* [PATCH v3 0/2] wcd934x fixes
@ 2026-09-03 15:21 ` David Heidelberg
0 siblings, 0 replies; 10+ messages in thread
From: David Heidelberg @ 2026-09-03 15:21 UTC (permalink / raw)
To: Lee Jones, Thomas Tai, Konrad Rzeszutek Wilk, Krzysztof Kozlowski
Cc: mfd, linux-kernel, phone-devel, David Heidelberg, stable, Sashiko
$subj
Signed-off-by: David Heidelberg <david@ixit.cz>
---
Changes in v3:
- Capitalize commit names. (Sashiko)
- Add commit addressing the NULL deref when of_irq_get fails. (Sashiko)
- Link to v2: https://patch.msgid.link/20260903-wcd-dma-v2-1-189cff560a28@ixit.cz
Changes in v2:
- Use dma_coerce_mask_and_coherent. (Lee)
- Link to v1: https://patch.msgid.link/20260823-wcd-dma-v1-1-95e44a315ccf@ixit.cz
---
David Heidelberg (2):
mfd: wcd934x: Fix NULL pointer dereference on IRQ probe deferral
mfd: wcd934x: Set DMA mask on parent to silence "DMA mask not set"
drivers/mfd/wcd934x.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
---
base-commit: 7079a12d7506b07fb53b54a664bfad5fa9b16d70
change-id: 20260823-wcd-dma-bd621ee39887
Best regards,
--
David Heidelberg <david@ixit.cz>
^ permalink raw reply [flat|nested] 10+ messages in thread* [PATCH v3 1/2] mfd: wcd934x: Fix NULL pointer dereference on IRQ probe deferral
2026-09-03 15:21 ` David Heidelberg
@ 2026-09-03 15:21 ` David Heidelberg
-1 siblings, 0 replies; 10+ messages in thread
From: David Heidelberg via B4 Relay @ 2026-09-03 15:21 UTC (permalink / raw)
To: Lee Jones, Thomas Tai, Konrad Rzeszutek Wilk, Krzysztof Kozlowski
Cc: mfd, linux-kernel, phone-devel, David Heidelberg, stable, Sashiko
From: David Heidelberg <david@ixit.cz>
ddata->dev is only assigned at the end of wcd934x_slim_probe(), but the
of_irq_get() error path has passed it to the error print since the
driver was added, while it is still NULL.
This used to be harmless with dev_err(), which copes with a NULL device
and was skipped on -EPROBE_DEFER. Since the switch to dev_err_probe(), a
deferred IRQ reaches device_set_deferred_probe_reason() ->
dev_driver_string(), which dereferences the NULL pointer and crashes
during probe. Use dev, which is already valid at this point.
Cc: stable@vger.kernel.org
Fixes: 0f1b1b899521 ("mfd: wcd934x: Simplify with dev_err_probe()")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://lore.kernel.org/mfd/20260903145651.AC1311F00ACA@smtp.kernel.org/
Signed-off-by: David Heidelberg <david@ixit.cz>
---
drivers/mfd/wcd934x.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/mfd/wcd934x.c b/drivers/mfd/wcd934x.c
index 3c3080e8c8cf7..3a939e7ad3da5 100644
--- a/drivers/mfd/wcd934x.c
+++ b/drivers/mfd/wcd934x.c
@@ -218,17 +218,17 @@ static int wcd934x_slim_probe(struct slim_device *sdev)
int ret;
ddata = devm_kzalloc(dev, sizeof(*ddata), GFP_KERNEL);
if (!ddata)
return -ENOMEM;
ddata->irq = of_irq_get(np, 0);
if (ddata->irq < 0)
- return dev_err_probe(ddata->dev, ddata->irq,
+ return dev_err_probe(dev, ddata->irq,
"Failed to get IRQ\n");
ddata->extclk = devm_clk_get(dev, "extclk");
if (IS_ERR(ddata->extclk))
return dev_err_probe(dev, PTR_ERR(ddata->extclk),
"Failed to get extclk");
ddata->supplies[0].supply = "vdd-buck";
--
2.55.0
^ permalink raw reply related [flat|nested] 10+ messages in thread* [PATCH v3 1/2] mfd: wcd934x: Fix NULL pointer dereference on IRQ probe deferral
@ 2026-09-03 15:21 ` David Heidelberg
0 siblings, 0 replies; 10+ messages in thread
From: David Heidelberg @ 2026-09-03 15:21 UTC (permalink / raw)
To: Lee Jones, Thomas Tai, Konrad Rzeszutek Wilk, Krzysztof Kozlowski
Cc: mfd, linux-kernel, phone-devel, David Heidelberg, stable, Sashiko
ddata->dev is only assigned at the end of wcd934x_slim_probe(), but the
of_irq_get() error path has passed it to the error print since the
driver was added, while it is still NULL.
