[PATCHv3] rtc: stmp3xxx: use devm_platform_ioremap_resource()

[PATCHv3] rtc: stmp3xxx: use devm_platform_ioremap_resource()

[Rosen Penev]

Replace the open-coded platform_get_resource() plus devm_ioremap()
sequence with a single devm_platform_ioremap_resource() call, which folds
the resource lookup and mapping into one step and returns an ERR_PTR on
failure, checked with IS_ERR() and propagated via PTR_ERR().

Move the mapping ahead of the devm_kzalloc() so that an error or deferred
probe is handled before the rtc_data allocation, avoiding needless work.

The fsl,stmp3xxx-rtc nodes in imx23.dtsi (reg = <0x8005c000 0x2000>) and
imx28.dtsi (reg = <0x80056000 0x2000>) each provide a single
non-overlapping IORESOURCE_MEM window, so the region reservation now
performed by devm_platform_ioremap_resource() introduces no conflict.

Remove irq_alarm from private struct. It's only used in _probe. Also add
check for platform_get_irq() errors.

Assisted-by: opencode:hy3-free
Signed-off-by: Rosen Penev <rosenp@gmail.com>
---
 v3: add missing variable in probe
 v2: add platform_get_irq error check
 drivers/rtc/rtc-stmp3xxx.c | 33 +++++++++++++--------------------
 1 file changed, 13 insertions(+), 20 deletions(-)

diff --git a/drivers/rtc/rtc-stmp3xxx.c b/drivers/rtc/rtc-stmp3xxx.c
index 7afcd14aeee5..a8ca681b574f 100644
--- a/drivers/rtc/rtc-stmp3xxx.c
+++ b/drivers/rtc/rtc-stmp3xxx.c
@@ -56,7 +56,6 @@
 struct stmp3xxx_rtc_data {
 	struct rtc_device *rtc;
 	void __iomem *io;
-	int irq_alarm;
 };
 
 #if IS_ENABLED(CONFIG_STMP3XXX_RTC_WATCHDOG)
@@ -245,29 +244,26 @@ static void stmp3xxx_rtc_remove(struct platform_device *pdev)
 static int stmp3xxx_rtc_probe(struct platform_device *pdev)
 {
 	struct stmp3xxx_rtc_data *rtc_data;
-	struct resource *r;
+	void __iomem *io;
 	u32 rtc_stat;
 	u32 pers0_set, pers0_clr;
 	u32 crystalfreq = 0;
+	int irq_alarm;
 	int err;
 
+	irq_alarm = platform_get_irq(pdev, 0);
+	if (irq_alarm < 0)
+		return irq_alarm;
+
+	io = devm_platform_ioremap_resource(pdev, 0);
+	if (IS_ERR(io))
+		return PTR_ERR(io);
+
 	rtc_data = devm_kzalloc(&pdev->dev, sizeof(*rtc_data), GFP_KERNEL);
 	if (!rtc_data)
 		return -ENOMEM;
 
-	r = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-	if (!r) {
-		dev_err(&pdev->dev, "failed to get resource\n");
-		return -ENXIO;
-	}
-
-	rtc_data->io = devm_ioremap(&pdev->dev, r->start, resource_size(r));
-	if (!rtc_data->io) {
-		dev_err(&pdev->dev, "ioremap failed\n");
-		return -EIO;
-	}
-
-	rtc_data->irq_alarm = platform_get_irq(pdev, 0);
+	rtc_data->io = io;
 
 	rtc_stat = readl(rtc_data->io + STMP3XXX_RTC_STAT);
 	if (!(rtc_stat & STMP3XXX_RTC_STAT_RTC_PRESENT)) {
@@ -354,13 +350,10 @@ static int stmp3xxx_rtc_probe(struct platform_device *pdev)
 	if (IS_ERR(rtc_data->rtc))
 		return PTR_ERR(rtc_data->rtc);
 
