[PATCH v2 01/10] regmap: fix reinit cache failure handling

[Peng Fan <peng.fan@linux.dev>]

From: Peng Fan <peng.fan@nxp.com>

regmap_reinit_cache() tears down the existing cache and then updates the
map configuration. regcache_exit() frees reg_defaults_raw when cache_free
is set but does not clear cache_free or the pointer, and neither
regmap_set_name() nor regcache_init() resets map->cache_type on failure.
The old cache_ops pointer also remains set when reinitialising to
REGCACHE_NONE.

If the reinitialisation then fails, a later regmap_exit() calls
regcache_exit() again. It frees reg_defaults_raw a second time and runs
cache_ops->exit() on the already torn-down cache. A stale cache_ops can
also make regmap_volatile() treat registers as cacheable on a map that
has no cache.

Clear cache_free and reg_defaults_raw in regcache_hw_exit(), and clear
the old cache_ops right after regcache_exit() so a reinitialisation to
REGCACHE_NONE cannot leave stale ops behind. Mark the map as having no
cache when regmap_reinit_cache() fails after tearing down the old one.
Assign the new cache type only after regmap_set_name() has succeeded so
the failure paths cannot leave a type without cache ops.

Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/bug/linux-5693609c-7965-4f36-ae8f-30c610e10a33
Fixes: bf315173359b ("regmap: Allow drivers to reinitialise the register cache at runtime")
Signed-off-by: Peng Fan <peng.fan@nxp.com>
---
 drivers/base/regmap/regcache.c |  8 ++++++--
 drivers/base/regmap/regmap.c   | 12 +++++++++---
 2 files changed, 15 insertions(+), 5 deletions(-)

diff --git a/drivers/base/regmap/regcache.c b/drivers/base/regmap/regcache.c
index 1447967ff00b..2954e73180ed 100644
--- a/drivers/base/regmap/regcache.c
+++ b/drivers/base/regmap/regcache.c
@@ -122,8 +122,11 @@ static int regcache_hw_init(struct regmap *map, int count)
 
 static void regcache_hw_exit(struct regmap *map)
 {
-	if (map->cache_free)
+	if (map->cache_free) {
 		kfree(map->reg_defaults_raw);
+		map->reg_defaults_raw = NULL;
+		map->cache_free = false;
+	}
 }
 
 static int regcache_locked_op(struct regmap *map,
@@ -282,12 +285,13 @@ int regcache_init(struct regmap *map, const struct regmap_config *config)
 
 void regcache_exit(struct regmap *map)
 {
+	regcache_hw_exit(map);
+
 	if (map->cache_type == REGCACHE_NONE)
 		return;
 
 	BUG_ON(!map->cache_ops);
 
-	regcache_hw_exit(map);
 	if (map->cache_ops->exit) {
 		dev_dbg(map->dev, "Destroying %s cache\n",
 			map->cache_ops->name);
diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
index a0e14dc1f6f6..327ae2ea9729 100644
--- a/drivers/base/regmap/regmap.c
+++ b/drivers/base/regmap/regmap.c
@@ -1424,6 +1424,7 @@ int regmap_reinit_cache(struct regmap *map, const struct regmap_config *config)
 
 	regmap_debugfs_exit(map);
 	regcache_exit(map);
+	map->cache_ops = NULL;
 
 	map->max_register = config->max_register;
 	map->max_register_is_set = map->max_register ?: config->max_register_is_0;
@@ -1434,18 +1435,23 @@ int regmap_reinit_cache(struct regmap *map, const struct regmap_config *config)
 	map->writeable_noinc_reg = config->writeable_noinc_reg;
 	map->readable_noinc_reg = config->readable_noinc_reg;
 	map->reg_default_cb = config->reg_default_cb;
-	map->cache_type = config->cache_type;
 
 	ret = regmap_set_name(map, config);
-	if (ret)
+	if (ret) {
+		map->cache_type = REGCACHE_NONE;
 		return ret;
+	}
 
 	map->cache_bypass = false;
 	map->cache_only = false;
 
+	map->cache_type = config->cache_type;
 	ret = regcache_init(map, config);
-	if (ret)
+	if (ret) {
+		map->cache_ops = NULL;
+		map->cache_type = REGCACHE_NONE;
 		return ret;
+	}
 
 	regmap_debugfs_init(map);
 

-- 
2.56.0