This used to be harmless with dev_err(), which copes with a NULL device
and was skipped on -EPROBE_DEFER. Since the switch to dev_err_probe(), a
deferred IRQ reaches device_set_deferred_probe_reason() ->
dev_driver_string(), which dereferences the NULL pointer and crashes
during probe. Use dev, which is already valid at this point.
Cc: stable@vger.kernel.org
Fixes: 0f1b1b899521 ("mfd: wcd934x: Simplify with dev_err_probe()")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://lore.kernel.org/mfd/20260903145651.AC1311F00ACA@smtp.kernel.org/
Signed-off-by: David Heidelberg <david@ixit.cz>
---
drivers/mfd/wcd934x.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/mfd/wcd934x.c b/drivers/mfd/wcd934x.c
index 3c3080e8c8cf7..3a939e7ad3da5 100644
--- a/drivers/mfd/wcd934x.c
+++ b/drivers/mfd/wcd934x.c
@@ -218,17 +218,17 @@ static int wcd934x_slim_probe(struct slim_device *sdev)
int ret;
ddata = devm_kzalloc(dev, sizeof(*ddata), GFP_KERNEL);
if (!ddata)
return -ENOMEM;
ddata->irq = of_irq_get(np, 0);
if (ddata->irq < 0)
- return dev_err_probe(ddata->dev, ddata->irq,
+ return dev_err_probe(dev, ddata->irq,
"Failed to get IRQ\n");
ddata->extclk = devm_clk_get(dev, "extclk");
if (IS_ERR(ddata->extclk))
return dev_err_probe(dev, PTR_ERR(ddata->extclk),
"Failed to get extclk");
ddata->supplies[0].supply = "vdd-buck";
--
2.55.0
^ permalink raw reply related [flat|nested] 10+ messages in thread* Re: (subset) [PATCH v3 1/2] mfd: wcd934x: Fix NULL pointer dereference on IRQ probe deferral
2026-09-03 15:21 ` David Heidelberg
(?)
@ 2026-09-16 13:53 ` Lee Jones
2026-09-16 14:04 ` Lee Jones
-1 siblings, 1 reply; 10+ messages in thread
From: Lee Jones @ 2026-09-16 13:53 UTC (permalink / raw)
To: Lee Jones, Thomas Tai, Konrad Rzeszutek Wilk, Krzysztof Kozlowski,
David Heidelberg
Cc: mfd, linux-kernel, phone-devel, stable, Sashiko
On Thu, 03 Sep 2026 17:21:42 +0200, David Heidelberg wrote:
> ddata->dev is only assigned at the end of wcd934x_slim_probe(), but the
> of_irq_get() error path has passed it to the error print since the
> driver was added, while it is still NULL.
>
> This used to be harmless with dev_err(), which copes with a NULL device
> and was skipped on -EPROBE_DEFER. Since the switch to dev_err_probe(), a
> deferred IRQ reaches device_set_deferred_probe_reason() ->
> dev_driver_string(), which dereferences the NULL pointer and crashes
> during probe. Use dev, which is already valid at this point.
