[PATCH 07/28] mfd: db8500-prcmu: Make AB8500 cell and IRQ resource static

[PATCH 07/28] mfd: db8500-prcmu: Make AB8500 cell and IRQ resource static

[Lee Jones]

db8500_prcmu_register_ab8500() declares struct resource ab850x_resource
and the mfd_cell descriptors on the stack and assigns &ab850x_resource
to ab850x_cell->resources.  Although mfd_add_device() deep-copies the
resource table via platform_device_add_resources() before
db8500_prcmu_register_ab8500() returns, the shallow MFD cell copy
attached to the child platform device retains a stale pointer to the
expired stack frame.

Mark ab850x_resource as static and the ab8500_cell and ab8505_cell
descriptors as static const so the resource pointer remains valid for
the lifetime of the device.

Closes: https://sashiko.dev/#/bug/linux-554f3a1f-ca41-4078-ae9e-66d0d7fb4c9d
Signed-off-by: Lee Jones <lee@kernel.org>
---
 drivers/mfd/db8500-prcmu.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/mfd/db8500-prcmu.c b/drivers/mfd/db8500-prcmu.c
index 6672c55f2ebc..cdfcbeb2a88c 100644
--- a/drivers/mfd/db8500-prcmu.c
+++ b/drivers/mfd/db8500-prcmu.c
@@ -2953,16 +2953,15 @@ static const struct mfd_cell db8500_prcmu_devs[] = {
 
 static int db8500_prcmu_register_ab8500(struct device *parent)
 {
-	struct device_node *np;
-	struct resource ab850x_resource;
-	const struct mfd_cell ab8500_cell = {
+	static struct resource ab850x_resource;
+	static const struct mfd_cell ab8500_cell = {
 		.name = "ab8500-core",
 		.of_compatible = "stericsson,ab8500",
 		.id = AB8500_VERSION_AB8500,
 		.resources = &ab850x_resource,
 		.num_resources = 1,
 	};
-	const struct mfd_cell ab8505_cell = {
+	static const struct mfd_cell ab8505_cell = {
 		.name = "ab8505-core",
 		.of_compatible = "stericsson,ab8505",
 		.id = AB8500_VERSION_AB8505,
@@ -2970,6 +2969,7 @@ static int db8500_prcmu_register_ab8500(struct device *parent)
 		.num_resources = 1,
 	};
 	const struct mfd_cell *ab850x_cell;
+	struct device_node *np;
 
 	if (!parent->of_node)
 		return -ENODEV;
-- 
2.56.0.218.g1ec904b173-goog

Re: [PATCH 07/28] mfd: db8500-prcmu: Make AB8500 cell and IRQ resource static

[Linus Walleij]

On Wed, Oct 21, 2026 at 2:14 PM Lee Jones <lee@kernel.org> wrote:

> db8500_prcmu_register_ab8500() declares struct resource ab850x_resource
> and the mfd_cell descriptors on the stack and assigns &ab850x_resource
> to ab850x_cell->resources.  Although mfd_add_device() deep-copies the
> resource table via platform_device_add_resources() before
> db8500_prcmu_register_ab8500() returns, the shallow MFD cell copy
> attached to the child platform device retains a stale pointer to the
> expired stack frame.
>
> Mark ab850x_resource as static and the ab8500_cell and ab8505_cell
> descriptors as static const so the resource pointer remains valid for
> the lifetime of the device.
>
> Closes: https://sashiko.dev/#/bug/linux-554f3a1f-ca41-4078-ae9e-66d0d7fb4c9d
> Signed-off-by: Lee Jones <lee@kernel.org>

Reviewed-by: Linus Walleij <linusw@kernel.org>

Yours,
Linus Walleij

[PATCH 13/28] mfd: twl-core: Clear pm_power_off callback in twl_remove()

[Lee Jones]

When a TWL6030-class device is configured as the system power
controller, twl_probe() registers twl6030_power_off() as the global
pm_power_off callback.  However, twl_remove() does not clear
pm_power_off when tearing down the device on late probe failure or
driver unbind, leaving a dangling callback that dereferences the freed
twl_priv context during system shutdown.

Reset pm_power_off to NULL in twl_remove() when it points to
twl6030_power_off().

Fixes: ca9414a1d087 ("mfd: twl-core: Add power off implementation for twl603x")
Closes: https://sashiko.dev/#/bug/linux-f5847f26-c868-416a-b926-3fc3da57802d
Cc: stable@vger.kernel.org
Signed-off-by: Lee Jones <lee@kernel.org>
---
 drivers/mfd/twl-core.c | 29 ++++++++++++++++-------------
 1 file changed, 16 insertions(+), 13 deletions(-)

diff --git a/drivers/mfd/twl-core.c b/drivers/mfd/twl-core.c
index c024a28b057e..64b45fe79159 100644
--- a/drivers/mfd/twl-core.c
+++ b/drivers/mfd/twl-core.c
@@ -672,10 +672,26 @@ static void clocks_init(struct device *dev)
 /*----------------------------------------------------------------------*/
 
 
+static void twl6030_power_off(void)
+{
+	int err;
+	u8 val;
+
+	err = twl_i2c_read_u8(TWL_MODULE_PM_MASTER, &val, TWL6030_PHOENIX_DEV_ON);
+	if (err)
+		return;
+
+	val |= TWL6030_APP_DEVOFF | TWL6030_CON_DEVOFF | TWL6030_MOD_DEVOFF;
+	twl_i2c_write_u8(TWL_MODULE_PM_MASTER, val, TWL6030_PHOENIX_DEV_ON);
+}
+
 static void twl_remove(struct i2c_client *client)
 {
 	unsigned i, num_slaves;
 
+	if (pm_power_off == twl6030_power_off)
+		pm_power_off = NULL;
+
 	if (twl_class_is_4030())
 		twl4030_exit_irq();
 	else
@@ -692,19 +708,6 @@ static void twl_remove(struct i2c_client *client)
 	twl_priv->ready = false;
 }
 
-static void twl6030_power_off(void)
-{
-	int err;
-	u8 val;
-
-	err = twl_i2c_read_u8(TWL_MODULE_PM_MASTER, &val, TWL6030_PHOENIX_DEV_ON);
-	if (err)
-		return;
-
-	val |= TWL6030_APP_DEVOFF | TWL6030_CON_DEVOFF | TWL6030_MOD_DEVOFF;
-	twl_i2c_write_u8(TWL_MODULE_PM_MASTER, val, TWL6030_PHOENIX_DEV_ON);
-}
-
 
 static struct of_dev_auxdata twl_auxdata_lookup[] = {
 	OF_DEV_AUXDATA("ti,twl4030-gpio", 0, "twl4030-gpio", NULL),
-- 
2.56.0.218.g1ec904b173-goog

[PATCH 14/28] mfd: twl-core: Clear twl_priv pointer on teardown and probe failure

[Lee Jones]

twl_probe() allocates the file-scope twl_priv state with devm_kzalloc()
and checks for a non-NULL twl_priv at entry to reject multiple device
instances.  However, twl_remove() and the early error paths in
twl_probe() never reset twl_priv to NULL, a failure when adding MFD
child devices bypasses twl_remove() by jumping to free instead of fail,
and twl_remove() tears down the IRQ domain and dummy I2C clients before
child devices are unregistered.  After devres frees the underlying
memory on probe failure or unbind, twl_priv remains a dangling pointer,
causing subsequent exported API calls to dereference freed memory and
blocking future probe attempts with -EBUSY.

Unregister DT-populated and MFD child devices at the start of
twl_remove(), ensure mfd_add_devices() failures unwind via fail, and
reset twl_priv to NULL in twl_remove() and on probe error exit.

Fixes: 80a97ccd33be ("mfd: twl-core: Collect global variables behind one private structure (global)")
Closes: https://sashiko.dev/#/bug/linux-73e82f84-94de-4d08-82a4-f22d42a1dedf
Cc: stable@vger.kernel.org
Signed-off-by: Lee Jones <lee@kernel.org>
---
 drivers/mfd/twl-core.c | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/drivers/mfd/twl-core.c b/drivers/mfd/twl-core.c
index 64b45fe79159..21fc0acb827b 100644
--- a/drivers/mfd/twl-core.c
+++ b/drivers/mfd/twl-core.c
@@ -689,6 +689,11 @@ static void twl_remove(struct i2c_client *client)
 {
 	unsigned i, num_slaves;
 
+	of_platform_depopulate(&client->dev);
+
+	if (twl_class_is_6030())
+		mfd_remove_devices(&client->dev);
+
 	if (pm_power_off == twl6030_power_off)
 		pm_power_off = NULL;
 
@@ -706,6 +711,7 @@ static void twl_remove(struct i2c_client *client)
 		twl->client = NULL;
 	}
 	twl_priv->ready = false;
+	twl_priv = NULL;
 }
 
 
@@ -880,10 +886,10 @@ twl_probe(struct i2c_client *client)
 			num_cells = ARRAY_SIZE(twl6030_cells);
 		}
 
-		status = devm_mfd_add_devices(&client->dev, PLATFORM_DEVID_NONE,
-					      cells, num_cells, NULL, 0, NULL);
+		status = mfd_add_devices(&client->dev, PLATFORM_DEVID_NONE,
+					 cells, num_cells, NULL, 0, NULL);
 		if (status < 0)
-			goto free;
+			goto fail;
 
 		if (of_device_is_system_power_controller(node)) {
 			if (!pm_power_off)
@@ -900,8 +906,10 @@ twl_probe(struct i2c_client *client)
 	if (status < 0)
 		twl_remove(client);
 free:
-	if (status < 0)
+	if (status < 0) {
 		platform_device_unregister(pdev);
+		twl_priv = NULL;
+	}
 
 	return status;
 }
-- 
2.56.0.218.g1ec904b173-goog

[PATCH 15/28] mfd: loongson-se: Check return value of dma_set_mask_and_coherent()

[Lee Jones]

loongson_se_probe() ignores the return value of
dma_set_mask_and_coherent() when requesting a 64-bit DMA mask before
allocating coherent DMA memory.  Check the return value and abort probe
if the platform cannot satisfy the 64-bit DMA mask requirement.

Fixes: e551fa3159e3 ("mfd: Add support for Loongson Security Engine chip controller")
Closes: https://sashiko.dev/#/bug/linux-6685ee0c-b7ed-4f21-8800-cc705cec449b
Cc: stable@vger.kernel.org
Signed-off-by: Lee Jones <lee@kernel.org>
---
 drivers/mfd/loongson-se.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/mfd/loongson-se.c b/drivers/mfd/loongson-se.c
index 3902ba377d69..8dcb90a067b3 100644
--- a/drivers/mfd/loongson-se.c
+++ b/drivers/mfd/loongson-se.c
@@ -199,7 +199,10 @@ static int loongson_se_probe(struct platform_device *pdev)
 	spin_lock_init(&se->dev_lock);
 	mutex_init(&se->engine_init_lock);
 
-	dma_set_mask_and_coherent(dev, DMA_BIT_MASK(64));
+	err = dma_set_mask_and_coherent(dev, DMA_BIT_MASK(64));
+	if (err)
+		return err;
+
 	if (device_property_read_u32(dev, "dmam_size", &se->dmam_size))
 		return -ENODEV;
 
-- 
2.56.0.218.g1ec904b173-goog

Re: [PATCH 15/28] mfd: loongson-se: Check return value of dma_set_mask_and_coherent()

[Qunqin Zhao]

在 2026/10/21 20:09, Lee Jones 写道:
> loongson_se_probe() ignores the return value of
> dma_set_mask_and_coherent() when requesting a 64-bit DMA mask before
> allocating coherent DMA memory.  Check the return value and abort probe
> if the platform cannot satisfy the 64-bit DMA mask requirement.
>
> Fixes: e551fa3159e3 ("mfd: Add support for Loongson Security Engine chip controller")
> Closes: https://sashiko.dev/#/bug/linux-6685ee0c-b7ed-4f21-8800-cc705cec449b
> Cc: stable@vger.kernel.org
> Signed-off-by: Lee Jones <lee@kernel.org>

Reviewed-by: Qunqin Zhao <zhaoqunqin@loongson.cn>

Thanks for fixing this!


