[PATCHv2] rtc: stmp3xxx: use devm_platform_ioremap_resource()

[PATCHv2] rtc: stmp3xxx: use devm_platform_ioremap_resource()

[Rosen Penev]

Replace the open-coded platform_get_resource() plus devm_ioremap()
sequence with a single devm_platform_ioremap_resource() call, which folds
the resource lookup and mapping into one step and returns an ERR_PTR on
failure, checked with IS_ERR() and propagated via PTR_ERR().

Move the mapping ahead of the devm_kzalloc() so that an error or deferred
probe is handled before the rtc_data allocation, avoiding needless work.

The fsl,stmp3xxx-rtc nodes in imx23.dtsi (reg = <0x8005c000 0x2000>) and
imx28.dtsi (reg = <0x80056000 0x2000>) each provide a single
non-overlapping IORESOURCE_MEM window, so the region reservation now
performed by devm_platform_ioremap_resource() introduces no conflict.

Remove irq_alarm from private struct. It's only used in _probe. Also add
check for platform_get_irq() errors.

Assisted-by: opencode:hy3-free
Signed-off-by: Rosen Penev <rosenp@gmail.com>
---
 v2: add platform_get_irq error check
 drivers/rtc/rtc-stmp3xxx.c | 32 ++++++++++++--------------------
 1 file changed, 12 insertions(+), 20 deletions(-)

diff --git a/drivers/rtc/rtc-stmp3xxx.c b/drivers/rtc/rtc-stmp3xxx.c
index 7afcd14aeee5..e789458ba96a 100644
--- a/drivers/rtc/rtc-stmp3xxx.c
+++ b/drivers/rtc/rtc-stmp3xxx.c
@@ -56,7 +56,6 @@
 struct stmp3xxx_rtc_data {
 	struct rtc_device *rtc;
 	void __iomem *io;
-	int irq_alarm;
 };
 
 #if IS_ENABLED(CONFIG_STMP3XXX_RTC_WATCHDOG)
@@ -245,29 +244,25 @@ static void stmp3xxx_rtc_remove(struct platform_device *pdev)
 static int stmp3xxx_rtc_probe(struct platform_device *pdev)
 {
 	struct stmp3xxx_rtc_data *rtc_data;
-	struct resource *r;
+	void __iomem *io;
 	u32 rtc_stat;
 	u32 pers0_set, pers0_clr;
 	u32 crystalfreq = 0;
 	int err;
 
+	irq_alarm = platform_get_irq(pdev, 0);
+	if (irq_alarm < 0)
+		return irq_alarm;
+
+	io = devm_platform_ioremap_resource(pdev, 0);
+	if (IS_ERR(io))
+		return PTR_ERR(io);
+
 	rtc_data = devm_kzalloc(&pdev->dev, sizeof(*rtc_data), GFP_KERNEL);
 	if (!rtc_data)
 		return -ENOMEM;
 
-	r = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-	if (!r) {
-		dev_err(&pdev->dev, "failed to get resource\n");
-		return -ENXIO;
-	}
-
-	rtc_data->io = devm_ioremap(&pdev->dev, r->start, resource_size(r));
-	if (!rtc_data->io) {
-		dev_err(&pdev->dev, "ioremap failed\n");
-		return -EIO;
-	}
-
-	rtc_data->irq_alarm = platform_get_irq(pdev, 0);
+	rtc_data->io = io;
 
 	rtc_stat = readl(rtc_data->io + STMP3XXX_RTC_STAT);
 	if (!(rtc_stat & STMP3XXX_RTC_STAT_RTC_PRESENT)) {
@@ -354,13 +349,10 @@ static int stmp3xxx_rtc_probe(struct platform_device *pdev)
 	if (IS_ERR(rtc_data->rtc))
 		return PTR_ERR(rtc_data->rtc);
 
-	err = devm_request_irq(&pdev->dev, rtc_data->irq_alarm,
+	err = devm_request_irq(&pdev->dev, irq_alarm,
 			stmp3xxx_rtc_interrupt, 0, "RTC alarm", &pdev->dev);
-	if (err) {
-		dev_err(&pdev->dev, "Cannot claim IRQ%d\n",
-			rtc_data->irq_alarm);
+	if (err)
 		return err;
-	}
 
 	rtc_data->rtc->ops = &stmp3xxx_rtc_ops;
 	rtc_data->rtc->range_max = U32_MAX;
-- 
2.55.0

Re: [PATCHv2] rtc: stmp3xxx: use devm_platform_ioremap_resource()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 3 potential issue(s) to consider:

New issues:
- [Low] The local variable `irq_alarm` is used in `stmp3xxx_rtc_probe()` without being declared.