>
> [...]
Applied, thanks!
[1/2] mfd: wcd934x: Fix NULL pointer dereference on IRQ probe deferral
commit: 1389a4a5877403e57573d6bc01c5b7790a4472ce
--
Lee Jones [李琼斯]
^ permalink raw reply [flat|nested] 10+ messages in thread* Re: (subset) [PATCH v3 1/2] mfd: wcd934x: Fix NULL pointer dereference on IRQ probe deferral
2026-09-16 13:53 ` (subset) " Lee Jones
@ 2026-09-16 14:04 ` Lee Jones
0 siblings, 0 replies; 10+ messages in thread
From: Lee Jones @ 2026-09-16 14:04 UTC (permalink / raw)
To: Thomas Tai, Konrad Rzeszutek Wilk, Krzysztof Kozlowski,
David Heidelberg
Cc: mfd, linux-kernel, phone-devel, stable, Sashiko
On Wed, 16 Sep 2026, Lee Jones wrote:
> On Thu, 03 Sep 2026 17:21:42 +0200, David Heidelberg wrote:
> > ddata->dev is only assigned at the end of wcd934x_slim_probe(), but the
> > of_irq_get() error path has passed it to the error print since the
> > driver was added, while it is still NULL.
> >
> > This used to be harmless with dev_err(), which copes with a NULL device
> > and was skipped on -EPROBE_DEFER. Since the switch to dev_err_probe(), a
> > deferred IRQ reaches device_set_deferred_probe_reason() ->
> > dev_driver_string(), which dereferences the NULL pointer and crashes
> > during probe. Use dev, which is already valid at this point.
> >
> > [...]
>
> Applied, thanks!
>
> [1/2] mfd: wcd934x: Fix NULL pointer dereference on IRQ probe deferral
> commit: 1389a4a5877403e57573d6bc01c5b7790a4472ce
Didn't apply initially, but I reworked it.
--
Lee Jones
^ permalink raw reply [flat|nested] 10+ messages in thread
* [PATCH v3 2/2] mfd: wcd934x: Set DMA mask on parent to silence "DMA mask not set"
2026-09-03 15:21 ` David Heidelberg
@ 2026-09-03 15:21 ` David Heidelberg
-1 siblings, 0 replies; 10+ messages in thread
From: David Heidelberg via B4 Relay @ 2026-09-03 15:21 UTC (permalink / raw)
To: Lee Jones, Thomas Tai, Konrad Rzeszutek Wilk, Krzysztof Kozlowski
Cc: mfd, linux-kernel, phone-devel, David Heidelberg, stable
From: David Heidelberg <david@ixit.cz>
The wcd934x MFD parent (a slim_device) never initializes its
dma_mask/coherent_dma_mask. When the DT-aware children pass through
of_dma_configure() this triggers the "DMA mask not set" warning for
each child.