Best Regards,

Qunqin.

[PATCH 16/28] mfd: loongson-se: Zero-initialise controller command structures

[Lee Jones]

loongson_se_init() and loongson_se_init_engine() declare struct
loongson_se_controller_cmd on the stack without zero-initialising it
and only populate a subset of its fields before
loongson_se_send_controller_cmd() writes all eight 32-bit words to the
controller MMIO registers.  Zero-initialise the stack command structures
so that unused words do not leak residual kernel stack contents to the
hardware.

Fixes: e551fa3159e3 ("mfd: Add support for Loongson Security Engine chip controller")
Closes: https://sashiko.dev/#/bug/linux-b81dca3d-6812-43b6-9ad9-912727674154
Cc: stable@vger.kernel.org
Signed-off-by: Lee Jones <lee@kernel.org>
---
 drivers/mfd/loongson-se.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/mfd/loongson-se.c b/drivers/mfd/loongson-se.c
index 8dcb90a067b3..485ee4a6ca5e 100644
--- a/drivers/mfd/loongson-se.c
+++ b/drivers/mfd/loongson-se.c
@@ -93,7 +93,7 @@ struct loongson_se_engine *loongson_se_init_engine(struct device *dev, int id)
 {
 	struct loongson_se *se = dev_get_drvdata(dev);
 	struct loongson_se_engine *engine = &se->engines[id];
-	struct loongson_se_controller_cmd cmd;
+	struct loongson_se_controller_cmd cmd = {};
 
 	engine->se = se;
 	engine->id = id;
@@ -162,7 +162,7 @@ static irqreturn_t se_irq_handler(int irq, void *dev_id)
 
 static int loongson_se_init(struct loongson_se *se, dma_addr_t addr, int size)
 {
-	struct loongson_se_controller_cmd cmd;
+	struct loongson_se_controller_cmd cmd = {};
 	int err;
 
 	cmd.command_id = SE_CMD_START;
-- 
2.56.0.218.g1ec904b173-goog

Re: [PATCH 16/28] mfd: loongson-se: Zero-initialise controller command structures

[Qunqin Zhao]

在 2026/10/21 20:09, Lee Jones 写道:
> loongson_se_init() and loongson_se_init_engine() declare struct
> loongson_se_controller_cmd on the stack without zero-initialising it
> and only populate a subset of its fields before
> loongson_se_send_controller_cmd() writes all eight 32-bit words to the
> controller MMIO registers.  Zero-initialise the stack command structures
> so that unused words do not leak residual kernel stack contents to the
> hardware.
>
> Fixes: e551fa3159e3 ("mfd: Add support for Loongson Security Engine chip controller")
> Closes: https://sashiko.dev/#/bug/linux-b81dca3d-6812-43b6-9ad9-912727674154
> Cc: stable@vger.kernel.org
> Signed-off-by: Lee Jones <lee@kernel.org>

Reviewed-by: Qunqin Zhao <zhaoqunqin@loongson.cn>

Thanks for fixing this!


Best Regards,

Qunqin.

[PATCH 17/28] mfd: loongson-se: Reinitialise completions and wait uninterruptibly for commands

[Lee Jones]

loongson_se_send_controller_cmd() and loongson_se_send_engine_cmd() wait
on se->cmd_completion and engine->completion using
wait_for_completion_interruptible() without reinitialising the
completion before issuing a new command.  Because the hardware has no
mechanism to abort an in-flight command once accepted by
loongson_se_poll(), returning early on a signal leaves the controller or
engine actively processing the shared command registers and DMA buffers
in the background, and its subsequent completion interrupt leaves a
stale completion token that causes the next command to return
prematurely.

Clear any stale pending interrupt status and reinitialise the target
completion inside loongson_se_poll() while holding se->dev_lock
immediately before notifying the controller, and wait uninterruptibly
via wait_for_completion() once loongson_se_poll() confirms the command
has been accepted by the hardware.

Fixes: e551fa3159e3 ("mfd: Add support for Loongson Security Engine chip controller")
Closes: https://sashiko.dev/#/bug/linux-4661fb0d-d936-4168-89cd-2f6dec31a7b5
Cc: stable@vger.kernel.org
Signed-off-by: Lee Jones <lee@kernel.org>
---
 drivers/mfd/loongson-se.c | 19 ++++++++++++++-----
 1 file changed, 14 insertions(+), 5 deletions(-)

diff --git a/drivers/mfd/loongson-se.c b/drivers/mfd/loongson-se.c
index 485ee4a6ca5e..9b531e62fb85 100644
--- a/drivers/mfd/loongson-se.c
+++ b/drivers/mfd/loongson-se.c
@@ -37,13 +37,17 @@ struct loongson_se_controller_cmd {
 	u32 info[7];
 };
 
-static int loongson_se_poll(struct loongson_se *se, u32 int_bit)
+static int loongson_se_poll(struct loongson_se *se, u32 int_bit,
+			    struct completion *completion)
 {
 	u32 status;
 	int err;
 
 	spin_lock_irq(&se->dev_lock);
 
+	writel(int_bit, se->base + SE_S2LINT_CL);
+	reinit_completion(completion);
+
 	/* Notify the controller that the engine needs to be started */
 	writel(int_bit, se->base + SE_L2SINT_SET);
 
@@ -66,11 +70,13 @@ static int loongson_se_send_controller_cmd(struct loongson_se *se,
 	for (i = 0; i < SE_SEND_CMD_REG_LEN; i++)
 		writel(send_cmd[i], se->base + SE_SEND_CMD_REG + i * 4);
 
-	err = loongson_se_poll(se, SE_INT_CONTROLLER);
+	err = loongson_se_poll(se, SE_INT_CONTROLLER, &se->cmd_completion);
 	if (err)
 		return err;
 
-	return wait_for_completion_interruptible(&se->cmd_completion);
+	wait_for_completion(&se->cmd_completion);
+
+	return 0;
 }
 
 int loongson_se_send_engine_cmd(struct loongson_se_engine *engine)
@@ -80,12 +86,15 @@ int loongson_se_send_engine_cmd(struct loongson_se_engine *engine)
 	 * where to obtain engine commands from. Now all we need to
 	 * do is notify the controller that the engine needs to be started.
 	 */
-	int err = loongson_se_poll(engine->se, BIT(engine->id));
+	int err = loongson_se_poll(engine->se, BIT(engine->id),
+				   &engine->completion);
 
 	if (err)
 		return err;
 
-	return wait_for_completion_interruptible(&engine->completion);
+	wait_for_completion(&engine->completion);
+
+	return 0;
 }
 EXPORT_SYMBOL_GPL(loongson_se_send_engine_cmd);
 
-- 
2.56.0.218.g1ec904b173-goog

Re: [PATCH 17/28] mfd: loongson-se: Reinitialise completions and wait uninterruptibly for commands

[Qunqin Zhao]

在 2026/10/21 20:09, Lee Jones 写道:
> loongson_se_send_controller_cmd() and loongson_se_send_engine_cmd() wait
> on se->cmd_completion and engine->completion using
> wait_for_completion_interruptible() without reinitialising the
> completion before issuing a new command.  Because the hardware has no
> mechanism to abort an in-flight command once accepted by
> loongson_se_poll(), returning early on a signal leaves the controller or
> engine actively processing the shared command registers and DMA buffers
> in the background, and its subsequent completion interrupt leaves a
> stale completion token that causes the next command to return
> prematurely.
>
> Clear any stale pending interrupt status and reinitialise the target
> completion inside loongson_se_poll() while holding se->dev_lock
> immediately before notifying the controller, and wait uninterruptibly
> via wait_for_completion() once loongson_se_poll() confirms the command
> has been accepted by the hardware.
>
> Fixes: e551fa3159e3 ("mfd: Add support for Loongson Security Engine chip controller")
> Closes: https://sashiko.dev/#/bug/linux-4661fb0d-d936-4168-89cd-2f6dec31a7b5
> Cc: stable@vger.kernel.org
> Signed-off-by: Lee Jones <lee@kernel.org>

Reviewed-by: Qunqin Zhao <zhaoqunqin@loongson.cn>
Tested-by: Qunqin Zhao <zhaoqunqin@loongson.cn>

Thanks for fixing this!


Best Regards,

Qunqin.

[PATCH 18/28] mfd: loongson-se: Zero-allocate driver data and initialise engine completions in probe

[Lee Jones]

loongson_se_probe() allocates struct loongson_se using devm_kmalloc(),
leaving the se->engines array uninitialised until child MFD drivers
later invoke loongson_se_init_engine().  Meanwhile, hardware interrupts
are unmasked and se_irq_handler() is registered during probe.  Any
engine interrupt arriving before loongson_se_init_engine() runs causes
se_irq_handler() to call complete() on an uninitialised completion
structure.

Allocate struct loongson_se with devm_kzalloc() and initialise all
engine completion structures in loongson_se_probe() before registering
interrupt handlers.

Fixes: e551fa3159e3 ("mfd: Add support for Loongson Security Engine chip controller")
Closes: https://sashiko.dev/#/bug/linux-ad9310d7-13b2-4a4a-ad7d-78a4c612c78c
Cc: stable@vger.kernel.org
Signed-off-by: Lee Jones <lee@kernel.org>
---
 drivers/mfd/loongson-se.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/mfd/loongson-se.c b/drivers/mfd/loongson-se.c
index 9b531e62fb85..187ebbed0422 100644
--- a/drivers/mfd/loongson-se.c
+++ b/drivers/mfd/loongson-se.c
@@ -106,7 +106,6 @@ struct loongson_se_engine *loongson_se_init_engine(struct device *dev, int id)
 
 	engine->se = se;
 	engine->id = id;
-	init_completion(&engine->completion);
 
 	/* Divide DMA memory equally among all engines */
 	engine->buffer_size = se->dmam_size / SE_ENGINE_MAX;
@@ -199,12 +198,14 @@ static int loongson_se_probe(struct platform_device *pdev)
 	int nr_irq, irq, err, i;
 	dma_addr_t paddr;
 
-	se = devm_kmalloc(dev, sizeof(*se), GFP_KERNEL);
+	se = devm_kzalloc(dev, sizeof(*se), GFP_KERNEL);
 	if (!se)
 		return -ENOMEM;
 
 	dev_set_drvdata(dev, se);
 	init_completion(&se->cmd_completion);
+	for (i = 0; i < SE_ENGINE_MAX; i++)
+		init_completion(&se->engines[i].completion);
 	spin_lock_init(&se->dev_lock);
 	mutex_init(&se->engine_init_lock);
 
-- 
2.56.0.218.g1ec904b173-goog

Re: [PATCH 18/28] mfd: loongson-se: Zero-allocate driver data and initialise engine completions in probe

[Qunqin Zhao]

在 2026/10/21 20:09, Lee Jones 写道:
> loongson_se_probe() allocates struct loongson_se using devm_kmalloc(),
> leaving the se->engines array uninitialised until child MFD drivers
> later invoke loongson_se_init_engine().  Meanwhile, hardware interrupts
> are unmasked and se_irq_handler() is registered during probe.  Any
> engine interrupt arriving before loongson_se_init_engine() runs causes
> se_irq_handler() to call complete() on an uninitialised completion
> structure.
>
> Allocate struct loongson_se with devm_kzalloc() and initialise all
> engine completion structures in loongson_se_probe() before registering
> interrupt handlers.
>
> Fixes: e551fa3159e3 ("mfd: Add support for Loongson Security Engine chip controller")
> Closes: https://sashiko.dev/#/bug/linux-ad9310d7-13b2-4a4a-ad7d-78a4c612c78c
> Cc: stable@vger.kernel.org
> Signed-off-by: Lee Jones <lee@kernel.org>

Reviewed-by: Qunqin Zhao <zhaoqunqin@loongson.cn>

Thanks for fixing this!


