[PATCH v2 00/27] mfd: Assorted resource lifetime, teardown, and error-handling fixes

[PATCH v2 00/27] mfd: Assorted resource lifetime, teardown, and error-handling fixes

[Lee Jones]

These issues were reported by Sashiko.

This series addresses a collection of resource lifetime, teardown
ordering, error-handling, and bounds-checking bugs across several MFD
drivers.

v1 => v2:
 - Collected Acked-by, Reviewed-by, and Tested-by tags from the list
 - Dropped "mfd: cgbc: Zero-initialise version buffer in
   cgbc_get_version()" in favour of Thomas Richard's upcoming central
   cgbc_command() validation series
 - Restored Fixes: tags (without Cc: stable@vger.kernel.org) on the four
   non-Stable MFD cell stack-pointer clean-ups (ls2kbmc, bd96801,
   ti_am335x_tscadc, and db8500-prcmu)

Cc: Aaro Koskinen <aaro.koskinen@iki.fi>
Cc: Andi Shyti <andi.shyti@kernel.org>
Cc: Andreas Kemnade <andreas@kemnade.info>
Cc: Andy Shevchenko <andy@kernel.org>
Cc: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Cc: AnilKumar Ch <anilkumar@ti.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Binbin Zhou <zhoubinbin@loongson.cn>
Cc: Brent Casavant <bcasavan@sgi.com>
Cc: Chong Qiao <qiaochong@loongson.cn>
Cc: Corey Minyard <corey@minyard.net>
Cc: David Lechner <dlechner@baylibre.com>
Cc: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Cc: Felipe Balbi <balbi@ti.com>
Cc: Gyungoh Yoo <jack.yoo@maxim-ic.com>
Cc: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Cc: Hsin-Hsiung Wang <hsin-hsiung.wang@mediatek.com>
Cc: Huacai Chen <chenhuacai@kernel.org>
Cc: Jarkko Nikula <jarkko.nikula@linux.intel.com>
Cc: Jonathan Cameron <jic23@kernel.org>
Cc: Joshua Kinard <linux@kumba.dev>
Cc: Kai Svahn <kai.svahn@nokia.com>
Cc: Kevin Hilman <khilman@baylibre.com>
Cc: Kumar Sanghvi <kumar.sanghvi@stericsson.com>
Cc: Linus Walleij <linusw@kernel.org>
Cc: linux-arm-kernel@lists.infradead.org
Cc: linux-crypto@vger.kernel.org
Cc: linux-i2c@vger.kernel.org
Cc: linux-iio@vger.kernel.org
Cc: linux-input@vger.kernel.org
Cc: linux-mediatek@lists.infradead.org
Cc: linux-omap@vger.kernel.org
Cc: Matthias Brugger <matthias.bgg@gmail.com>
Cc: Mattias Nilsson <mattias.i.nilsson@stericsson.com>
Cc: Mattias Wallin <mattias.wallin@stericsson.com>
Cc: Matti Vaittinen <mazziesaccount@gmail.com>
Cc: mfd@lists.linux.dev
Cc: Mika Westerberg <mika.westerberg@linux.intel.com>
Cc: Milo Kim <woogyom.kim@gmail.com>
Cc: Ming Yu <tmyu0@nuvoton.com>
Cc: "Nuno Sá" <nuno.sa@analog.com>
Cc: Pantelis Antoniou <panto@antoniou-consulting.com>
Cc: Pat Gefre <pfg@sgi.com>
Cc: Paul Burton <paulburton@kernel.org>
Cc: Peter Ujfalusi <peter.ujfalusi@ti.com>
Cc: Qunqin Zhao <zhaoqunqin@loongson.cn>
Cc: Rabin Vincent <rabin.vincent@stericsson.com>
Cc: Rachna Patil <rachna@ti.com>
Cc: Roger Quadros <rogerq@kernel.org>
Cc: Samuel Ortiz <sameo@linux.intel.com>
Cc: Sascha Hauer <s.hauer@pengutronix.de>
Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Cc: Shi Hao <i.shihao.999@gmail.com>
Cc: Srinidhi Kasagar <srinidhi.kasagar@stericsson.com>
Cc: Stanislaw Skowronek <skylark@unaligned.org>
Cc: Stephen Warren <swarren@nvidia.com>
Cc: Sundar Iyer <sundar.iyer@stericsson.com>
Cc: syed khasim <x0khasim@ti.com>
Cc: Thomas Bogendoerfer <tbogendoerfer@suse.de>
Cc: Thomas Richard <thomas.richard@bootlin.com>
Cc: Tony Lindgren <tony@atomide.com>
Cc: Yinggang Gu <guyinggang@loongson.cn>

