kernel/linux.git/drivers/mfd, branch v5.15.212

mfd: tps6586x: Fix OF node refcount

2026-07-24T13:51:48+00:00

commit 3001ed2b4e06da2276c42ace6551617065a5b1f9 upstream. Platform devices created with platform_device_alloc() call platform_device_release() when the last reference to the device's kobject is dropped. This function calls of_node_put() unconditionally. This works fine for devices created with platform_device_register_full() but users of the split approach (platform_device_alloc() + platform_device_add()) must bump the reference of the of_node they assign manually. Add the missing call to of_node_get(). Cc: stable@vger.kernel.org Fixes: 62f6b0879304 ("tps6586x: Add device tree support") Signed-off-by: Bartosz Golaszewski Link: https://patch.msgid.link/20260521-pdev-fwnode-ref-v1-1-88c324a1b8d2@oss.qualcomm.com Signed-off-by: Lee Jones Signed-off-by: Greg Kroah-Hartman

mfd: sm501: Fix reference leak on failed device registration

2026-07-24T13:51:47+00:00

commit 8c2f0b42fc252e1bf1c7746447091a468e784ca1 upstream. When platform_device_register() fails in sm501_register_device(), the embedded struct device in pdev has already been initialized by device_initialize(), but the failure path only reports the error and returns without dropping the device reference for the current platform device: sm501_register_device() -> platform_device_register(pdev) -> device_initialize(&pdev->dev) -> setup_pdev_dma_masks(pdev) -> platform_device_add(pdev) This leads to a reference leak when platform_device_register() fails. Fix this by calling platform_device_put() before returning the error. The issue was identified by a static analysis tool I developed and confirmed by manual review. Fixes: b6d6454fdb66f ("[PATCH] mfd: SM501 core driver") Cc: stable@vger.kernel.org Signed-off-by: Guangshuo Li Link: https://patch.msgid.link/20260415162627.3558789-1-lgs201920130244@gmail.com Signed-off-by: Lee Jones Signed-off-by: Greg Kroah-Hartman

mfd: cros_ec: Delay dev_set_drvdata() until probe success

2026-07-24T13:51:21+00:00

commit 8b2c1d41bc36c100b38ce5ee6def246c527eaf8a upstream. If ec_device_probe() fails, cros_ec_class_release releases memory for the cros_ec_dev structure. However, because the drvdata was already set, sub-drivers like cros_ec_typec can still retrieve the stale pointer via the platform device. This leads to a use-after-free when cros_ec_typec attempts to access &typec->ec->ec->dev on a device that has already been released. Move dev_set_drvdata() to ensure that the pointer is only made available once all initialization steps have succeeded. sysfs: cannot create duplicate filename '/class/chromeos/cros_ec' Call trace: sysfs_do_create_link_sd+0x94/0xdc sysfs_create_link+0x30/0x44 device_add_class_symlinks+0x90/0x13c device_add+0xf0/0x50c ec_device_probe+0x150/0x4f0 platform_probe+0xa0/0xe0 ... BUG: KASAN: invalid-access in __memcpy+0x44/0x230 Write at addr f5ffff809e2d33ac by task kworker/u32:5/125 Pointer tag: [f5], memory tag: [fe] Tainted : [W]=WARN, [O]=OOT_MODULE Hardware name: Google Navi unprovisioned 0x7FFFFFFF/sku0 board/sku3 Workqueue: events_unbound deferred_probe_work_func Call trace: __memcpy+0x44/0x230 cros_ec_check_features+0x60/0xcc [cros_ec_proto] cros_typec_probe+0xe8/0x6e0 [cros_ec_typec] platform_probe+0xa0/0xe0 Cc: stable@vger.kernel.org Fixes: 1c1d152cc5ac ("platform/chrome: cros_ec_dev - utilize new cdev_device_add helper function") Co-developed-by: Sergey Senozhatsky Signed-off-by: Sergey Senozhatsky Signed-off-by: Andrei Kuchynski Reviewed-by: Benson Leung Link: https://patch.msgid.link/20260427131721.1165078-1-akuchynski@chromium.org Signed-off-by: Lee Jones Signed-off-by: Greg Kroah-Hartman

mfd: mc13xxx-core: Fix memory leak in mc13xxx_add_subdevice_pdata()

2026-06-01T15:35:36+00:00

[ Upstream commit a5a65a7fb2f7796bbe492cd6be59c92cb64377d1 ] The memory allocated for cell.name using kmemdup() is not freed when mfd_add_devices() fails. Fix that by using devm_kmemdup(). Fixes: 8e00593557c3 ("mfd: Add mc13892 support to mc13xxx") Signed-off-by: Abdun Nihaal Link: https://patch.msgid.link/20260120102622.66921-1-nihaal@cse.iitm.ac.in Signed-off-by: Lee Jones Signed-off-by: Sasha Levin

mfd: omap-usb-host: Fix OF populate on driver rebind

2026-04-18T08:33:07+00:00

[ Upstream commit 24804ba508a3e240501c521685a1c4eb9f574f8e ] Since commit c6e126de43e7 ("of: Keep track of populated platform devices") child devices will not be created by of_platform_populate() if the devices had previously been deregistered individually so that the OF_POPULATED flag is still set in the corresponding OF nodes. Switch to using of_platform_depopulate() instead of open coding so that the child devices are created if the driver is rebound. Fixes: c6e126de43e7 ("of: Keep track of populated platform devices") Cc: stable@vger.kernel.org # 3.16 Signed-off-by: Johan Hovold Reviewed-by: Andreas Kemnade Link: https://patch.msgid.link/20251219110714.23919-1-johan@kernel.org Signed-off-by: Lee Jones Signed-off-by: Sasha Levin

mfd: omap-usb-host: Convert to platform remove callback returning void

2026-04-18T08:33:07+00:00

[ Upstream commit 418d1e74f8597e0b2d5d0d6e1be8f1f47e68f0a4 ] The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new(), which already returns void. Eventually after all drivers are converted, .remove_new() will be renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/20231123165627.492259-11-u.kleine-koenig@pengutronix.de Signed-off-by: Lee Jones Stable-dep-of: 24804ba508a3 ("mfd: omap-usb-host: Fix OF populate on driver rebind") Signed-off-by: Sasha Levin

mfd: qcom-pm8xxx: Fix OF populate on driver rebind

2026-04-18T08:33:07+00:00

[ Upstream commit 27a8acea47a93fea6ad0e2df4c20a9b51490e4d9 ] Since commit c6e126de43e7 ("of: Keep track of populated platform devices") child devices will not be created by of_platform_populate() if the devices had previously been deregistered individually so that the OF_POPULATED flag is still set in the corresponding OF nodes. Switch to using of_platform_depopulate() instead of open coding so that the child devices are created if the driver is rebound. Fixes: c6e126de43e7 ("of: Keep track of populated platform devices") Cc: stable@vger.kernel.org # 3.16 Signed-off-by: Johan Hovold Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Link: https://patch.msgid.link/20251219110947.24101-1-johan@kernel.org Signed-off-by: Lee Jones Signed-off-by: Sasha Levin

mfd: qcom-pm8xxx: Convert to platform remove callback returning void

2026-04-18T08:33:07+00:00

[ Upstream commit 19ea1d3953017518d85db35b69b5aea9bc64d630 ] The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new(), which already returns void. Eventually after all drivers are converted, .remove_new() will be renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Reviewed-by: Konrad Dybcio Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/20231123165627.492259-14-u.kleine-koenig@pengutronix.de Signed-off-by: Lee Jones Stable-dep-of: 27a8acea47a9 ("mfd: qcom-pm8xxx: Fix OF populate on driver rebind") Signed-off-by: Sasha Levin