Best Regards,

Qunqin.

> ---
>  drivers/mfd/loongson-se.c | 5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/mfd/loongson-se.c b/drivers/mfd/loongson-se.c
> index 9b531e62fb85..187ebbed0422 100644
> --- a/drivers/mfd/loongson-se.c
> +++ b/drivers/mfd/loongson-se.c
> @@ -106,7 +106,6 @@ struct loongson_se_engine *loongson_se_init_engine(struct device *dev, int id)
>  
>  	engine->se = se;
>  	engine->id = id;
> -	init_completion(&engine->completion);
>  
>  	/* Divide DMA memory equally among all engines */
>  	engine->buffer_size = se->dmam_size / SE_ENGINE_MAX;
> @@ -199,12 +198,14 @@ static int loongson_se_probe(struct platform_device *pdev)
>  	int nr_irq, irq, err, i;
>  	dma_addr_t paddr;
>  
> -	se = devm_kmalloc(dev, sizeof(*se), GFP_KERNEL);
> +	se = devm_kzalloc(dev, sizeof(*se), GFP_KERNEL);
>  	if (!se)
>  		return -ENOMEM;
>  
>  	dev_set_drvdata(dev, se);
>  	init_completion(&se->cmd_completion);
> +	for (i = 0; i < SE_ENGINE_MAX; i++)
> +		init_completion(&se->engines[i].completion);
>  	spin_lock_init(&se->dev_lock);
>  	mutex_init(&se->engine_init_lock);
>  

[PATCH 19/28] mfd: loongson-se: Prevent out-of-bounds engine access in se_irq_handler()

[Lee Jones]

loongson_se_probe() enables all 32 interrupt bits via SE_INT_ALL
(0xffffffff), and se_irq_handler() uses the set bit index from the
32-bit status register directly to index se->engines, which only holds
SE_ENGINE_MAX (16) entries.  Any interrupt bit asserted at index 16 or
above triggers an out-of-bounds access on se->engines.

Restrict SE_INT_ALL to GENMASK(SE_ENGINE_MAX - 1, 0) and bounds-check
the bit index against SE_ENGINE_MAX before completing the engine in
se_irq_handler().

Fixes: e551fa3159e3 ("mfd: Add support for Loongson Security Engine chip controller")
Closes: https://sashiko.dev/#/bug/linux-bc962408-5c42-40af-8111-a8463a05ccdf
Cc: stable@vger.kernel.org
Signed-off-by: Lee Jones <lee@kernel.org>
---
 drivers/mfd/loongson-se.c       | 3 ++-
 include/linux/mfd/loongson-se.h | 7 ++++---
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/drivers/mfd/loongson-se.c b/drivers/mfd/loongson-se.c
index 187ebbed0422..10af13c3b7cc 100644
--- a/drivers/mfd/loongson-se.c
+++ b/drivers/mfd/loongson-se.c
@@ -158,7 +158,8 @@ static irqreturn_t se_irq_handler(int irq, void *dev_id)
 	/* For engines */
 	while (int_status) {
 		id = __ffs(int_status);
-		complete(&se->engines[id].completion);
+		if (id < SE_ENGINE_MAX)
+			complete(&se->engines[id].completion);
 		int_status &= ~BIT(id);
 		writel(BIT(id), se->base + SE_S2LINT_CL);
 	}
diff --git a/include/linux/mfd/loongson-se.h b/include/linux/mfd/loongson-se.h
index 07afa0c2524d..2d0a8b1e5c9e 100644
--- a/include/linux/mfd/loongson-se.h
+++ b/include/linux/mfd/loongson-se.h
@@ -4,6 +4,8 @@
 #ifndef __MFD_LOONGSON_SE_H__
 #define __MFD_LOONGSON_SE_H__
 
+#include <linux/bits.h>
+
 #define LOONGSON_ENGINE_CMD_TIMEOUT_US	10000
 #define SE_SEND_CMD_REG			0x0
 #define SE_SEND_CMD_REG_LEN		0x8
@@ -18,10 +20,9 @@
 #define SE_L2SINT_STAT			0x98
 #define SE_L2SINT_SET			0xa0
 
-#define SE_INT_ALL			0xffffffff
-#define SE_INT_CONTROLLER		BIT(0)
-
 #define SE_ENGINE_MAX			16
+#define SE_INT_ALL			GENMASK(SE_ENGINE_MAX - 1, 0)
+#define SE_INT_CONTROLLER		BIT(0)
 #define SE_ENGINE_RNG			1
 #define SE_CMD_RNG			0x100
 
-- 
2.56.0.218.g1ec904b173-goog

Re: [PATCH 19/28] mfd: loongson-se: Prevent out-of-bounds engine access in se_irq_handler()

[Qunqin Zhao]

在 2026/10/21 20:09, Lee Jones 写道:
> loongson_se_probe() enables all 32 interrupt bits via SE_INT_ALL
> (0xffffffff), and se_irq_handler() uses the set bit index from the
> 32-bit status register directly to index se->engines, which only holds
> SE_ENGINE_MAX (16) entries.  Any interrupt bit asserted at index 16 or
> above triggers an out-of-bounds access on se->engines.
>
> Restrict SE_INT_ALL to GENMASK(SE_ENGINE_MAX - 1, 0) and bounds-check
> the bit index against SE_ENGINE_MAX before completing the engine in
> se_irq_handler().
>
> Fixes: e551fa3159e3 ("mfd: Add support for Loongson Security Engine chip controller")
> Closes: https://sashiko.dev/#/bug/linux-bc962408-5c42-40af-8111-a8463a05ccdf
> Cc: stable@vger.kernel.org
> Signed-off-by: Lee Jones <lee@kernel.org>

Reviewed-by: Qunqin Zhao <zhaoqunqin@loongson.cn>

Thanks for fixing this!


Best Regards,

Qunqin.

> ---
>  drivers/mfd/loongson-se.c       | 3 ++-
>  include/linux/mfd/loongson-se.h | 7 ++++---
>  2 files changed, 6 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/mfd/loongson-se.c b/drivers/mfd/loongson-se.c
> index 187ebbed0422..10af13c3b7cc 100644
> --- a/drivers/mfd/loongson-se.c
> +++ b/drivers/mfd/loongson-se.c
> @@ -158,7 +158,8 @@ static irqreturn_t se_irq_handler(int irq, void *dev_id)
>  	/* For engines */
>  	while (int_status) {
>  		id = __ffs(int_status);
> -		complete(&se->engines[id].completion);
> +		if (id < SE_ENGINE_MAX)
> +			complete(&se->engines[id].completion);
>  		int_status &= ~BIT(id);
>  		writel(BIT(id), se->base + SE_S2LINT_CL);
>  	}
> diff --git a/include/linux/mfd/loongson-se.h b/include/linux/mfd/loongson-se.h
> index 07afa0c2524d..2d0a8b1e5c9e 100644
> --- a/include/linux/mfd/loongson-se.h
> +++ b/include/linux/mfd/loongson-se.h
> @@ -4,6 +4,8 @@
>  #ifndef __MFD_LOONGSON_SE_H__
>  #define __MFD_LOONGSON_SE_H__
>  
> +#include <linux/bits.h>
> +
>  #define LOONGSON_ENGINE_CMD_TIMEOUT_US	10000
>  #define SE_SEND_CMD_REG			0x0
>  #define SE_SEND_CMD_REG_LEN		0x8
> @@ -18,10 +20,9 @@
>  #define SE_L2SINT_STAT			0x98
>  #define SE_L2SINT_SET			0xa0
>  
> -#define SE_INT_ALL			0xffffffff
> -#define SE_INT_CONTROLLER		BIT(0)
> -
>  #define SE_ENGINE_MAX			16
> +#define SE_INT_ALL			GENMASK(SE_ENGINE_MAX - 1, 0)
> +#define SE_INT_CONTROLLER		BIT(0)
>  #define SE_ENGINE_RNG			1
>  #define SE_CMD_RNG			0x100
>  

[PATCH 20/28] mfd: loongson-se: Stop controller and mask interrupts on teardown and shutdown

[Lee Jones]

loongson_se_probe() enables hardware interrupts before registering IRQ
handlers and starts the controller via loongson_se_init(), but provides
no teardown or shutdown handler to stop the controller and mask
interrupts.  If probe fails after loongson_se_init(), if the driver is
unbound, or during a system reboot or kexec transition, the controller
remains active with DMA configured to memory that is reclaimed.

Clear pending interrupts before requesting IRQs, unmask interrupts only
after IRQ handlers are registered, clean up on failure inside
loongson_se_init(), register a devres action after loongson_se_init()
succeeds to issue SE_CMD_STOP and mask interrupts on teardown, and wire
up the platform driver .shutdown callback.

Fixes: e551fa3159e3 ("mfd: Add support for Loongson Security Engine chip controller")
Closes: https://sashiko.dev/#/bug/linux-15511672-7569-4eac-96a0-c08581925710
Closes: https://sashiko.dev/#/bug/linux-e6ed8d33-d641-4969-a5ea-959f21ae3696
Cc: stable@vger.kernel.org
Signed-off-by: Lee Jones <lee@kernel.org>
---
 drivers/mfd/loongson-se.c       | 51 +++++++++++++++++++++++++++++----
 include/linux/mfd/loongson-se.h |  1 +
 2 files changed, 46 insertions(+), 6 deletions(-)

diff --git a/drivers/mfd/loongson-se.c b/drivers/mfd/loongson-se.c
index 10af13c3b7cc..bdbab4b91729 100644
--- a/drivers/mfd/loongson-se.c
+++ b/drivers/mfd/loongson-se.c
@@ -169,6 +169,23 @@ static irqreturn_t se_irq_handler(int irq, void *dev_id)
 	return IRQ_HANDLED;
 }
 
+static void loongson_se_stop(void *data)
+{
+	struct loongson_se *se = data;
+	struct loongson_se_controller_cmd cmd = {};
+
+	mutex_lock(&se->engine_init_lock);
+
+	cmd.command_id = SE_CMD_STOP;
+	loongson_se_send_controller_cmd(se, &cmd);
+
+	spin_lock_irq(&se->dev_lock);
+	writel(0, se->base + SE_S2LINT_EN);
+	spin_unlock_irq(&se->dev_lock);
+
+	mutex_unlock(&se->engine_init_lock);
+}
+
 static int loongson_se_init(struct loongson_se *se, dma_addr_t addr, int size)
 {
 	struct loongson_se_controller_cmd cmd = {};
@@ -176,15 +193,23 @@ static int loongson_se_init(struct loongson_se *se, dma_addr_t addr, int size)
 
 	cmd.command_id = SE_CMD_START;
 	err = loongson_se_send_controller_cmd(se, &cmd);
-	if (err)
+	if (err) {
+		writel(0, se->base + SE_S2LINT_EN);
 		return err;
+	}
 
 	cmd.command_id = SE_CMD_SET_DMA;
 	cmd.info[0] = lower_32_bits(addr);
 	cmd.info[1] = upper_32_bits(addr);
 	cmd.info[2] = size;
 
-	return loongson_se_send_controller_cmd(se, &cmd);
+	err = loongson_se_send_controller_cmd(se, &cmd);
+	if (err) {
+		loongson_se_stop(se);
+		return err;
+	}
+
+	return 0;
 }
 
 static const struct mfd_cell engines[] = {
@@ -192,6 +217,13 @@ static const struct mfd_cell engines[] = {
 	{ .name = "tpm_loongson" },
 };
 