Lee Jones (27):
  mfd: nct6694: Allocate USB DMA buffers with kzalloc_obj()
  mfd: ls2kbmc: Unregister GPIO GSI via devm_add_action_or_reset()
  mfd: ls2kbmc: Cancel reset work on teardown via devm_work_autocancel()
  mfd: ls2kbmc: Allocate simplefb platform_data on the heap
  mfd: bd96801: Allocate watchdog IRQ resource on the heap
  mfd: ti_am335x_tscadc: Retrieve parent driver data via
    dev_get_drvdata()
  mfd: db8500-prcmu: Make AB8500 cell and IRQ resource static
  mfd: nct6694: Do not resubmit interrupt URB on endpoint stall (-EPIPE)
  mfd: ioc3: Request parent IRQ via request_irq() and free before domain
    removal
  mfd: intel-lpss: Remove registered MFD child devices on probe failure
  mfd: max8907: Manage power-off handler via
    devm_register_sys_off_handler()
  mfd: twl-core: Clear pm_power_off callback in twl_remove()
  mfd: twl-core: Clear twl_priv pointer on teardown and probe failure
  mfd: loongson-se: Check return value of dma_set_mask_and_coherent()
  mfd: loongson-se: Zero-initialise controller command structures
  mfd: loongson-se: Reinitialise completions and wait uninterruptibly
    for commands
  mfd: loongson-se: Zero-allocate driver data and initialise engine
    completions in probe
  mfd: loongson-se: Prevent out-of-bounds engine access in
    se_irq_handler()
  mfd: loongson-se: Stop controller and mask interrupts on teardown and
    shutdown
  mfd: loongson-se: Validate engine ID, DMA buffer size, and IRQ
    registration
  mfd: abx500-core: Unregister device ops on devm release
  mfd: ab8500-core: Register sysfs attribute groups via
    devm_device_add_group()
  mfd: tps65217: Manage IRQ domain teardown via devres
  mfd: mt6397: Manage IRQ domain lifecycle with devres
  mfd: mt6397: Unregister PM notifier on probe failure and unbind
  i2c: cgbc: Propagate hardware errors when polling read status
  mfd: ti_am335x_tscadc: Remove redundant ti_tscadc_dev_get() helper

 drivers/i2c/busses/i2c-cgbc.c             |  27 ++++--
 drivers/iio/adc/ti_am335x_adc.c           |   2 +-
 drivers/input/touchscreen/ti_am335x_tsc.c |   2 +-
 drivers/mfd/ab8500-core.c                 |  11 +--
 drivers/mfd/abx500-core.c                 |  29 +++---
 drivers/mfd/db8500-prcmu.c                |   8 +-
 drivers/mfd/intel-lpss.c                  |   1 +
 drivers/mfd/ioc3.c                        |  32 ++++---
 drivers/mfd/loongson-se.c                 | 110 +++++++++++++++++-----
 drivers/mfd/ls2k-bmc-core.c               |  27 ++++--
 drivers/mfd/max8907.c                     |  28 ++++--
 drivers/mfd/mt6358-irq.c                  |  17 +++-
 drivers/mfd/mt6397-core.c                 |   4 +-
 drivers/mfd/mt6397-irq.c                  |  31 +++++-
 drivers/mfd/nct6694.c                     |  23 +++--
 drivers/mfd/rohm-bd96801.c                |  11 ++-
 drivers/mfd/ti_am335x_tscadc.c            |   7 +-
 drivers/mfd/tps65217.c                    |  40 ++++----
 drivers/mfd/twl-core.c                    |  45 +++++----
 include/linux/mfd/loongson-se.h           |   8 +-
 include/linux/mfd/ti_am335x_tscadc.h      |   7 --
 21 files changed, 326 insertions(+), 144 deletions(-)