Cc: stable@vger.kernel.org
Fixes: f959dcd6ddfd ("dma-direct: Fix potential NULL pointer dereference")
Assisted-by: tencent:hy3
Signed-off-by: David Heidelberg <david@ixit.cz>
---
drivers/mfd/wcd934x.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/mfd/wcd934x.c b/drivers/mfd/wcd934x.c
index 3a939e7ad3da5..fc17c39791301 100644
--- a/drivers/mfd/wcd934x.c
+++ b/drivers/mfd/wcd934x.c
@@ -1,12 +1,13 @@
// SPDX-License-Identifier: GPL-2.0
// Copyright (c) 2019, Linaro Limited
#include <linux/clk.h>
+#include <linux/dma-mapping.h>
#include <linux/gpio/consumer.h>
#include <linux/interrupt.h>
#include <linux/kernel.h>
#include <linux/mfd/core.h>
#include <linux/mfd/wcd934x/registers.h>
#include <linux/mfd/wcd934x/wcd934x.h>
#include <linux/module.h>
#include <linux/of.h>
@@ -212,16 +213,21 @@ static int wcd934x_slim_status(struct slim_device *sdev,
static int wcd934x_slim_probe(struct slim_device *sdev)
{
struct device *dev = &sdev->dev;
struct device_node *np = dev->of_node;
struct wcd934x_ddata *ddata;
struct gpio_desc *reset_gpio;
int ret;
+ ret = dma_coerce_mask_and_coherent(dev, DMA_BIT_MASK(32));
+ if (ret)
+ return dev_err_probe(dev, ret,
+ "Failed to set dma mask\n");
+
ddata = devm_kzalloc(dev, sizeof(*ddata), GFP_KERNEL);
if (!ddata)
return -ENOMEM;
ddata->irq = of_irq_get(np, 0);
if (ddata->irq < 0)
return dev_err_probe(dev, ddata->irq,
"Failed to get IRQ\n");
--
2.55.0
^ permalink raw reply related [flat|nested] 10+ messages in thread* [PATCH v3 2/2] mfd: wcd934x: Set DMA mask on parent to silence "DMA mask not set"
@ 2026-09-03 15:21 ` David Heidelberg
0 siblings, 0 replies; 10+ messages in thread
From: David Heidelberg @ 2026-09-03 15:21 UTC (permalink / raw)
To: Lee Jones, Thomas Tai, Konrad Rzeszutek Wilk, Krzysztof Kozlowski
Cc: mfd, linux-kernel, phone-devel, David Heidelberg, stable
The wcd934x MFD parent (a slim_device) never initializes its
dma_mask/coherent_dma_mask. When the DT-aware children pass through
of_dma_configure() this triggers the "DMA mask not set" warning for
each child.
Cc: stable@vger.kernel.org
Fixes: f959dcd6ddfd ("dma-direct: Fix potential NULL pointer dereference")
Assisted-by: tencent:hy3
Signed-off-by: David Heidelberg <david@ixit.cz>
---
drivers/mfd/wcd934x.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/mfd/wcd934x.c b/drivers/mfd/wcd934x.c
index 3a939e7ad3da5..fc17c39791301 100644
--- a/drivers/mfd/wcd934x.c
+++ b/drivers/mfd/wcd934x.c
@@ -1,12 +1,13 @@
// SPDX-License-Identifier: GPL-2.0
// Copyright (c) 2019, Linaro Limited
#include <linux/clk.h>
+#include <linux/dma-mapping.h>
#include <linux/gpio/consumer.h>
#include <linux/interrupt.h>
#include <linux/kernel.h>
#include <linux/mfd/core.h>
#include <linux/mfd/wcd934x/registers.h>
#include <linux/mfd/wcd934x/wcd934x.h>
#include <linux/module.h>
#include <linux/of.h>
@@ -212,16 +213,21 @@ static int wcd934x_slim_status(struct slim_device *sdev,
static int wcd934x_slim_probe(struct slim_device *sdev)
{
struct device *dev = &sdev->dev;
struct device_node *np = dev->of_node;
struct wcd934x_ddata *ddata;
struct gpio_desc *reset_gpio;
int ret;
+ ret = dma_coerce_mask_and_coherent(dev, DMA_BIT_MASK(32));
+ if (ret)
+ return dev_err_probe(dev, ret,
+ "Failed to set dma mask\n");
+
ddata = devm_kzalloc(dev, sizeof(*ddata), GFP_KERNEL);
if (!ddata)
return -ENOMEM;
ddata->irq = of_irq_get(np, 0);
if (ddata->irq < 0)
return dev_err_probe(dev, ddata->irq,
"Failed to get IRQ\n");
--
2.55.0
^ permalink raw reply related [flat|nested] 10+ messages in thread* Re: [PATCH v3 2/2] mfd: wcd934x: Set DMA mask on parent to silence "DMA mask not set"
2026-09-03 15:21 ` David Heidelberg
(?)