+static void loongson_se_shutdown(struct platform_device *pdev)
+{
+	struct loongson_se *se = platform_get_drvdata(pdev);
+
+	loongson_se_stop(se);
+}
+
 static int loongson_se_probe(struct platform_device *pdev)
 {
 	struct device *dev = &pdev->dev;
@@ -225,12 +257,12 @@ static int loongson_se_probe(struct platform_device *pdev)
 	if (IS_ERR(se->base))
 		return PTR_ERR(se->base);
 
-	writel(SE_INT_ALL, se->base + SE_S2LINT_EN);
-
 	nr_irq = platform_irq_count(pdev);
 	if (nr_irq <= 0)
 		return -ENODEV;
 
+	writel(SE_INT_ALL, se->base + SE_S2LINT_CL);
+
 	for (i = 0; i < nr_irq; i++) {
 		irq = platform_get_irq(pdev, i);
 		err = devm_request_irq(dev, irq, se_irq_handler, 0, "loongson-se", se);
@@ -238,10 +270,16 @@ static int loongson_se_probe(struct platform_device *pdev)
 			dev_err(dev, "failed to request IRQ: %d\n", irq);
 	}
 
+	writel(SE_INT_ALL, se->base + SE_S2LINT_EN);
+
 	err = loongson_se_init(se, paddr, se->dmam_size);
 	if (err)
 		return err;
 
+	err = devm_add_action_or_reset(dev, loongson_se_stop, se);
+	if (err)
+		return err;
+
 	return devm_mfd_add_devices(dev, PLATFORM_DEVID_NONE, engines,
 				    ARRAY_SIZE(engines), NULL, 0, NULL);
 }
@@ -253,8 +291,9 @@ static const struct acpi_device_id loongson_se_acpi_match[] = {
 MODULE_DEVICE_TABLE(acpi, loongson_se_acpi_match);
 
 static struct platform_driver loongson_se_driver = {
-	.probe   = loongson_se_probe,
-	.driver  = {
+	.probe    = loongson_se_probe,
+	.shutdown = loongson_se_shutdown,
+	.driver   = {
 		.name  = "loongson-se",
 		.acpi_match_table = loongson_se_acpi_match,
 	},
diff --git a/include/linux/mfd/loongson-se.h b/include/linux/mfd/loongson-se.h
index 2d0a8b1e5c9e..dbe5992bd435 100644
--- a/include/linux/mfd/loongson-se.h
+++ b/include/linux/mfd/loongson-se.h
@@ -11,6 +11,7 @@
 #define SE_SEND_CMD_REG_LEN		0x8
 /* Controller command ID */
 #define SE_CMD_START			0x0
+#define SE_CMD_STOP			0x1
 #define SE_CMD_SET_DMA			0x3
 #define SE_CMD_SET_ENGINE_CMDBUF	0x4
 
-- 
2.56.0.218.g1ec904b173-goog

Re: [PATCH 20/28] mfd: loongson-se: Stop controller and mask interrupts on teardown and shutdown

[Qunqin Zhao]

在 2026/10/21 20:09, Lee Jones 写道:
> loongson_se_probe() enables hardware interrupts before registering IRQ
> handlers and starts the controller via loongson_se_init(), but provides
> no teardown or shutdown handler to stop the controller and mask
> interrupts.  If probe fails after loongson_se_init(), if the driver is
> unbound, or during a system reboot or kexec transition, the controller
> remains active with DMA configured to memory that is reclaimed.
>
> Clear pending interrupts before requesting IRQs, unmask interrupts only
> after IRQ handlers are registered, clean up on failure inside
> loongson_se_init(), register a devres action after loongson_se_init()
> succeeds to issue SE_CMD_STOP and mask interrupts on teardown, and wire
> up the platform driver .shutdown callback.
>
> Fixes: e551fa3159e3 ("mfd: Add support for Loongson Security Engine chip controller")
> Closes: https://sashiko.dev/#/bug/linux-15511672-7569-4eac-96a0-c08581925710
> Closes: https://sashiko.dev/#/bug/linux-e6ed8d33-d641-4969-a5ea-959f21ae3696
> Cc: stable@vger.kernel.org
> Signed-off-by: Lee Jones <lee@kernel.org>

Reviewed-by: Qunqin Zhao <zhaoqunqin@loongson.cn>

Thanks for fixing this!


Best Regards,

Qunqin.

> ---
>  drivers/mfd/loongson-se.c       | 51 +++++++++++++++++++++++++++++----
>  include/linux/mfd/loongson-se.h |  1 +
>  2 files changed, 46 insertions(+), 6 deletions(-)
>
> diff --git a/drivers/mfd/loongson-se.c b/drivers/mfd/loongson-se.c
> index 10af13c3b7cc..bdbab4b91729 100644
> --- a/drivers/mfd/loongson-se.c
> +++ b/drivers/mfd/loongson-se.c
> @@ -169,6 +169,23 @@ static irqreturn_t se_irq_handler(int irq, void *dev_id)
>  	return IRQ_HANDLED;
>  }
>  
> +static void loongson_se_stop(void *data)
> +{
> +	struct loongson_se *se = data;
> +	struct loongson_se_controller_cmd cmd = {};
> +
> +	mutex_lock(&se->engine_init_lock);
> +
> +	cmd.command_id = SE_CMD_STOP;
> +	loongson_se_send_controller_cmd(se, &cmd);
> +
> +	spin_lock_irq(&se->dev_lock);
> +	writel(0, se->base + SE_S2LINT_EN);
> +	spin_unlock_irq(&se->dev_lock);
> +
> +	mutex_unlock(&se->engine_init_lock);
> +}
> +
>  static int loongson_se_init(struct loongson_se *se, dma_addr_t addr, int size)
>  {
>  	struct loongson_se_controller_cmd cmd = {};
> @@ -176,15 +193,23 @@ static int loongson_se_init(struct loongson_se *se, dma_addr_t addr, int size)
>  
>  	cmd.command_id = SE_CMD_START;
>  	err = loongson_se_send_controller_cmd(se, &cmd);
> -	if (err)
> +	if (err) {
> +		writel(0, se->base + SE_S2LINT_EN);
>  		return err;
> +	}
>  
>  	cmd.command_id = SE_CMD_SET_DMA;
>  	cmd.info[0] = lower_32_bits(addr);
>  	cmd.info[1] = upper_32_bits(addr);
>  	cmd.info[2] = size;
>  
> -	return loongson_se_send_controller_cmd(se, &cmd);
> +	err = loongson_se_send_controller_cmd(se, &cmd);
> +	if (err) {
> +		loongson_se_stop(se);
> +		return err;
> +	}
> +
> +	return 0;
>  }
>  
>  static const struct mfd_cell engines[] = {
> @@ -192,6 +217,13 @@ static const struct mfd_cell engines[] = {
>  	{ .name = "tpm_loongson" },
>  };
>  
> +static void loongson_se_shutdown(struct platform_device *pdev)
> +{
> +	struct loongson_se *se = platform_get_drvdata(pdev);
> +
> +	loongson_se_stop(se);
> +}
> +
>  static int loongson_se_probe(struct platform_device *pdev)
>  {
>  	struct device *dev = &pdev->dev;
> @@ -225,12 +257,12 @@ static int loongson_se_probe(struct platform_device *pdev)
>  	if (IS_ERR(se->base))
>  		return PTR_ERR(se->base);
>  
> -	writel(SE_INT_ALL, se->base + SE_S2LINT_EN);
> -
>  	nr_irq = platform_irq_count(pdev);
>  	if (nr_irq <= 0)
>  		return -ENODEV;
>  
> +	writel(SE_INT_ALL, se->base + SE_S2LINT_CL);
> +
>  	for (i = 0; i < nr_irq; i++) {
>  		irq = platform_get_irq(pdev, i);
>  		err = devm_request_irq(dev, irq, se_irq_handler, 0, "loongson-se", se);
> @@ -238,10 +270,16 @@ static int loongson_se_probe(struct platform_device *pdev)
>  			dev_err(dev, "failed to request IRQ: %d\n", irq);
>  	}
>  
> +	writel(SE_INT_ALL, se->base + SE_S2LINT_EN);
> +
>  	err = loongson_se_init(se, paddr, se->dmam_size);
>  	if (err)
>  		return err;
>  
> +	err = devm_add_action_or_reset(dev, loongson_se_stop, se);
> +	if (err)
> +		return err;
> +
>  	return devm_mfd_add_devices(dev, PLATFORM_DEVID_NONE, engines,
>  				    ARRAY_SIZE(engines), NULL, 0, NULL);
>  }
> @@ -253,8 +291,9 @@ static const struct acpi_device_id loongson_se_acpi_match[] = {
>  MODULE_DEVICE_TABLE(acpi, loongson_se_acpi_match);
>  
>  static struct platform_driver loongson_se_driver = {
> -	.probe   = loongson_se_probe,
> -	.driver  = {
> +	.probe    = loongson_se_probe,
> +	.shutdown = loongson_se_shutdown,
> +	.driver   = {
>  		.name  = "loongson-se",
>  		.acpi_match_table = loongson_se_acpi_match,
>  	},
> diff --git a/include/linux/mfd/loongson-se.h b/include/linux/mfd/loongson-se.h
> index 2d0a8b1e5c9e..dbe5992bd435 100644
> --- a/include/linux/mfd/loongson-se.h
> +++ b/include/linux/mfd/loongson-se.h
> @@ -11,6 +11,7 @@
>  #define SE_SEND_CMD_REG_LEN		0x8
>  /* Controller command ID */
>  #define SE_CMD_START			0x0
> +#define SE_CMD_STOP			0x1
>  #define SE_CMD_SET_DMA			0x3
>  #define SE_CMD_SET_ENGINE_CMDBUF	0x4
>  

[PATCH 21/28] mfd: loongson-se: Validate engine ID, DMA buffer size, and IRQ registration

[Lee Jones]

Harden input and error checking in loongson_se_init_engine() and
loongson_se_probe():

- Reject out-of-bounds engine IDs and engine 0 in
  loongson_se_init_engine() before indexing se->engines.
- Store dmam_size as u32 to match device_property_read_u32() and verify
  that it is large enough to hold the command buffers of all engines
  within engine 0's data region.
- Propagate negative error codes from platform_irq_count(),
  platform_get_irq(), and devm_request_irq() instead of ignoring IRQ
  registration failures or masking -EPROBE_DEFER.