-- 
2.56.0.307.g5fe7bd680c-goog

[PATCH v2 14/27] mfd: loongson-se: Check return value of dma_set_mask_and_coherent()

[Lee Jones]

loongson_se_probe() ignores the return value of
dma_set_mask_and_coherent() when requesting a 64-bit DMA mask before
allocating coherent DMA memory.  Check the return value and abort probe
if the platform cannot satisfy the 64-bit DMA mask requirement.

Fixes: e551fa3159e3 ("mfd: Add support for Loongson Security Engine chip controller")
Closes: https://sashiko.dev/#/bug/linux-6685ee0c-b7ed-4f21-8800-cc705cec449b
Cc: stable@vger.kernel.org
Reviewed-by: Qunqin Zhao <zhaoqunqin@loongson.cn>
Signed-off-by: Lee Jones <lee@kernel.org>
---
 drivers/mfd/loongson-se.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/mfd/loongson-se.c b/drivers/mfd/loongson-se.c
index 3902ba377d69..8dcb90a067b3 100644
--- a/drivers/mfd/loongson-se.c
+++ b/drivers/mfd/loongson-se.c
@@ -199,7 +199,10 @@ static int loongson_se_probe(struct platform_device *pdev)
 	spin_lock_init(&se->dev_lock);
 	mutex_init(&se->engine_init_lock);
 
-	dma_set_mask_and_coherent(dev, DMA_BIT_MASK(64));
+	err = dma_set_mask_and_coherent(dev, DMA_BIT_MASK(64));
+	if (err)
+		return err;
+
 	if (device_property_read_u32(dev, "dmam_size", &se->dmam_size))
 		return -ENODEV;
 
-- 
2.56.0.307.g5fe7bd680c-goog

[PATCH v2 15/27] mfd: loongson-se: Zero-initialise controller command structures

[Lee Jones]

loongson_se_init() and loongson_se_init_engine() declare struct
loongson_se_controller_cmd on the stack without zero-initialising it
and only populate a subset of its fields before
loongson_se_send_controller_cmd() writes all eight 32-bit words to the
controller MMIO registers.  Zero-initialise the stack command structures
so that unused words do not leak residual kernel stack contents to the
hardware.

Fixes: e551fa3159e3 ("mfd: Add support for Loongson Security Engine chip controller")
Closes: https://sashiko.dev/#/bug/linux-b81dca3d-6812-43b6-9ad9-912727674154
Cc: stable@vger.kernel.org
Reviewed-by: Qunqin Zhao <zhaoqunqin@loongson.cn>
Signed-off-by: Lee Jones <lee@kernel.org>
---
 drivers/mfd/loongson-se.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/mfd/loongson-se.c b/drivers/mfd/loongson-se.c
index 8dcb90a067b3..485ee4a6ca5e 100644
--- a/drivers/mfd/loongson-se.c
+++ b/drivers/mfd/loongson-se.c
@@ -93,7 +93,7 @@ struct loongson_se_engine *loongson_se_init_engine(struct device *dev, int id)
 {
 	struct loongson_se *se = dev_get_drvdata(dev);
 	struct loongson_se_engine *engine = &se->engines[id];
-	struct loongson_se_controller_cmd cmd;
+	struct loongson_se_controller_cmd cmd = {};
 
 	engine->se = se;
 	engine->id = id;
@@ -162,7 +162,7 @@ static irqreturn_t se_irq_handler(int irq, void *dev_id)
 
 static int loongson_se_init(struct loongson_se *se, dma_addr_t addr, int size)
 {
-	struct loongson_se_controller_cmd cmd;
+	struct loongson_se_controller_cmd cmd = {};
 	int err;
 
 	cmd.command_id = SE_CMD_START;
-- 
2.56.0.307.g5fe7bd680c-goog

[PATCH v2 16/27] mfd: loongson-se: Reinitialise completions and wait uninterruptibly for commands

[Lee Jones]

loongson_se_send_controller_cmd() and loongson_se_send_engine_cmd() wait
on se->cmd_completion and engine->completion using
wait_for_completion_interruptible() without reinitialising the
completion before issuing a new command.  Because the hardware has no
mechanism to abort an in-flight command once accepted by
loongson_se_poll(), returning early on a signal leaves the controller or
engine actively processing the shared command registers and DMA buffers
in the background, and its subsequent completion interrupt leaves a
stale completion token that causes the next command to return
prematurely.