Pre-existing issues:
- [High] The dynamically registered child watchdog device is not unregistered when the RTC driver is unbound, leading to a NULL pointer dereference.
- [High] Incorrect devm cleanup order creates a race condition where a pending interrupt can trigger a Use-After-Free by re-queueing an already-canceled work object.
--

--- Patch [1]: [PATCHv2] rtc: stmp3xxx: use devm_platform_ioremap_resource() ---
commit 9966c4bcfecfb31f7bf74af8e9b176bb32e74820
Author: Rosen Penev <rosenp@gmail.com>

rtc: stmp3xxx: use devm_platform_ioremap_resource()

This patch refactors the driver to use devm_platform_ioremap_resource()
instead of open-coding the resource lookup and mapping. It moves the
mapping ahead of the data allocation to handle deferred probes earlier.
It also removes irq_alarm from the private struct and adds an error
check for platform_get_irq().

> diff --git a/drivers/rtc/rtc-stmp3xxx.c b/drivers/rtc/rtc-stmp3xxx.c
> index 7afcd14aeee56..e789458ba96a6 100644
> --- a/drivers/rtc/rtc-stmp3xxx.c
> +++ b/drivers/rtc/rtc-stmp3xxx.c
> @@ -245,29 +244,25 @@ static void stmp3xxx_rtc_remove(struct platform_device *pdev)
>  static int stmp3xxx_rtc_probe(struct platform_device *pdev)
>  {
>  	struct stmp3xxx_rtc_data *rtc_data;
> -	struct resource *r;
> +	void __iomem *io;
>  	u32 rtc_stat;
>  	u32 pers0_set, pers0_clr;
>  	u32 crystalfreq = 0;
>  	int err;
>  
> +	irq_alarm = platform_get_irq(pdev, 0);

[Severity: Low]
Does this regression introduce a build failure?

The variable irq_alarm was removed from the private struct stmp3xxx_rtc_data,
but it is used here without being declared as a local int variable first.

> +	if (irq_alarm < 0)
> +		return irq_alarm;
> +
> +	io = devm_platform_ioremap_resource(pdev, 0);

[ ... ]

> @@ -354,13 +349,10 @@ static int stmp3xxx_rtc_probe(struct platform_device *pdev)
>  	if (IS_ERR(rtc_data->rtc))
>  		return PTR_ERR(rtc_data->rtc);
>  
> -	err = devm_request_irq(&pdev->dev, rtc_data->irq_alarm,
> +	err = devm_request_irq(&pdev->dev, irq_alarm,
>  			stmp3xxx_rtc_interrupt, 0, "RTC alarm", &pdev->dev);

[Severity: High]
This isn't a bug introduced by this patch, but does this devm initialization
order create a use-after-free race condition during driver unbind?

The IRQ is requested via devm_request_irq() before the RTC device is
registered via devm_rtc_register_device() further down in probe.

During driver removal, devres cleans up in reverse order: the RTC device is
unregistered first (which cancels the irqwork), and the IRQ is freed second.

If a pending hardware interrupt fires in the window between these two steps,
could stmp3xxx_rtc_interrupt() unconditionally call rtc_update_irq(), which
re-queues the irqwork on an RTC device that is about to be freed?

> -	if (err) {
> -		dev_err(&pdev->dev, "Cannot claim IRQ%d\n",
> -			rtc_data->irq_alarm);
> +	if (err)
>  		return err;
> -	}
>  
>  	rtc_data->rtc->ops = &stmp3xxx_rtc_ops;
>  	rtc_data->rtc->range_max = U32_MAX;

[Severity: High]
This is a pre-existing issue, but does the dynamically registered watchdog
device leak on driver unbind?