mfd: qcom-pm8xxx: switch away from using chained IRQ handlers

2026-04-18T08:33:07+00:00

[ Upstream commit d3546ccdce4bc07fcf0648bfe865dbcd6d961afc ] PM8xxx PMIC family uses GPIO as parent IRQ. Using it together with the irq_set_chained_handler_and_data() results in warnings from the GPIOLIB (see 461c1a7d4733 ("gpiolib: override irq_enable/disable")) as in this path the IRQ resources are not allocated (and thus the corresponding GPIO is not marked as used for the IRQ. Use request_irq so that the IRQ resources are proprely setup. [ 0.803271] ------------[ cut here ]------------ [ 0.803338] WARNING: CPU: 3 PID: 1 at drivers/gpio/gpiolib.c:3207 gpiochip_enable_irq+0xa4/0xa8 [ 0.803470] Modules linked in: [ 0.803542] CPU: 3 PID: 1 Comm: swapper/0 Not tainted 5.14.0-rc6-next-20210820-postmarketos-qcom-apq8064+ #1 [ 0.803645] Hardware name: Generic DT based system [ 0.803710] Backtrace: [ 0.803777] [] (dump_backtrace) from [] (show_stack+0x20/0x24) [ 0.803911] r7:00000c87 r6:c07062dc r5:60000093 r4:c11d0f54 [ 0.803980] [] (show_stack) from [] (dump_stack_lvl+0x48/0x54) [ 0.804097] [] (dump_stack_lvl) from [] (dump_stack+0x18/0x1c) [ 0.804217] r5:00000009 r4:c11fe208 [ 0.804274] [] (dump_stack) from [] (__warn+0xfc/0x114) [ 0.804387] [] (__warn) from [] (warn_slowpath_fmt+0x74/0xd0) [ 0.804509] r7:c07062dc r6:00000c87 r5:c11fe208 r4:00000000 [ 0.804577] [] (warn_slowpath_fmt) from [] (gpiochip_enable_irq+0xa4/0xa8) [ 0.804716] r8:c27b6200 r7:c27aec00 r6:c27aec18 r5:cf77a448 r4:c02225f0 [ 0.804789] [] (gpiochip_enable_irq) from [] (gpiochip_irq_enable+0x28/0x38) [ 0.804921] r5:cf77a448 r4:c27aec18 [ 0.804977] [] (gpiochip_irq_enable) from [] (irq_enable+0x48/0x78) [ 0.805111] r5:00000000 r4:c27aec00 [ 0.805167] [] (irq_enable) from [] (__irq_startup+0x80/0xbc) [ 0.805286] r5:00000000 r4:c27aec00 [ 0.805343] [] (__irq_startup) from [] (irq_startup+0xe0/0x18c) [ 0.805468] r7:c27aec00 r6:00000001 r5:00000000 r4:c27aec00 [ 0.805535] [] (irq_startup) from [] (irq_activate_and_startup+0x3c/0x74) [ 0.805669] r7:c27aec00 r6:00000001 r5:c27aec00 r4:00000000 [ 0.805736] [] (irq_activate_and_startup) from [] (__irq_do_set_handler+0xcc/0x1c0) [ 0.805875] r7:c27aec00 r6:c0383710 r5:c08a16b0 r4:00000001 [ 0.805943] [] (__irq_do_set_handler) from [] (irq_set_chained_handler_and_data+0x60/0x98) [ 0.806087] r7:c27b5c10 r6:c27aed40 r5:c08a16b0 r4:c27aec00 [ 0.806154] [] (irq_set_chained_handler_and_data) from [] (pm8xxx_probe+0x1fc/0x24c) [ 0.806298] r6:0000003a r5:0000003a r4:c27b5c00 [ 0.806359] [] (pm8xxx_probe) from [] (platform_probe+0x6c/0xc8) [ 0.806495] r10:c2507080 r9:e8bea2cc r8:c165e0e0 r7:c165e0e0 