Clear any stale pending interrupt status and reinitialise the target
completion inside loongson_se_poll() while holding se->dev_lock
immediately before notifying the controller, and wait uninterruptibly
via wait_for_completion() once loongson_se_poll() confirms the command
has been accepted by the hardware.

Fixes: e551fa3159e3 ("mfd: Add support for Loongson Security Engine chip controller")
Closes: https://sashiko.dev/#/bug/linux-4661fb0d-d936-4168-89cd-2f6dec31a7b5
Cc: stable@vger.kernel.org
Reviewed-by: Qunqin Zhao <zhaoqunqin@loongson.cn>
Tested-by: Qunqin Zhao <zhaoqunqin@loongson.cn>
Signed-off-by: Lee Jones <lee@kernel.org>
---
 drivers/mfd/loongson-se.c | 19 ++++++++++++++-----
 1 file changed, 14 insertions(+), 5 deletions(-)

diff --git a/drivers/mfd/loongson-se.c b/drivers/mfd/loongson-se.c
index 485ee4a6ca5e..9b531e62fb85 100644
--- a/drivers/mfd/loongson-se.c
+++ b/drivers/mfd/loongson-se.c
@@ -37,13 +37,17 @@ struct loongson_se_controller_cmd {
 	u32 info[7];
 };
 
-static int loongson_se_poll(struct loongson_se *se, u32 int_bit)
+static int loongson_se_poll(struct loongson_se *se, u32 int_bit,
+			    struct completion *completion)
 {
 	u32 status;
 	int err;
 
 	spin_lock_irq(&se->dev_lock);
 
+	writel(int_bit, se->base + SE_S2LINT_CL);
+	reinit_completion(completion);
+
 	/* Notify the controller that the engine needs to be started */
 	writel(int_bit, se->base + SE_L2SINT_SET);
 
@@ -66,11 +70,13 @@ static int loongson_se_send_controller_cmd(struct loongson_se *se,
 	for (i = 0; i < SE_SEND_CMD_REG_LEN; i++)
 		writel(send_cmd[i], se->base + SE_SEND_CMD_REG + i * 4);
 
-	err = loongson_se_poll(se, SE_INT_CONTROLLER);
+	err = loongson_se_poll(se, SE_INT_CONTROLLER, &se->cmd_completion);
 	if (err)
 		return err;
 
-	return wait_for_completion_interruptible(&se->cmd_completion);
+	wait_for_completion(&se->cmd_completion);
+
+	return 0;
 }
 
 int loongson_se_send_engine_cmd(struct loongson_se_engine *engine)
@@ -80,12 +86,15 @@ int loongson_se_send_engine_cmd(struct loongson_se_engine *engine)
 	 * where to obtain engine commands from. Now all we need to
 	 * do is notify the controller that the engine needs to be started.
 	 */
-	int err = loongson_se_poll(engine->se, BIT(engine->id));
+	int err = loongson_se_poll(engine->se, BIT(engine->id),
+				   &engine->completion);
 
 	if (err)
 		return err;
 
-	return wait_for_completion_interruptible(&engine->completion);
+	wait_for_completion(&engine->completion);
+
+	return 0;
 }
 EXPORT_SYMBOL_GPL(loongson_se_send_engine_cmd);
 
-- 
2.56.0.307.g5fe7bd680c-goog

[PATCH v2 17/27] mfd: loongson-se: Zero-allocate driver data and initialise engine completions in probe

[Lee Jones]

loongson_se_probe() allocates struct loongson_se using devm_kmalloc(),
leaving the se->engines array uninitialised until child MFD drivers
later invoke loongson_se_init_engine().  Meanwhile, hardware interrupts
are unmasked and se_irq_handler() is registered during probe.  Any
engine interrupt arriving before loongson_se_init_engine() runs causes
se_irq_handler() to call complete() on an uninitialised completion
structure.

