kernel/linux.git/drivers/pinctrl/core.c, branch v6.1.168

pinctrl: core: fix possible memory leak when pinctrl_enable() fails

2024-08-03T06:49:26+00:00

[ Upstream commit ae1cf4759972c5fe665ee4c5e0c29de66fe3cf4a ] In devm_pinctrl_register(), if pinctrl_enable() fails in pinctrl_register(), the "pctldev" has not been added to dev resources, so devm_pinctrl_dev_release() can not be called, it leads memory leak. Introduce pinctrl_uninit_controller(), call it in the error path to free memory. Fixes: 5038a66dad01 ("pinctrl: core: delete incorrect free in pinctrl_enable()") Signed-off-by: Yang Yingliang Reviewed-by: Dan Carpenter Link: https://lore.kernel.org/r/20240606023704.3931561-2-yangyingliang@huawei.com Signed-off-by: Linus Walleij Signed-off-by: Sasha Levin

pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER

2024-07-05T07:31:43+00:00

[ Upstream commit adec57ff8e66aee632f3dd1f93787c13d112b7a1 ] In create_pinctrl(), pinctrl_maps_mutex is acquired before calling add_setting(). If add_setting() returns -EPROBE_DEFER, create_pinctrl() calls pinctrl_free(). However, pinctrl_free() attempts to acquire pinctrl_maps_mutex, which is already held by create_pinctrl(), leading to a potential deadlock. This patch resolves the issue by releasing pinctrl_maps_mutex before calling pinctrl_free(), preventing the deadlock. This bug was discovered and resolved using Coverity Static Analysis Security Testing (SAST) by Synopsys, Inc. Fixes: 42fed7ba44e4 ("pinctrl: move subsystem mutex to pinctrl_dev struct") Suggested-by: Maximilian Heyne Signed-off-by: Hagar Hemdan Link: https://lore.kernel.org/r/20240604085838.3344-1-hagarhem@amazon.com Signed-off-by: Linus Walleij Signed-off-by: Sasha Levin

pinctrl: core: handle radix_tree_insert() errors in pinctrl_register_one_pin()

2024-05-25T14:21:30+00:00

commit ecfe9a015d3e1e46504d5b3de7eef1f2d186194a upstream. pinctrl_register_one_pin() doesn't check the result of radix_tree_insert() despite they both may return a negative error code. Linus Walleij said he has copied the radix tree code from kernel/irq/ where the functions calling radix_tree_insert() are *void* themselves; I think it makes more sense to propagate the errors from radix_tree_insert() upstream if we can do that... Found by Linux Verification Center (linuxtesting.org) with the Svace static analysis tool. Signed-off-by: Sergey Shtylyov Link: https://lore.kernel.org/r/20230719202253.13469-3-s.shtylyov@omp.ru Signed-off-by: Linus Walleij Cc: "Hemdan, Hagar Gamal Halim" Signed-off-by: Greg Kroah-Hartman

pinctrl: core: delete incorrect free in pinctrl_enable()

2024-05-17T09:55:53+00:00

[ Upstream commit 5038a66dad0199de60e5671603ea6623eb9e5c79 ] The "pctldev" struct is allocated in devm_pinctrl_register_and_init(). It's a devm_ managed pointer that is freed by devm_pinctrl_dev_release(), so freeing it in pinctrl_enable() will lead to a double free. The devm_pinctrl_dev_release() function frees the pindescs and destroys the mutex as well. Fixes: 6118714275f0 ("pinctrl: core: Fix pinctrl_register_and_init() with pinctrl_enable()") Signed-off-by: Dan Carpenter Message-ID: <578fbe56-44e9-487c-ae95-29b695650f7c@moroto.mountain> Signed-off-by: Linus Walleij Signed-off-by: Sasha Levin

pinctrl: avoid reload of p state in list iteration

2023-12-08T07:51:13+00:00

commit 4198a9b571065978632276264e01d71d68000ac5 upstream. When in the list_for_each_entry iteration, reload of p->state->settings with a local setting from old_state will turn the list iteration into an infinite loop. The typical symptom when the issue happens, will be a printk message like: "not freeing pin xx (xxx) as part of deactivating group xxx - it is already used for some other setting". This is a compiler-dependent problem, one instance occurred using Clang version 10.0 on the arm64 architecture with linux version 4.19. Fixes: 6e5e959dde0d ("pinctrl: API changes to support multiple states per device") Signed-off-by: Maria Yu Cc: Link: https://lore.kernel.org/r/20231115102824.23727-1-quic_aiquny@quicinc.com Signed-off-by: Linus Walleij Signed-off-by: Greg Kroah-Hartman

Revert "pinctrl: avoid unsafe code pattern in find_pinctrl()"

2023-10-25T10:03:13+00:00

commit 62140a1e4dec4594d5d1e1d353747bf2ef434e8b upstream. The commit breaks MMC enumeration on the Intel Merrifield plaform. Before: [ 36.439057] mmc0: SDHCI controller on PCI [0000:00:01.0] using ADMA [ 36.450924] mmc2: SDHCI controller on PCI [0000:00:01.3] using ADMA [ 36.459355] mmc1: SDHCI controller on PCI [0000:00:01.2] using ADMA [ 36.706399] mmc0: new DDR MMC card at address 0001 [ 37.058972] mmc2: new ultra high speed DDR50 SDIO card at address 0001 [ 37.278977] mmcblk0: mmc0:0001 H4G1d 3.64 GiB [ 37.297300] mmcblk0: p1 p2 p3 p4 p5 p6 p7 p8 p9 p10 After: [ 36.436704] mmc2: SDHCI controller on PCI [0000:00:01.3] using ADMA [ 36.436720] mmc1: SDHCI controller on PCI [0000:00:01.0] using ADMA [ 36.463685] mmc0: SDHCI controller on PCI [0000:00:01.2] using ADMA [ 36.720627] mmc1: new DDR MMC card at address 0001 [ 37.068181] mmc2: new ultra high speed DDR50 SDIO card at address 0001 [ 37.279998] mmcblk1: mmc1:0001 H4G1d 3.64 GiB [ 37.302670] mmcblk1: p1 p2 p3 p4 p5 p6 p7 p8 p9 p10 This reverts commit c153a4edff6ab01370fcac8e46f9c89cca1060c2. Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20231017141806.535191-1-andriy.shevchenko@linux.intel.com Signed-off-by: Linus Walleij Signed-off-by: Greg Kroah-Hartman

pinctrl: avoid unsafe code pattern in find_pinctrl()

