* [PATCH 1/2] pinctrl: s32cc: fix uninitialized memory in s32_pinctrl_desc
2025-11-11 21:54 [PATCH 0/2] pinctrl: s32cc: fix uninitialized memory issues Jared Kangas
@ 2025-11-11 21:54 ` Jared Kangas
2025-11-12 7:58 ` [EXT] " Jan Petrous (OSS)
2025-11-11 21:54 ` [PATCH 2/2] pinctrl: s32cc: initialize gpio_pin_config::list after kmalloc() Jared Kangas
2025-11-18 22:56 ` [PATCH 0/2] pinctrl: s32cc: fix uninitialized memory issues Linus Walleij
2 siblings, 1 reply; 5+ messages in thread
From: Jared Kangas @ 2025-11-11 21:54 UTC (permalink / raw)
To: Dong Aisheng, Fabio Estevam, Shawn Guo, Jacky Bai,
Pengutronix Kernel Team, NXP S32 Linux Team, Chester Lin,
Matthias Brugger, Ghennadi Procopciuc, Linus Walleij,
Bartosz Golaszewski
Cc: linux-gpio, linux-arm-kernel, linux-kernel, Jared Kangas
s32_pinctrl_desc is allocated with devm_kmalloc(), but not all of its
fields are initialized. Notably, num_custom_params is used in
pinconf_generic_parse_dt_config(), resulting in intermittent allocation
errors, such as the following splat when probing i2c-imx:
WARNING: CPU: 0 PID: 176 at mm/page_alloc.c:4795 __alloc_pages_noprof+0x290/0x300
[...]
Hardware name: NXP S32G3 Reference Design Board 3 (S32G-VNP-RDB3) (DT)
[...]
Call trace:
__alloc_pages_noprof+0x290/0x300 (P)
___kmalloc_large_node+0x84/0x168
__kmalloc_large_node_noprof+0x34/0x120
__kmalloc_noprof+0x2ac/0x378
pinconf_generic_parse_dt_config+0x68/0x1a0
s32_dt_node_to_map+0x104/0x248
dt_to_map_one_config+0x154/0x1d8
pinctrl_dt_to_map+0x12c/0x280
create_pinctrl+0x6c/0x270
pinctrl_get+0xc0/0x170
devm_pinctrl_get+0x50/0xa0
pinctrl_bind_pins+0x60/0x2a0
really_probe+0x60/0x3a0
[...]
__platform_driver_register+0x2c/0x40
i2c_adap_imx_init+0x28/0xff8 [i2c_imx]
[...]
This results in later parse failures that can cause issues in dependent
drivers:
s32g-siul2-pinctrl 4009c240.pinctrl: /soc@0/pinctrl@4009c240/i2c0-pins/i2c0-grp0: could not parse node property
s32g-siul2-pinctrl 4009c240.pinctrl: /soc@0/pinctrl@4009c240/i2c0-pins/i2c0-grp0: could not parse node property
[...]
pca953x 0-0022: failed writing register: -6
i2c i2c-0: IMX I2C adapter registered
s32g-siul2-pinctrl 4009c240.pinctrl: /soc@0/pinctrl@4009c240/i2c2-pins/i2c2-grp0: could not parse node property
s32g-siul2-pinctrl 4009c240.pinctrl: /soc@0/pinctrl@4009c240/i2c2-pins/i2c2-grp0: could not parse node property
i2c i2c-1: IMX I2C adapter registered
s32g-siul2-pinctrl 4009c240.pinctrl: /soc@0/pinctrl@4009c240/i2c4-pins/i2c4-grp0: could not parse node property
s32g-siul2-pinctrl 4009c240.pinctrl: /soc@0/pinctrl@4009c240/i2c4-pins/i2c4-grp0: could not parse node property
i2c i2c-2: IMX I2C adapter registered
Fix this by initializing s32_pinctrl_desc with devm_kzalloc() instead of
devm_kmalloc() in s32_pinctrl_probe(), which sets the previously
uninitialized fields to zero.