Allocate struct loongson_se with devm_kzalloc() and initialise all
engine completion structures in loongson_se_probe() before registering
interrupt handlers.

Fixes: e551fa3159e3 ("mfd: Add support for Loongson Security Engine chip controller")
Closes: https://sashiko.dev/#/bug/linux-ad9310d7-13b2-4a4a-ad7d-78a4c612c78c
Cc: stable@vger.kernel.org
Reviewed-by: Qunqin Zhao <zhaoqunqin@loongson.cn>
Signed-off-by: Lee Jones <lee@kernel.org>
---
 drivers/mfd/loongson-se.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/mfd/loongson-se.c b/drivers/mfd/loongson-se.c
index 9b531e62fb85..187ebbed0422 100644
--- a/drivers/mfd/loongson-se.c
+++ b/drivers/mfd/loongson-se.c
@@ -106,7 +106,6 @@ struct loongson_se_engine *loongson_se_init_engine(struct device *dev, int id)
 
 	engine->se = se;
 	engine->id = id;
-	init_completion(&engine->completion);
 
 	/* Divide DMA memory equally among all engines */
 	engine->buffer_size = se->dmam_size / SE_ENGINE_MAX;
@@ -199,12 +198,14 @@ static int loongson_se_probe(struct platform_device *pdev)
 	int nr_irq, irq, err, i;
 	dma_addr_t paddr;
 
-	se = devm_kmalloc(dev, sizeof(*se), GFP_KERNEL);
+	se = devm_kzalloc(dev, sizeof(*se), GFP_KERNEL);
 	if (!se)
 		return -ENOMEM;
 
 	dev_set_drvdata(dev, se);
 	init_completion(&se->cmd_completion);
+	for (i = 0; i < SE_ENGINE_MAX; i++)
+		init_completion(&se->engines[i].completion);
 	spin_lock_init(&se->dev_lock);
 	mutex_init(&se->engine_init_lock);
 
-- 
2.56.0.307.g5fe7bd680c-goog

[PATCH v2 18/27] mfd: loongson-se: Prevent out-of-bounds engine access in se_irq_handler()

[Lee Jones]

loongson_se_probe() enables all 32 interrupt bits via SE_INT_ALL
(0xffffffff), and se_irq_handler() uses the set bit index from the
32-bit status register directly to index se->engines, which only holds
SE_ENGINE_MAX (16) entries.  Any interrupt bit asserted at index 16 or
above triggers an out-of-bounds access on se->engines.

Restrict SE_INT_ALL to GENMASK(SE_ENGINE_MAX - 1, 0) and bounds-check
the bit index against SE_ENGINE_MAX before completing the engine in
se_irq_handler().

Fixes: e551fa3159e3 ("mfd: Add support for Loongson Security Engine chip controller")
Closes: https://sashiko.dev/#/bug/linux-bc962408-5c42-40af-8111-a8463a05ccdf
Cc: stable@vger.kernel.org
Reviewed-by: Qunqin Zhao <zhaoqunqin@loongson.cn>
Signed-off-by: Lee Jones <lee@kernel.org>
---
 drivers/mfd/loongson-se.c       | 3 ++-
 include/linux/mfd/loongson-se.h | 7 ++++---
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/drivers/mfd/loongson-se.c b/drivers/mfd/loongson-se.c
index 187ebbed0422..10af13c3b7cc 100644
--- a/drivers/mfd/loongson-se.c
+++ b/drivers/mfd/loongson-se.c
@@ -158,7 +158,8 @@ static irqreturn_t se_irq_handler(int irq, void *dev_id)
 	/* For engines */
 	while (int_status) {
 		id = __ffs(int_status);
-		complete(&se->engines[id].completion);
+		if (id < SE_ENGINE_MAX)
+			complete(&se->engines[id].completion);
 		int_status &= ~BIT(id);
 		writel(BIT(id), se->base + SE_S2LINT_CL);
 	}
diff --git a/include/linux/mfd/loongson-se.h b/include/linux/mfd/loongson-se.h
index 07afa0c2524d..2d0a8b1e5c9e 100644
--- a/include/linux/mfd/loongson-se.h
+++ b/include/linux/mfd/loongson-se.h
@@ -4,6 +4,8 @@
 #ifndef __MFD_LOONGSON_SE_H__
 #define __MFD_LOONGSON_SE_H__
 