2023-10-19T21:08:57+00:00

commit c153a4edff6ab01370fcac8e46f9c89cca1060c2 upstream. The code in find_pinctrl() takes a mutex and traverses a list of pinctrl structures. Later the caller bumps up reference count on the found structure. Such pattern is not safe as pinctrl that was found may get deleted before the caller gets around to increasing the reference count. Fix this by taking the reference count in find_pinctrl(), while it still holds the mutex. Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov Link: https://lore.kernel.org/r/ZQs1RgTKg6VJqmPs@google.com Signed-off-by: Linus Walleij Signed-off-by: Greg Kroah-Hartman

pinctrl: core: Use device_match_of_node() helper

2022-07-18T09:38:37+00:00

Instead of open coding, use device_match_of_node() helper. Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20220629115840.16241-1-andriy.shevchenko@linux.intel.com Signed-off-by: Linus Walleij

Merge tag 'pinctrl-v5.16-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl

2021-11-05T15:24:17+00:00

Pull pin control updates from Linus Walleij: "The most interesting aspect is that we now have initial support for the Apple pin controller as used in the M1 laptops and the iPhones which is a step forward for using Linux efficiently on this Apple silicon. Core changes: - Add infrastructure for per-parent interrupt data to support the Apple pin controller. New drivers: - New combined pin control and GPIO driver for the Apple SoC. This is used in all modern Apple silicon such as the M1 laptops but also in at least recent iPhone variants. - New subdriver for the Qualcomm SM6350 - New subdriver for the Qualcomm QCM2290 - New subdriver for the Qualcomm PM6350 - New subdriver for the Uniphier NX1 - New subdriver for the Samsung ExynosAutoV9 - New subdriver for the Mediatek MT7986 - New subdriver for the nVidia Tegra194 Improvements: - Improve power management in the Mediatek driver. - Improvements to the Renesas internal consistency checker. - Convert the Rockchip pin control device tree bindings to YAML. - Finally convert the Qualcomm PMIC SSBI and SPMI MPP GPIO driver to use hierarchical interrupts. - Convert the Qualcomm PMIC MPP device tree bindings to YAML" * tag 'pinctrl-v5.16-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: (55 commits) pinctrl: add pinctrl/GPIO driver for Apple SoCs dt-bindings: pinctrl: Add apple,npins property to apple,pinctrl dt-bindings: pinctrl: add #interrupt-cells to apple,pinctrl gpio: Allow per-parent interrupt data pinctrl: tegra: Fix warnings and error pinctrl: intel: Kconfig: Add configuration menu to Intel pin control pinctrl: tegra: Use correct offset for pin group pinctrl: core: fix possible memory leak in pinctrl_enable() pinctrl: bcm2835: Allow building driver as a module pinctrl: equilibrium: Fix function addition in multiple groups pinctrl: tegra: Add pinmux support for Tegra194 pinctrl: tegra: include lpdr pin properties pinctrl: mediatek: add support for MT7986 SoC dt-bindings: pinctrl: update bindings for MT7986 SoC pinctrl: microchip sgpio: use reset driver dt-bindings: pinctrl: pinctrl-microchip-sgpio: Add reset binding dt-bindings: pinctrl: qcom,pmic-mpp: switch to #interrupt-cells pinctrl: qcom: spmi-mpp: add support for hierarchical IRQ chip pinctrl: qcom: spmi-mpp: hardcode IRQ counts pinctrl: qcom: ssbi-mpp: add support for hierarchical IRQ chip ...

pinctrl: core: fix possible memory leak in pinctrl_enable()

2021-10-24T23:43:43+00:00

I got memory leak as follows when doing fault injection test: unreferenced object 0xffff888020a7a680 (size 64): comm "i2c-mcp23018-41", pid 23090, jiffies 4295160544 (age 8.680s) hex dump (first 32 bytes): 00 48 d3 1e 80 88 ff ff 00 1a 56 c1 ff ff ff ff .H........V..... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<0000000083c79b35>] kmem_cache_alloc_trace+0x16d/0x360 [<0000000051803c95>] pinctrl_init_controller+0x6ed/0xb70 [<0000000064346707>] pinctrl_register+0x27/0x80 [<0000000029b0e186>] devm_pinctrl_register+0x5b/0xe0 [<00000000391f5a3e>] mcp23s08_probe_one+0x968/0x118a [pinctrl_mcp23s08] [<000000006112c039>] mcp230xx_probe+0x266/0x560 [pinctrl_mcp23s08_i2c] If pinctrl_claim_hogs() fails, the 'pindesc' allocated in pinctrl_register_one_pin() need be freed. Cc: stable@vger.kernel.org Reported-by: Hulk Robot Fixes: 950b0d91dc10 ("pinctrl: core: Fix regression caused by delayed work for hogs") Signed-off-by: Yang Yingliang Link: https://lore.kernel.org/r/20211022014323.1156924-1-yangyingliang@huawei.com Signed-off-by: Linus Walleij