Linux kernel stable tree (mirror) https://git.radix-linux.su/kernel/linux.git/atom?h=v6.12.80 2024-12-14T19:03:59+00:00 2024-12-14T19:03:59+00:00 Mukesh Ojha quic_mojha@quicinc.com 2024-10-14T19:29:30+00:00 urn:sha1:c11e2ec9a780f54982a187ee10ffd1b810715c85 [ Upstream commit 5a3e85c3c397c781393ea5fb2f45b1f60f8a4e6e ] When two client of the same gpio call pinctrl_select_state() for the same functionality, we are seeing NULL pointer issue while accessing desc->mux_owner. Let's say two processes A, B executing in pin_request() for the same pin and process A updates the desc->mux_usecount but not yet updated the desc->mux_owner while process B see the desc->mux_usecount which got updated by A path and further executes strcmp and while accessing desc->mux_owner it crashes with NULL pointer. Serialize the access to mux related setting with a mutex lock. cpu0 (process A) cpu1(process B) pinctrl_select_state() { pinctrl_select_state() { pin_request() { pin_request() { ... .... } else { desc->mux_usecount++; desc->mux_usecount && strcmp(desc->mux_owner, owner)) { if (desc->mux_usecount > 1) return 0; desc->mux_owner = owner; } } Signed-off-by: Mukesh Ojha <quic_mojha@quicinc.com> Link: https://lore.kernel.org/20241014192930.1539673-1-quic_mojha@quicinc.com Signed-off-by: Linus Walleij <linus.walleij@linaro.org> Signed-off-by: Sasha Levin <sashal@kernel.org> 2024-09-05T13:09:47+00:00 Li Zetao lizetao1@huawei.com 2024-09-03T14:38:12+00:00 urn:sha1:92f4368347a2a8a204b0513df32233075cd93b4f Since the debugfs_create_dir() never returns a null pointer, checking the return value for a null pointer is redundant, and using IS_ERR is safe enough. Signed-off-by: Li Zetao <lizetao1@huawei.com> Link: https://lore.kernel.org/20240903143812.2005071-1-lizetao1@huawei.com Signed-off-by: Linus Walleij <linus.walleij@linaro.org> 2024-07-21T17:25:59+00:00 Linus Torvalds torvalds@linux-foundation.org 2024-07-21T17:25:59+00:00 urn:sha1:8e313211f7d46d42b6aa7601b972fe89dcc4a076 Pull pin control updates from Linus Walleij: "Some new drivers is the main part, the rest is cleanups and nonurgent fixes. Nothing much special about this, no core changes this time. New drivers: - Renesas RZ/V2H(P) SoC - NXP Freescale i.MX91 SoC - Nuvoton MA35D1 SoC - Qualcomm PMC8380, SM4250, SM4250 LPI Enhancements: - A slew of scoped-based simplifications of of_node_put()" * tag 'pinctrl-v6.11-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: (110 commits) pinctrl: renesas: rzg2l: Support output enable on RZ/G2L pinctrl: renesas: rzg2l: Clean up and refactor OEN read/write functions pinctrl: renesas: rzg2l: Clarify OEN read/write support dt-bindings: pinctrl: pinctrl-single: Fix pinctrl-single,gpio-range description dt-bindings: pinctrl: npcm8xx: add missing pin group and mux function dt-bindings: pinctrl: pinctrl-single: fix schmitt related properties pinctrl: freescale: Use scope based of_node_put() cleanups pinctrl: equilibrium: Use scope based of_node_put() cleanups pinctrl: ti: iodelay: Use scope based of_node_put() cleanups pinctrl: qcom: lpass-lpi: increase MAX_NR_GPIO to 32 pinctrl: cy8c95x0: Update cache modification pinctrl: cy8c95x0: Use cleanup.h pinctrl: renesas: r8a779h0: Remove unneeded separators pinctrl: renesas: r8a779g0: Add INTC-EX pins, groups, and function pinctrl: renesas: r8a779g0: Remove unneeded separators pinctrl: renesas: r8a779h0: Add AVB MII pins and groups pinctrl: renesas: r8a779g0: Fix TPU suffixes pinctrl: renesas: r8a779g0: Fix TCLK suffixes pinctrl: renesas: r8a779g0: FIX PWM suffixes pinctrl: renesas: r8a779g0: Fix IRQ suffixes ... 