+#include <linux/bits.h>
+
 #define LOONGSON_ENGINE_CMD_TIMEOUT_US	10000
 #define SE_SEND_CMD_REG			0x0
 #define SE_SEND_CMD_REG_LEN		0x8
@@ -18,10 +20,9 @@
 #define SE_L2SINT_STAT			0x98
 #define SE_L2SINT_SET			0xa0
 
-#define SE_INT_ALL			0xffffffff
-#define SE_INT_CONTROLLER		BIT(0)
-
 #define SE_ENGINE_MAX			16
+#define SE_INT_ALL			GENMASK(SE_ENGINE_MAX - 1, 0)
+#define SE_INT_CONTROLLER		BIT(0)
 #define SE_ENGINE_RNG			1
 #define SE_CMD_RNG			0x100
 
-- 
2.56.0.307.g5fe7bd680c-goog

[PATCH v2 19/27] mfd: loongson-se: Stop controller and mask interrupts on teardown and shutdown

[Lee Jones]

loongson_se_probe() enables hardware interrupts before registering IRQ
handlers and starts the controller via loongson_se_init(), but provides
no teardown or shutdown handler to stop the controller and mask
interrupts.  If probe fails after loongson_se_init(), if the driver is
unbound, or during a system reboot or kexec transition, the controller
remains active with DMA configured to memory that is reclaimed.

Clear pending interrupts before requesting IRQs, unmask interrupts only
after IRQ handlers are registered, clean up on failure inside
loongson_se_init(), register a devres action after loongson_se_init()
succeeds to issue SE_CMD_STOP and mask interrupts on teardown, and wire
up the platform driver .shutdown callback.

Fixes: e551fa3159e3 ("mfd: Add support for Loongson Security Engine chip controller")
Closes: https://sashiko.dev/#/bug/linux-15511672-7569-4eac-96a0-c08581925710
Closes: https://sashiko.dev/#/bug/linux-e6ed8d33-d641-4969-a5ea-959f21ae3696
Cc: stable@vger.kernel.org
Reviewed-by: Qunqin Zhao <zhaoqunqin@loongson.cn>
Signed-off-by: Lee Jones <lee@kernel.org>
---
 drivers/mfd/loongson-se.c       | 51 +++++++++++++++++++++++++++++----
 include/linux/mfd/loongson-se.h |  1 +
 2 files changed, 46 insertions(+), 6 deletions(-)

diff --git a/drivers/mfd/loongson-se.c b/drivers/mfd/loongson-se.c
index 10af13c3b7cc..bdbab4b91729 100644
--- a/drivers/mfd/loongson-se.c
+++ b/drivers/mfd/loongson-se.c
@@ -169,6 +169,23 @@ static irqreturn_t se_irq_handler(int irq, void *dev_id)
 	return IRQ_HANDLED;
 }
 
+static void loongson_se_stop(void *data)
+{
+	struct loongson_se *se = data;
+	struct loongson_se_controller_cmd cmd = {};
+
+	mutex_lock(&se->engine_init_lock);
+
+	cmd.command_id = SE_CMD_STOP;
+	loongson_se_send_controller_cmd(se, &cmd);
+
+	spin_lock_irq(&se->dev_lock);
+	writel(0, se->base + SE_S2LINT_EN);
+	spin_unlock_irq(&se->dev_lock);
+
+	mutex_unlock(&se->engine_init_lock);
+}
+
 static int loongson_se_init(struct loongson_se *se, dma_addr_t addr, int size)
 {
 	struct loongson_se_controller_cmd cmd = {};
@@ -176,15 +193,23 @@ static int loongson_se_init(struct loongson_se *se, dma_addr_t addr, int size)
 
 	cmd.command_id = SE_CMD_START;
 	err = loongson_se_send_controller_cmd(se, &cmd);
-	if (err)
+	if (err) {
+		writel(0, se->base + SE_S2LINT_EN);
 		return err;
+	}
 
 	cmd.command_id = SE_CMD_SET_DMA;
 	cmd.info[0] = lower_32_bits(addr);
 	cmd.info[1] = upper_32_bits(addr);
 	cmd.info[2] = size;
 