Fixes: fd84aaa8173d ("pinctrl: add NXP S32 SoC family support")
Signed-off-by: Jared Kangas <jkangas@redhat.com>
---
drivers/pinctrl/nxp/pinctrl-s32cc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/pinctrl/nxp/pinctrl-s32cc.c b/drivers/pinctrl/nxp/pinctrl-s32cc.c
index 501eb296c76050aa05386c51ef6ae0f97d4c76c3..51ecb8d0fb7e8a203e10cbe965dfec308eaa5f30 100644
--- a/drivers/pinctrl/nxp/pinctrl-s32cc.c
+++ b/drivers/pinctrl/nxp/pinctrl-s32cc.c
@@ -951,7 +951,7 @@ int s32_pinctrl_probe(struct platform_device *pdev,
spin_lock_init(&ipctl->gpio_configs_lock);
s32_pinctrl_desc =
- devm_kmalloc(&pdev->dev, sizeof(*s32_pinctrl_desc), GFP_KERNEL);
+ devm_kzalloc(&pdev->dev, sizeof(*s32_pinctrl_desc), GFP_KERNEL);
if (!s32_pinctrl_desc)
return -ENOMEM;
--
2.51.1
^ permalink raw reply related [flat|nested] 5+ messages in thread* RE: [EXT] [PATCH 1/2] pinctrl: s32cc: fix uninitialized memory in s32_pinctrl_desc
2025-11-11 21:54 ` [PATCH 1/2] pinctrl: s32cc: fix uninitialized memory in s32_pinctrl_desc Jared Kangas
@ 2025-11-12 7:58 ` Jan Petrous (OSS)
0 siblings, 0 replies; 5+ messages in thread
From: Jan Petrous (OSS) @ 2025-11-12 7:58 UTC (permalink / raw)
To: Jared Kangas, Aisheng Dong, Fabio Estevam, Shawn Guo, Jacky Bai,
Pengutronix Kernel Team, dl-S32, Chester Lin, Matthias Brugger,
Ghennadi Procopciuc (OSS), Linus Walleij, Bartosz Golaszewski
Cc: linux-gpio@vger.kernel.org, linux-arm-kernel@lists.infradead.org,
linux-kernel@vger.kernel.org
>
> s32_pinctrl_desc is allocated with devm_kmalloc(), but not all of its
> fields are initialized. Notably, num_custom_params is used in
> pinconf_generic_parse_dt_config(), resulting in intermittent allocation
> errors, such as the following splat when probing i2c-imx:
>
> WARNING: CPU: 0 PID: 176 at mm/page_alloc.c:4795
> __alloc_pages_noprof+0x290/0x300
> [...]
> Hardware name: NXP S32G3 Reference Design Board 3 (S32G-VNP-RDB3)
> (DT)
> [...]
> Call trace:
> __alloc_pages_noprof+0x290/0x300 (P)
> ___kmalloc_large_node+0x84/0x168
> __kmalloc_large_node_noprof+0x34/0x120
> __kmalloc_noprof+0x2ac/0x378
> pinconf_generic_parse_dt_config+0x68/0x1a0
> s32_dt_node_to_map+0x104/0x248
> dt_to_map_one_config+0x154/0x1d8
> pinctrl_dt_to_map+0x12c/0x280
> create_pinctrl+0x6c/0x270
> pinctrl_get+0xc0/0x170
> devm_pinctrl_get+0x50/0xa0
> pinctrl_bind_pins+0x60/0x2a0
> really_probe+0x60/0x3a0
> [...]
> __platform_driver_register+0x2c/0x40
> i2c_adap_imx_init+0x28/0xff8 [i2c_imx]
> [...]
>
> This results in later parse failures that can cause issues in dependent
> drivers:
>
> s32g-siul2-pinctrl 4009c240.pinctrl: /soc@0/pinctrl@4009c240/i2c0-
> pins/i2c0-grp0: could not parse node property
> s32g-siul2-pinctrl 4009c240.pinctrl: /soc@0/pinctrl@4009c240/i2c0-
> pins/i2c0-grp0: could not parse node property
> [...]