@ 2026-09-16 13:49 ` Lee Jones
-1 siblings, 0 replies; 10+ messages in thread
From: Lee Jones @ 2026-09-16 13:49 UTC (permalink / raw)
To: david
Cc: Thomas Tai, Konrad Rzeszutek Wilk, Krzysztof Kozlowski, mfd,
linux-kernel, phone-devel, stable
On Thu, 03 Sep 2026, David Heidelberg via B4 Relay wrote:
> From: David Heidelberg <david@ixit.cz>
>
> The wcd934x MFD parent (a slim_device) never initializes its
> dma_mask/coherent_dma_mask. When the DT-aware children pass through
> of_dma_configure() this triggers the "DMA mask not set" warning for
> each child.
>
> Cc: stable@vger.kernel.org
> Fixes: f959dcd6ddfd ("dma-direct: Fix potential NULL pointer dereference")
> Assisted-by: tencent:hy3
> Signed-off-by: David Heidelberg <david@ixit.cz>
Already applied.
> ---
> drivers/mfd/wcd934x.c | 6 ++++++
> 1 file changed, 6 insertions(+)
>
> diff --git a/drivers/mfd/wcd934x.c b/drivers/mfd/wcd934x.c
> index 3a939e7ad3da5..fc17c39791301 100644
> --- a/drivers/mfd/wcd934x.c
> +++ b/drivers/mfd/wcd934x.c
> @@ -1,12 +1,13 @@
> // SPDX-License-Identifier: GPL-2.0
> // Copyright (c) 2019, Linaro Limited
>
> #include <linux/clk.h>
> +#include <linux/dma-mapping.h>
> #include <linux/gpio/consumer.h>
> #include <linux/interrupt.h>
> #include <linux/kernel.h>
> #include <linux/mfd/core.h>
> #include <linux/mfd/wcd934x/registers.h>
> #include <linux/mfd/wcd934x/wcd934x.h>
> #include <linux/module.h>
> #include <linux/of.h>
> @@ -212,16 +213,21 @@ static int wcd934x_slim_status(struct slim_device *sdev,
> static int wcd934x_slim_probe(struct slim_device *sdev)
> {
> struct device *dev = &sdev->dev;
> struct device_node *np = dev->of_node;
> struct wcd934x_ddata *ddata;
> struct gpio_desc *reset_gpio;
> int ret;
>
> + ret = dma_coerce_mask_and_coherent(dev, DMA_BIT_MASK(32));
> + if (ret)
> + return dev_err_probe(dev, ret,
> + "Failed to set dma mask\n");
> +
> ddata = devm_kzalloc(dev, sizeof(*ddata), GFP_KERNEL);
> if (!ddata)
> return -ENOMEM;
>
> ddata->irq = of_irq_get(np, 0);
> if (ddata->irq < 0)
> return dev_err_probe(dev, ddata->irq,
> "Failed to get IRQ\n");
>
> --
> 2.55.0
>
>
--
Lee Jones
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH v3 0/2] wcd934x fixes
2026-09-03 15:21 ` David Heidelberg
` (2 preceding siblings ...)
(?)
@ 2026-09-16 13:53 ` Lee Jones
-1 siblings, 0 replies; 10+ messages in thread
From: Lee Jones @ 2026-09-16 13:53 UTC (permalink / raw)
To: Lee Jones, Thomas Tai, Konrad Rzeszutek Wilk, Krzysztof Kozlowski,
David Heidelberg
Cc: mfd, linux-kernel, phone-devel, stable, Sashiko
On Thu, 03 Sep 2026 17:21:41 +0200, David Heidelberg wrote:
> $subj
Applied, thanks!
[1/2] mfd: wcd934x: Fix NULL pointer dereference on IRQ probe deferral
commit: 1389a4a5877403e57573d6bc01c5b7790a4472ce
[2/2] mfd: wcd934x: Set DMA mask on parent to silence "DMA mask not set"
(no commit info)
--
Lee Jones [李琼斯]
^ permalink raw reply [flat|nested] 10+ messages in thread