-	return loongson_se_send_controller_cmd(se, &cmd);
+	err = loongson_se_send_controller_cmd(se, &cmd);
+	if (err) {
+		loongson_se_stop(se);
+		return err;
+	}
+
+	return 0;
 }
 
 static const struct mfd_cell engines[] = {
@@ -192,6 +217,13 @@ static const struct mfd_cell engines[] = {
 	{ .name = "tpm_loongson" },
 };
 
+static void loongson_se_shutdown(struct platform_device *pdev)
+{
+	struct loongson_se *se = platform_get_drvdata(pdev);
+
+	loongson_se_stop(se);
+}
+
 static int loongson_se_probe(struct platform_device *pdev)
 {
 	struct device *dev = &pdev->dev;
@@ -225,12 +257,12 @@ static int loongson_se_probe(struct platform_device *pdev)
 	if (IS_ERR(se->base))
 		return PTR_ERR(se->base);
 
-	writel(SE_INT_ALL, se->base + SE_S2LINT_EN);
-
 	nr_irq = platform_irq_count(pdev);
 	if (nr_irq <= 0)
 		return -ENODEV;
 
+	writel(SE_INT_ALL, se->base + SE_S2LINT_CL);
+
 	for (i = 0; i < nr_irq; i++) {
 		irq = platform_get_irq(pdev, i);
 		err = devm_request_irq(dev, irq, se_irq_handler, 0, "loongson-se", se);
@@ -238,10 +270,16 @@ static int loongson_se_probe(struct platform_device *pdev)
 			dev_err(dev, "failed to request IRQ: %d\n", irq);
 	}
 
+	writel(SE_INT_ALL, se->base + SE_S2LINT_EN);
+
 	err = loongson_se_init(se, paddr, se->dmam_size);
 	if (err)
 		return err;
 
+	err = devm_add_action_or_reset(dev, loongson_se_stop, se);
+	if (err)
+		return err;
+
 	return devm_mfd_add_devices(dev, PLATFORM_DEVID_NONE, engines,
 				    ARRAY_SIZE(engines), NULL, 0, NULL);
 }
@@ -253,8 +291,9 @@ static const struct acpi_device_id loongson_se_acpi_match[] = {
 MODULE_DEVICE_TABLE(acpi, loongson_se_acpi_match);
 
 static struct platform_driver loongson_se_driver = {
-	.probe   = loongson_se_probe,
-	.driver  = {
+	.probe    = loongson_se_probe,
+	.shutdown = loongson_se_shutdown,
+	.driver   = {
 		.name  = "loongson-se",
 		.acpi_match_table = loongson_se_acpi_match,
 	},
diff --git a/include/linux/mfd/loongson-se.h b/include/linux/mfd/loongson-se.h
index 2d0a8b1e5c9e..dbe5992bd435 100644
--- a/include/linux/mfd/loongson-se.h
+++ b/include/linux/mfd/loongson-se.h
@@ -11,6 +11,7 @@
 #define SE_SEND_CMD_REG_LEN		0x8
 /* Controller command ID */
 #define SE_CMD_START			0x0
+#define SE_CMD_STOP			0x1
 #define SE_CMD_SET_DMA			0x3
 #define SE_CMD_SET_ENGINE_CMDBUF	0x4
 
-- 
2.56.0.307.g5fe7bd680c-goog

[PATCH v2 20/27] mfd: loongson-se: Validate engine ID, DMA buffer size, and IRQ registration

[Lee Jones]

Harden input and error checking in loongson_se_init_engine() and
loongson_se_probe():

- Reject out-of-bounds engine IDs and engine 0 in
  loongson_se_init_engine() before indexing se->engines.
- Store dmam_size as u32 to match device_property_read_u32() and verify
  that it is large enough to hold the command buffers of all engines
  within engine 0's data region.
- Propagate negative error codes from platform_irq_count(),
  platform_get_irq(), and devm_request_irq() instead of ignoring IRQ
  registration failures or masking -EPROBE_DEFER.

