[PATCH v5 0/2] regcache: Avoid accessing non-initialised cache

[PATCH v5 0/2] regcache: Avoid accessing non-initialised cache

[Andy Shevchenko]

Refactor regcache flow that populates cache on initialisation phase
based on the values in HW. This makes code robust against any possible
accesses to not-fully initialised caches.

Changelog v5:
- added a precursor patch to make things clearer
- also put the freeing resources into an order (Mark)
- dropped applied patches

v4: 20260302095847.2310066-1-andriy.shevchenko@linux.intel.com

Changelog v4:
- made conditional against 'count' to make it less dependent to the previous code path

v3: 20260226135918.381979-1-andriy.shevchenko@linux.intel.com

Changelog v3:
- dropped unneeded churn in patch 3 (Mark)
- fixed code to pass kunit test cases (Mark)

v2: 20260225161659.3811671-1-andriy.shevchenko@linux.intel.com

Changelog v2:
- rebased on top of the latest regmap changes (Mark)
- added two more little cleanups (patches 4 & 5)

Andy Shevchenko (2):
  regcache: Factor out regcache_hw_exit() helper
  regcache: Move HW readback after cache initialisation

 drivers/base/regmap/regcache.c | 46 +++++++++++++++++++++-------------
 1 file changed, 29 insertions(+), 17 deletions(-)

-- 
2.50.1

[PATCH v5 1/2] regcache: Factor out regcache_hw_exit() helper

[Andy Shevchenko]

Factor out regcache_hw_exit() helper to make error and exit paths
clearer. This helps to avoid missing changes in case the code gets
shuffled in the future.

Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
---
 drivers/base/regmap/regcache.c | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/drivers/base/regmap/regcache.c b/drivers/base/regmap/regcache.c
index 13c480b6e21d..329cdee1ae1c 100644
--- a/drivers/base/regmap/regcache.c
+++ b/drivers/base/regmap/regcache.c
@@ -131,6 +131,13 @@ static int regcache_hw_init(struct regmap *map, int count)
 	return ret;
 }
 
+static void regcache_hw_exit(struct regmap *map)
+{
+	kfree(map->reg_defaults);
+	if (map->cache_free)
+		kfree(map->reg_defaults_raw);
+}
+
 int regcache_init(struct regmap *map, const struct regmap_config *config)
 {
 	int count = 0;
@@ -245,9 +252,7 @@ int regcache_init(struct regmap *map, const struct regmap_config *config)
 		map->unlock(map->lock_arg);
 	}
 err_free:
-	kfree(map->reg_defaults);
-	if (map->cache_free)
-		kfree(map->reg_defaults_raw);
+	regcache_hw_exit(map);
 
 	return ret;
 }
@@ -259,9 +264,7 @@ void regcache_exit(struct regmap *map)
 
 	BUG_ON(!map->cache_ops);
 
-	kfree(map->reg_defaults);
-	if (map->cache_free)
-		kfree(map->reg_defaults_raw);
+	regcache_hw_exit(map);
 
 	if (map->cache_ops->exit) {
 		dev_dbg(map->dev, "Destroying %s cache\n",
-- 
2.50.1

[PATCH v5 2/2] regcache: Move HW readback after cache initialisation

[Andy Shevchenko]

Make sure that cache is initialised before calling any IO
using regmap, this makes sure that we won't access NULL or
invalid pointers in the cache which hasn't been initialised.

As a side effect it also makes the ordering of cleaning up
the resources in regcache_exit() to be the same (and correct)
as in the error path of regcache_init(). This is not a problem
right now as they do not have dependencies, but it makes code
robust against potential changes in the future.

Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
---
 drivers/base/regmap/regcache.c | 33 +++++++++++++++++++++------------
 1 file changed, 21 insertions(+), 12 deletions(-)

diff --git a/drivers/base/regmap/regcache.c b/drivers/base/regmap/regcache.c
index 329cdee1ae1c..5beada4ca64c 100644
--- a/drivers/base/regmap/regcache.c
+++ b/drivers/base/regmap/regcache.c
@@ -66,6 +66,14 @@ static int regcache_hw_init(struct regmap *map, int count)
 	unsigned int reg, val;
 	void *tmp_buf;
 
