From: Lee Jones <lee@kernel.org>
To: lee@kernel.org, Linus Walleij <linusw@kernel.org>,
Srinidhi Kasagar <srinidhi.kasagar@stericsson.com>,
Rabin Vincent <rabin.vincent@stericsson.com>,
Mattias Wallin <mattias.wallin@stericsson.com>,
linux-arm-kernel@lists.infradead.org, mfd@lists.linux.dev,
linux-kernel@vger.kernel.org
Cc: stable@vger.kernel.org
Subject: [PATCH v2 22/27] mfd: ab8500-core: Register sysfs attribute groups via devm_device_add_group()
Date: Tue, 27 Oct 2026 09:30:51 +0000 [thread overview]
Message-ID: <20261027093306.2812695-23-lee@kernel.org> (raw)
In-Reply-To: <20261027093306.2812695-1-lee@kernel.org>
ab8500_probe() registers up to two sysfs attribute groups with
sysfs_create_group(). On AB8505 and AB9540 (cut 2.0 and later), the
second sysfs_create_group() call unconditionally overwrites the return
value of the first, and if the second call fails, ab8500_probe() returns
an error without removing the first group. Because the driver context
is freed and driver data is cleared on probe failure, reading any leaked
sysfs attribute dereferences a NULL ab8500 pointer in
get_register_interruptible().
Register the attribute groups via devm_device_add_group() and only
register the second group when the first succeeds so that devres
automatically cleans up registered sysfs attributes on probe failure.
Fixes: 93ff722e8853 ("ab8500-fg: Add power cut feature for ab8505 and ab8540")
Closes: https://sashiko.dev/#/bug/linux-a9ac1a9d-5a97-4ad3-b4c5-c7775c24a333
Cc: stable@vger.kernel.org
Reviewed-by: Linus Walleij <linusw@kernel.org>
Signed-off-by: Lee Jones <lee@kernel.org>
---
drivers/mfd/ab8500-core.c | 11 ++++-------
1 file changed, 4 insertions(+), 7 deletions(-)
diff --git a/drivers/mfd/ab8500-core.c b/drivers/mfd/ab8500-core.c
index 86fa99022cb3..408bad2f577a 100644
--- a/drivers/mfd/ab8500-core.c
+++ b/drivers/mfd/ab8500-core.c
@@ -1232,16 +1232,13 @@ static int ab8500_probe(struct platform_device *pdev)
if (((is_ab8505(ab8500) || is_ab9540(ab8500)) &&
ab8500->chip_id >= AB8500_CUT2P0) || is_ab8540(ab8500))
- ret = sysfs_create_group(&ab8500->dev->kobj,
- &ab9540_attr_group);
+ ret = devm_device_add_group(ab8500->dev, &ab9540_attr_group);
else
- ret = sysfs_create_group(&ab8500->dev->kobj,
- &ab8500_attr_group);
+ ret = devm_device_add_group(ab8500->dev, &ab8500_attr_group);
if ((is_ab8505(ab8500) || is_ab9540(ab8500)) &&
- ab8500->chip_id >= AB8500_CUT2P0)
- ret = sysfs_create_group(&ab8500->dev->kobj,
- &ab8505_attr_group);
+ ab8500->chip_id >= AB8500_CUT2P0 && !ret)
+ ret = devm_device_add_group(ab8500->dev, &ab8505_attr_group);
if (ret)
dev_err(ab8500->dev, "error creating sysfs entries\n");
--
2.56.0.307.g5fe7bd680c-goog
next prev parent reply other threads:[~2026-10-27 10:38 UTC|newest]
Thread overview: 21+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-27 9:30 [PATCH v2 00/27] mfd: Assorted resource lifetime, teardown, and error-handling fixes Lee Jones
2026-10-27 9:30 ` [PATCH v2 07/27] mfd: db8500-prcmu: Make AB8500 cell and IRQ resource static Lee Jones
2026-10-27 9:30 ` [PATCH v2 12/27] mfd: twl-core: Clear pm_power_off callback in twl_remove() Lee Jones
2026-10-27 9:30 ` [PATCH v2 13/27] mfd: twl-core: Clear twl_priv pointer on teardown and probe failure Lee Jones
2026-10-28 15:50 ` Andreas Kemnade
2026-10-27 9:30 ` [PATCH v2 14/27] mfd: loongson-se: Check return value of dma_set_mask_and_coherent() Lee Jones
2026-10-27 9:30 ` [PATCH v2 15/27] mfd: loongson-se: Zero-initialise controller command structures Lee Jones
2026-10-27 9:30 ` [PATCH v2 16/27] mfd: loongson-se: Reinitialise completions and wait uninterruptibly for commands Lee Jones
2026-10-27 9:30 ` [PATCH v2 17/27] mfd: loongson-se: Zero-allocate driver data and initialise engine completions in probe Lee Jones
2026-10-27 9:30 ` [PATCH v2 18/27] mfd: loongson-se: Prevent out-of-bounds engine access in se_irq_handler() Lee Jones
2026-10-27 9:30 ` [PATCH v2 19/27] mfd: loongson-se: Stop controller and mask interrupts on teardown and shutdown Lee Jones
2026-10-27 9:30 ` [PATCH v2 20/27] mfd: loongson-se: Validate engine ID, DMA buffer size, and IRQ registration Lee Jones
2026-10-27 9:30 ` [PATCH v2 21/27] mfd: abx500-core: Unregister device ops on devm release Lee Jones
2026-10-27 9:30 ` Lee Jones [this message]
2026-10-27 9:30 ` [PATCH v2 23/27] mfd: tps65217: Manage IRQ domain teardown via devres Lee Jones
2026-10-27 9:30 ` [PATCH v2 24/27] mfd: mt6397: Manage IRQ domain lifecycle with devres Lee Jones
2026-10-28 3:45 ` Chen-Yu Tsai
2026-10-27 9:30 ` [PATCH v2 25/27] mfd: mt6397: Unregister PM notifier on probe failure and unbind Lee Jones
2026-10-28 4:15 ` Chen-Yu Tsai
2026-10-27 9:30 ` [PATCH v2 26/27] i2c: cgbc: Propagate hardware errors when polling read status Lee Jones
2026-10-27 9:30 ` [PATCH v2 27/27] mfd: ti_am335x_tscadc: Remove redundant ti_tscadc_dev_get() helper Lee Jones
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261027093306.2812695-23-lee@kernel.org \
--to=lee@kernel.org \
--cc=linusw@kernel.org \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mattias.wallin@stericsson.com \
--cc=mfd@lists.linux.dev \
--cc=rabin.vincent@stericsson.com \
--cc=srinidhi.kasagar@stericsson.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.