kernel/linux.git/drivers/gpio/gpiolib-cdev.c, branch v6.19.11

gpio: cdev: Avoid NULL dereference in linehandle_create()

2026-02-26T23:01:36+00:00

[ Upstream commit 6af6be278e3ba2ffb6af5b796c89dfb3f5d9063e ] In linehandle_create(), there is a statement like this: retain_and_null_ptr(lh); Soon after, there is a debug printout that dereferences "lh", which will crash things. Avoid the crash by using handlereq.lines, which is the same value. Fixes: da7e394bf58f ("gpio: convert linehandle_create() to FD_PREPARE()") Signed-off-by: Douglas Anderson Link: https://patch.msgid.link/20260215120555.v2.1.I77c3eb563271c21870379eefd16ebbc4e09635bb@changeid Signed-off-by: Bartosz Golaszewski Signed-off-by: Sasha Levin

gpio: cdev: Fix resource leaks on errors in gpiolib_cdev_register()

2026-01-20T09:51:11+00:00

On error handling paths, gpiolib_cdev_register() doesn't free the allocated resources which results leaks. Fix it. Cc: stable@vger.kernel.org Fixes: 7b9b77a8bba9 ("gpiolib: add a per-gpio_device line state notification workqueue") Fixes: d83cee3d2bb1 ("gpio: protect the pointer to gpio_chip in gpio_device with SRCU") Signed-off-by: Tzung-Bi Shih Link: https://lore.kernel.org/r/20260120092650.2305319-1-tzungbi@kernel.org Signed-off-by: Bartosz Golaszewski

gpio: cdev: Fix resource leaks on errors in lineinfo_changed_notify()

2026-01-20T08:52:31+00:00

On error handling paths, lineinfo_changed_notify() doesn't free the allocated resources which results leaks. Fix it. Cc: stable@vger.kernel.org Fixes: d4cd0902c156 ("gpio: cdev: make sure the cdev fd is still active before emitting events") Signed-off-by: Tzung-Bi Shih Link: https://lore.kernel.org/r/20260120030857.2144847-1-tzungbi@kernel.org Signed-off-by: Bartosz Golaszewski

gpio: cdev: Correct return code on memory allocation failure

2026-01-20T08:52:26+00:00

-ENOMEM is a more appropriate return code for memory allocation failures. Correct it. Cc: stable@vger.kernel.org Fixes: 20bddcb40b2b ("gpiolib: cdev: replace locking wrappers for gpio_device with guards") Signed-off-by: Tzung-Bi Shih Link: https://lore.kernel.org/r/20260116081036.352286-6-tzungbi@kernel.org Signed-off-by: Bartosz Golaszewski

Merge tag 'gpio-updates-for-v6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux

2025-12-04T20:33:38+00:00

Pull gpio updates from Bartosz Golaszewski: "There's one new driver, lots of various updates to existing ones, some refactoring support for new models and misc tweaks and fixes. The biggest new feature in GPIO core is adding support for managed, enable-counted sharing of GPIO pins, something that - until now - was only hacked around with the GPIOD_FLAGS_BIT_NONEXCLUSIVE request flag which basically allowed drivers to "fight it out" for the descriptor and provided no synchronization. It was enabled on Qualcomm platforms (and thus is enabled on arm64 defconfig) and I plan on removing GPIOD_FLAGS_BIT_NONEXCLUSIVE once all drivers using it are switched to the new mechanism. GPIO core: - add proper support for shared GPIOs that's aiming to replace the current sharing mechanism (which provides no synchronization ot enable counting) and enable it for Qualcomm platforms - improve the software node GPIO lookup by using the fwnode representation instead of the software node's name which was prone to bugs (GPIO controllers don't have to use the software node's name as their kernel label) - remove the last user of legacy-of-mm-gpiochip.h and drop the header - move closer to removing the legacy gpio_request_one() routine - rename some symbols for consistency - shrink GPIO printk() helpers by reusing existing code - remove some redundant kernel messages - use min() instead of min_t() in GPIO ACPI code - use system_percpu_wq instead of system_wq in GPIO character device code New drivers: - add a driver for the QIXIS FPGA GPIO controller Driver improvements: - use modernized variants of power management macros across a wide array of drivers in order to avoid having to use the __maybe_unused attribute - convert gpio-elkhartlake and reset-gpio to using the auxiliary bus instead of the platform bus as they are not really described in firmware - use lock guards and update symbol prefixes in gpio-mmio - support the bryx radio interface kit in gpio-mpsse + refactor the driver - use software nodes for configuring the reset-gpio driver, including setting up the reference to the shared "reset" pin - check and propagate the return value of gpiod_set_value() to user-space in gpio-virtuser (this was previously not possible as this function returned void) - extend the gpio-regmap helper with more features (bypass cache for aliased inputs, force writes for aliased data registers, add a new configuration parameter) - remove unneeded includes from gpio-aspeed and gpio-latch - add support for Tegra410 to gpio-tegra186 - replace PCI-specific PM with generic device-level PM in gpio-bt8xx - use dynamic GPIO range allocation in gpio-loongson-64bit - improve handling of level-triggered interrupts in gpio-pca953x - add suspend/resume support to gpio-fxl6408 - add support for more models to gpio-menz127 - optimize gpio-mvebu interrupt handling by avoiding unnecessary calls to mvebu_gpio_irq_handler() - make locking more consistent in gpio-grgpio Device-tree bindings: - document new NXP and Microchip models Documentation: - add a comprehensive compatibility and feature list for gpio-pca953x, which is a great addition as it's probably the most commonly used GPIO expander driver - kernel-doc tweaks Late fixes: - use BYTE_CTRL_MODE for 2K2000/3000 models in gpio-loongson" * tag 'gpio-updates-for-v6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: (80 commits) gpio: loongson: Switch 2K2000/3000 GPIO to BYTE_CTRL_MODE gpio: regmap: fix kernel-doc notation gpio: shared: fix a deadlock gpio: shared-proxy: set suppress_bind_attrs gpio: shared: ignore GPIO hogs when traversing the device tree gpio: shared: ignore special __symbols__ node when traversing device tree gpio: shared: handle the reset-gpios corner case gpio: zynq: Use modern PM macros gpio: xilinx: Use modern PM macros gpio: xgene: Use modern PM macros gpio: uniphier: Use modern PM macros gpio: tqmx86: Use modern PM macros gpio: pch: Use modern PM macros gpio: omap: Use modern PM macros gpio: msc313: Use modern PM macros gpio: mlxbf2: Use modern PM macros gpio: ml-ioh: Use modern PM macros gpio: pl061: Use modern PM macros gpio: htc-egpio: Use modern PM macros gpio: brcmstb: Use modern PM macros ...

Merge tag 'vfs-6.19-rc1.fd_prepare.fs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2025-12-02T01:32:07+00:00