Fixes: e551fa3159e3 ("mfd: Add support for Loongson Security Engine chip controller")
Closes: https://sashiko.dev/#/bug/linux-89bf25f5-ecd9-40e3-bb4c-bd26d07c53a1
Cc: stable@vger.kernel.org
Signed-off-by: Lee Jones <lee@kernel.org>
---
 drivers/mfd/loongson-se.c | 23 ++++++++++++++++++-----
 1 file changed, 18 insertions(+), 5 deletions(-)

diff --git a/drivers/mfd/loongson-se.c b/drivers/mfd/loongson-se.c
index bdbab4b91729..23af05d388aa 100644
--- a/drivers/mfd/loongson-se.c
+++ b/drivers/mfd/loongson-se.c
@@ -26,7 +26,7 @@ struct loongson_se {
 	struct completion cmd_completion;
 
 	void *dmam_base;
-	int dmam_size;
+	u32 dmam_size;
 
 	struct mutex engine_init_lock;
 	struct loongson_se_engine engines[SE_ENGINE_MAX];
@@ -101,8 +101,13 @@ EXPORT_SYMBOL_GPL(loongson_se_send_engine_cmd);
 struct loongson_se_engine *loongson_se_init_engine(struct device *dev, int id)
 {
 	struct loongson_se *se = dev_get_drvdata(dev);
-	struct loongson_se_engine *engine = &se->engines[id];
 	struct loongson_se_controller_cmd cmd = {};
+	struct loongson_se_engine *engine;
+
+	if (id <= 0 || id >= SE_ENGINE_MAX)
+		return NULL;
+
+	engine = &se->engines[id];
 
 	engine->se = se;
 	engine->id = id;
@@ -186,7 +191,7 @@ static void loongson_se_stop(void *data)
 	mutex_unlock(&se->engine_init_lock);
 }
 
-static int loongson_se_init(struct loongson_se *se, dma_addr_t addr, int size)
+static int loongson_se_init(struct loongson_se *se, dma_addr_t addr, u32 size)
 {
 	struct loongson_se_controller_cmd cmd = {};
 	int err;
@@ -249,6 +254,9 @@ static int loongson_se_probe(struct platform_device *pdev)
 	if (device_property_read_u32(dev, "dmam_size", &se->dmam_size))
 		return -ENODEV;
 
+	if ((se->dmam_size / SE_ENGINE_MAX) < (SE_ENGINE_MAX * 2 * SE_ENGINE_CMD_SIZE))
+		return -EINVAL;
+
 	se->dmam_base = dmam_alloc_coherent(dev, se->dmam_size, &paddr, GFP_KERNEL);
 	if (!se->dmam_base)
 		return -ENOMEM;
@@ -258,16 +266,21 @@ static int loongson_se_probe(struct platform_device *pdev)
 		return PTR_ERR(se->base);
 
 	nr_irq = platform_irq_count(pdev);
-	if (nr_irq <= 0)
+	if (!nr_irq)
 		return -ENODEV;
+	if (nr_irq < 0)
+		return nr_irq;
 
 	writel(SE_INT_ALL, se->base + SE_S2LINT_CL);
 
 	for (i = 0; i < nr_irq; i++) {
 		irq = platform_get_irq(pdev, i);
+		if (irq < 0)
+			return irq;
+
 		err = devm_request_irq(dev, irq, se_irq_handler, 0, "loongson-se", se);
 		if (err)
-			dev_err(dev, "failed to request IRQ: %d\n", irq);
+			return dev_err_probe(dev, err, "Failed to request IRQ: %d\n", irq);
 	}
 
 	writel(SE_INT_ALL, se->base + SE_S2LINT_EN);
-- 
2.56.0.218.g1ec904b173-goog

Re: [PATCH 21/28] mfd: loongson-se: Validate engine ID, DMA buffer size, and IRQ registration

[Qunqin Zhao]

在 2026/10/21 20:09, Lee Jones 写道:
> Harden input and error checking in loongson_se_init_engine() and
> loongson_se_probe():
>
> - Reject out-of-bounds engine IDs and engine 0 in
>   loongson_se_init_engine() before indexing se->engines.
> - Store dmam_size as u32 to match device_property_read_u32() and verify
>   that it is large enough to hold the command buffers of all engines
>   within engine 0's data region.
> - Propagate negative error codes from platform_irq_count(),
>   platform_get_irq(), and devm_request_irq() instead of ignoring IRQ
>   registration failures or masking -EPROBE_DEFER.
>
> Fixes: e551fa3159e3 ("mfd: Add support for Loongson Security Engine chip controller")
> Closes: https://sashiko.dev/#/bug/linux-89bf25f5-ecd9-40e3-bb4c-bd26d07c53a1
> Cc: stable@vger.kernel.org
> Signed-off-by: Lee Jones <lee@kernel.org>

Reviewed-by: Qunqin Zhao <zhaoqunqin@loongson.cn>

Thanks for fixing this!


Best Regards,

Qunqin.

> ---
>  drivers/mfd/loongson-se.c | 23 ++++++++++++++++++-----
>  1 file changed, 18 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/mfd/loongson-se.c b/drivers/mfd/loongson-se.c
> index bdbab4b91729..23af05d388aa 100644
> --- a/drivers/mfd/loongson-se.c
> +++ b/drivers/mfd/loongson-se.c
> @@ -26,7 +26,7 @@ struct loongson_se {
>  	struct completion cmd_completion;
>  
>  	void *dmam_base;
> -	int dmam_size;
> +	u32 dmam_size;
>  
>  	struct mutex engine_init_lock;
>  	struct loongson_se_engine engines[SE_ENGINE_MAX];
> @@ -101,8 +101,13 @@ EXPORT_SYMBOL_GPL(loongson_se_send_engine_cmd);
>  struct loongson_se_engine *loongson_se_init_engine(struct device *dev, int id)
>  {
>  	struct loongson_se *se = dev_get_drvdata(dev);
> -	struct loongson_se_engine *engine = &se->engines[id];
>  	struct loongson_se_controller_cmd cmd = {};
> +	struct loongson_se_engine *engine;
> +
> +	if (id <= 0 || id >= SE_ENGINE_MAX)
> +		return NULL;
> +
> +	engine = &se->engines[id];
>  
>  	engine->se = se;
>  	engine->id = id;
> @@ -186,7 +191,7 @@ static void loongson_se_stop(void *data)
>  	mutex_unlock(&se->engine_init_lock);
>  }
>  
> -static int loongson_se_init(struct loongson_se *se, dma_addr_t addr, int size)
> +static int loongson_se_init(struct loongson_se *se, dma_addr_t addr, u32 size)
>  {
>  	struct loongson_se_controller_cmd cmd = {};
>  	int err;
> @@ -249,6 +254,9 @@ static int loongson_se_probe(struct platform_device *pdev)
>  	if (device_property_read_u32(dev, "dmam_size", &se->dmam_size))
>  		return -ENODEV;
>  
> +	if ((se->dmam_size / SE_ENGINE_MAX) < (SE_ENGINE_MAX * 2 * SE_ENGINE_CMD_SIZE))
> +		return -EINVAL;
> +
>  	se->dmam_base = dmam_alloc_coherent(dev, se->dmam_size, &paddr, GFP_KERNEL);
>  	if (!se->dmam_base)
>  		return -ENOMEM;
> @@ -258,16 +266,21 @@ static int loongson_se_probe(struct platform_device *pdev)
>  		return PTR_ERR(se->base);
>  
>  	nr_irq = platform_irq_count(pdev);
> -	if (nr_irq <= 0)
> +	if (!nr_irq)
>  		return -ENODEV;
> +	if (nr_irq < 0)
> +		return nr_irq;
>  
>  	writel(SE_INT_ALL, se->base + SE_S2LINT_CL);
>  
>  	for (i = 0; i < nr_irq; i++) {
>  		irq = platform_get_irq(pdev, i);
> +		if (irq < 0)
> +			return irq;
> +
>  		err = devm_request_irq(dev, irq, se_irq_handler, 0, "loongson-se", se);
>  		if (err)
> -			dev_err(dev, "failed to request IRQ: %d\n", irq);
> +			return dev_err_probe(dev, err, "Failed to request IRQ: %d\n", irq);
>  	}
>  
>  	writel(SE_INT_ALL, se->base + SE_S2LINT_EN);

[PATCH 22/28] mfd: abx500-core: Unregister device ops on devm release

[Lee Jones]

abx500_register_ops() allocates struct abx500_device_entry via
devm_kzalloc() and links it into the global abx500_list without
registering a devres cleanup action.  If a caller's probe function
subsequently fails, devres frees the entry while it remains linked in
abx500_list, causing use-after-free and list corruption on later
traversals.

Register a devm_add_action_or_reset() callback in abx500_register_ops()
to remove the entry from abx500_list before devres frees it.

Fixes: c211b6b9c014 ("mfd: abx500-core: Convert to managed resources for allocating memory")
Closes: https://sashiko.dev/#/bug/linux-6a9c6b8b-8f89-4af5-8cb1-102822e44e6e
Cc: stable@vger.kernel.org
Signed-off-by: Lee Jones <lee@kernel.org>
---
 drivers/mfd/abx500-core.c | 29 ++++++++++++++++++-----------
 1 file changed, 18 insertions(+), 11 deletions(-)

diff --git a/drivers/mfd/abx500-core.c b/drivers/mfd/abx500-core.c
index e896531d0354..5873e335c395 100644
--- a/drivers/mfd/abx500-core.c
+++ b/drivers/mfd/abx500-core.c
@@ -5,6 +5,7 @@
  * Author: Mattias Wallin <mattias.wallin@stericsson.com>
  */
 
+#include <linux/device.h>
 #include <linux/list.h>
 #include <linux/slab.h>
 #include <linux/err.h>
@@ -33,6 +34,21 @@ static void lookup_ops(struct device *dev, struct abx500_ops **ops)
 	}
 }
 
+void abx500_remove_ops(struct device *dev)
+{
+	struct abx500_device_entry *dev_entry, *tmp;
+
+	list_for_each_entry_safe(dev_entry, tmp, &abx500_list, list)
+		if (dev_entry->dev == dev)
+			list_del(&dev_entry->list);
+}
+EXPORT_SYMBOL(abx500_remove_ops);
+
+static void abx500_unregister_ops(void *data)
+{
+	abx500_remove_ops(data);
+}
+
 int abx500_register_ops(struct device *dev, struct abx500_ops *ops)
 {
 	struct abx500_device_entry *dev_entry;
@@ -45,20 +61,11 @@ int abx500_register_ops(struct device *dev, struct abx500_ops *ops)
 	memcpy(&dev_entry->ops, ops, sizeof(*ops));
 
 	list_add_tail(&dev_entry->list, &abx500_list);
-	return 0;
+
+	return devm_add_action_or_reset(dev, abx500_unregister_ops, dev);
 }
 EXPORT_SYMBOL(abx500_register_ops);
 
-void abx500_remove_ops(struct device *dev)
-{
-	struct abx500_device_entry *dev_entry, *tmp;
-
-	list_for_each_entry_safe(dev_entry, tmp, &abx500_list, list)
-		if (dev_entry->dev == dev)
-			list_del(&dev_entry->list);
-}
-EXPORT_SYMBOL(abx500_remove_ops);
-
 int abx500_set_register_interruptible(struct device *dev, u8 bank, u8 reg,
 	u8 value)
 {
-- 
2.56.0.218.g1ec904b173-goog

Re: [PATCH 22/28] mfd: abx500-core: Unregister device ops on devm release

[Linus Walleij]

On Wed, Oct 21, 2026 at 2:16 PM Lee Jones <lee@kernel.org> wrote:

> abx500_register_ops() allocates struct abx500_device_entry via
> devm_kzalloc() and links it into the global abx500_list without
> registering a devres cleanup action.  If a caller's probe function
> subsequently fails, devres frees the entry while it remains linked in
> abx500_list, causing use-after-free and list corruption on later
> traversals.
>
> Register a devm_add_action_or_reset() callback in abx500_register_ops()
> to remove the entry from abx500_list before devres frees it.
>
> Fixes: c211b6b9c014 ("mfd: abx500-core: Convert to managed resources for allocating memory")
> Closes: https://sashiko.dev/#/bug/linux-6a9c6b8b-8f89-4af5-8cb1-102822e44e6e
> Cc: stable@vger.kernel.org
> Signed-off-by: Lee Jones <lee@kernel.org>

Reviewed-by: Linus Walleij <linusw@kernel.org>

Yours,
Linus Walleij

[PATCH 23/28] mfd: ab8500-core: Register sysfs attribute groups via devm_device_add_group()

[Lee Jones]

ab8500_probe() registers up to two sysfs attribute groups with
sysfs_create_group().  On AB8505 and AB9540 (cut 2.0 and later), the
second sysfs_create_group() call unconditionally overwrites the return
value of the first, and if the second call fails, ab8500_probe() returns
an error without removing the first group.  Because the driver context
is freed and driver data is cleared on probe failure, reading any leaked
sysfs attribute dereferences a NULL ab8500 pointer in
get_register_interruptible().

Register the attribute groups via devm_device_add_group() and only
register the second group when the first succeeds so that devres
automatically cleans up registered sysfs attributes on probe failure.

