linux.git/drivers/of/base.c, branch v7.3-rc2

Merge tag 'devicetree-fixes-for-7.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux

2026-08-27T19:53:43+00:00

Pull devicetree fixes from Rob Herring:

 - Fix possible out-of-bounds access in of_alias_scan()

 - Fix refcount leak in of_irq_get_affinity()

 - Add Qualcomm SPMI PMIC haptics input which is already referenced

* tag 'devicetree-fixes-for-7.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux:
  of: fix out-of-bounds read in of_alias_scan() stem parser
  of/irq: Fix device node refcount leak in of_irq_get_affinity()
  dt-bindings: input: Add Qualcomm SPMI PMIC haptics

of: fix out-of-bounds read in of_alias_scan() stem parser

2026-08-27T14:36:05+00:00

The stem parser tests isdigit(*(end - 1)) before checking end > start
and so reads one byte before the property name when the name is empty
or all digits. Check the bound first.

Fixes: 611cad720148 ("dt: add of_alias_scan and of_alias_get_id")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-fable-5 [Claude Code]
Signed-off-by: Abdurrahman Hussain 
Reviewed-by: Geert Uytterhoeven 
Link: https://patch.msgid.link/20260805-nh-of-alias-overlay-v6-1-74f21d440819@nexthop.ai
Signed-off-by: Rob Herring (Arm)

Merge tag 'devicetree-for-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux

2026-08-19T17:32:34+00:00

Pull devicetree updates from Rob Herring:

 - Add a DT maintainer profile document

 - Various dt-check-style improvements

 - Add a devres managed reserved memory region init function

 - Print node name on any skipped reserved memory regions

 - Correctly handle optional argument in
   of_parse_phandle_with_args_map()

 - Convert ti,keystone-reset, ti,da850-vpif, TI L4 interconnect, TI
   SmartReflex, microchip,pic32mzda-dmt, microchip,pic32mzda-wdt, TI
   DA8XX MSTPRI bus, and Xen VM bindings to DT schema format

 - Add bindings for StarFive JHB100 plic, Allwinner A733 NMI controller,
   MediaTek MT8173 GPU, QCom Shikra, Eliza, and Maili cpu-bwmon, and
   QCom Shikra SCM firmware

 - A couple of syntax fixes found using PoC Rust implementation of
   dtschema tools

 - Clean-ups for typos, brackets, incorrect "::" usages, and
   white-space style

* tag 'devicetree-for-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: (40 commits)
  dt-bindings: interconnect: qcom-bwmon: Add Maili cpu-bwmon compatible
  dtc: dt-check-style: Simplify setting depth of DtsLine
  dtc: dt-check-style: Add missing /dts-v1/ to few test cases
  dt-bindings: power: reset: ti,keystone-reset: Convert to DT schema
  media: dt-bindings: ti,da850-vpif: Convert to dt-schema
  dt-bindings: devfreq: samsung,exynos-ppmu: Use standard regex syntax
  dt-bindings: interrupt-controller: mediatek,mt6577-sysirq: Drop invalid JSON pointer
  dt-bindings: arm: omap: Convert L4 interconnect to DT schema
  dt-bindings: power: Convert TI SmartReflex to DT schema
  of: reserved_mem: Introduce devres-managed initialization function
  dt-bindings: interrupt-controller: Add StarFive JHB100 plic
  dt-bindings: irq: sun7i-nmi: Document the Allwinner A733 NMI controller
  dt-bindings: Correct white-space style
  dt-bindings: fix typos and brackets
  docs: dt: submitting-patches: Mention expectation about dt-check-style
  docs: dt: maintainer: Add Devicetree and OF maintainer profile document
  docs: dt: writing-schema: Extend expectations about example part of binding
  dt-bindings: gpu: powervr-rogue: Add MediaTek MT8173 GPU
  of: base: Handle optional argument in of_parse_phandle_with_args_map()
  dt-bindings: update Sudeep Holla's email address
  ...

of: export of_stdout symbol

2026-07-27T09:53:04+00:00

of_stdout is declared extern in include/linux/of.h alongside of_root
and of_chosen, but unlike those two it is not exported, preventing
modules from referencing it.

Export it with EXPORT_SYMBOL_GPL() so drivers that need the stdout
device node can be built as modules.

Signed-off-by: Zhipeng Wang 
Acked-by: Rob Herring (Arm) 
Signed-off-by: Ulf Hansson

of: base: Handle optional argument in of_parse_phandle_with_args_map()

2026-07-22T13:48:18+00:00

The kernel doc claims out_args is optional. In practice, the function
unconditionally dereferences it. It feels like calling this function
with a NULL out_args argument may be a valid use case (in order to know
if the lookup would work, even though we might not care about the
result), even though in practice there seem to be no actual user of that
possibility. All callers give an on-stack object to fill.

There are two ways out: either we drop the "optional" wording from the
kernel doc, or we handle the NULL case properly. Since handling this
case goes in favor of more harmonization of the semantics and since
of_parse_phandle_with_args() actually do handle that situation
correctly, let's handle it in the _map() case as well.

Use a local on-stack object in case no argument is passed. This way, we
actually go through the same logic as if there was an argument. We may
however return rather early, since the second part of the function is
dedicated at filling that argument.

