Re: [PATCH v5 2/7] mux: Add helper functions for getting optional and selected mux-state

[Josua Mayer <josua@solid-run.com>]

On 20/01/2026 11:45, Geert Uytterhoeven wrote:
> Hi Josua,
>
> On Sun, 18 Jan 2026 at 11:29, Josua Mayer <josua@solid-run.com> wrote:
>> In-tree phy-can-transceiver driver has already implemented a local
>> version of devm_mux_state_get_optional.
>>
>> The omap-i2c driver gets and selects an optional mux in its probe
>> function without using any helper.
>>
>> Add new helper functions covering both aforementioned use-cases:
>>
>> - mux_control_get_optional:
>>    Get a mux-control if specified in dt, return NULL otherwise.
>> - devm_mux_state_get_optional:
>>    Get a mux-state if specified in dt, return NULL otherwise.
>> - devm_mux_state_get_selected:
>>    Get and select a mux-state specified in dt, return error otherwise.
>> - devm_mux_state_get_optional_selected:
>>    Get and select a mux-state if specified in dt, return error or NULL.
>>
>> Existing mux_get helper function is changed to take an extra argument
>> indicating whether the mux is optional.
>> In this case no error is printed, and NULL returned in case of ENOENT.
>>
>> Calling code is adapted to handle NULL return case, and to pass optional
>> argument as required.
>>
>> To support automatic deselect for _selected helper, a new structure is
>> created storing an exit pointer similar to clock core which is called on
>> release.
>>
>> To facilitate code sharing between optional/mandatory/selected helpers,
>> a new internal helper function is added to handle quiet (optional) and
>> verbose (mandatory) errors, as well as storing the correct callback for
>> devm release: __devm_mux_state_get
>>
>> Due to this structure devm_mux_state_get_*_selected can no longer print
>> a useful error message when select fails. Instead callers should print
>> errors where needed.
>>
>> Commit e153fdea9db04 ("phy: can-transceiver: Re-instate "mux-states"
>> property presence check") noted that "mux_get() always prints an error
>> message in case of an error, including when the property is not present,
>> confusing the user."
>>
>> The first error message covers the case that a mux name is not matched
>> in dt. The second error message is based on of_parse_phandle_with_args
>> return value.
>>
>> In optional case no error is printed and NULL is returned.
>> This ensures that the new helper functions will not confuse the user
>> either.
>>
>> With the addition of optional helper functions it became clear that
>> drivers should compile and link even if CONFIG_MULTIPLEXER was not enabled.
>> Add stubs for all symbols exported by mux core.
>>
>> Signed-off-by: Josua Mayer <josua@solid-run.com>
> Thanks for your patch!
>
>> --- a/drivers/mux/core.c
>> +++ b/drivers/mux/core.c
>> @@ -677,7 +707,7 @@ EXPORT_SYMBOL_GPL(devm_mux_control_get);
>>    *
>>    * Return: A pointer to the mux-state, or an ERR_PTR with a negative errno.
>>    */
>> -static struct mux_state *mux_state_get(struct device *dev, const char *mux_name)
>> +static struct mux_state *mux_state_get(struct device *dev, const char *mux_name, bool optional)
>>   {
>>          struct mux_state *mstate;
>>
>> @@ -685,12 +715,10 @@ static struct mux_state *mux_state_get(struct device *dev, const char *mux_name)
>>          if (!mstate)
>>                  return ERR_PTR(-ENOMEM);
>>
>> -       mstate->mux = mux_get(dev, mux_name, &mstate->state);
>> -       if (IS_ERR(mstate->mux)) {
>> -               int err = PTR_ERR(mstate->mux);
>> -
>> +       mstate->mux = mux_get(dev, mux_name, &mstate->state, optional);
>> +       if (IS_ERR_OR_NULL(mstate->mux)) {
>>                  kfree(mstate);
> mstate is freed here...
>
>> -               return ERR_PTR(err);
>> +               return ERR_CAST(mstate->mux);
> ... and dereferenced here, leading to a use after free.
Thank you for spotting this, I will resolve it in next version!

(along with what the kernel robot found)

>
>>          }
>>
>>          return mstate;
> Gr{oetje,eeting}s,
>
>                          Geert
>