Fixes: 93ff722e8853 ("ab8500-fg: Add power cut feature for ab8505 and ab8540")
Closes: https://sashiko.dev/#/bug/linux-a9ac1a9d-5a97-4ad3-b4c5-c7775c24a333
Cc: stable@vger.kernel.org
Signed-off-by: Lee Jones <lee@kernel.org>
---
 drivers/mfd/ab8500-core.c | 11 ++++-------
 1 file changed, 4 insertions(+), 7 deletions(-)

diff --git a/drivers/mfd/ab8500-core.c b/drivers/mfd/ab8500-core.c
index 86fa99022cb3..408bad2f577a 100644
--- a/drivers/mfd/ab8500-core.c
+++ b/drivers/mfd/ab8500-core.c
@@ -1232,16 +1232,13 @@ static int ab8500_probe(struct platform_device *pdev)
 
 	if (((is_ab8505(ab8500) || is_ab9540(ab8500)) &&
 			ab8500->chip_id >= AB8500_CUT2P0) || is_ab8540(ab8500))
-		ret = sysfs_create_group(&ab8500->dev->kobj,
-					&ab9540_attr_group);
+		ret = devm_device_add_group(ab8500->dev, &ab9540_attr_group);
 	else
-		ret = sysfs_create_group(&ab8500->dev->kobj,
-					&ab8500_attr_group);
+		ret = devm_device_add_group(ab8500->dev, &ab8500_attr_group);
 
 	if ((is_ab8505(ab8500) || is_ab9540(ab8500)) &&
-			ab8500->chip_id >= AB8500_CUT2P0)
-		ret = sysfs_create_group(&ab8500->dev->kobj,
-					 &ab8505_attr_group);
+			ab8500->chip_id >= AB8500_CUT2P0 && !ret)
+		ret = devm_device_add_group(ab8500->dev, &ab8505_attr_group);
 
 	if (ret)
 		dev_err(ab8500->dev, "error creating sysfs entries\n");
-- 
2.56.0.218.g1ec904b173-goog

Re: [PATCH 23/28] mfd: ab8500-core: Register sysfs attribute groups via devm_device_add_group()

[Linus Walleij]

Hi Lee,

On Wed, Oct 21, 2026 at 2:16 PM Lee Jones <lee@kernel.org> wrote:

> ab8500_probe() registers up to two sysfs attribute groups with
> sysfs_create_group().  On AB8505 and AB9540 (cut 2.0 and later), the
> second sysfs_create_group() call unconditionally overwrites the return
> value of the first, and if the second call fails, ab8500_probe() returns
> an error without removing the first group.  Because the driver context
> is freed and driver data is cleared on probe failure, reading any leaked
> sysfs attribute dereferences a NULL ab8500 pointer in
> get_register_interruptible().
>
> Register the attribute groups via devm_device_add_group() and only
> register the second group when the first succeeds so that devres
> automatically cleans up registered sysfs attributes on probe failure.
>
> Fixes: 93ff722e8853 ("ab8500-fg: Add power cut feature for ab8505 and ab8540")
> Closes: https://sashiko.dev/#/bug/linux-a9ac1a9d-5a97-4ad3-b4c5-c7775c24a333
> Cc: stable@vger.kernel.org
> Signed-off-by: Lee Jones <lee@kernel.org>

Neat, thanks for fixing!
Reviewed-by: Linus Walleij <linusw@kernel.org>

Yours,
Linus Walleij

[PATCH 24/28] mfd: tps65217: Manage IRQ domain teardown via devres

[Lee Jones]

tps65217_irq_init() creates tps->irq_domain with an unmanaged call and
requests the parent interrupt via devm_request_threaded_irq(), while
tps65217_remove() manually disposes mappings and removes
tps->irq_domain.  Because tps65217_remove() executes before devres
teardown, the IRQ domain is destroyed while tps65217_irq_thread() and
child MFD devices are still active, allowing a concurrent interrupt to
dereference a freed or NULL domain.  Furthermore, if probe fails after
irq_domain_create_linear() or if tps65217_irq_init() fails, the IRQ
domain is leaked, and if the device is probed without an interrupt
(client->irq == 0), tps65217_remove() unconditionally passes a NULL
tps->irq_domain to irq_domain_remove().

Register a devres action to tear down the IRQ domain in
tps65217_irq_init() prior to devm_request_threaded_irq(), propagate
errors from tps65217_irq_init() in tps65217_probe(), and drop
tps65217_remove().

Fixes: 40a50f8b307d ("mfd: tps65217: Fix page fault on unloading modules")
Closes: https://sashiko.dev/#/bug/linux-7e358c08-6d75-48be-87d2-35dc037ea953
Cc: stable@vger.kernel.org
Signed-off-by: Lee Jones <lee@kernel.org>
---
 drivers/mfd/tps65217.c | 40 ++++++++++++++++++++++------------------
 1 file changed, 22 insertions(+), 18 deletions(-)

diff --git a/drivers/mfd/tps65217.c b/drivers/mfd/tps65217.c
index c240fac0ede7..a1e9b9e22d82 100644
--- a/drivers/mfd/tps65217.c
+++ b/drivers/mfd/tps65217.c
@@ -146,6 +146,21 @@ static const struct irq_domain_ops tps65217_irq_domain_ops = {
 	.map = tps65217_irq_map,
 };
 
+static void tps65217_irq_exit(void *data)
+{
+	struct tps65217 *tps = data;
+	unsigned int virq;
+
+	for (int i = 0; i < TPS65217_NUM_IRQ; i++) {
+		virq = irq_find_mapping(tps->irq_domain, i);
+		if (virq)
+			irq_dispose_mapping(virq);
+	}
+
+	irq_domain_remove(tps->irq_domain);
+	tps->irq_domain = NULL;
+}
+
 static int tps65217_irq_init(struct tps65217 *tps, int irq)
 {
 	int ret;
@@ -165,6 +180,10 @@ static int tps65217_irq_init(struct tps65217 *tps, int irq)
 		return -ENOMEM;
 	}
 
+	ret = devm_add_action_or_reset(tps->dev, tps65217_irq_exit, tps);
+	if (ret)
+		return ret;
+
 	ret = devm_request_threaded_irq(tps->dev, irq, NULL,
 					tps65217_irq_thread, IRQF_ONESHOT,
 					"tps65217-irq", tps);
@@ -333,7 +352,9 @@ static int tps65217_probe(struct i2c_client *client)
 	}
 
 	if (client->irq) {
-		tps65217_irq_init(tps, client->irq);
+		ret = tps65217_irq_init(tps, client->irq);
+		if (ret)
+			return ret;
 	} else {
 		int i;
 
@@ -373,22 +394,6 @@ static int tps65217_probe(struct i2c_client *client)
 	return 0;
 }
 
-static void tps65217_remove(struct i2c_client *client)
-{
-	struct tps65217 *tps = i2c_get_clientdata(client);
-	unsigned int virq;
-	int i;
-
-	for (i = 0; i < TPS65217_NUM_IRQ; i++) {
-		virq = irq_find_mapping(tps->irq_domain, i);
-		if (virq)
-			irq_dispose_mapping(virq);
-	}
-
-	irq_domain_remove(tps->irq_domain);
-	tps->irq_domain = NULL;
-}
-
 static const struct i2c_device_id tps65217_id_table[] = {
 	{"tps65217", TPS65217},
 	{ /* sentinel */ }
@@ -402,7 +407,6 @@ static struct i2c_driver tps65217_driver = {
 	},
 	.id_table	= tps65217_id_table,
 	.probe		= tps65217_probe,
-	.remove		= tps65217_remove,
 };
 
 static int __init tps65217_init(void)
-- 
2.56.0.218.g1ec904b173-goog

[PATCH 25/28] mfd: mt6397: Manage IRQ domain lifecycle with devres

[Lee Jones]

mt6397_irq_init() and mt6358_irq_init() create chip->irq_domain with
irq_domain_create_linear() before registering the parent interrupt via
devm_request_threaded_irq().  If devm_mfd_add_devices() fails in
mt6397_probe(), irq_domain_remove() is called before devres frees the
threaded IRQ and without disposing child IRQ mappings, allowing an
in-flight interrupt handler or late IRQ lookup to dereference the
removed domain.  Conversely, when the driver is unbound, the IRQ
mappings and domain are never removed at all.

Register a devres action immediately after irq_domain_create_linear() to
dispose all mapped hardware interrupts and remove chip->irq_domain so
that the domain is torn down after child MFD devices and the managed IRQ
handler have been released on both probe failure and unbind.

Fixes: 6df8dd5c185b ("mfd: Add support for the MediaTek MT6397 PMIC")
Closes: https://sashiko.dev/#/bug/linux-b296fbe4-6e83-40c0-91c7-2c31e8d226d0
Cc: stable@vger.kernel.org
Signed-off-by: Lee Jones <lee@kernel.org>
---
 drivers/mfd/mt6358-irq.c  | 17 ++++++++++++++++-
 drivers/mfd/mt6397-core.c |  4 +---
 drivers/mfd/mt6397-irq.c  | 16 +++++++++++++++-
 3 files changed, 32 insertions(+), 5 deletions(-)

diff --git a/drivers/mfd/mt6358-irq.c b/drivers/mfd/mt6358-irq.c
index 74cf20843044..c747cae909ea 100644
--- a/drivers/mfd/mt6358-irq.c
+++ b/drivers/mfd/mt6358-irq.c
@@ -224,6 +224,17 @@ static const struct irq_domain_ops mt6358_irq_domain_ops = {
 	.xlate = irq_domain_xlate_twocell,
 };
 
+static void mt6358_irq_domain_remove(void *data)
+{
+	struct mt6397_chip *chip = data;
+	struct pmic_irq_data *irqd = chip->irq_data;
+
+	for (unsigned int hwirq = 0; hwirq < irqd->num_pmic_irqs; hwirq++)
+		irq_dispose_mapping(irq_find_mapping(chip->irq_domain, hwirq));
+
+	irq_domain_remove(chip->irq_domain);
+}
+
 int mt6358_irq_init(struct mt6397_chip *chip)
 {
 	int i, j, ret;
@@ -279,13 +290,17 @@ int mt6358_irq_init(struct mt6397_chip *chip)
 		return -ENODEV;
 	}
 
+	ret = devm_add_action_or_reset(chip->dev, mt6358_irq_domain_remove,
+				       chip);
+	if (ret)
+		return ret;
+
 	ret = devm_request_threaded_irq(chip->dev, chip->irq, NULL,
 					mt6358_irq_handler, IRQF_ONESHOT,
 					mt6358_irq_chip.name, chip);
 	if (ret) {
 		dev_err(chip->dev, "Failed to register IRQ=%d, ret=%d\n",
 			chip->irq, ret);
-		irq_domain_remove(chip->irq_domain);
 		return ret;
 	}
 
diff --git a/drivers/mfd/mt6397-core.c b/drivers/mfd/mt6397-core.c
index 9ec951996588..e94e37cba249 100644
--- a/drivers/mfd/mt6397-core.c
+++ b/drivers/mfd/mt6397-core.c
@@ -395,10 +395,8 @@ static int mt6397_probe(struct platform_device *pdev)
 	ret = devm_mfd_add_devices(&pdev->dev, PLATFORM_DEVID_NONE,
 				   pmic_core->cells, pmic_core->cell_size,
 				   NULL, 0, pmic->irq_domain);
-	if (ret) {
-		irq_domain_remove(pmic->irq_domain);
+	if (ret)
 		dev_err(&pdev->dev, "failed to add child devices: %d\n", ret);
-	}
 
 	return ret;
 }
diff --git a/drivers/mfd/mt6397-irq.c b/drivers/mfd/mt6397-irq.c
index 5d2e5459f744..58645dbd8095 100644
--- a/drivers/mfd/mt6397-irq.c
+++ b/drivers/mfd/mt6397-irq.c
@@ -169,6 +169,16 @@ static int mt6397_irq_pm_notifier(struct notifier_block *notifier,
 	return NOTIFY_DONE;
 }
 
