kernel/linux.git/drivers/pinctrl/core.c, branch v5.15.208

pinctrl: core: fix possible memory leak when pinctrl_enable() fails

2024-08-19T03:45:08+00:00

[ Upstream commit ae1cf4759972c5fe665ee4c5e0c29de66fe3cf4a ] In devm_pinctrl_register(), if pinctrl_enable() fails in pinctrl_register(), the "pctldev" has not been added to dev resources, so devm_pinctrl_dev_release() can not be called, it leads memory leak. Introduce pinctrl_uninit_controller(), call it in the error path to free memory. Fixes: 5038a66dad01 ("pinctrl: core: delete incorrect free in pinctrl_enable()") Signed-off-by: Yang Yingliang Reviewed-by: Dan Carpenter Link: https://lore.kernel.org/r/20240606023704.3931561-2-yangyingliang@huawei.com Signed-off-by: Linus Walleij Signed-off-by: Sasha Levin

pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER

2024-07-05T07:14:39+00:00

[ Upstream commit adec57ff8e66aee632f3dd1f93787c13d112b7a1 ] In create_pinctrl(), pinctrl_maps_mutex is acquired before calling add_setting(). If add_setting() returns -EPROBE_DEFER, create_pinctrl() calls pinctrl_free(). However, pinctrl_free() attempts to acquire pinctrl_maps_mutex, which is already held by create_pinctrl(), leading to a potential deadlock. This patch resolves the issue by releasing pinctrl_maps_mutex before calling pinctrl_free(), preventing the deadlock. This bug was discovered and resolved using Coverity Static Analysis Security Testing (SAST) by Synopsys, Inc. Fixes: 42fed7ba44e4 ("pinctrl: move subsystem mutex to pinctrl_dev struct") Suggested-by: Maximilian Heyne Signed-off-by: Hagar Hemdan Link: https://lore.kernel.org/r/20240604085838.3344-1-hagarhem@amazon.com Signed-off-by: Linus Walleij Signed-off-by: Sasha Levin

pinctrl: core: handle radix_tree_insert() errors in pinctrl_register_one_pin()

2024-05-25T14:20:16+00:00

commit ecfe9a015d3e1e46504d5b3de7eef1f2d186194a upstream. pinctrl_register_one_pin() doesn't check the result of radix_tree_insert() despite they both may return a negative error code. Linus Walleij said he has copied the radix tree code from kernel/irq/ where the functions calling radix_tree_insert() are *void* themselves; I think it makes more sense to propagate the errors from radix_tree_insert() upstream if we can do that... Found by Linux Verification Center (linuxtesting.org) with the Svace static analysis tool. Signed-off-by: Sergey Shtylyov Link: https://lore.kernel.org/r/20230719202253.13469-3-s.shtylyov@omp.ru Signed-off-by: Linus Walleij Cc: "Hemdan, Hagar Gamal Halim" Signed-off-by: Greg Kroah-Hartman

pinctrl: core: delete incorrect free in pinctrl_enable()

2024-05-17T09:50:45+00:00

[ Upstream commit 5038a66dad0199de60e5671603ea6623eb9e5c79 ] The "pctldev" struct is allocated in devm_pinctrl_register_and_init(). It's a devm_ managed pointer that is freed by devm_pinctrl_dev_release(), so freeing it in pinctrl_enable() will lead to a double free. The devm_pinctrl_dev_release() function frees the pindescs and destroys the mutex as well. Fixes: 6118714275f0 ("pinctrl: core: Fix pinctrl_register_and_init() with pinctrl_enable()") Signed-off-by: Dan Carpenter Message-ID: <578fbe56-44e9-487c-ae95-29b695650f7c@moroto.mountain> Signed-off-by: Linus Walleij Signed-off-by: Sasha Levin

pinctrl: avoid reload of p state in list iteration

2023-12-08T07:48:00+00:00

commit 4198a9b571065978632276264e01d71d68000ac5 upstream. When in the list_for_each_entry iteration, reload of p->state->settings with a local setting from old_state will turn the list iteration into an infinite loop. The typical symptom when the issue happens, will be a printk message like: "not freeing pin xx (xxx) as part of deactivating group xxx - it is already used for some other setting". This is a compiler-dependent problem, one instance occurred using Clang version 10.0 on the arm64 architecture with linux version 4.19. Fixes: 6e5e959dde0d ("pinctrl: API changes to support multiple states per device") Signed-off-by: Maria Yu Cc: Link: https://lore.kernel.org/r/20231115102824.23727-1-quic_aiquny@quicinc.com Signed-off-by: Linus Walleij Signed-off-by: Greg Kroah-Hartman

Revert "pinctrl: avoid unsafe code pattern in find_pinctrl()"

2023-10-25T09:59:02+00:00

commit 62140a1e4dec4594d5d1e1d353747bf2ef434e8b upstream. The commit breaks MMC enumeration on the Intel Merrifield plaform. Before: [ 36.439057] mmc0: SDHCI controller on PCI [0000:00:01.0] using ADMA [ 36.450924] mmc2: SDHCI controller on PCI [0000:00:01.3] using ADMA [ 36.459355] mmc1: SDHCI controller on PCI [0000:00:01.2] using ADMA [ 36.706399] mmc0: new DDR MMC card at address 0001 [ 37.058972] mmc2: new ultra high speed DDR50 SDIO card at address 0001 [ 37.278977] mmcblk0: mmc0:0001 H4G1d 3.64 GiB [ 37.297300] mmcblk0: p1 p2 p3 p4 p5 p6 p7 p8 p9 p10 After: [ 36.436704] mmc2: SDHCI controller on PCI [0000:00:01.3] using ADMA [ 36.436720] mmc1: SDHCI controller on PCI [0000:00:01.0] using ADMA [ 36.463685] mmc0: SDHCI controller on PCI [0000:00:01.2] using ADMA [ 36.720627] mmc1: new DDR MMC card at address 0001 [ 37.068181] mmc2: new ultra high speed DDR50 SDIO card at address 0001 [ 37.279998] mmcblk1: mmc1:0001 H4G1d 3.64 GiB [ 37.302670] mmcblk1: p1 p2 p3 p4 p5 p6 p7 p8 p9 p10 This reverts commit c153a4edff6ab01370fcac8e46f9c89cca1060c2. Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20231017141806.535191-1-andriy.shevchenko@linux.intel.com Signed-off-by: Linus Walleij Signed-off-by: Greg Kroah-Hartman

pinctrl: avoid unsafe code pattern in find_pinctrl()

2023-10-19T21:05:37+00:00

commit c153a4edff6ab01370fcac8e46f9c89cca1060c2 upstream. The code in find_pinctrl() takes a mutex and traverses a list of pinctrl structures. Later the caller bumps up reference count on the found structure. Such pattern is not safe as pinctrl that was found may get deleted before the caller gets around to increasing the reference count. Fix this by taking the reference count in find_pinctrl(), while it still holds the mutex. Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov Link: https://lore.kernel.org/r/ZQs1RgTKg6VJqmPs@google.com Signed-off-by: Linus Walleij Signed-off-by: Greg Kroah-Hartman

pinctrl: core: fix possible memory leak in pinctrl_enable()

2021-11-18T18:16:06+00:00

commit c7892ae13e461ed20154321eb792e07ebe38f5b3 upstream. I got memory leak as follows when doing fault injection test: unreferenced object 0xffff888020a7a680 (size 64): comm "i2c-mcp23018-41", pid 23090, jiffies 4295160544 (age 8.680s) hex dump (first 32 bytes): 00 48 d3 1e 80 88 ff ff 00 1a 56 c1 ff ff ff ff .H........V..... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<0000000083c79b35>] kmem_cache_alloc_trace+0x16d/0x360 [<0000000051803c95>] pinctrl_init_controller+0x6ed/0xb70 [<0000000064346707>] pinctrl_register+0x27/0x80 [<0000000029b0e186>] devm_pinctrl_register+0x5b/0xe0 [<00000000391f5a3e>] mcp23s08_probe_one+0x968/0x118a [pinctrl_mcp23s08] [<000000006112c039>] mcp230xx_probe+0x266/0x560 [pinctrl_mcp23s08_i2c] If pinctrl_claim_hogs() fails, the 'pindesc' allocated in pinctrl_register_one_pin() need be freed. Cc: stable@vger.kernel.org Reported-by: Hulk Robot Fixes: 950b0d91dc10 ("pinctrl: core: Fix regression caused by delayed work for hogs") Signed-off-by: Yang Yingliang Link: https://lore.kernel.org/r/20211022014323.1156924-1-yangyingliang@huawei.com Signed-off-by: Linus Walleij Signed-off-by: Greg Kroah-Hartman

pinctrl: core: Remove duplicated word from devm_pinctrl_unregister()

2021-09-16T22:03:55+00:00

Remove duplicated "which" from devm_pinctrl_unregister() kernel doc description. Signed-off-by: Michal Simek Link: https://lore.kernel.org/r/8b75e5dfd9363f35ebdd7812e119757379678f97.1629877281.git.michal.simek@xilinx.com Signed-off-by: Linus Walleij

Merge tag 'pinctrl-v5.13-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl

2021-04-30T20:04:30+00:00

Pull pin control updates from Linus Walleij: "There is a lot going on! Core changes: - A semantic change to handle pinmux and pinconf in explicit order while up until now we depended on the semantic order in the device tree. The device tree is a functional programming language and does not imply any order, so the right thing is for the pin control core to provide these semantics. - Add a new pinmux-select debugfs file which makes it possible to go in and select functions for a pin manually (iteratively, at the prompt) for debugging purposes. - Fixes to gpio regmap handling for a new pin control driver making use of regmap-gpio. - Use octal permissions on debugfs files. New drivers: - A massive rewrite of the former custom pin control driver for MIPS Broadcom devices to instead use the pin control subsystem. New pin control drivers for BCM6345, BCM6328, BCM6358, BCM6362, BCM6368, BCM63268 and BCM6318 SoC variants are implemented. - Support for PM8350, PM8350B, PM8350C, PMK8350, PMR735A and PMR735B in the Qualcomm PMIC GPIO driver. Also the two GPIOs on PM8008 are supported. - Support for the Rockchip RK3568/RK3566 pin controller. - Support for Ingenic JZ4730, JZ4750, JZ4755, JZ4775 and X2000. - Support for Mediatek MTK8195. - Add a new Xilinx ZynqMP pin control driver. Driver improvements and non-urgent fixes: - Modularization and improvements of the Rockchip drivers. - Some new pins added to the description of new Renesas SoCs. - Clarifications of the GPIO base calculation in the Intel driver. - Fix the function names for the MPP54 and MPP55 pins in the Armada CP110 pin controller. - GPIO wakeup interrupt map for Qualcomm SC7280 and SM8350. - Support for ACPI probing of the Qualcomm SC8180x. - Fix interrupt clear status on rockchip - Fix some missing pins on the Ingenic JZ4770, some semantic fixes for the behaviour of the Ingenic pin controller. Add DMIC pins for JZ4780, X1000, X1500 and X1830. - A slew of janitorial like of_node_put() calls" * tag 'pinctrl-v5.13-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: (99 commits) pinctrl: Add Xilinx ZynqMP pinctrl driver support firmware: xilinx: Add pinctrl support pinctrl: rockchip: do coding style for mux route struct pinctrl: Add PIN_CONFIG_MODE_PWM to enum pin_config_param pinctrl: Introduce MODE group in enum pin_config_param pinctrl: Keep enum pin_config_param ordered by name dt-bindings: pinctrl: Add binding for ZynqMP pinctrl driver pinctrl: core: Fix kernel doc string for pin_get_name() pinctrl: mediatek: use spin lock in mtk_rmw pinctrl: add drive for I2C related pins on MT8195 pinctrl: add pinctrl driver on mt8195 dt-bindings: pinctrl: mt8195: add pinctrl file and binding document pinctrl: Ingenic: Add pinctrl driver for X2000. pinctrl: Ingenic: Add pinctrl driver for JZ4775. pinctrl: Ingenic: Add pinctrl driver for JZ4755. pinctrl: Ingenic: Add pinctrl driver for JZ4750. pinctrl: Ingenic: Add pinctrl driver for JZ4730. dt-bindings: pinctrl: Add bindings for new Ingenic SoCs. pinctrl: Ingenic: Reformat the code. pinctrl: Ingenic: Add DMIC pins support for Ingenic SoCs. ...