Reported-by: Sashiko 
Closes: https://lore.kernel.org/all/20260710183359.61D3A1F000E9@smtp.kernel.org/
Signed-off-by: Miquel Raynal (Schneider Electric) 
Link: https://patch.msgid.link/20260716-schneider-v7-2-rc1-eip-of-fix-v1-1-9b9383f936c6@bootlin.com
Signed-off-by: Rob Herring (Arm)

of: Fix RST inline emphasis warnings in of_map_id() kernel-doc

2026-06-24T12:56:55+00:00

The @filter_np parameter descriptions in of_map_id() and of_map_msi_id()
contained the text '*filter_np' in prose. Docutils interprets a leading
'*' as the start of RST emphasis (italic), but finds no closing '*',
triggering:

  Documentation/devicetree/kernel-api:11: ./drivers/of/base.c:2134:
  WARNING: Inline emphasis start-string without end-string. [docutils]

  Documentation/devicetree/kernel-api:11: ./drivers/of/base.c:2260:
  WARNING: Inline emphasis start-string without end-string. [docutils]

Fix by wrapping '*filter_np' in double backticks (*filter_np) to
render it as an RST inline code literal, which is also the correct
kernel-doc convention for pointer expressions.

Reported-by: kernel test robot 
Closes: https://lore.kernel.org/oe-kbuild-all/202606130111.ldC96rqf-lkp@intel.com/
Signed-off-by: Vijayanand Jitta 
Link: https://patch.msgid.link/20260619-iommu_map_kdoc_fix-v1-1-9573e1cf30b3@oss.qualcomm.com
Signed-off-by: Rob Herring (Arm)

of: Respect #{iommu,msi}-cells in maps

2026-06-12T15:25:39+00:00

So far our parsing of {iommu,msi}-map properties has always blindly
assumed that the output specifiers will always have exactly 1 cell.
This typically does happen to be the case, but is not actually enforced
(and the PCI msi-map binding even explicitly states support for 0 or 1
cells) - as a result we've now ended up with dodgy DTs out in the field
which depend on this behaviour to map a 1-cell specifier for a 2-cell
provider, despite that being bogus per the bindings themselves.

Since there is some potential use in being able to map at least single
input IDs to multi-cell output specifiers (and properly support 0-cell
outputs as well), add support for properly parsing and using the target
nodes' #cells values, albeit with the unfortunate complication of still
having to work around expectations of the old behaviour too.

Since there are multi-cell output specifiers, the callers of of_map_id()
may need to get the exact cell output value for further processing.
Update of_map_id() to set args_count in the output to reflect the actual
number of output specifier cells.

Signed-off-by: Robin Murphy 
Signed-off-by: Charan Teja Kalla 
Signed-off-by: Vijayanand Jitta 
Link: https://patch.msgid.link/20260603-parse_iommu_cells-v16-3-dc509dacb19a@oss.qualcomm.com
Signed-off-by: Rob Herring (Arm)

of: Factor arguments passed to of_map_id() into a struct

2026-06-12T15:25:39+00:00

Change of_map_id() to take a pointer to struct of_phandle_args
instead of passing target device node and translated IDs separately.
Update all callers accordingly.

Add an explicit filter_np parameter to of_map_id() and of_map_msi_id()
to separate the filter input from the output. Previously, the target
parameter served dual purpose: as an input filter (if non-NULL, only
match entries targeting that node) and as an output (receiving the
matched node with a reference held). Now filter_np is the explicit
input filter and arg->np is the pure output.

Previously, of_map_id() would call of_node_put() on the matched node
when a filter was provided, making reference ownership inconsistent.
Remove this internal of_node_put() call so that of_map_id() now always
transfers ownership of the matched node reference to the caller via
arg->np. Callers are now consistently responsible for releasing this
reference with of_node_put(arg->np) when done.

Acked-by: Frank Li 
Suggested-by: Rob Herring (Arm) 
Suggested-by: Dmitry Baryshkov 
Signed-off-by: Charan Teja Kalla 
Signed-off-by: Vijayanand Jitta 
Link: https://patch.msgid.link/20260603-parse_iommu_cells-v16-2-dc509dacb19a@oss.qualcomm.com
Signed-off-by: Rob Herring (Arm)

of: Add convenience wrappers for of_map_id()

2026-06-12T15:25:39+00:00

Since we now have quite a few users parsing "iommu-map" and "msi-map"
properties, give them some wrappers to conveniently encapsulate the
appropriate sets of property names. This will also make it easier to
then change of_map_id() to correctly account for specifier cells.

Reviewed-by: Rob Herring (Arm) 
Reviewed-by: Frank Li 
Acked-by: Marc Zyngier 
Acked-by: Bjorn Helgaas 
Signed-off-by: Robin Murphy 
Signed-off-by: Vijayanand Jitta 
Link: https://patch.msgid.link/20260603-parse_iommu_cells-v16-1-dc509dacb19a@oss.qualcomm.com
Signed-off-by: Rob Herring (Arm)

drivers/of: validate live-tree string properties before string use

2026-05-13T22:18:01+00:00

`populate_properties()` stores live-tree property values as raw byte
sequences plus a separate `length`. They are not globally guaranteed to
be NUL-terminated.

`of_prop_next_string()` iterates string-list properties by walking raw
bytes, `__of_node_is_type()` checks `device_type`,
`__of_device_is_status()` checks `status`, and
`of_alias_from_compatible()` reads the first `compatible` entry. These
paths must validate that the relevant string fits within the property
bounds before they hand it to C string helpers.

Validate these live-tree string properties within their declared bounds.
In particular, make `of_prop_next_string()` reject malformed entries
before returning them, keep the `device_type` check inside the existing
no-lock helper path, and add unit coverage for malformed first and
trailing string-list entries.

Signed-off-by: Pengpeng Hou 
Link: https://patch.msgid.link/20260507081812.91838-1-pengpeng@iscas.ac.cn
Signed-off-by: Rob Herring (Arm)