+static void mt6397_irq_domain_remove(void *data)
+{
+	struct mt6397_chip *chip = data;
+
+	for (int hwirq = 0; hwirq < MT6397_IRQ_NR; hwirq++)
+		irq_dispose_mapping(irq_find_mapping(chip->irq_domain, hwirq));
+
+	irq_domain_remove(chip->irq_domain);
+}
+
 int mt6397_irq_init(struct mt6397_chip *chip)
 {
 	int ret;
@@ -223,13 +233,17 @@ int mt6397_irq_init(struct mt6397_chip *chip)
 		return -ENOMEM;
 	}
 
+	ret = devm_add_action_or_reset(chip->dev, mt6397_irq_domain_remove,
+				       chip);
+	if (ret)
+		return ret;
+
 	ret = devm_request_threaded_irq(chip->dev, chip->irq, NULL,
 					mt6397_irq_thread, IRQF_ONESHOT,
 					"mt6397-pmic", chip);
 	if (ret) {
 		dev_err(chip->dev, "failed to register irq=%d; err: %d\n",
 			chip->irq, ret);
-		irq_domain_remove(chip->irq_domain);
 		return ret;
 	}
 
-- 
2.56.0.218.g1ec904b173-goog

[PATCH 26/28] mfd: mt6397: Unregister PM notifier on probe failure and unbind

[Lee Jones]

mt6397_irq_init() registers a power management notifier block embedded
in the devres-managed struct mt6397_chip via register_pm_notifier(),
but never unregisters it if mt6397_probe() later fails or when the
driver is unbound.  Once devres frees struct mt6397_chip, the dangling
notifier block corrupts the global PM notifier chain and causes a
use-after-free on subsequent suspend or resume transitions.

Check the return value of register_pm_notifier() and register a devres
action to unregister the PM notifier on probe failure or device unbind.

Fixes: 4e2e7cfec13a ("mfd: mt6397: Modify suspend/resume behavior")
Closes: https://sashiko.dev/#/bug/linux-edb62fbc-213a-49a2-be55-c002e234e554
Cc: stable@vger.kernel.org
Signed-off-by: Lee Jones <lee@kernel.org>
---
 drivers/mfd/mt6397-irq.c | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/drivers/mfd/mt6397-irq.c b/drivers/mfd/mt6397-irq.c
index 58645dbd8095..bc7ca22d6f17 100644
--- a/drivers/mfd/mt6397-irq.c
+++ b/drivers/mfd/mt6397-irq.c
@@ -179,6 +179,13 @@ static void mt6397_irq_domain_remove(void *data)
 	irq_domain_remove(chip->irq_domain);
 }
 
+static void mt6397_unregister_pm_notifier(void *data)
+{
+	struct mt6397_chip *chip = data;
+
+	unregister_pm_notifier(&chip->pm_nb);
+}
+
 int mt6397_irq_init(struct mt6397_chip *chip)
 {
 	int ret;
@@ -247,6 +254,10 @@ int mt6397_irq_init(struct mt6397_chip *chip)
 		return ret;
 	}
 
-	register_pm_notifier(&chip->pm_nb);
-	return 0;
+	ret = register_pm_notifier(&chip->pm_nb);
+	if (ret)
+		return ret;
+
+	return devm_add_action_or_reset(chip->dev,
+					mt6397_unregister_pm_notifier, chip);
 }
-- 
2.56.0.218.g1ec904b173-goog

[PATCH 27/28] i2c: cgbc: Propagate hardware errors when polling read status

[Lee Jones]

In cgbc_i2c_xfer_msg(), read_poll_timeout() uses the same ret variable
to store the polled return value of cgbc_i2c_get_status() and the
timeout result of the macro itself.  When cgbc_i2c_get_status() returns
a negative error code (such as -EIO on an I2C NACK), the loop condition
ret != CGBC_I2C_STAT_BUSY evaluates to true and read_poll_timeout()
overwrites ret with 0.  The driver then issues CGBC_I2C_CMD_DATA, which
completes with CGBC_STATUS_CMD_READY without populating msg->buf,
leaving uninitialised heap memory in the caller's read buffer.

Store the polled status in a separate variable, verify that it equals
CGBC_I2C_STAT_DAT, and check that CGBC_I2C_CMD_DATA returns the expected
number of bytes.

Fixes: 6894f640b8f3 ("i2c: Congatec Board Controller i2c bus driver")
Closes: https://sashiko.dev/#/bug/linux-66cbf4b1-a219-4012-969d-236417bf419a
Cc: stable@vger.kernel.org
Signed-off-by: Lee Jones <lee@kernel.org>
---
 drivers/i2c/busses/i2c-cgbc.c | 27 +++++++++++++++++++++------
 1 file changed, 21 insertions(+), 6 deletions(-)

diff --git a/drivers/i2c/busses/i2c-cgbc.c b/drivers/i2c/busses/i2c-cgbc.c
index 25a74fa51aa0..9909c25f0b18 100644
--- a/drivers/i2c/busses/i2c-cgbc.c
+++ b/drivers/i2c/busses/i2c-cgbc.c
@@ -205,9 +205,9 @@ static int cgbc_i2c_xfer_msg(struct i2c_adapter *adap)
 	struct cgbc_device_data *cgbc = i2c->cgbc;
 	struct i2c_msg *msg = i2c->msg;
 	u8 cmd[CGBC_I2C_CMD_SIZE];
-	int ret, max_len, len, i;
+	int ret, status, max_len, len, i;
 	unsigned int cmd_len;
-	u8 cmd_data;
+	u8 cmd_data, data_len;
 
 	struct cgbc_i2c_transfer xfer = {
 		.bus_id = algo_data->bus_id,
@@ -266,17 +266,32 @@ static int cgbc_i2c_xfer_msg(struct i2c_adapter *adap)
 		if (ret)
 			goto err;
 
-		ret = read_poll_timeout(cgbc_i2c_get_status, ret,
-					ret != CGBC_I2C_STAT_BUSY, 0,
+		ret = read_poll_timeout(cgbc_i2c_get_status, status,
+					status != CGBC_I2C_STAT_BUSY, 0,
 					2 * algo_data->read_maxtime_us, false, adap);
-		if (ret < 0)
+		if (ret)
 			goto err;
 
+		if (status < 0) {
+			ret = status;
+			goto err;
+		}
+
+		if (status != CGBC_I2C_STAT_DAT) {
+			ret = -EIO;
+			goto err;
+		}
+
 		cmd_data = CGBC_I2C_CMD_DATA | algo_data->bus_id;
 		ret = cgbc_command(cgbc, &cmd_data, sizeof(cmd_data),
-				   msg->buf + i2c->pos, len, NULL);
+				   msg->buf + i2c->pos, len, &data_len);
 		if (ret)
 			goto err;
+
+		if (data_len != len) {
+			ret = -EIO;
+			goto err;
+		}
 	}
 
 	if (len == (msg->len - i2c->pos)) {
-- 
2.56.0.218.g1ec904b173-goog

Re: [PATCH 27/28] i2c: cgbc: Propagate hardware errors when polling read status

[Thomas Richard (congatec GmbH)]

> In cgbc_i2c_xfer_msg(), read_poll_timeout() uses the same ret variable
> to store the polled return value of cgbc_i2c_get_status() and the
> timeout result of the macro itself.  When cgbc_i2c_get_status() returns
> a negative error code (such as -EIO on an I2C NACK), the loop condition
> ret != CGBC_I2C_STAT_BUSY evaluates to true and read_poll_timeout()
> overwrites ret with 0.  The driver then issues CGBC_I2C_CMD_DATA, which
> completes with CGBC_STATUS_CMD_READY without populating msg->buf,
> leaving uninitialised heap memory in the caller's read buffer.
> 
> Store the polled status in a separate variable, verify that it equals
> CGBC_I2C_STAT_DAT, and check that CGBC_I2C_CMD_DATA returns the expected
> number of bytes.
> 
> Fixes: 6894f640b8f3 ("i2c: Congatec Board Controller i2c bus driver")
> Closes: https://sashiko.dev/#/bug/linux-66cbf4b1-a219-4012-969d-236417bf419a
> Cc: stable@vger.kernel.org
> Signed-off-by: Lee Jones <lee@kernel.org>
>
> diff --git a/drivers/i2c/busses/i2c-cgbc.c b/drivers/i2c/busses/i2c-cgbc.c
> index 682ba639d887..3226838cca46 100644
> --- a/drivers/i2c/busses/i2c-cgbc.c
> +++ b/drivers/i2c/busses/i2c-cgbc.c
> @@ -198,9 +198,9 @@ static int cgbc_i2c_xfer_msg(struct i2c_adapter *adap)
>  	struct cgbc_device_data *cgbc = i2c->cgbc;
>  	struct i2c_msg *msg = i2c->msg;
>  	u8 cmd[CGBC_I2C_CMD_SIZE];
> -	int ret, max_len, len, i;
> +	int ret, status, max_len, len, i;
>  	unsigned int cmd_len;
> -	u8 cmd_data;
> +	u8 cmd_data, data_len;
>  
>  	struct cgbc_i2c_transfer xfer = {
>  		.bus_id = i2c->bus_id,
> @@ -259,17 +259,32 @@ static int cgbc_i2c_xfer_msg(struct i2c_adapter *adap)
>  		if (ret)
>  			goto err;
>  
> -		ret = read_poll_timeout(cgbc_i2c_get_status, ret,
> -					ret != CGBC_I2C_STAT_BUSY, 0,
> +		ret = read_poll_timeout(cgbc_i2c_get_status, status,
> +					status != CGBC_I2C_STAT_BUSY, 0,
>  					2 * i2c->read_maxtime_us, false, adap);
> -		if (ret < 0)
> +		if (ret)
> +			goto err;
> +
> +		if (status < 0) {
> +			ret = status;
>  			goto err;
> +		}
> +
> +		if (status != CGBC_I2C_STAT_DAT) {
> +			ret = -EIO;
> +			goto err;
> +		}

We could save a goto and make code more readable IMO

if (ret)
	goto err;

if (status != CGBC_I2C_STAT_DAT) {
	ret = (status < 0) ? status : -EIO;
	goto err;
}

>  
>  		cmd_data = CGBC_I2C_CMD_DATA | i2c->bus_id;
>  		ret = cgbc_command(cgbc, &cmd_data, sizeof(cmd_data),
> -				   msg->buf + i2c->pos, len, NULL);
> +				   msg->buf + i2c->pos, len, &data_len);
>  		if (ret)
>  			goto err;
> +
> +		if (data_len != len) {
> +			ret = -EIO;
> +			goto err;
> +		}
>  	}
>  
>  	if (len == (msg->len - i2c->pos)) {

Otherwise looks good to me.