r6:c15f08f8 r5:c27b5c10 [ 0.806582] r4:00000000 [ 0.806632] [] (platform_probe) from [] (really_probe+0xe8/0x460) [ 0.806769] r7:c165e0e0 r6:c15f08f8 r5:00000000 r4:c27b5c10 [ 0.806837] [] (really_probe) from [] (__driver_probe_device+0xb0/0x22c) [ 0.806975] r7:c27b5c10 r6:cf70fba4 r5:c15f08f8 r4:c27b5c10 [ 0.807042] [] (__driver_probe_device) from [] (driver_probe_device+0x44/0xe0) [ 0.807188] r9:e8bea2cc r8:00000000 r7:c27b5c10 r6:cf70fba4 r5:c16ae4b4 r4:c16ae4b0 [ 0.807271] [] (driver_probe_device) from [] (__device_attach_driver+0xb4/0x12c) [ 0.807421] r9:e8bea2cc r8:c15eec08 r7:c27b5c10 r6:cf70fba4 r5:c15f08f8 r4:00000001 [ 0.807506] [] (__device_attach_driver) from [] (bus_for_each_drv+0x94/0xe4) [ 0.807651] r7:c16ae484 r6:c086ec24 r5:cf70fba4 r4:00000000 [ 0.807718] [] (bus_for_each_drv) from [] (__device_attach+0x104/0x19c) [ 0.807852] r6:00000001 r5:c27b5c54 r4:c27b5c10 [ 0.807913] [] (__device_attach) from [] (device_initial_probe+0x1c/0x20) [ 0.808050] r6:c27b5c10 r5:c15ef1b0 r4:c27b5c10 [ 0.808111] [] (device_initial_probe) from [] (bus_probe_device+0x94/0x9c) [ 0.808240] [] (bus_probe_device) from [] (device_add+0x404/0x8f4) [ 0.808370] r7:c16ae484 r6:c251ba10 r5:00000000 r4:c27b5c10 [ 0.808439] [] (device_add) from [] (of_device_add+0x44/0x4c) [ 0.808581] r10:c144c854 r9:00000001 r8:e8bea314 r7:c251ba10 r6:00000000 r5:00000000 [ 0.808669] r4:c27b5c00 [ 0.808718] [] (of_device_add) from [] (of_platform_device_create_pdata+0xa0/0xc8) [ 0.808850] [] (of_platform_device_create_pdata) from [] (of_platform_bus_create+0x1f0/0x514) [ 0.809005] r9:00000001 r8:c251ba10 r7:00000000 r6:00000000 r5:00000000 r4:e8bea2b0 [ 0.809086] [] (of_platform_bus_create) from [] (of_platform_populate+0x98/0x128) [ 0.809233] r10:c144c854 r9:00000001 r8:c251ba10 r7:00000000 r6:00000000 r5:e8bea170 [ 0.809321] r4:e8bea2b0 [ 0.809371] [] (of_platform_populate) from [] (devm_of_platform_populate+0x60/0xa8) [ 0.809521] r9:0000011d r8:c165e0e0 r7:e8bea170 r6:c2c34f40 r5:c2cac140 r4:c251ba10 [ 0.809604] [] (devm_of_platform_populate) from [] (ssbi_probe+0x138/0x16c) [ 0.809738] r6:c2c34f40 r5:c251ba10 r4:ff822700 [ 0.809800] [] (ssbi_probe) from [] (platform_probe+0x6c/0xc8) [ 0.809923] r7:c165e0e0 r6:c15f0a80 r5:c251ba10 r4:00000000 [ 0.809989] [] (platform_probe) from [] (really_probe+0xe8/0x460) [ 0.810120] r7:c165e0e0 r6:c15f0a80 r5:00000000 r4:c251ba10 [ 0.810187] [] (really_probe) from [] (__driver_probe_device+0xb0/0x22c) [ 0.810325] r7:c251ba10 r6:c15f0a80 r5:c15f0a80 r4:c251ba10 [ 0.810393] [] (__driver_probe_device) from [] (driver_probe_device+0x44/0xe0) [ 0.810539] r9:0000011d r8:00000000 r7:c251ba10 