Looking at stmp3xxx_wdt_register() called at the end of stmp3xxx_rtc_probe(),
the watchdog child device is manually added with platform_device_add(), but
stmp3xxx_rtc_remove() doesn't appear to call platform_device_unregister()
to clean this up.

If the RTC driver is unbound via sysfs, the parent device's drvdata is
cleared and devm resources are freed. Because the child watchdog device
remains active, could a subsequent access via stmp3xxx_wdt_set_timeout()
dereference the now-NULL parent drvdata and crash the system?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260728005303.574936-1-rosenp@gmail.com?part=1

Re: [PATCHv2] rtc: stmp3xxx: use devm_platform_ioremap_resource()

[kernel test robot]

Hi Rosen,

kernel test robot noticed the following build errors:

[auto build test ERROR on abelloni/rtc-next]
[also build test ERROR on linus/master v7.2-rc7 next-20260813]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Rosen-Penev/rtc-stmp3xxx-use-devm_platform_ioremap_resource/20260814-172225
base:   https://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux.git rtc-next
patch link:    https://lore.kernel.org/r/20260728005303.574936-1-rosenp%40gmail.com
patch subject: [PATCHv2] rtc: stmp3xxx: use devm_platform_ioremap_resource()
config: alpha-allmodconfig (https://download.01.org/0day-ci/archive/20260815/202608150130.OdnZnae5-lkp@intel.com/config)
compiler: alpha-linux-gcc (GCC) 16.1.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260815/202608150130.OdnZnae5-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202608150130.OdnZnae5-lkp@intel.com/

All errors (new ones prefixed by >>):

   drivers/rtc/rtc-stmp3xxx.c: In function 'stmp3xxx_rtc_probe':
>> drivers/rtc/rtc-stmp3xxx.c:253:9: error: 'irq_alarm' undeclared (first use in this function)
     253 |         irq_alarm = platform_get_irq(pdev, 0);
         |         ^~~~~~~~~
   drivers/rtc/rtc-stmp3xxx.c:253:9: note: each undeclared identifier is reported only once for each function it appears in