Reviewed-by: Thomas Richard (congatec GmbH) <thomas.richard@bootlin.com>
Tested-by: Thomas Richard (congatec GmbH) <thomas.richard@bootlin.com>

Best Regards,
Thomas

-- 
Thomas Richard (congatec GmbH) <thomas.richard@bootlin.com>

Re: [PATCH 27/28] i2c: cgbc: Propagate hardware errors when polling read status

[Lee Jones]

On Fri, 23 Oct 2026, Thomas Richard (congatec GmbH) wrote:

> > In cgbc_i2c_xfer_msg(), read_poll_timeout() uses the same ret variable
> > to store the polled return value of cgbc_i2c_get_status() and the
> > timeout result of the macro itself.  When cgbc_i2c_get_status() returns
> > a negative error code (such as -EIO on an I2C NACK), the loop condition
> > ret != CGBC_I2C_STAT_BUSY evaluates to true and read_poll_timeout()
> > overwrites ret with 0.  The driver then issues CGBC_I2C_CMD_DATA, which
> > completes with CGBC_STATUS_CMD_READY without populating msg->buf,
> > leaving uninitialised heap memory in the caller's read buffer.
> > 
> > Store the polled status in a separate variable, verify that it equals
> > CGBC_I2C_STAT_DAT, and check that CGBC_I2C_CMD_DATA returns the expected
> > number of bytes.
> > 
> > Fixes: 6894f640b8f3 ("i2c: Congatec Board Controller i2c bus driver")
> > Closes: https://sashiko.dev/#/bug/linux-66cbf4b1-a219-4012-969d-236417bf419a
> > Cc: stable@vger.kernel.org
> > Signed-off-by: Lee Jones <lee@kernel.org>
> >
> > diff --git a/drivers/i2c/busses/i2c-cgbc.c b/drivers/i2c/busses/i2c-cgbc.c
> > index 682ba639d887..3226838cca46 100644
> > --- a/drivers/i2c/busses/i2c-cgbc.c
> > +++ b/drivers/i2c/busses/i2c-cgbc.c
> > @@ -198,9 +198,9 @@ static int cgbc_i2c_xfer_msg(struct i2c_adapter *adap)
> >  	struct cgbc_device_data *cgbc = i2c->cgbc;
> >  	struct i2c_msg *msg = i2c->msg;
> >  	u8 cmd[CGBC_I2C_CMD_SIZE];
> > -	int ret, max_len, len, i;
> > +	int ret, status, max_len, len, i;
> >  	unsigned int cmd_len;
> > -	u8 cmd_data;
> > +	u8 cmd_data, data_len;
> >  
> >  	struct cgbc_i2c_transfer xfer = {
> >  		.bus_id = i2c->bus_id,
> > @@ -259,17 +259,32 @@ static int cgbc_i2c_xfer_msg(struct i2c_adapter *adap)
> >  		if (ret)
> >  			goto err;
> >  
> > -		ret = read_poll_timeout(cgbc_i2c_get_status, ret,
> > -					ret != CGBC_I2C_STAT_BUSY, 0,
> > +		ret = read_poll_timeout(cgbc_i2c_get_status, status,
> > +					status != CGBC_I2C_STAT_BUSY, 0,
> >  					2 * i2c->read_maxtime_us, false, adap);
> > -		if (ret < 0)
> > +		if (ret)
> > +			goto err;
> > +
> > +		if (status < 0) {
> > +			ret = status;
> >  			goto err;
> > +		}
> > +
> > +		if (status != CGBC_I2C_STAT_DAT) {
> > +			ret = -EIO;
> > +			goto err;
> > +		}
> 
> We could save a goto and make code more readable IMO
> 
> if (ret)
> 	goto err;
> 
> if (status != CGBC_I2C_STAT_DAT) {
> 	ret = (status < 0) ? status : -EIO;

Ternary operators certainly do not make the code _more_ readable.

Concise, yes.  Readable, no.  The current code is preferable.

> }
> 
> >  
> >  		cmd_data = CGBC_I2C_CMD_DATA | i2c->bus_id;
> >  		ret = cgbc_command(cgbc, &cmd_data, sizeof(cmd_data),
> > -				   msg->buf + i2c->pos, len, NULL);
> > +				   msg->buf + i2c->pos, len, &data_len);
> >  		if (ret)
> >  			goto err;
> > +
> > +		if (data_len != len) {
> > +			ret = -EIO;
> > +			goto err;
> > +		}
> >  	}
> >  
> >  	if (len == (msg->len - i2c->pos)) {
> 
> Otherwise looks good to me.
> 
> Reviewed-by: Thomas Richard (congatec GmbH) <thomas.richard@bootlin.com>
> Tested-by: Thomas Richard (congatec GmbH) <thomas.richard@bootlin.com>

Thanks for these.  Much appreciated.

-- 
Lee Jones

[PATCH 28/28] mfd: ti_am335x_tscadc: Remove redundant ti_tscadc_dev_get() helper

[Lee Jones]

Now that ti_tscadc_dev_get() is a single-line wrapper around
dev_get_drvdata(p->dev.parent), remove the bespoke helper and retrieve
the parent driver data directly in the child ADC and touchscreen
drivers.

Signed-off-by: Lee Jones <lee@kernel.org>
---
 drivers/iio/adc/ti_am335x_adc.c           | 2 +-
 drivers/input/touchscreen/ti_am335x_tsc.c | 2 +-
 include/linux/mfd/ti_am335x_tscadc.h      | 5 -----
 3 files changed, 2 insertions(+), 7 deletions(-)

diff --git a/drivers/iio/adc/ti_am335x_adc.c b/drivers/iio/adc/ti_am335x_adc.c
index 1516dd332f90..77ea59d6c6b7 100644
--- a/drivers/iio/adc/ti_am335x_adc.c
+++ b/drivers/iio/adc/ti_am335x_adc.c
@@ -636,7 +636,7 @@ static int tiadc_probe(struct platform_device *pdev)
 
 	adc_dev = iio_priv(indio_dev);
 
-	adc_dev->mfd_tscadc = ti_tscadc_dev_get(pdev);
+	adc_dev->mfd_tscadc = dev_get_drvdata(pdev->dev.parent);
 	tiadc_parse_dt(pdev, adc_dev);
 
 	indio_dev->name = dev_name(&pdev->dev);
diff --git a/drivers/input/touchscreen/ti_am335x_tsc.c b/drivers/input/touchscreen/ti_am335x_tsc.c
index 623546e80668..40ffdec9d207 100644
--- a/drivers/input/touchscreen/ti_am335x_tsc.c
+++ b/drivers/input/touchscreen/ti_am335x_tsc.c
@@ -418,7 +418,7 @@ static int titsc_probe(struct platform_device *pdev)
 {
 	struct titsc *ts_dev;
 	struct input_dev *input_dev;
-	struct ti_tscadc_dev *tscadc_dev = ti_tscadc_dev_get(pdev);
+	struct ti_tscadc_dev *tscadc_dev = dev_get_drvdata(pdev->dev.parent);
 	int err;
 
 	/* Allocate memory for device */
diff --git a/include/linux/mfd/ti_am335x_tscadc.h b/include/linux/mfd/ti_am335x_tscadc.h
index 4a048a897cf3..36d365b64fe6 100644
--- a/include/linux/mfd/ti_am335x_tscadc.h
+++ b/include/linux/mfd/ti_am335x_tscadc.h
@@ -175,11 +175,6 @@ struct ti_tscadc_dev {
 	struct adc_device *adc;
 };
 
-static inline struct ti_tscadc_dev *ti_tscadc_dev_get(struct platform_device *p)
-{
-	return dev_get_drvdata(p->dev.parent);
-}
-
 static inline bool ti_adc_with_touchscreen(struct ti_tscadc_dev *tscadc)
 {
 	return of_device_is_compatible(tscadc->dev->of_node,
-- 
2.56.0.218.g1ec904b173-goog

Re: [PATCH 28/28] mfd: ti_am335x_tscadc: Remove redundant ti_tscadc_dev_get() helper

[Andy Shevchenko]

On Wed, Oct 21, 2026 at 12:09:50PM +0000, Lee Jones wrote:
> Now that ti_tscadc_dev_get() is a single-line wrapper around
> dev_get_drvdata(p->dev.parent), remove the bespoke helper and retrieve
> the parent driver data directly in the child ADC and touchscreen
> drivers.

I don't see more patches Cc'ed to me, so I don't know if this one makes sense
or not, but OTOH I don't care much, both approaches are fine with me.

Acked-by: Andy Shevchenko <andriy.shevchenko@intel.com>

-- 
With Best Regards,
Andy Shevchenko

Re: [PATCH 28/28] mfd: ti_am335x_tscadc: Remove redundant ti_tscadc_dev_get() helper

[Dmitry Torokhov]

On Wed, Oct 21, 2026 at 12:09:50PM +0000, Lee Jones wrote:
> Now that ti_tscadc_dev_get() is a single-line wrapper around
> dev_get_drvdata(p->dev.parent), remove the bespoke helper and retrieve
> the parent driver data directly in the child ADC and touchscreen
> drivers.
> 
> Signed-off-by: Lee Jones <lee@kernel.org>
> ---
>  drivers/iio/adc/ti_am335x_adc.c           | 2 +-
>  drivers/input/touchscreen/ti_am335x_tsc.c | 2 +-

Acked-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> # for input

Thanks.

-- 
Dmitry

Re: [PATCH 28/28] mfd: ti_am335x_tscadc: Remove redundant ti_tscadc_dev_get() helper

[Jonathan Cameron]

On Wed, 21 Oct 2026 12:09:50 +0000
Lee Jones <lee@kernel.org> wrote:

> Now that ti_tscadc_dev_get() is a single-line wrapper around
> dev_get_drvdata(p->dev.parent), remove the bespoke helper and retrieve
> the parent driver data directly in the child ADC and touchscreen
> drivers.
> 
> Signed-off-by: Lee Jones <lee@kernel.org>
Acked-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>

Seems moderately unlikely we will get a flurry of activity on
this driver and if we do merge conflicts should be minimal
so no need for an immutable I think.

J
> ---
>  drivers/iio/adc/ti_am335x_adc.c           | 2 +-
>  drivers/input/touchscreen/ti_am335x_tsc.c | 2 +-
>  include/linux/mfd/ti_am335x_tscadc.h      | 5 -----
>  3 files changed, 2 insertions(+), 7 deletions(-)
> 
> diff --git a/drivers/iio/adc/ti_am335x_adc.c b/drivers/iio/adc/ti_am335x_adc.c
> index 1516dd332f90..77ea59d6c6b7 100644
> --- a/drivers/iio/adc/ti_am335x_adc.c
> +++ b/drivers/iio/adc/ti_am335x_adc.c
> @@ -636,7 +636,7 @@ static int tiadc_probe(struct platform_device *pdev)
>  
>  	adc_dev = iio_priv(indio_dev);
>  
> -	adc_dev->mfd_tscadc = ti_tscadc_dev_get(pdev);
> +	adc_dev->mfd_tscadc = dev_get_drvdata(pdev->dev.parent);
>  	tiadc_parse_dt(pdev, adc_dev);
>  
>  	indio_dev->name = dev_name(&pdev->dev);
> diff --git a/drivers/input/touchscreen/ti_am335x_tsc.c b/drivers/input/touchscreen/ti_am335x_tsc.c
> index 623546e80668..40ffdec9d207 100644
> --- a/drivers/input/touchscreen/ti_am335x_tsc.c
> +++ b/drivers/input/touchscreen/ti_am335x_tsc.c
> @@ -418,7 +418,7 @@ static int titsc_probe(struct platform_device *pdev)
>  {
>  	struct titsc *ts_dev;
>  	struct input_dev *input_dev;
> -	struct ti_tscadc_dev *tscadc_dev = ti_tscadc_dev_get(pdev);
> +	struct ti_tscadc_dev *tscadc_dev = dev_get_drvdata(pdev->dev.parent);
>  	int err;
>  
>  	/* Allocate memory for device */
> diff --git a/include/linux/mfd/ti_am335x_tscadc.h b/include/linux/mfd/ti_am335x_tscadc.h
> index 4a048a897cf3..36d365b64fe6 100644
> --- a/include/linux/mfd/ti_am335x_tscadc.h
> +++ b/include/linux/mfd/ti_am335x_tscadc.h
> @@ -175,11 +175,6 @@ struct ti_tscadc_dev {
>  	struct adc_device *adc;
>  };
>  
> -static inline struct ti_tscadc_dev *ti_tscadc_dev_get(struct platform_device *p)
> -{
> -	return dev_get_drvdata(p->dev.parent);
> -}
> -
>  static inline bool ti_adc_with_touchscreen(struct ti_tscadc_dev *tscadc)
>  {
>  	return of_device_is_compatible(tscadc->dev->of_node,