r6:c15f0a80 r5:c16ae4b4 r4:c16ae4b0 [ 0.810623] [] (driver_probe_device) from [] (__driver_attach+0xdc/0x188) [ 0.810766] r9:0000011d r8:c144c834 r7:00000000 r6:c15f0a80 r5:c251ba10 r4:00000000 [ 0.810849] [] (__driver_attach) from [] (bus_for_each_dev+0x88/0xd4) [ 0.810985] r7:00000000 r6:c086ed50 r5:c15f0a80 r4:00000000 [ 0.811052] [] (bus_for_each_dev) from [] (driver_attach+0x2c/0x30) [ 0.811182] r6:c15ef1b0 r5:c2c34e80 r4:c15f0a80 [ 0.811243] [] (driver_attach) from [] (bus_add_driver+0x180/0x21c) [ 0.811364] [] (bus_add_driver) from [] (driver_register+0x84/0x118) [ 0.811492] r7:00000000 r6:ffffe000 r5:c1428210 r4:c15f0a80 [ 0.811558] [] (driver_register) from [] (__platform_driver_register+0x2c/0x34) [ 0.811683] r5:c1428210 r4:c16524a0 [ 0.811739] [] (__platform_driver_register) from [] (ssbi_driver_init+0x24/0x28) [ 0.811868] [] (ssbi_driver_init) from [] (do_one_initcall+0x68/0x2c8) [ 0.811990] [] (do_one_initcall) from [] (kernel_init_freeable+0x1dc/0x23c) [ 0.812135] r7:cf7b0400 r6:c130339c r5:00000007 r4:c147f6a0 [ 0.812204] [] (kernel_init_freeable) from [] (kernel_init+0x20/0x138) [ 0.812345] r10:00000000 r9:00000000 r8:00000000 r7:00000000 r6:00000000 r5:c0e40e40 [ 0.812433] r4:00000000 [ 0.812483] [] (kernel_init) from [] (ret_from_fork+0x14/0x24) [ 0.812596] Exception stack(0xcf70ffb0 to 0xcf70fff8) [ 0.812684] ffa0: 00000000 00000000 00000000 00000000 [ 0.812809] ffc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 [ 0.812923] ffe0: 00000000 00000000 00000000 00000000 00000013 00000000 [ 0.813008] r5:c0e40e40 r4:00000000 [ 0.813075] ---[ end trace ad2443eee078d094 ]--- Signed-off-by: Dmitry Baryshkov Reviewed-by: Bjorn Andersson Reviewed-by: Linus Walleij Tested-by: David Heidelberg # on Nexus 7 (deb) Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20210925234333.2430755-1-dmitry.baryshkov@linaro.org Stable-dep-of: 27a8acea47a9 ("mfd: qcom-pm8xxx: Fix OF populate on driver rebind") Signed-off-by: Sasha Levin

Revert "mfd: da9052-spi: Change read-mask to write-mask"

2026-03-04T12:20:17+00:00

[ Upstream commit 12daa9c1954542bf98bb942fb2dadf19de79a44b ] This reverts commit 2e3378f6c79a1b3f7855ded1ef306ea4406352ed. Almost every register in this chip can be customized via OTP memory. Somehow the value for R19, which decide if the flag is set on read or write operation, seems to have been overwritten for the chip the original patch were written for. Revert the change to follow the default behavior. Signed-off-by: Marcus Folkesson Link: https://patch.msgid.link/20251124-da9052-revert-v1-1-fbeb2c894002@gmail.com Signed-off-by: Lee Jones Signed-off-by: Sasha Levin