-	err = devm_request_irq(&pdev->dev, rtc_data->irq_alarm,
+	err = devm_request_irq(&pdev->dev, irq_alarm,
 			stmp3xxx_rtc_interrupt, 0, "RTC alarm", &pdev->dev);
-	if (err) {
-		dev_err(&pdev->dev, "Cannot claim IRQ%d\n",
-			rtc_data->irq_alarm);
+	if (err)
 		return err;
-	}
 
 	rtc_data->rtc->ops = &stmp3xxx_rtc_ops;
 	rtc_data->rtc->range_max = U32_MAX;
-- 
2.55.0

Re: [PATCHv3] rtc: stmp3xxx: use devm_platform_ioremap_resource()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] This problem wasn't introduced by this patch, but the child watchdog platform device is not unregistered when the RTC driver is unbound, leading to a resource leak, sysfs name collision, and a deterministic Use-After-Free or NULL pointer dereference.
--

--- Patch [1]: [PATCHv3] rtc: stmp3xxx: use devm_platform_ioremap_resource() ---
commit 901eb0948c2584d64b7584f8b8da4d7f0a425840
Author: Rosen Penev <rosenp@gmail.com>

rtc: stmp3xxx: use devm_platform_ioremap_resource()

This commit replaces the open-coded platform_get_resource() and
devm_ioremap() sequence with a single devm_platform_ioremap_resource() call.
It also moves the mapping ahead of devm_kzalloc() to handle errors earlier
and removes irq_alarm from the private struct.

> diff --git a/drivers/rtc/rtc-stmp3xxx.c b/drivers/rtc/rtc-stmp3xxx.c
> index 7afcd14aeee56..a8ca681b574f5 100644
> --- a/drivers/rtc/rtc-stmp3xxx.c
> +++ b/drivers/rtc/rtc-stmp3xxx.c

[ ... ]

> @@ -354,13 +350,10 @@ static int stmp3xxx_rtc_probe(struct platform_device *pdev)
>  	if (IS_ERR(rtc_data->rtc))
>  		return PTR_ERR(rtc_data->rtc);
>  
> -	err = devm_request_irq(&pdev->dev, rtc_data->irq_alarm,
> +	err = devm_request_irq(&pdev->dev, irq_alarm,
>  			stmp3xxx_rtc_interrupt, 0, "RTC alarm", &pdev->dev);
> -	if (err) {
> -		dev_err(&pdev->dev, "Cannot claim IRQ%d\n",
> -			rtc_data->irq_alarm);
> +	if (err)
>  		return err;
> -	}
>  
>  	rtc_data->rtc->ops = &stmp3xxx_rtc_ops;
>  	rtc_data->rtc->range_max = U32_MAX;

[Severity: High]
This is a pre-existing issue, but does the child watchdog device registered
further down in stmp3xxx_rtc_probe() outlive the RTC device if the driver
is unbound?

Looking at stmp3xxx_rtc_remove(), the child watchdog device is never
unregistered:

static void stmp3xxx_rtc_remove(struct platform_device *pdev)
{
	struct stmp3xxx_rtc_data *rtc_data = platform_get_drvdata(pdev);

	if (!rtc_data)
		return;

	writel(STMP3XXX_RTC_CTRL_ALARM_IRQ_EN,
		rtc_data->io + STMP3XXX_RTC_CTRL + STMP_OFFSET_REG_CLR);
}

Since devres will free all devm_ managed resources (including rtc_data) when
the RTC driver is unbound, but the watchdog driver remains active, could
this cause a use-after-free or NULL pointer dereference?

For example, if the system shuts down after unbinding the RTC driver, the
reboot notifier in the orphaned watchdog driver could trigger:

drivers/watchdog/stmp3xxx_rtc_wdt.c:wdt_notify_sys() {
	switch (code) {
	...
	case SYS_POWER_OFF:
		wdt_stop(&stmp3xxx_wdd);
		break;
	}
}

Could this attempt to access the freed parent data when it dereferences
rtc_data->io?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260729225159.775183-1-rosenp@gmail.com?part=1