[PATCH 00/10] regulator: Fix teardown races, reference counting, and error handling

[PATCH 00/10] regulator: Fix teardown races, reference counting, and error handling

[Lee Jones]

These issues were reported by Sashiko.

This series addresses ten bugs across the regulator core and regulator
drivers:

- Clear the caller's handle pointer (*handle = NULL) in
  regulator_irq_helper_cancel() instead of assigning NULL to the local
  variable.
- Remove the redundant arizona_ldo1_remove() callback that caused a
  premature and double gpiod_put() on config.ena_gpiod (whose lifetime
  is owned by the regulator core).
- Flush rdev->disable_work with flush_delayed_work() before releasing
  rdev->supply in regulator_unregister().
- Cancel micsupp->check_cp_work on device teardown in arizona-micsupp
  using devm_work_autocancel().
- Take a dedicated device reference for rdev->supply in set_supply() and
  retain the local lookup reference throughout regulator_resolve_supply().
- Initialise rdev->last_off with ktime_get_boottime() in
  set_machine_constraints() to match _regulator_do_enable() and
  _regulator_do_disable().
- Propagate GPIO lookup errors (such as -EPROBE_DEFER) from
  bq257xx_reg_dt_parse_gpio() instead of leaving an ERR_PTR in
  pdata->otg_en_gpio.
- Fix the LDO4 n_voltages count in tps6594-regulator so selectors 0x3f
  through 0x74 are reachable.
- Guard against a NULL idata pointer for BBAT, SDBY, and VRTC in
  max8907_regulator_probe().
- Check the pm_runtime_resume_and_get() return value in
  rt6190_out_enable().

Cc: "André Draszik" <andre.draszik@linaro.org>
Cc: Andy Shevchenko <andy.shevchenko@gmail.com>
Cc: Bartosz Golaszewski <brgl@kernel.org>
Cc: Charles Keepax <ckeepax@opensource.cirrus.com>
Cc: ChiYuan Huang <cy_huang@richtek.com>
Cc: Chris Morgan <macromorgan@hotmail.com>
Cc: Douglas Anderson <dianders@chromium.org>
Cc: Eduardo Candelaria <jedu@slimlogic.co.uk>
Cc: Esteban Blanc <eblanc@baylibre.com>
Cc: Graeme Gregory <gg@slimlogic.co.uk>
Cc: Gyungoh Yoo <jack.yoo@maxim-ic.com>
Cc: Jerome Neanne <jneanne@baylibre.com>
Cc: Jiale Yao <yaojiale02@163.com>
Cc: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Cc: Laxman Dewangan <ldewangan@nvidia.com>
Cc: Liam Girdwood <lgirdwood@gmail.com>
Cc: Linus Walleij <linusw@kernel.org>
Cc: Mal Nadar <m.nirmaladevi@ltts.com>
Cc: Mark Brown <broonie@kernel.org>
Cc: Matti Vaittinen <mazziesaccount@gmail.com>
Cc: Stephen Warren <swarren@nvidia.com>
Cc: Uday Khare <udaykhare77@gmail.com>
Cc: Wentao Liang <vulab@iscas.ac.cn>
Cc: linux-gpio@vger.kernel.org
Cc: patches@opensource.cirrus.com

Lee Jones (10):
  regulator: irq_helpers: Clear caller handle in
    regulator_irq_helper_cancel()
  regulator: arizona-ldo1: Avoid double gpiod_put() on enable GPIO
  regulator: core: Flush delayed disable_work before releasing supply in
    regulator_unregister()
  regulator: arizona-micsupp: Cancel check_cp_work on device teardown
  regulator: core: Hold supply device reference until constraints are
    resolved in regulator_resolve_supply()
  regulator: core: Use ktime_get_boottime() in set_machine_constraints()
  regulator: bq257xx: Propagate GPIO error in
    bq257xx_reg_dt_parse_gpio()
  regulator: tps6594-regulator: Fix LDO4 n_voltages in tps6594_ldo_regs
  regulator: max8907: Avoid NULL idata dereference in
    max8907_regulator_probe()
  regulator: rt6190: Check pm_runtime_resume_and_get() return value in
    rt6190_out_enable()

 drivers/regulator/arizona-ldo1.c      | 16 ----------------
 drivers/regulator/arizona-micsupp.c   |  6 +++++-
 drivers/regulator/bq257xx-regulator.c | 20 ++++++++++++--------
 drivers/regulator/core.c              | 22 ++++++++++++----------
 drivers/regulator/irq_helpers.c       |  2 +-
 drivers/regulator/max8907-regulator.c |  3 ++-
 drivers/regulator/rt6190-regulator.c  |  4 +++-
 drivers/regulator/tps6594-regulator.c |  2 +-
 8 files changed, 36 insertions(+), 39 deletions(-)


base-commit: 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4
-- 
2.56.0.385.gac671c819a-goog

[PATCH 02/10] regulator: arizona-ldo1: Avoid double gpiod_put() on enable GPIO

[Lee Jones]

Passing config.ena_gpiod to devm_regulator_register() transfers ownership
of the GPIO descriptor to the regulator core, which releases it via
gpiod_put() in regulator_ena_gpio_free() upon registration failure or
when devres unregisters the regulator.

