All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH] w1: netlink: fix spelling mistakes in comments
@ 2026-08-11  0:27 Ivy Lopez
  2026-08-11  5:46 ` Krzysztof Kozlowski
  2026-08-12 23:57 ` [PATCH] w1: fix spelling mistakes in comments across the subsystem Ivy Lopez
  0 siblings, 2 replies; 5+ messages in thread
From: Ivy Lopez @ 2026-08-11  0:27 UTC (permalink / raw)
  To: krzk; +Cc: linux-kernel, Ivy Lopez

Correct several typos in comments: "appeneded"/"appened" ->
"appended", "Direclty" -> "Directly", "compariable" -> "comparable",
"duplicats" -> "duplicates".

No functional change.

Signed-off-by: Ivy Lopez <skunkolee@gmail.com>
---
 drivers/w1/w1_netlink.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/w1/w1_netlink.c b/drivers/w1/w1_netlink.c
index e6b59d921076..ac541a8fc274 100644
--- a/drivers/w1/w1_netlink.c
+++ b/drivers/w1/w1_netlink.c
@@ -23,9 +23,9 @@ struct w1_cb_block {
 	u16 maxlen;
 	/* pointers to building up the reply message */
 	struct cn_msg *first_cn; /* fixed once the structure is populated */
-	struct cn_msg *cn; /* advances as cn_msg is appeneded */
-	struct w1_netlink_msg *msg; /* advances as w1_netlink_msg is appened */
-	struct w1_netlink_cmd *cmd; /* advances as cmds are appened */
+	struct cn_msg *cn; /* advances as cn_msg is appended */
+	struct w1_netlink_msg *msg; /* advances as w1_netlink_msg is appended */
+	struct w1_netlink_cmd *cmd; /* advances as cmds are appended */
 	struct w1_netlink_msg *cur_msg; /* currently message being processed */
 	/* copy of the original request follows */
 	struct cn_msg request_cn;
@@ -49,8 +49,8 @@ struct w1_cb_node {
  * @block: block to calculate
  *
  * Calculates the current message length including possible multiple
- * cn_msg and data, excludes the first sizeof(struct cn_msg).  Direclty
- * compariable to maxlen and usable to send the message.
+ * cn_msg and data, excludes the first sizeof(struct cn_msg).  Directly
+ * comparable to maxlen and usable to send the message.
  */
 static u16 w1_reply_len(struct w1_cb_block *block)
 {
@@ -581,7 +581,7 @@ static void w1_cn_callback(struct cn_msg *cn, struct netlink_skb_parms *nsp)
 		int size;
 		int reply_size = sizeof(*cn) + cn->len + slave_len;
 		if (cn->flags & W1_CN_BUNDLE) {
-			/* bundling duplicats some of the messages */
+			/* bundling duplicates some of the messages */
 			reply_size += 2 * cmd_count * (sizeof(struct cn_msg) +
 				sizeof(struct w1_netlink_msg) +
 				sizeof(struct w1_netlink_cmd));
-- 
2.55.0


^ permalink raw reply related	[flat|nested] 5+ messages in thread
* [PATCH] power: supply: ds2760_battery: fix NULL pointer dereference in w1_ds2760_remove_slave()
@ 2026-08-08 21:44 Ivy Lopez
  2026-08-13  0:41 ` [PATCH v2] power: supply: ds2760_battery: convert to devm-managed workqueue and pm_notifier Ivy Lopez
  0 siblings, 1 reply; 5+ messages in thread
From: Ivy Lopez @ 2026-08-08 21:44 UTC (permalink / raw)
  To: sre; +Cc: linux-pm, linux-kernel, Ivy Lopez

w1_ds2760_add_slave()'s failure paths (di_alloc_failed, batt_failed,
workqueue_failed) are all empty labels that just return the error
code, with no explicit unwind. This works for di itself and the
registered power supply, both are devm-managed against the w1 slave
device and get cleaned up automatically. But di->monitor_wqueue and
di->pm_notifier are not devm-managed, and are only ever set up in
the success tail of the function, after the workqueue allocation and
power supply registration have both succeeded.

The w1 core's BUS_NOTIFY_ADD_DEVICE handling in w1_family_notify()
logs and returns on a failing add_slave(), but does not prevent the
w1 slave device from later being removed from the bus, which
triggers BUS_NOTIFY_DEL_DEVICE and an unconditional call to
remove_slave(). This means w1_ds2760_remove_slave() is effectively
the only failure-unwind path for a partially initialized di, and
needs to treat every field as potentially never having been set.

Currently it does not: it unconditionally calls
destroy_workqueue(di->monitor_wqueue), which crashes with a NULL
pointer dereference if add_slave() failed before or during the
workqueue allocation (e.g. on a power_supply_register() failure, as
seen when a colliding sysfs name from a misdetected slave device
causes registration to fail).

sl->family_data can also be NULL if add_slave() failed at its own
allocation, before family_data was ever set, which would crash on
the very first dereference in remove_slave().

Fix both: return early if di is NULL, and only call
destroy_workqueue() if monitor_wqueue was actually allocated.
unregister_pm_notifier() and cancel_delayed_work_sync() are safe to
call unconditionally: the former is a no-op if the notifier was
never registered, and the latter operates on the embedded
delayed_work struct, which is always validly initialized by the
time remove_slave() can run with a non-NULL di.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=217832
Signed-off-by: Ivy Lopez <skunkolee@gmail.com>
---
 drivers/power/supply/ds2760_battery.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/power/supply/ds2760_battery.c b/drivers/power/supply/ds2760_battery.c
index 142c7492c3c2..3c2433f6b5e9 100644
--- a/drivers/power/supply/ds2760_battery.c
+++ b/drivers/power/supply/ds2760_battery.c
@@ -723,9 +723,13 @@ static void w1_ds2760_remove_slave(struct w1_slave *sl)
 {
 	struct ds2760_device_info *di = sl->family_data;
 
+	if (!di)
+		return;
+
 	unregister_pm_notifier(&di->pm_notifier);
 	cancel_delayed_work_sync(&di->monitor_work);
-	destroy_workqueue(di->monitor_wqueue);
+	if (di->monitor_wqueue)
+		destroy_workqueue(di->monitor_wqueue);
 }
 
 #ifdef CONFIG_OF
-- 
2.55.0


^ permalink raw reply related	[flat|nested] 5+ messages in thread
end of thread, other threads:[~2026-08-13  0:43 UTC | newest]

Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-08-11  0:27 [PATCH] w1: netlink: fix spelling mistakes in comments Ivy Lopez
2026-08-11  5:46 ` Krzysztof Kozlowski
2026-08-12 23:57 ` [PATCH] w1: fix spelling mistakes in comments across the subsystem Ivy Lopez
  -- strict thread matches above, loose matches on Subject: below --
2026-08-08 21:44 [PATCH] power: supply: ds2760_battery: fix NULL pointer dereference in w1_ds2760_remove_slave() Ivy Lopez
2026-08-13  0:41 ` [PATCH v2] power: supply: ds2760_battery: convert to devm-managed workqueue and pm_notifier Ivy Lopez
2026-08-13  0:41   ` [PATCH] w1: fix spelling mistakes in comments across the subsystem Ivy Lopez
2026-08-13  0:43     ` Ivy Lopez

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.