Fixes: e551fa3159e3 ("mfd: Add support for Loongson Security Engine chip controller")
Closes: https://sashiko.dev/#/bug/linux-89bf25f5-ecd9-40e3-bb4c-bd26d07c53a1
Cc: stable@vger.kernel.org
Reviewed-by: Qunqin Zhao <zhaoqunqin@loongson.cn>
Signed-off-by: Lee Jones <lee@kernel.org>
---
 drivers/mfd/loongson-se.c | 23 ++++++++++++++++++-----
 1 file changed, 18 insertions(+), 5 deletions(-)

diff --git a/drivers/mfd/loongson-se.c b/drivers/mfd/loongson-se.c
index bdbab4b91729..23af05d388aa 100644
--- a/drivers/mfd/loongson-se.c
+++ b/drivers/mfd/loongson-se.c
@@ -26,7 +26,7 @@ struct loongson_se {
 	struct completion cmd_completion;
 
 	void *dmam_base;
-	int dmam_size;
+	u32 dmam_size;
 
 	struct mutex engine_init_lock;
 	struct loongson_se_engine engines[SE_ENGINE_MAX];
@@ -101,8 +101,13 @@ EXPORT_SYMBOL_GPL(loongson_se_send_engine_cmd);
 struct loongson_se_engine *loongson_se_init_engine(struct device *dev, int id)
 {
 	struct loongson_se *se = dev_get_drvdata(dev);
-	struct loongson_se_engine *engine = &se->engines[id];
 	struct loongson_se_controller_cmd cmd = {};
+	struct loongson_se_engine *engine;
+
+	if (id <= 0 || id >= SE_ENGINE_MAX)
+		return NULL;
+
+	engine = &se->engines[id];
 
 	engine->se = se;
 	engine->id = id;
@@ -186,7 +191,7 @@ static void loongson_se_stop(void *data)
 	mutex_unlock(&se->engine_init_lock);
 }
 
-static int loongson_se_init(struct loongson_se *se, dma_addr_t addr, int size)
+static int loongson_se_init(struct loongson_se *se, dma_addr_t addr, u32 size)
 {
 	struct loongson_se_controller_cmd cmd = {};
 	int err;
@@ -249,6 +254,9 @@ static int loongson_se_probe(struct platform_device *pdev)
 	if (device_property_read_u32(dev, "dmam_size", &se->dmam_size))
 		return -ENODEV;
 
+	if ((se->dmam_size / SE_ENGINE_MAX) < (SE_ENGINE_MAX * 2 * SE_ENGINE_CMD_SIZE))
+		return -EINVAL;
+
 	se->dmam_base = dmam_alloc_coherent(dev, se->dmam_size, &paddr, GFP_KERNEL);
 	if (!se->dmam_base)
 		return -ENOMEM;
@@ -258,16 +266,21 @@ static int loongson_se_probe(struct platform_device *pdev)
 		return PTR_ERR(se->base);
 
 	nr_irq = platform_irq_count(pdev);
-	if (nr_irq <= 0)
+	if (!nr_irq)
 		return -ENODEV;
+	if (nr_irq < 0)
+		return nr_irq;
 
 	writel(SE_INT_ALL, se->base + SE_S2LINT_CL);
 
 	for (i = 0; i < nr_irq; i++) {
 		irq = platform_get_irq(pdev, i);
+		if (irq < 0)
+			return irq;
+
 		err = devm_request_irq(dev, irq, se_irq_handler, 0, "loongson-se", se);
 		if (err)
-			dev_err(dev, "failed to request IRQ: %d\n", irq);
+			return dev_err_probe(dev, err, "Failed to request IRQ: %d\n", irq);
 	}
 
 	writel(SE_INT_ALL, se->base + SE_S2LINT_EN);
-- 
2.56.0.307.g5fe7bd680c-goog