2024-06-17T08:33:30+00:00 Yang Yingliang yangyingliang@huawei.com 2024-06-06T02:37:02+00:00 urn:sha1:ae1cf4759972c5fe665ee4c5e0c29de66fe3cf4a In devm_pinctrl_register(), if pinctrl_enable() fails in pinctrl_register(), the "pctldev" has not been added to dev resources, so devm_pinctrl_dev_release() can not be called, it leads memory leak. Introduce pinctrl_uninit_controller(), call it in the error path to free memory. Fixes: 5038a66dad01 ("pinctrl: core: delete incorrect free in pinctrl_enable()") Signed-off-by: Yang Yingliang <yangyingliang@huawei.com> Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org> Link: https://lore.kernel.org/r/20240606023704.3931561-2-yangyingliang@huawei.com Signed-off-by: Linus Walleij <linus.walleij@linaro.org> 2024-06-17T07:54:50+00:00 Hagar Hemdan hagarhem@amazon.com 2024-06-04T08:58:38+00:00 urn:sha1:adec57ff8e66aee632f3dd1f93787c13d112b7a1 In create_pinctrl(), pinctrl_maps_mutex is acquired before calling add_setting(). If add_setting() returns -EPROBE_DEFER, create_pinctrl() calls pinctrl_free(). However, pinctrl_free() attempts to acquire pinctrl_maps_mutex, which is already held by create_pinctrl(), leading to a potential deadlock. This patch resolves the issue by releasing pinctrl_maps_mutex before calling pinctrl_free(), preventing the deadlock. This bug was discovered and resolved using Coverity Static Analysis Security Testing (SAST) by Synopsys, Inc. Fixes: 42fed7ba44e4 ("pinctrl: move subsystem mutex to pinctrl_dev struct") Suggested-by: Maximilian Heyne <mheyne@amazon.de> Signed-off-by: Hagar Hemdan <hagarhem@amazon.com> Link: https://lore.kernel.org/r/20240604085838.3344-1-hagarhem@amazon.com Signed-off-by: Linus Walleij <linus.walleij@linaro.org> 2024-06-17T07:22:24+00:00 Léo DUBOIN lduboin@freebox.fr 2024-04-25T13:58:02+00:00 urn:sha1:9dfbcf2fc566c0be2de1c7685f29effd25696b75 We were not resetting the pointer to the associated gpio_device once we are done displaying a pin's information. This meant that once we reached the end of a gpio-range, if there were pins right after it that did not belong to any known range, they would be associated with the previous range's gpio device. This resulted in those pins appearing as <4294966783:old_gdev> instead of the expected <0:?> (due to gpio_num being -1). Signed-off-by: Léo DUBOIN <lduboin@freebox.fr> Link: https://lore.kernel.org/r/c40d0634abefa19e689ffd450e0f48a8d63c4fc4.1714049455.git.lduboin@freebox.fr Signed-off-by: Linus Walleij <linus.walleij@linaro.org> 2024-06-17T07:22:15+00:00 Léo DUBOIN lduboin@freebox.fr 2024-04-25T13:58:01+00:00 urn:sha1:db5032981ab37eb181810eea6037008c42d21ab3 We previously only looked at the 'pin_base' of the pinctrl_gpio_ranges struct for determining if a pin matched a GPIO number. This value is present only if the 'pins' array is not NULL, and is 0 otherwise. This means that GPIO ranges declared using gpiochip_add_pingroup_range(), thus making use of pins, were always matched by the pins in the range [0-npins] even if they contained pins in a completely separate range. Signed-off-by: Léo DUBOIN <lduboin@freebox.fr> Link: https://lore.kernel.org/r/6df39bd47942156be5713f8f4e317d2ad3e0ddeb.1714049455.git.lduboin@freebox.fr Signed-off-by: Linus Walleij <linus.walleij@linaro.org> 2024-03-28T23:04:16+00:00 Dan Carpenter dan.carpenter@linaro.org 2024-03-21T06:38:39+00:00 urn:sha1:5038a66dad0199de60e5671603ea6623eb9e5c79 The "pctldev" struct is allocated in devm_pinctrl_register_and_init(). It's a devm_ managed pointer that is freed by devm_pinctrl_dev_release(), so freeing it in pinctrl_enable() will lead to a double free. The devm_pinctrl_dev_release() function frees the pindescs and destroys the mutex as well. Fixes: 6118714275f0 ("pinctrl: core: Fix pinctrl_register_and_init() with pinctrl_enable()") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Message-ID: <578fbe56-44e9-487c-ae95-29b695650f7c@moroto.mountain> Signed-off-by: Linus Walleij <linus.walleij@linaro.org> 2024-03-14T17:22:26+00:00 Linus Torvalds torvalds@linux-foundation.org 2024-03-14T17:22:26+00:00 urn:sha1:a3df5d5422b4edfcfe658d5057e7e059571e32ce Pull pin control updates from Linus Walleij: "No core changes this time around. New drivers: - New driver for Renesas R8A779H0 also known as R-Car V4M. - New driver for the Awinic AW9523/B I2C GPIO expander. I found this living out-of-tree in OpenWrt as an upstream attempt had stalled on the finishing line, so I picked it up and finished the job. Improvements: - The Nomadik pin control driver was for years re-used out of tree for the ST STA chips, and now the IP was re-used in a MIPS automotive SoC called MobilEyeq5, so it has been split in pin control and GPIO drivers so the latter can be reused by MobilEyeq5. (Along with a long list of cleanups) - A lot of overall cleanup and tidying up" * tag 'pinctrl-v6.9-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: (87 commits) drivers/gpio/nomadik: move dummy nmk_gpio_dbg_show_one() to header gpio: nomadik: remove BUG_ON() in nmk_gpio_populate_chip() dt-bindings: pinctrl: qcom: update compatible name for match with driver pinctrl: aw9523: Make the driver tristate pinctrl: nomadik: fix dereference of error pointer gpio: nomadik: Back out some managed resources pinctrl: aw9523: Add proper terminator pinctrl: core: comment that pinctrl_add_gpio_range() is deprecated pinctrl: pinmux: Suppress error message for -EPROBE_DEFER pinctrl: Add driver for Awinic AW9523/B I2C GPIO Expander dt-bindings: pinctrl: Add bindings for Awinic AW9523/AW9523B gpio: nomadik: Finish conversion to use firmware node APIs gpio: nomadik: fix Kconfig dependencies inbetween pinctrl & GPIO pinctrl: da9062: Add OF table dt-bindings: pinctrl: at91: add sam9x7 pinctrl: ocelot: remove redundant assignment to variable ret gpio: nomadik: grab optional reset control and deassert it at probe gpio: nomadik: support mobileye,eyeq5-gpio gpio: nomadik: handle variadic GPIO count gpio: nomadik: support shared GPIO IRQs ... 2024-03-05T22:30:45+00:00 Dan Carpenter dan.carpenter@linaro.org 2024-03-04T07:05:09+00:00 urn:sha1:3ded216936392775d17bb22fdc480a48eb549961 The pinctrl_add_gpio_range() function is deprecated add a comment so people don't accidentally use it in new code. Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Link: https://lore.kernel.org/r/533a7a10-c6eb-4ebe-adf1-f8dc95ae8d33@moroto.mountain Signed-off-by: Linus Walleij <linus.walleij@linaro.org>