Calling gpiod_put(ldo1->ena_gpiod) in arizona_ldo1_remove() prematurely
frees the enable GPIO while the regulator is still registered and causes
a second gpiod_put() when devm_rdev_release() runs.  Drop the redundant
remove callback and ena_gpiod field so the regulator core manages the
descriptor lifetime exclusively.

Fixes: a9191579ba10 ("regulator: arizona-ldo1: Use correct device to get enable GPIO")
Closes: https://sashiko.dev/#/bug/linux-7988402e-ca08-4bd3-9488-5779d6da0450
Cc: stable@vger.kernel.org
Signed-off-by: Lee Jones <lee@kernel.org>
---
 drivers/regulator/arizona-ldo1.c | 16 ----------------
 1 file changed, 16 deletions(-)

diff --git a/drivers/regulator/arizona-ldo1.c b/drivers/regulator/arizona-ldo1.c
index 501843996faa..981e047167ea 100644
--- a/drivers/regulator/arizona-ldo1.c
+++ b/drivers/regulator/arizona-ldo1.c
@@ -35,8 +35,6 @@ struct arizona_ldo1 {
 
 	struct regulator_consumer_supply supply;
 	struct regulator_init_data init_data;
-
-	struct gpio_desc *ena_gpiod;
 };
 
 static int arizona_ldo1_hc_set_voltage_sel(struct regulator_dev *rdev,
@@ -262,8 +260,6 @@ static int arizona_ldo1_common_init(struct platform_device *pdev,
 	if (IS_ERR(config.ena_gpiod))
 		return PTR_ERR(config.ena_gpiod);
 
-	ldo1->ena_gpiod = config.ena_gpiod;
-
 	if (pdata->init_data)
 		config.init_data = pdata->init_data;
 	else
@@ -287,8 +283,6 @@ static int arizona_ldo1_common_init(struct platform_device *pdev,
 		return ret;
 	}
 
-	platform_set_drvdata(pdev, ldo1);
-
 	return 0;
 }
 
@@ -339,14 +333,6 @@ static int arizona_ldo1_probe(struct platform_device *pdev)
 	return ret;
 }
 
-static void arizona_ldo1_remove(struct platform_device *pdev)
-{
-	struct arizona_ldo1 *ldo1 = platform_get_drvdata(pdev);
-
-	if (ldo1->ena_gpiod)
-		gpiod_put(ldo1->ena_gpiod);
-}
-
 static int madera_ldo1_probe(struct platform_device *pdev)
 {
 	struct madera *madera = dev_get_drvdata(pdev->dev.parent);
@@ -375,7 +361,6 @@ static int madera_ldo1_probe(struct platform_device *pdev)
 
 static struct platform_driver arizona_ldo1_driver = {
 	.probe = arizona_ldo1_probe,
-	.remove = arizona_ldo1_remove,
 	.driver = {
 		.name = "arizona-ldo1",
 		.probe_type = PROBE_FORCE_SYNCHRONOUS,
@@ -384,7 +369,6 @@ static struct platform_driver arizona_ldo1_driver = {
 
 static struct platform_driver madera_ldo1_driver = {
 	.probe = madera_ldo1_probe,
-	.remove = arizona_ldo1_remove,
 	.driver = {
 		.name = "madera-ldo1",
 		.probe_type = PROBE_FORCE_SYNCHRONOUS,
-- 
2.56.0.385.gac671c819a-goog

Re: [PATCH 02/10] regulator: arizona-ldo1: Avoid double gpiod_put() on enable GPIO

[Charles Keepax]

On Wed, Nov 04, 2026 at 06:20:52PM +0000, Lee Jones wrote:
> Passing config.ena_gpiod to devm_regulator_register() transfers ownership
> of the GPIO descriptor to the regulator core, which releases it via
> gpiod_put() in regulator_ena_gpio_free() upon registration failure or
> when devres unregisters the regulator.
> 
> Calling gpiod_put(ldo1->ena_gpiod) in arizona_ldo1_remove() prematurely
> frees the enable GPIO while the regulator is still registered and causes
> a second gpiod_put() when devm_rdev_release() runs.  Drop the redundant
> remove callback and ena_gpiod field so the regulator core manages the
> descriptor lifetime exclusively.
> 
> Fixes: a9191579ba10 ("regulator: arizona-ldo1: Use correct device to get enable GPIO")
> Closes: https://sashiko.dev/#/bug/linux-7988402e-ca08-4bd3-9488-5779d6da0450
> Cc: stable@vger.kernel.org
> Signed-off-by: Lee Jones <lee@kernel.org>
> ---

Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com>

Thanks,
Charles