Pull fd prepare updates from Christian Brauner: "This adds the FD_ADD() and FD_PREPARE() primitive. They simplify the common pattern of get_unused_fd_flags() + create file + fd_install() that is used extensively throughout the kernel and currently requires cumbersome cleanup paths. FD_ADD() - For simple cases where a file is installed immediately: fd = FD_ADD(O_CLOEXEC, vfio_device_open_file(device)); if (fd < 0) vfio_device_put_registration(device); return fd; FD_PREPARE() - For cases requiring access to the fd or file, or additional work before publishing: FD_PREPARE(fdf, O_CLOEXEC, sync_file->file); if (fdf.err) { fput(sync_file->file); return fdf.err; } data.fence = fd_prepare_fd(fdf); if (copy_to_user((void __user *)arg, &data, sizeof(data))) return -EFAULT; return fd_publish(fdf); The primitives are centered around struct fd_prepare. FD_PREPARE() encapsulates all allocation and cleanup logic and must be followed by a call to fd_publish() which associates the fd with the file and installs it into the caller's fdtable. If fd_publish() isn't called, both are deallocated automatically. FD_ADD() is a shorthand that does fd_publish() immediately and never exposes the struct to the caller. I've implemented this in a way that it's compatible with the cleanup infrastructure while also being usable separately. IOW, it's centered around struct fd_prepare which is aliased to class_fd_prepare_t and so we can make use of all the basica guard infrastructure" * tag 'vfs-6.19-rc1.fd_prepare.fs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (42 commits) io_uring: convert io_create_mock_file() to FD_PREPARE() file: convert replace_fd() to FD_PREPARE() vfio: convert vfio_group_ioctl_get_device_fd() to FD_ADD() tty: convert ptm_open_peer() to FD_ADD() ntsync: convert ntsync_obj_get_fd() to FD_PREPARE() media: convert media_request_alloc() to FD_PREPARE() hv: convert mshv_ioctl_create_partition() to FD_ADD() gpio: convert linehandle_create() to FD_PREPARE() pseries: port papr_rtas_setup_file_interface() to FD_ADD() pseries: convert papr_platform_dump_create_handle() to FD_ADD() spufs: convert spufs_gang_open() to FD_PREPARE() papr-hvpipe: convert papr_hvpipe_dev_create_handle() to FD_PREPARE() spufs: convert spufs_context_open() to FD_PREPARE() net/socket: convert __sys_accept4_file() to FD_ADD() net/socket: convert sock_map_fd() to FD_ADD() net/kcm: convert kcm_ioctl() to FD_PREPARE() net/handshake: convert handshake_nl_accept_doit() to FD_PREPARE() secretmem: convert memfd_secret() to FD_ADD() memfd: convert memfd_create() to FD_ADD() bpf: convert bpf_token_create() to FD_PREPARE() ...

gpio: convert linehandle_create() to FD_PREPARE()

2025-11-28T11:42:35+00:00

Link: https://patch.msgid.link/20251123-work-fd-prepare-v4-38-b6efa1706cfd@kernel.org Signed-off-by: Christian Brauner

gpio: cdev: make sure the cdev fd is still active before emitting events

2025-11-19T11:00:28+00:00

With the final call to fput() on a file descriptor, the release action may be deferred and scheduled on a work queue. The reference count of that descriptor is still zero and it must not be used. It's possible that a GPIO change, we want to notify the user-space about, happens AFTER the reference count on the file descriptor associated with the character device went down to zero but BEFORE the .release() callback was called from the workqueue and so BEFORE we unregistered from the notifier. Using the regular get_file() routine in this situation triggers the following warning: struct file::f_count incremented from zero; use-after-free condition present! So use the get_file_active() variant that will return NULL on file descriptors that have been or are being released. Fixes: 40b7c49950bd ("gpio: cdev: put emitting the line state events on a workqueue") Reported-by: Alexander Sverdlin Closes: https://lore.kernel.org/all/5d605f7fc99456804911403102a4fe999a14cc85.camel@siemens.com/ Tested-by: Alexander Sverdlin Link: https://lore.kernel.org/r/20251117-gpio-cdev-get-file-v1-1-28a16b5985b8@linaro.org Signed-off-by: Bartosz Golaszewski

gpio: cdev: replace use of system_wq with system_percpu_wq

2025-11-05T11:14:06+00:00

Currently if a user enqueue a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistency cannot be addressed without refactoring the API. system_wq should be the per-cpu workqueue, yet in this name nothing makes that clear, so replace system_wq with system_percpu_wq. The old wq (system_wq) will be kept for a few release cycles. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Link: https://lore.kernel.org/r/20251031111628.143924-2-marco.crivellari@suse.com Signed-off-by: Bartosz Golaszewski

gpio: rename gpio_chip_hwgpio() to gpiod_hwgpio()

2025-10-21T08:35:57+00:00

This function takes a GPIO descriptor as first argument. Make its naming consistent with the rest of the GPIO codebase and use the gpiod_ prefix. Reviewed-by: Linus Walleij Reviewed-by: Andrew Jeffery Link: https://lore.kernel.org/r/20251016-aspeed-gpiolib-include-v1-1-31201c06d124@linaro.org Signed-off-by: Bartosz Golaszewski