+	/*
+	 * When count is zero, it means there is nothing to cache and hence
+	 * nothing to read back from HW to set up defaults, so skip this phase
+	 * without an error code returned.
+	 */
+	if (!count)
+		return 0;
+
 	map->num_reg_defaults = count;
 	map->reg_defaults = kmalloc_objs(struct reg_default, count);
 	if (!map->reg_defaults)
@@ -208,14 +216,6 @@ int regcache_init(struct regmap *map, const struct regmap_config *config)
 		count = regcache_count_cacheable_registers(map);
 		if (map->cache_bypass)
 			return 0;
-
-		/* Some devices such as PMICs don't have cache defaults,
-		 * we cope with this by reading back the HW registers and
-		 * crafting the cache defaults by hand.
-		 */
-		ret = regcache_hw_init(map, count);
-		if (ret < 0)
-			return ret;
 	}
 
 	if (!map->max_register_is_set && map->num_reg_defaults_raw) {
@@ -230,9 +230,18 @@ int regcache_init(struct regmap *map, const struct regmap_config *config)
 		ret = map->cache_ops->init(map);
 		map->unlock(map->lock_arg);
 		if (ret)
-			goto err_free;
+			return ret;
 	}
 
+	/*
+	 * Some devices such as PMICs don't have cache defaults,
+	 * we cope with this by reading back the HW registers and
+	 * crafting the cache defaults by hand.
+	 */
+	ret = regcache_hw_init(map, count);
+	if (ret)
+		goto err_exit;
+
 	if (map->cache_ops->populate &&
 	    (map->num_reg_defaults || map->reg_default_cb)) {
 		dev_dbg(map->dev, "Populating %s cache\n", map->cache_ops->name);
@@ -240,10 +249,12 @@ int regcache_init(struct regmap *map, const struct regmap_config *config)
 		ret = map->cache_ops->populate(map);
 		map->unlock(map->lock_arg);
 		if (ret)
-			goto err_exit;
+			goto err_free;
 	}
 	return 0;
 
+err_free:
+	regcache_hw_exit(map);
 err_exit:
 	if (map->cache_ops->exit) {
 		dev_dbg(map->dev, "Destroying %s cache\n", map->cache_ops->name);
@@ -251,8 +262,6 @@ int regcache_init(struct regmap *map, const struct regmap_config *config)
 		ret = map->cache_ops->exit(map);
 		map->unlock(map->lock_arg);
 	}
-err_free:
-	regcache_hw_exit(map);
 
 	return ret;
 }
-- 
2.50.1

Re: [PATCH v5 2/2] regcache: Move HW readback after cache initialisation

[Mark Brown]

[-- Attachment #1: Type: text/plain, Size: 414 bytes --]

On Tue, Mar 03, 2026 at 10:26:25AM +0100, Andy Shevchenko wrote:

> @@ -230,9 +230,18 @@ int regcache_init(struct regmap *map, const struct regmap_config *config)
>  		ret = map->cache_ops->init(map);
>  		map->unlock(map->lock_arg);
>  		if (ret)
> -			goto err_free;
> +			return ret;
>  	}
>  

We might still need to free the copy we take of supplied reg_defaults,
it's not just the hw_init case.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: [PATCH v5 2/2] regcache: Move HW readback after cache initialisation

[Andy Shevchenko]

On Tue, Mar 03, 2026 at 01:03:11PM +0000, Mark Brown wrote:
> On Tue, Mar 03, 2026 at 10:26:25AM +0100, Andy Shevchenko wrote:

...

> > int regcache_init(struct regmap *map, const struct regmap_config *config)

> >  		ret = map->cache_ops->init(map);
> >  		map->unlock(map->lock_arg);
> >  		if (ret)
> > -			goto err_free;
> > +			return ret;
> >  	}
> 
> We might still need to free the copy we take of supplied reg_defaults,
> it's not just the hw_init case.

I see, so someone transfers an ownership to that allocation...
I'll check more, thanks!

-- 
With Best Regards,
Andy Shevchenko

Re: [PATCH v5 0/2] regcache: Avoid accessing non-initialised cache

[Mark Brown]

On Tue, 03 Mar 2026 10:26:23 +0100, Andy Shevchenko wrote:
> Refactor regcache flow that populates cache on initialisation phase
> based on the values in HW. This makes code robust against any possible
> accesses to not-fully initialised caches.
> 
> Changelog v5:
> - added a precursor patch to make things clearer
> - also put the freeing resources into an order (Mark)
> - dropped applied patches
> 
> [...]

Applied to

   https://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap.git for-next

Thanks!

[1/2] regcache: Factor out regcache_hw_exit() helper
      commit: 9891b52ba12e9d5fed5901b6b5f6e0cdcd424390
[2/2] regcache: Move HW readback after cache initialisation
      (no commit info)

All being well this means that it will be integrated into the linux-next
tree (usually sometime in the next 24 hours) and sent to Linus during
the next merge window (or sooner if it is a bug fix), however if
problems are discovered then the patch may be dropped or reverted.

You may get further e-mails resulting from automated or manual testing
and review of the tree, please engage with people reporting problems and
send followup patches addressing any issues that are reported if needed.

If any updates are required or you are submitting further changes they
should be sent as incremental updates against current git, existing
patches will not be replaced.

Please add any relevant lists and maintainers to the CCs when replying
to this mail.

Thanks,
Mark