> pca953x 0-0022: failed writing register: -6
> i2c i2c-0: IMX I2C adapter registered
> s32g-siul2-pinctrl 4009c240.pinctrl: /soc@0/pinctrl@4009c240/i2c2-
> pins/i2c2-grp0: could not parse node property
> s32g-siul2-pinctrl 4009c240.pinctrl: /soc@0/pinctrl@4009c240/i2c2-
> pins/i2c2-grp0: could not parse node property
> i2c i2c-1: IMX I2C adapter registered
> s32g-siul2-pinctrl 4009c240.pinctrl: /soc@0/pinctrl@4009c240/i2c4-
> pins/i2c4-grp0: could not parse node property
> s32g-siul2-pinctrl 4009c240.pinctrl: /soc@0/pinctrl@4009c240/i2c4-
> pins/i2c4-grp0: could not parse node property
> i2c i2c-2: IMX I2C adapter registered
>
> Fix this by initializing s32_pinctrl_desc with devm_kzalloc() instead of
> devm_kmalloc() in s32_pinctrl_probe(), which sets the previously
> uninitialized fields to zero.
>
> Fixes: fd84aaa8173d ("pinctrl: add NXP S32 SoC family support")
> Signed-off-by: Jared Kangas <jkangas@redhat.com>
> ---
> drivers/pinctrl/nxp/pinctrl-s32cc.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/pinctrl/nxp/pinctrl-s32cc.c b/drivers/pinctrl/nxp/pinctrl-
> s32cc.c
> index
> 501eb296c76050aa05386c51ef6ae0f97d4c76c3..51ecb8d0fb7e8a203e10cbe9
> 65dfec308eaa5f30 100644
> --- a/drivers/pinctrl/nxp/pinctrl-s32cc.c
> +++ b/drivers/pinctrl/nxp/pinctrl-s32cc.c
> @@ -951,7 +951,7 @@ int s32_pinctrl_probe(struct platform_device *pdev,
> spin_lock_init(&ipctl->gpio_configs_lock);
>
> s32_pinctrl_desc =
> - devm_kmalloc(&pdev->dev, sizeof(*s32_pinctrl_desc),
> GFP_KERNEL);
> + devm_kzalloc(&pdev->dev, sizeof(*s32_pinctrl_desc), GFP_KERNEL);
> if (!s32_pinctrl_desc)
> return -ENOMEM;
>
>
> --
> 2.51.1
Thanks for the fix (I had it on my list too).
Tested-by: Jan Petrous (OSS) <jan.petrous@oss.nxp.com>
^ permalink raw reply [flat|nested] 5+ messages in thread
* [PATCH 2/2] pinctrl: s32cc: initialize gpio_pin_config::list after kmalloc()
2025-11-11 21:54 [PATCH 0/2] pinctrl: s32cc: fix uninitialized memory issues Jared Kangas
2025-11-11 21:54 ` [PATCH 1/2] pinctrl: s32cc: fix uninitialized memory in s32_pinctrl_desc Jared Kangas
@ 2025-11-11 21:54 ` Jared Kangas
2025-11-18 22:56 ` [PATCH 0/2] pinctrl: s32cc: fix uninitialized memory issues Linus Walleij
2 siblings, 0 replies; 5+ messages in thread
From: Jared Kangas @ 2025-11-11 21:54 UTC (permalink / raw)
To: Dong Aisheng, Fabio Estevam, Shawn Guo, Jacky Bai,
Pengutronix Kernel Team, NXP S32 Linux Team, Chester Lin,
Matthias Brugger, Ghennadi Procopciuc, Linus Walleij,
Bartosz Golaszewski
Cc: linux-gpio, linux-arm-kernel, linux-kernel, Jared Kangas
s32_pmx_gpio_request_enable() does not initialize the newly-allocated
gpio_pin_config::list before adding it to s32_pinctrl::gpio_configs.
This could result in a linked list corruption.
Initialize the new list_head with INIT_LIST_HEAD() to fix this.
