* [PATCH] pinctrl: rk805: fix ordering of gpio and pinctrl registration
@ 2026-10-30 11:55 ` Heiko Stuebner
0 siblings, 0 replies; 4+ messages in thread
From: Heiko Stuebner @ 2026-10-30 11:55 UTC (permalink / raw)
To: linusw; +Cc: heiko, chenjh, linux-gpio, linux-rockchip, Heiko Stuebner, stable
From: Heiko Stuebner <heiko.stuebner@cherry.de>
The call to gpiochip_add_pin_range() binds the gpio-chip and pinctrl
together. devm_gpiochip_add_data() sets up the devm action to tear it
down again - and this includes removing the pin-range.
As devm teardown is running in opposite order, when
pinctrl_remove_gpio_range() is reached from gpiochip_remove_pin_ranges()
that pin-controller is already gone, leading to something like:
[ 9.703366] Unable to handle kernel paging request at virtual address dead000000000108
[...]
[ 9.703553] [dead000000000108] address between user and kernel address ranges
[ 9.703573] Internal error: Oops: 0000000096000044 [#1] SMP
[...]
[ 23.237380] Call trace:
[ 23.240120] pinctrl_remove_gpio_range+0x28/0x60 (P)
[ 23.245687] gpiochip_remove_pin_ranges+0x5c/0x8c
[ 23.250955] gpiochip_remove+0x144/0x1c0
[ 23.255350] devm_gpio_chip_release+0x10/0x1c
[ 23.260239] devm_action_release+0x14/0x20
[ 23.264834] devres_release_all+0xb0/0x120
[ 23.269430] device_unbind_cleanup+0x2c/0x84
[ 23.274221] device_release_driver_internal+0x1ec/0x224
[ 23.280072] device_release_driver+0x18/0x24
[ 23.284862] bus_remove_device+0xe4/0x19c
[ 23.289359] device_del+0x14c/0x40c
[ 23.293273] platform_device_del+0x28/0x94
[ 23.297871] platform_device_unregister+0x18/0x3c
[ 23.303149] mfd_remove_devices_fn+0x130/0x14c
[...]
Fix this by reordering gpio and pinctrl addition.
Fixes: ea479996c79b ("pinctrl: Add pinctrl driver for the RK805 PMIC")
Cc: stable@vger.kernel.org
Signed-off-by: Heiko Stuebner <heiko.stuebner@cherry.de>
---
drivers/pinctrl/pinctrl-rk805.c | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
diff --git a/drivers/pinctrl/pinctrl-rk805.c b/drivers/pinctrl/pinctrl-rk805.c
index 22f576337faa..8e04da3ef0f3 100644
--- a/drivers/pinctrl/pinctrl-rk805.c
+++ b/drivers/pinctrl/pinctrl-rk805.c
@@ -663,13 +663,6 @@ static int rk805_pinctrl_probe(struct platform_device *pdev)
return -EINVAL;
}
- /* Add gpio chip */
- ret = devm_gpiochip_add_data(&pdev->dev, &pci->gpio_chip, pci);
- if (ret < 0) {
- dev_err(&pdev->dev, "Couldn't add gpiochip\n");
- return ret;
- }
-
/* Add pinctrl */
pci->pctl = devm_pinctrl_register(&pdev->dev, &pci->pinctrl_desc, pci);
if (IS_ERR(pci->pctl)) {
@@ -677,6 +670,13 @@ static int rk805_pinctrl_probe(struct platform_device *pdev)
return PTR_ERR(pci->pctl);
}
+ /* Add gpio chip */
+ ret = devm_gpiochip_add_data(&pdev->dev, &pci->gpio_chip, pci);
+ if (ret < 0) {
+ dev_err(&pdev->dev, "Couldn't add gpiochip\n");
+ return ret;
+ }
+
/* Add pin range */
ret = gpiochip_add_pin_range(&pci->gpio_chip, dev_name(&pdev->dev),
0, 0, pci->gpio_chip.ngpio);
--
2.47.3
_______________________________________________
Linux-rockchip mailing list
Linux-rockchip@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-rockchip
^ permalink raw reply related [flat|nested] 4+ messages in thread* [PATCH] pinctrl: rk805: fix ordering of gpio and pinctrl registration
@ 2026-10-30 11:55 ` Heiko Stuebner
0 siblings, 0 replies; 4+ messages in thread
From: Heiko Stuebner @ 2026-10-30 11:55 UTC (permalink / raw)
To: linusw; +Cc: heiko, chenjh, linux-gpio, linux-rockchip, Heiko Stuebner, stable
From: Heiko Stuebner <heiko.stuebner@cherry.de>
The call to gpiochip_add_pin_range() binds the gpio-chip and pinctrl
together. devm_gpiochip_add_data() sets up the devm action to tear it
down again - and this includes removing the pin-range.
