Linux kernel stable tree (mirror) https://git.radix-linux.su/kernel/linux.git/atom?h=v6.6 2022-12-08T13:02:37+00:00 2022-12-08T13:02:37+00:00 ChiYuan Huang cy_huang@richtek.com 2022-12-06T07:22:21+00:00 urn:sha1:8f3cbcd6b440032ebc7f7d48a1689dcc70a4eb98 Following by the below discussion, there's the potential UAF issue between regulator and mfd. https://lore.kernel.org/all/20221128143601.1698148-1-yangyingliang@huawei.com/ From the analysis of Yingliang CPU A |CPU B mt6370_probe() | devm_mfd_add_devices() | |mt6370_regulator_probe() | regulator_register() | //allocate init_data and add it to devres | regulator_of_get_init_data() i2c_unregister_device() | device_del() | devres_release_all() | // init_data is freed | release_nodes() | | // using init_data causes UAF | regulator_register() It's common to use mfd core to create child device for the regulator. In order to do the DT lookup for init data, the child that registered the regulator would pass its parent as the parameter. And this causes init data resource allocated to its parent, not itself. The issue happen when parent device is going to release and regulator core is still doing some operation of init data constraint for the regulator of child device. To fix it, this patch expand 'regulator_register' API to use the different devices for init data allocation and DT lookup. Reported-by: Yang Yingliang <yangyingliang@huawei.com> Signed-off-by: ChiYuan Huang <cy_huang@richtek.com> Link: https://lore.kernel.org/r/1670311341-32664-1-git-send-email-u0084500@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org> 2022-11-22T17:05:05+00:00 Peng Wu wupeng58@huawei.com 2022-11-22T08:22:42+00:00 urn:sha1:c957387c402a1a213102e38f92b800d7909a728d The regulator_get() function never returns NULL. It returns error pointers. Fixes: 27b9ecc7a9ba ("regulator: Add of_regulator_bulk_get_all") Signed-off-by: Peng Wu <wupeng58@huawei.com> Link: https://lore.kernel.org/r/20221122082242.82937-1-wupeng58@huawei.com Signed-off-by: Mark Brown <broonie@kernel.org> 2022-11-18T15:13:34+00:00 Corentin Labbe clabbe@baylibre.com 2022-11-15T07:36:01+00:00 urn:sha1:27b9ecc7a9ba1d0014779bfe5a6dbf630899c6e7 It work exactly like regulator_bulk_get() but instead of working on a provided list of names, it seek all consumers properties matching xxx-supply. Signed-off-by: Corentin Labbe <clabbe@baylibre.com> Link: https://lore.kernel.org/r/20221115073603.3425396-2-clabbe@baylibre.com Signed-off-by: Mark Brown <broonie@kernel.org> 2022-09-19T14:44:16+00:00 Jiapeng Chong jiapeng.chong@linux.alibaba.com 2022-09-19T02:48:29+00:00 urn:sha1:a8c31d3507fbf4e5e6d4a47225294a4d2f09d0b2 drivers/regulator/of_regulator.c:689: warning: expecting prototype for of_parse_coupled regulator(). Prototype was for of_parse_coupled_regulator() instead. Link: https://bugzilla.openanolis.cn/show_bug.cgi?id=2205#c0 Reported-by: Abaci Robot <abaci@linux.alibaba.com> Signed-off-by: Jiapeng Chong <jiapeng.chong@linux.alibaba.com> Link: https://lore.kernel.org/r/20220919024830.111874-1-jiapeng.chong@linux.alibaba.com Signed-off-by: Mark Brown <broonie@kernel.org> 2022-07-15T11:35:14+00:00 Liang He windhl@126.com 2022-07-15T11:10:27+00:00 urn:sha1:66efb665cd5ad69b27dca8571bf89fc6b9c628a4 We should call the of_node_put() for the reference returned by of_get_child_by_name() which has increased the refcount. Fixes: 40e20d68bb3f ("regulator: of: Add support for parsing regulator_state for suspend state") Signed-off-by: Liang He <windhl@126.com> Link: https://lore.kernel.org/r/20220715111027.391032-1-windhl@126.com Signed-off-by: Mark Brown <broonie@kernel.org> 2021-06-21T12:08:41+00:00 Matti Vaittinen matti.vaittinen@fi.rohmeurope.com 2021-06-03T05:42:12+00:00 urn:sha1:89a6a5e56c8248a077d12424a1383a6b18ea840b Add DT property parsing code and setting callback for regulator over/under voltage, over-current and temperature error limits. Signed-off-by: Matti Vaittinen <matti.vaittinen@fi.rohmeurope.com> Link: https://lore.kernel.org/r/e7b8007ba9eae7076178bf3363fb942ccb1cc9a5.1622628334.git.matti.vaittinen@fi.rohmeurope.com Signed-off-by: Mark Brown <broonie@kernel.org> 2021-04-21T14:54:56+00:00 Christophe JAILLET christophe.jaillet@wanadoo.fr 2021-04-20T19:31:51+00:00 urn:sha1:8a065ce92b218e453742b745162d75a6f86fb768 'for_each_available_child_of_node()' already performs an 'of_node_get()' on child, so there is no need to perform another one before returning. Otherwise, a double 'get' is performed and a resource may never be released. Fixes: 925c85e21ed8 ("regulator: Factor out location of init data OF node") Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com> Link: https://lore.kernel.org/r/a79f0068812b89ff412d572a1171f22109c24132.1618947049.git.christophe.jaillet@wanadoo.fr Signed-off-by: Mark Brown <broonie@kernel.org> 2020-11-23T18:38:13+00:00 Cristian Marussi cristian.marussi@arm.com 2020-11-19T19:10:49+00:00 urn:sha1:e7095c35abfc5a5d566941a87434c0fd5ffb570f During regulators registration, if .of_match and .regulators_node are defined as non-null strings in struct regulator_desc the core searches the DT subtree rooted at .regulators_node trying to match, at first, .of_match against the 'regulator-compatible' property and, then, falling back to use the name of the node itself to determine a good match. Property 'regulator-compatible', though, is now deprecated and falling back to match against the node name, works fine only as long as the involved nodes are named in an unique way across the searched subtree; if that's not the case, like when using <common-name>@<unit> style naming for properties indexed via 'reg' property (as advised by the standard), the above matching mechanism based on the simple common name will lead to multiple matches and the only viable alternative would be to properly define the now deprecated 'regulator-compatible' as the node full name, i.e. <common-name>@<unit>. In order to address this case without using such deprecated binding, define a new boolean flag .of_match_full_name in struct regulator_desc to force the core to match against the node full-name instead of the plain name. Signed-off-by: Cristian Marussi <cristian.marussi@arm.com> Link: https://lore.kernel.org/r/20201119191051.46363-4-cristian.marussi@arm.com Signed-off-by: Mark Brown <broonie@kernel.org> 2020-07-08T16:37:53+00:00 Lee Jones lee.jones@linaro.org 2020-07-08T12:48:31+00:00 urn:sha1:45e8446e7a153a011ae099bb8c5657bb853c0ad0 Kerneldoc validation gets confused if syntax isn't "@.*: ". Adding the missing colons squashes the following W=1 warnings: Signed-off-by: Lee Jones <lee.jones@linaro.org> Cc: Rajendra Nayak <rnayak@ti.com> Link: https://lore.kernel.org/r/20200708124832.3441649-3-lee.jones@linaro.org Signed-off-by: Mark Brown <broonie@kernel.org> 2019-10-23T19:31:17+00:00 Linus Torvalds torvalds@linux-foundation.org 2019-10-23T19:31:17+00:00 urn:sha1:deed1d44699135e5af7678442607469d14a92141 Pull regulator fixes from Mark Brown: "There are a few core fixes here around error handling and handling if suspend mode configuration and some driver specific fixes here but the most important change is the fix to the fixed-regulator DT schema conversion introduced during the last merge window. That fixes one of the last two errors preventing successful execution of "make dt_binding_check" which will be enormously helpful for DT schema development" * tag 'regulator-fix-v5.4-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: qcom-rpmh: Fix PMIC5 BoB min voltage regulator: pfuze100-regulator: Variable "val" in pfuze100_regulator_probe() could be uninitialized regulator: lochnagar: Add on_off_delay for VDDCORE regulator: ti-abb: Fix timeout in ti_abb_wait_txdone/ti_abb_clear_all_txdone regulator: da9062: fix suspend_enable/disable preparation dt-bindings: fixed-regulator: fix compatible enum regulator: fixed: Prevent NULL pointer dereference when !CONFIG_OF regulator: core: make regulator_register() EPROBE_DEFER aware regulator: of: fix suspend-min/max-voltage parsing