Fixes: fd84aaa8173d ("pinctrl: add NXP S32 SoC family support")
Signed-off-by: Jared Kangas <jkangas@redhat.com>
---
drivers/pinctrl/nxp/pinctrl-s32cc.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/pinctrl/nxp/pinctrl-s32cc.c b/drivers/pinctrl/nxp/pinctrl-s32cc.c
index 51ecb8d0fb7e8a203e10cbe965dfec308eaa5f30..35511f83d05603f5374e2d09be4b0843c7d7dc53 100644
--- a/drivers/pinctrl/nxp/pinctrl-s32cc.c
+++ b/drivers/pinctrl/nxp/pinctrl-s32cc.c
@@ -392,6 +392,7 @@ static int s32_pmx_gpio_request_enable(struct pinctrl_dev *pctldev,
gpio_pin->pin_id = offset;
gpio_pin->config = config;
+ INIT_LIST_HEAD(&gpio_pin->list);
spin_lock_irqsave(&ipctl->gpio_configs_lock, flags);
list_add(&gpio_pin->list, &ipctl->gpio_configs);
--
2.51.1
^ permalink raw reply related [flat|nested] 5+ messages in thread* Re: [PATCH 0/2] pinctrl: s32cc: fix uninitialized memory issues
2025-11-11 21:54 [PATCH 0/2] pinctrl: s32cc: fix uninitialized memory issues Jared Kangas
2025-11-11 21:54 ` [PATCH 1/2] pinctrl: s32cc: fix uninitialized memory in s32_pinctrl_desc Jared Kangas
2025-11-11 21:54 ` [PATCH 2/2] pinctrl: s32cc: initialize gpio_pin_config::list after kmalloc() Jared Kangas
@ 2025-11-18 22:56 ` Linus Walleij
2 siblings, 0 replies; 5+ messages in thread
From: Linus Walleij @ 2025-11-18 22:56 UTC (permalink / raw)
To: Jared Kangas
Cc: Dong Aisheng, Fabio Estevam, Shawn Guo, Jacky Bai,
Pengutronix Kernel Team, NXP S32 Linux Team, Chester Lin,
Matthias Brugger, Ghennadi Procopciuc, Bartosz Golaszewski,
linux-gpio, linux-arm-kernel, linux-kernel
On Tue, Nov 11, 2025 at 10:55 PM Jared Kangas <jkangas@redhat.com> wrote:
> This is a small series that fixes some uninitialized memory issues in
> pinctrl-s32cc. As an example of how these can affect the kernel, when
> probing i2c-imx, a memory allocation may fail because of the
> uninitialized memory giving a junk allocation size, which prevents chips
> on one of the I2C buses from being detected:
>
> # i2cdetect -l
> i2c-1 i2c 401ec000.i2c I2C adapter
> i2c-2 i2c 402dc000.i2c I2C adapter
> i2c-0 i2c 401e4000.i2c I2C adapter
> # i2cdetect -y 0
> 0 1 2 3 4 5 6 7 8 9 a b c d e f
> 00: -- -- -- -- -- -- -- -- -- -- -- -- --
> 10: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
> 20: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
> 30: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
> 40: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
> 50: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
> 60: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
> 70: -- -- -- -- -- -- -- --
>
> Compared to when no failure occurs:
>
> # i2cdetect -l
> i2c-1 i2c 401ec000.i2c I2C adapter
> i2c-2 i2c 402dc000.i2c I2C adapter
> i2c-0 i2c 401e4000.i2c I2C adapter
> # i2cdetect -y 0
> 0 1 2 3 4 5 6 7 8 9 a b c d e f
> 00: -- -- -- -- -- -- -- -- -- -- -- -- --
> 10: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
> 20: -- -- UU -- -- -- -- -- -- -- -- -- -- -- -- --
> 30: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
> 40: -- -- -- -- -- -- -- -- 48 -- -- -- -- -- -- --
> 50: -- 51 -- -- -- -- -- -- -- -- -- -- -- -- -- --
> 60: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
> 70: -- -- -- -- -- -- -- --
>
> Signed-off-by: Jared Kangas <jkangas@redhat.com>
> ---
> Jared Kangas (2):
> pinctrl: s32cc: fix uninitialized memory in s32_pinctrl_desc
> pinctrl: s32cc: initialize gpio_pin_config::list after kmalloc()
Patches applied for fixes!
Nice attention to detail here.
Yours,
Linus Walleij
^ permalink raw reply [flat|nested] 5+ messages in thread