As devm teardown is running in opposite order, when
pinctrl_remove_gpio_range() is reached from gpiochip_remove_pin_ranges()
that pin-controller is already gone, leading to something like:
[ 9.703366] Unable to handle kernel paging request at virtual address dead000000000108
[...]
[ 9.703553] [dead000000000108] address between user and kernel address ranges
[ 9.703573] Internal error: Oops: 0000000096000044 [#1] SMP
[...]
[ 23.237380] Call trace:
[ 23.240120] pinctrl_remove_gpio_range+0x28/0x60 (P)
[ 23.245687] gpiochip_remove_pin_ranges+0x5c/0x8c
[ 23.250955] gpiochip_remove+0x144/0x1c0
[ 23.255350] devm_gpio_chip_release+0x10/0x1c
[ 23.260239] devm_action_release+0x14/0x20
[ 23.264834] devres_release_all+0xb0/0x120
[ 23.269430] device_unbind_cleanup+0x2c/0x84
[ 23.274221] device_release_driver_internal+0x1ec/0x224
[ 23.280072] device_release_driver+0x18/0x24
[ 23.284862] bus_remove_device+0xe4/0x19c
[ 23.289359] device_del+0x14c/0x40c
[ 23.293273] platform_device_del+0x28/0x94
[ 23.297871] platform_device_unregister+0x18/0x3c
[ 23.303149] mfd_remove_devices_fn+0x130/0x14c
[...]
Fix this by reordering gpio and pinctrl addition.
Fixes: ea479996c79b ("pinctrl: Add pinctrl driver for the RK805 PMIC")
Cc: stable@vger.kernel.org
Signed-off-by: Heiko Stuebner <heiko.stuebner@cherry.de>
---
drivers/pinctrl/pinctrl-rk805.c | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
diff --git a/drivers/pinctrl/pinctrl-rk805.c b/drivers/pinctrl/pinctrl-rk805.c
index 22f576337faa..8e04da3ef0f3 100644
--- a/drivers/pinctrl/pinctrl-rk805.c
+++ b/drivers/pinctrl/pinctrl-rk805.c
@@ -663,13 +663,6 @@ static int rk805_pinctrl_probe(struct platform_device *pdev)
return -EINVAL;
}
- /* Add gpio chip */
- ret = devm_gpiochip_add_data(&pdev->dev, &pci->gpio_chip, pci);
- if (ret < 0) {
- dev_err(&pdev->dev, "Couldn't add gpiochip\n");
- return ret;
- }
-
/* Add pinctrl */
pci->pctl = devm_pinctrl_register(&pdev->dev, &pci->pinctrl_desc, pci);
if (IS_ERR(pci->pctl)) {
@@ -677,6 +670,13 @@ static int rk805_pinctrl_probe(struct platform_device *pdev)
return PTR_ERR(pci->pctl);
}
+ /* Add gpio chip */
+ ret = devm_gpiochip_add_data(&pdev->dev, &pci->gpio_chip, pci);
+ if (ret < 0) {
+ dev_err(&pdev->dev, "Couldn't add gpiochip\n");
+ return ret;
+ }
+
/* Add pin range */
ret = gpiochip_add_pin_range(&pci->gpio_chip, dev_name(&pdev->dev),
0, 0, pci->gpio_chip.ngpio);
--
2.47.3
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [PATCH] pinctrl: rk805: fix ordering of gpio and pinctrl registration
2026-10-30 11:55 ` Heiko Stuebner
(?)
@ 2026-10-30 12:05 ` sashiko-bot
2026-10-30 17:16 ` Heiko Stuebner
-1 siblings, 1 reply; 4+ messages in thread
From: sashiko-bot @ 2026-10-30 12:05 UTC (permalink / raw)
To: Heiko Stuebner; +Cc: linux-gpio
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] pinctrl: rk805: NULL dereference in gpiochip_get_data() via pinconf
--
commit a49ae4e9bf527300ce287085a0623b150f2db443
Author: Heiko Stuebner <heiko.stuebner@cherry.de>
pinctrl: rk805: fix ordering of gpio and pinctrl registration
This commit reorders rk805_pinctrl_probe() so that devm_pinctrl_register() is
called before devm_gpiochip_add_data(), ensuring the GPIO chip and its pin
ranges are torn down before the pinctrl device during devres release.
> diff --git a/drivers/pinctrl/pinctrl-rk805.c b/drivers/pinctrl/pinctrl-rk805.c
> index 22f576337faa9..8e04da3ef0f3a 100644
> --- a/drivers/pinctrl/pinctrl-rk805.c
> +++ b/drivers/pinctrl/pinctrl-rk805.c
> @@ -663,13 +663,6 @@ static int rk805_pinctrl_probe(struct platform_device *pdev)
> return -EINVAL;
> }
>
> - /* Add gpio chip */
> - ret = devm_gpiochip_add_data(&pdev->dev, &pci->gpio_chip, pci);
> - if (ret < 0) {
> - dev_err(&pdev->dev, "Couldn't add gpiochip\n");
> - return ret;
> - }
> -
> /* Add pinctrl */
> pci->pctl = devm_pinctrl_register(&pdev->dev, &pci->pinctrl_desc, pci);
> if (IS_ERR(pci->pctl)) {
> @@ -677,6 +670,13 @@ static int rk805_pinctrl_probe(struct platform_device *pdev)
> return PTR_ERR(pci->pctl);
> }
>
> + /* Add gpio chip */
> + ret = devm_gpiochip_add_data(&pdev->dev, &pci->gpio_chip, pci);
> + if (ret < 0) {
> + dev_err(&pdev->dev, "Couldn't add gpiochip\n");
> + return ret;
> + }
[Severity: High]
Can registering pinctrl before the gpio_chip cause a NULL pointer dereference
in gpiochip_get_data() when pinconf callbacks run?
In rk805_pinctrl_probe(), device_set_node() attaches the parent PMIC fwnode to
pdev->dev, and devm_pinctrl_register() immediately claims default pinctrl hogs
via:
devm_pinctrl_register()
pinctrl_register()
pinctrl_enable()
pinctrl_claim_hogs()
create_pinctrl()
pinctrl_select_state()
pinctrl_commit_state()
pinconf_apply_setting()
rk805_pinconf_set()
Both rk805_pinconf_set() and rk805_pinconf_get() delegate PIN_CONFIG_LEVEL
(and PIN_CONFIG_INPUT_ENABLE in rk805_pinconf_get()) to rk805_gpio_set() and
rk805_gpio_get(), passing &pci->gpio_chip:
drivers/pinctrl/pinctrl-rk805.c:rk805_pinconf_set() {
...
switch (param) {
case PIN_CONFIG_LEVEL:
rk805_gpio_set(&pci->gpio_chip, pin, arg);
rk805_pmx_gpio_set_direction(pctldev, NULL, pin, false);
break;
...
}
drivers/pinctrl/pinctrl-rk805.c:rk805_gpio_set() {
struct rk805_pctrl_info *pci = gpiochip_get_data(chip);
...
}
drivers/gpio/gpiolib.c:gpiochip_get_data() {
return gc->gpiodev->data;
}
Because devm_gpiochip_add_data() has not run yet when devm_pinctrl_register()
is called, pci->gpio_chip.gpiodev is still NULL. If a default hog state on the
PMIC node sets output-low or output-high, or if a consumer or debugfs reader
queries pinconf before devm_gpiochip_add_data() completes (or during unbind
after devm_gpio_chip_release() clears gc->gpiodev->data), wouldn't
gpiochip_get_data() dereference a NULL pointer?
Would it be safer for rk805_pinconf_get() and rk805_pinconf_set() to use a
helper that takes struct rk805_pctrl_info *pci directly (obtained via
pinctrl_dev_get_drvdata(pctldev)) rather than going through
&pci->gpio_chip and gpiochip_get_data()?
--
Sashiko AI review · https://sashiko.dev/#/patchset/20261030115540.3660242-1-heiko@sntech.de?part=1
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH] pinctrl: rk805: fix ordering of gpio and pinctrl registration
2026-10-30 12:05 ` sashiko-bot
@ 2026-10-30 17:16 ` Heiko Stuebner
0 siblings, 0 replies; 4+ messages in thread
From: Heiko Stuebner @ 2026-10-30 17:16 UTC (permalink / raw)
To: sashiko-reviews; +Cc: linux-gpio
Am Freitag, 30. Oktober 2026, 13:05:40 Mitteleuropäische Normalzeit schrieb sashiko-bot@kernel.org:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [High] pinctrl: rk805: NULL dereference in gpiochip_get_data() via pinconf
> --
>
> commit a49ae4e9bf527300ce287085a0623b150f2db443
> Author: Heiko Stuebner <heiko.stuebner@cherry.de>
>
> pinctrl: rk805: fix ordering of gpio and pinctrl registration
>
> This commit reorders rk805_pinctrl_probe() so that devm_pinctrl_register() is
> called before devm_gpiochip_add_data(), ensuring the GPIO chip and its pin
> ranges are torn down before the pinctrl device during devres release.
>
> > diff --git a/drivers/pinctrl/pinctrl-rk805.c b/drivers/pinctrl/pinctrl-rk805.c
> > index 22f576337faa9..8e04da3ef0f3a 100644
> > --- a/drivers/pinctrl/pinctrl-rk805.c
> > +++ b/drivers/pinctrl/pinctrl-rk805.c
> > @@ -663,13 +663,6 @@ static int rk805_pinctrl_probe(struct platform_device *pdev)
> > return -EINVAL;
> > }
> >
> > - /* Add gpio chip */
> > - ret = devm_gpiochip_add_data(&pdev->dev, &pci->gpio_chip, pci);
> > - if (ret < 0) {
> > - dev_err(&pdev->dev, "Couldn't add gpiochip\n");
> > - return ret;
> > - }
> > -
> > /* Add pinctrl */
> > pci->pctl = devm_pinctrl_register(&pdev->dev, &pci->pinctrl_desc, pci);
> > if (IS_ERR(pci->pctl)) {
> > @@ -677,6 +670,13 @@ static int rk805_pinctrl_probe(struct platform_device *pdev)
> > return PTR_ERR(pci->pctl);
> > }
> >
> > + /* Add gpio chip */
> > + ret = devm_gpiochip_add_data(&pdev->dev, &pci->gpio_chip, pci);
> > + if (ret < 0) {
> > + dev_err(&pdev->dev, "Couldn't add gpiochip\n");
> > + return ret;
> > + }
>
> [Severity: High]
> Can registering pinctrl before the gpio_chip cause a NULL pointer dereference
> in gpiochip_get_data() when pinconf callbacks run?
>
> In rk805_pinctrl_probe(), device_set_node() attaches the parent PMIC fwnode to
> pdev->dev, and devm_pinctrl_register() immediately claims default pinctrl hogs
> via:
>
> devm_pinctrl_register()
> pinctrl_register()
> pinctrl_enable()
> pinctrl_claim_hogs()
> create_pinctrl()
> pinctrl_select_state()
> pinctrl_commit_state()
> pinconf_apply_setting()
> rk805_pinconf_set()
that is a correct finding.
It seems the correct way to resolve this, is to switch from
devm_pinctrl_register() to the newer devm_pinctrl_register_and_init()
and calling pinctrl_enable() at the appropritate time in the driver
as suggested by the documentation.
Heiko
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2026-10-30 17:16 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-10-30 11:55 [PATCH] pinctrl: rk805: fix ordering of gpio and pinctrl registration Heiko Stuebner
2026-10-30 11:55 ` Heiko Stuebner
2026-10-30 12:05 ` sashiko-bot
2026-10-30 17:16 ` Heiko Stuebner
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.