vim +/irq_alarm +253 drivers/rtc/rtc-stmp3xxx.c

   243	
   244	static int stmp3xxx_rtc_probe(struct platform_device *pdev)
   245	{
   246		struct stmp3xxx_rtc_data *rtc_data;
   247		void __iomem *io;
   248		u32 rtc_stat;
   249		u32 pers0_set, pers0_clr;
   250		u32 crystalfreq = 0;
   251		int err;
   252	
 > 253		irq_alarm = platform_get_irq(pdev, 0);
   254		if (irq_alarm < 0)
   255			return irq_alarm;
   256	
   257		io = devm_platform_ioremap_resource(pdev, 0);
   258		if (IS_ERR(io))
   259			return PTR_ERR(io);
   260	
   261		rtc_data = devm_kzalloc(&pdev->dev, sizeof(*rtc_data), GFP_KERNEL);
   262		if (!rtc_data)
   263			return -ENOMEM;
   264	
   265		rtc_data->io = io;
   266	
   267		rtc_stat = readl(rtc_data->io + STMP3XXX_RTC_STAT);
   268		if (!(rtc_stat & STMP3XXX_RTC_STAT_RTC_PRESENT)) {
   269			dev_err(&pdev->dev, "no device onboard\n");
   270			return -ENODEV;
   271		}
   272	
   273		platform_set_drvdata(pdev, rtc_data);
   274	
   275		/*
   276		 * Resetting the rtc stops the watchdog timer that is potentially
   277		 * running. So (assuming it is running on purpose) don't reset if the
   278		 * watchdog is enabled.
   279		 */
   280		if (readl(rtc_data->io + STMP3XXX_RTC_CTRL) &
   281		    STMP3XXX_RTC_CTRL_WATCHDOGEN) {
   282			dev_info(&pdev->dev,
   283				 "Watchdog is running, skip resetting rtc\n");
   284		} else {
   285			err = stmp_reset_block(rtc_data->io);
   286			if (err) {
   287				dev_err(&pdev->dev, "stmp_reset_block failed: %d\n",
   288					err);
   289				return err;
   290			}
   291		}
   292	
   293		/*
   294		 * Obviously the rtc needs a clock input to be able to run.
   295		 * This clock can be provided by an external 32k crystal. If that one is
   296		 * missing XTAL must not be disabled in suspend which consumes a
   297		 * lot of power. Normally the presence and exact frequency (supported
   298		 * are 32000 Hz and 32768 Hz) is detectable from fuses, but as reality
   299		 * proves these fuses are not blown correctly on all machines, so the
   300		 * frequency can be overridden in the device tree.
   301		 */
   302		if (rtc_stat & STMP3XXX_RTC_STAT_XTAL32000_PRESENT)
   303			crystalfreq = 32000;
   304		else if (rtc_stat & STMP3XXX_RTC_STAT_XTAL32768_PRESENT)
   305			crystalfreq = 32768;
   306	
   307		of_property_read_u32(pdev->dev.of_node, "stmp,crystal-freq",
   308				     &crystalfreq);
   309	
   310		switch (crystalfreq) {
   311		case 32000:
   312			/* keep 32kHz crystal running in low-power mode */
   313			pers0_set = STMP3XXX_RTC_PERSISTENT0_XTAL32_FREQ |
   314				STMP3XXX_RTC_PERSISTENT0_XTAL32KHZ_PWRUP |
   315				STMP3XXX_RTC_PERSISTENT0_CLOCKSOURCE;
   316			pers0_clr = STMP3XXX_RTC_PERSISTENT0_XTAL24MHZ_PWRUP;
   317			break;
   318		case 32768:
   319			/* keep 32.768kHz crystal running in low-power mode */
   320			pers0_set = STMP3XXX_RTC_PERSISTENT0_XTAL32KHZ_PWRUP |
   321				STMP3XXX_RTC_PERSISTENT0_CLOCKSOURCE;
   322			pers0_clr = STMP3XXX_RTC_PERSISTENT0_XTAL24MHZ_PWRUP |
   323				STMP3XXX_RTC_PERSISTENT0_XTAL32_FREQ;
   324			break;
   325		default:
   326			dev_warn(&pdev->dev,
   327				 "invalid crystal-freq specified in device-tree. Assuming no crystal\n");
   328			fallthrough;
   329		case 0:
   330			/* keep XTAL on in low-power mode */
   331			pers0_set = STMP3XXX_RTC_PERSISTENT0_XTAL24MHZ_PWRUP;
   332			pers0_clr = STMP3XXX_RTC_PERSISTENT0_XTAL32KHZ_PWRUP |
   333				STMP3XXX_RTC_PERSISTENT0_CLOCKSOURCE;
   334		}
   335	
   336		writel(pers0_set, rtc_data->io + STMP3XXX_RTC_PERSISTENT0 +
   337				STMP_OFFSET_REG_SET);
   338	
   339		writel(STMP3XXX_RTC_PERSISTENT0_ALARM_EN |
   340				STMP3XXX_RTC_PERSISTENT0_ALARM_WAKE_EN |
   341				STMP3XXX_RTC_PERSISTENT0_ALARM_WAKE | pers0_clr,
   342			rtc_data->io + STMP3XXX_RTC_PERSISTENT0 + STMP_OFFSET_REG_CLR);
   343	
   344		writel(STMP3XXX_RTC_CTRL_ONEMSEC_IRQ_EN |
   345				STMP3XXX_RTC_CTRL_ALARM_IRQ_EN,
   346			rtc_data->io + STMP3XXX_RTC_CTRL + STMP_OFFSET_REG_CLR);
   347	
   348		rtc_data->rtc = devm_rtc_allocate_device(&pdev->dev);
   349		if (IS_ERR(rtc_data->rtc))
   350			return PTR_ERR(rtc_data->rtc);
   351	
   352		err = devm_request_irq(&pdev->dev, irq_alarm,
   353				stmp3xxx_rtc_interrupt, 0, "RTC alarm", &pdev->dev);
   354		if (err)
   355			return err;
   356	
   357		rtc_data->rtc->ops = &stmp3xxx_rtc_ops;
   358		rtc_data->rtc->range_max = U32_MAX;
   359	
   360		err = devm_rtc_register_device(rtc_data->rtc);
   361		if (err)
   362			return err;
   363	
   364		stmp3xxx_wdt_register(pdev);
   365		return 0;
   366	}
   367	

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki