linux-stable.git/drivers/gpio, branch v6.1.8

gpio: sifive: Fix refcount leak in sifive_gpio_probe

2023-01-12T11:02:24+00:00

[ Upstream commit 694175cd8a1643cde3acb45c9294bca44a8e08e9 ]

of_irq_find_parent() returns a node pointer with refcount incremented,
We should use of_node_put() on it when not needed anymore.
Add missing of_node_put() to avoid refcount leak.

Fixes: 96868dce644d ("gpio/sifive: Add GPIO driver for SiFive SoCs")
Signed-off-by: Miaoqian Lin 
Signed-off-by: Bartosz Golaszewski 
Signed-off-by: Sasha Levin

gpio: pca953x: avoid to use uninitialized value pinctrl

2023-01-12T11:02:20+00:00

[ Upstream commit 90fee3dd5bfc1b9f4c8c0ba6cd2a35c9d79ca4de ]

There is a variable pinctrl declared without initializer. And then
has the case (switch operation chose the default case) to directly
use this uninitialized value, this is not a safe behavior. So here
initialize the pinctrl as 0 to avoid this issue.
This is reported by Coverity.

Fixes: 13c5d4ce8060 ("gpio: pca953x: Add support for PCAL6534")
Signed-off-by: Haibo Chen 
Signed-off-by: Andy Shevchenko 
Signed-off-by: Bartosz Golaszewski 
Signed-off-by: Sasha Levin

gpiolib: protect the GPIO device against being dropped while in use by user-space

2022-12-31T12:32:42+00:00

[ Upstream commit bdbbae241a04f387ba910b8609f95fad5f1470c7 ]

While any of the GPIO cdev syscalls is in progress, the kernel can call
gpiochip_remove() (for instance, when a USB GPIO expander is disconnected)
which will set gdev->chip to NULL after which any subsequent access will
cause a crash.

To avoid that: use an RW-semaphore in which the syscalls take it for
reading (so that we don't needlessly prohibit the user-space from calling
syscalls simultaneously) while gpiochip_remove() takes it for writing so
that it can only happen once all syscalls return.

Fixes: d7c51b47ac11 ("gpio: userspace ABI for reading/writing GPIO lines")
Fixes: 3c0d9c635ae2 ("gpiolib: cdev: support GPIO_V2_GET_LINE_IOCTL and GPIO_V2_LINE_GET_VALUES_IOCTL")
Fixes: aad955842d1c ("gpiolib: cdev: support GPIO_V2_GET_LINEINFO_IOCTL and GPIO_V2_GET_LINEINFO_WATCH_IOCTL")
Fixes: a54756cb24ea ("gpiolib: cdev: support GPIO_V2_LINE_SET_CONFIG_IOCTL")
Fixes: 7b8e00d98168 ("gpiolib: cdev: support GPIO_V2_LINE_SET_VALUES_IOCTL")
Signed-off-by: Bartosz Golaszewski 
[Nick: fixed a build failure with CDEV_V1 disabled]
Co-authored-by: Nick Hainke 
Reviewed-by: Kent Gibson 
Reviewed-by: Andy Shevchenko 
Reviewed-by: Linus Walleij 
Signed-off-by: Sasha Levin

gpiolib: cdev: fix NULL-pointer dereferences

2022-12-31T12:32:42+00:00

[ Upstream commit 533aae7c94dbc2b14301cfd68ae7e0e90f0c8438 ]

There are several places where we can crash the kernel by requesting
lines, unbinding the GPIO device, then calling any of the system calls
relevant to the GPIO character device's annonymous file descriptors:
ioctl(), read(), poll().

While I observed it with the GPIO simulator, it will also happen for any
of the GPIO devices that can be hot-unplugged - for instance any HID GPIO
expander (e.g. CP2112).

This affects both v1 and v2 uAPI.

This fixes it partially by checking if gdev->chip is not NULL but it
doesn't entirely remedy the situation as we still have a race condition
in which another thread can remove the device after the check.

Fixes: d7c51b47ac11 ("gpio: userspace ABI for reading/writing GPIO lines")
Fixes: 3c0d9c635ae2 ("gpiolib: cdev: support GPIO_V2_GET_LINE_IOCTL and GPIO_V2_LINE_GET_VALUES_IOCTL")
Fixes: aad955842d1c ("gpiolib: cdev: support GPIO_V2_GET_LINEINFO_IOCTL and GPIO_V2_GET_LINEINFO_WATCH_IOCTL")
Fixes: a54756cb24ea ("gpiolib: cdev: support GPIO_V2_LINE_SET_CONFIG_IOCTL")
Fixes: 7b8e00d98168 ("gpiolib: cdev: support GPIO_V2_LINE_SET_VALUES_IOCTL")
Signed-off-by: Bartosz Golaszewski 
Reviewed-by: Andy Shevchenko 
Reviewed-by: Linus Walleij 
Signed-off-by: Sasha Levin

gpio/rockchip: fix refcount leak in rockchip_gpiolib_register()

2022-12-06T09:10:46+00:00

The node returned by of_get_parent() with refcount incremented,
of_node_put() needs be called when finish using it. So add it in the
end of of_pinctrl_get().

Fixes: 936ee2675eee ("gpio/rockchip: add driver for rockchip gpio")
Signed-off-by: Wang Yufen 
Signed-off-by: Bartosz Golaszewski

gpio: amd8111: Fix PCI device reference count leak

2022-11-30T16:18:35+00:00

for_each_pci_dev() is implemented by pci_get_device(). The comment of
pci_get_device() says that it will increase the reference count for the
returned pci_dev and also decrease the reference count for the input
pci_dev @from if it is not NULL.

If we break for_each_pci_dev() loop with pdev not NULL, we need to call
pci_dev_put() to decrease the reference count. Add the missing
pci_dev_put() after the 'out' label. Since pci_dev_put() can handle NULL
input parameter, there is no problem for the 'Device not found' branch.
For the normal path, add pci_dev_put() in amd_gpio_exit().

Fixes: f942a7de047d ("gpio: add a driver for GPIO pins found on AMD-8111 south bridge chips")
Signed-off-by: Xiongfeng Wang 
Signed-off-by: Bartosz Golaszewski

gpiolib: fix memory leak in gpiochip_setup_dev()

2022-11-28T08:39:25+00:00

Here is a backtrace report about memory leak detected in
gpiochip_setup_dev():

unreferenced object 0xffff88810b406400 (size 512):
  comm "python3", pid 1682, jiffies 4295346908 (age 24.090s)
  backtrace:
    kmalloc_trace
    device_add		device_private_init at drivers/base/core.c:3361
			(inlined by) device_add at drivers/base/core.c:3411
    cdev_device_add
    gpiolib_cdev_register
    gpiochip_setup_dev
    gpiochip_add_data_with_key

gcdev_register() & gcdev_unregister() would call device_add() &
device_del() (no matter CONFIG_GPIO_CDEV is enabled or not) to
register/unregister device.

However, if device_add() succeeds, some resource (like
struct device_private allocated by device_private_init())
is not released by device_del().

Therefore, after device_add() succeeds by gcdev_register(), it
needs to call put_device() to release resource in the error handle
path.

Here we move forward the register of release function, and let it
release every piece of resource by put_device() instead of kfree().

While at it, fix another subtle issue, i.e. when gc->ngpio is equal
to 0, we still call kcalloc() and, in case of further error, kfree()
on the ZERO_PTR pointer, which is not NULL. It's not a bug per se,
but rather waste of the resources and potentially wrong expectation
about contents of the gdev->descs variable.

Fixes: 159f3cd92f17 ("gpiolib: Defer gpio device setup until after gpiolib initialization")
Signed-off-by: Zeng Heng 
Co-developed-by: Andy Shevchenko 
Signed-off-by: Andy Shevchenko 
Signed-off-by: Bartosz Golaszewski

gpio: tegra: Convert to immutable irq chip

2022-10-20T11:47:54+00:00

Update the driver to use an immutable IRQ chip to fix this warning:

    "not an immutable chip, please consider fixing it!"

Preserve per-chip labels by adding an ->irq_print_chip() callback.

Tested-by: Svyatoslav Ryhel  # TF201 T30
Tested-by: Robert Eckelmann  # TF101 T20
Signed-off-by: Svyatoslav Ryhel 
Reviewed-by: Dmitry Osipenko 
Signed-off-by: Bartosz Golaszewski

Merge tag 'irq-core-2022-10-12' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

2022-10-12T17:23:24+00:00

Pull interrupt updates from Thomas Gleixner:
 "Core code:

   - Provide a generic wrapper which can be utilized in drivers to
     handle the problem of force threaded demultiplex interrupts on RT
     enabled kernels. This avoids conditionals and horrible quirks in
     drivers all over the place

   - Fix up affected pinctrl and GPIO drivers to make them cleanly RT
     safe

  Interrupt drivers:

   - A new driver for the FSL MU platform specific MSI implementation

   - Make irqchip_init() available for pure ACPI based systems

   - Provide a functional DT binding for the Realtek RTL interrupt chip

   - The usual DT updates and small code improvements all over the
     place"

* tag 'irq-core-2022-10-12' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (21 commits)
  irqchip: IMX_MU_MSI should depend on ARCH_MXC
  irqchip/imx-mu-msi: Fix wrong register offset for 8ulp
  irqchip/ls-extirq: Fix invalid wait context by avoiding to use regmap
  dt-bindings: irqchip: Describe the IMX MU block as a MSI controller
  irqchip: Add IMX MU MSI controller driver
  dt-bindings: irqchip: renesas,irqc: Add r8a779g0 support
  irqchip/gic-v3: Fix typo in comment
  dt-bindings: interrupt-controller: ti,sci-intr: Fix missing reg property in the binding
  dt-bindings: irqchip: ti,sci-inta: Fix warning for missing #interrupt-cells
  irqchip: Allow extra fields to be passed to IRQCHIP_PLATFORM_DRIVER_END
  platform-msi: Export symbol platform_msi_create_irq_domain()
  irqchip/realtek-rtl: use parent interrupts
  dt-bindings: interrupt-controller: realtek,rtl-intc: require parents
  irqchip/realtek-rtl: use irq_domain_add_linear()
  irqchip: Make irqchip_init() usable on pure ACPI systems
  bcma: gpio: Use generic_handle_irq_safe()
  gpio: mlxbf2: Use generic_handle_irq_safe()
  platform/x86: intel_int0002_vgpio: Use generic_handle_irq_safe()
  ssb: gpio: Use generic_handle_irq_safe()
  pinctrl: amd: Use generic_handle_irq_safe()
  ...

Merge tag 'pinctrl-v6.1-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl

2022-10-11T17:59:59+00:00

Pull pin control updates from Linus Walleij:
 "There is nothing exciting going on, no core changes, just a few
  drivers and cleanups.

  New drivers:

   - Cypress CY8C95x0 chip pin control support, along with an immediate
     cleanup

   - Mediatek MT8188 SoC pin control support

   - Qualcomm SM8450 and SC8280XP LPASS (low power audio subsystem) pin
     control support

   - Qualcomm PM7250, PM8450

   - Rockchip RV1126 SoC pin control support

  Improvements:

   - Fix some missing pins in the Armada 37xx driver

   - Convert Broadcom and Nomadik drivers to use PINCTRL_PINGROUP()
     macro

   - Fix some GPIO irq_chips to be immutable

   - Massive Qualcomm device tree binding cleanup, with more to come"

* tag 'pinctrl-v6.1-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: (119 commits)
  MAINTAINERS: adjust STARFIVE JH7100 PINCTRL DRIVER after file movement
  pinctrl: starfive: Rename "pinctrl-starfive" to "pinctrl-starfive-jh7100"
  pinctrl: Create subdirectory for StarFive drivers
  dt-bindings: pinctrl: st,stm32: Document interrupt-controller property
  dt-bindings: pinctrl: st,stm32: Document gpio-hog pattern property
  dt-bindings: pinctrl: st,stm32: Document gpio-line-names
  pinctrl: st: stop abusing of_get_named_gpio()
  pinctrl: wpcm450: Correct the fwnode_irq_get() return value check
  pinctrl: bcm: Remove unused struct bcm6328_pingroup
  pinctrl: qcom: restrict drivers per ARM/ARM64
  pinctrl: bcm: ns: Remove redundant dev_err call
  gpio: rockchip: request GPIO mux to pinctrl when setting direction
  pinctrl: rockchip: add pinmux_ops.gpio_set_direction callback
  pinctrl: cy8c95x0: Align function names in cy8c95x0_pmxops
  pinctrl: cy8c95x0: Drop atomicity on operations on push_pull
  pinctrl: cy8c95x0: Lock register accesses in cy8c95x0_set_mux()
  pinctrl: sunxi: sun50i-h5: Switch to use dev_err_probe() helper
  pinctrl: stm32: Switch to use dev_err_probe() helper
  dt-bindings: qcom-pmic-gpio: Add PM7250B and PM8450 bindings
  pinctrl: qcom: spmi-gpio: Add compatible for PM7250B
  ...