configfs release path uses guard(mutex) to protect the device structure. However, the device is freed before the guard cleanup runs, causing mutex_unlock() to operate on freed memory. Specifically, gpio_virtuser_device_config_group_release() destroys the mutex and frees the device while still inside the guard(mutex) scope. When the function returns, the guard cleanup invokes mutex_unlock(&dev->lock), resulting in a slab use-after-free. Limit the mutex lifetime by using a scoped_guard() only around the activation check, so that the lock is released before mutex_destroy() and kfree() are called. Fixes: 91581c4b3f29 ("gpio: virtuser: new virtual testing driver for the GPIO API") Signed-off-by: Yuhao Huang Link: https://lore.kernel.org/r/20260126040348.11167-1-yuhaohuang@YuhaodeMacBook-Pro.local Signed-off-by: Bartosz Golaszewski

gpio: Constify struct configfs_item_operations and configfs_group_operations

2025-12-17T09:27:08+00:00

'struct configfs_item_operations' and 'configfs_group_operations' are not modified in these drivers. Constifying these structures moves some data to a read-only section, so increases overall security, especially when the structure holds some function pointers. On a x86_64, with allmodconfig, as an example: Before: ====== text data bss dec hex filename 43935 11632 384 55951 da8f drivers/gpio/gpio-aggregator.o After: ===== text data bss dec hex filename 44191 11376 384 55951 da8f drivers/gpio/gpio-aggregator.o Signed-off-by: Christophe JAILLET Link: https://lore.kernel.org/r/ccb5155342ce6dbb89cfbad0687b448860d8e8f0.1765703044.git.christophe.jaillet@wanadoo.fr Signed-off-by: Bartosz Golaszewski