From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CF27B44A72C for ; Wed, 29 Jul 2026 09:47:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785318423; cv=none; b=UnDaeOZ1934znqQjZqW24nM09MZnk1sW/wPSrxlQ38w1ny9TgmRjlSIL1W8TCZIPbQJAalUMsr5fRj0AaxtzzyCvrkl0K23nsoPdt2qI0GXk24oLSPAXYgpDpodzjWo8z6s+AH+xHZvdER/LADaBOKlgU9WDlIkO1H7mQLIctgg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785318423; c=relaxed/simple; bh=pzu5Y5MPYRplW7FhsQ2WyoHC6tRcO2lJxqzbVd5cHIk=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=b7jkvJJ3r9Qj/GLe0EdAFLxwrvFJfVCif3zAlWdYFMeu/+N6gADUuM0W5xxgsFjxUiUwW6/xjNBXwf2YYsHLQI3vegsjsB8XllRTzegv32bPRqn1C3MDnv7j1HcCD+FEaOyS7U4Mzp4+q/WYX8P868DFq8NcG4i792u40sLsJFA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=URJI02vO; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="URJI02vO" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2ECF51F000E9; Wed, 29 Jul 2026 09:47:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1785318421; bh=46fA22ShVYAJfIXMV63WLGt9M8wnA3b1svhfChxF55s=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=URJI02vOHjM8cUnqqeIcQaYiuW15ddJp0Tq9uNss5cGf0bmoYSZBPSj/AefcfdYGu S8BqptWms/EdysCjNM0k7hBzVflOROiw/EsyZT5QRy4A1uUe7mvprSve3Qy6LIc9Pi 6/hgmmUhp27t0LzL3nAOnRL4V/rzS11GC9I164xscUkUFYQIAG/GIeJfvxjLVD+kU7 9Ou8DFql/ze06YQ13ufHm4DJEroMoNh8nXkp7rqnF7g+O/buKwCOK3MiXy0iAls35E VAR1paakBkJiM0J4Z5m9ubLP+oJkpAmc95Q3xn05Abo66KTfapQZpNDrXy8aK+5Zx8 w0Age9jTPbHjw== From: srini@kernel.org To: gregkh@linuxfoundation.org Cc: linux-kernel@vger.kernel.org, Bartosz Golaszewski , Loic Poulain , Srinivas Kandagatla Subject: [PATCH 06/14] nvmem: split out the reg_read/write() callbacks out of struct nvmem_device Date: Wed, 29 Jul 2026 10:46:39 +0100 Message-ID: <20260729094647.111468-7-srini@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260729094647.111468-1-srini@kernel.org> References: <20260729094647.111468-1-srini@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Bartosz Golaszewski The reg_read/write() fields of struct nvmem_device point to memory owned by the nvmem provider. They must not be dereferenced after the provider is unregistered. Ahead of protecting against accesses to invalid memory with SRCU, move the callbacks into a separate structure the address of which is stored in nvmem_device. Signed-off-by: Bartosz Golaszewski Tested-by: Loic Poulain Signed-off-by: Srinivas Kandagatla --- drivers/nvmem/core.c | 37 +++++++++++++++++++++++++++---------- drivers/nvmem/internals.h | 9 +++++++-- 2 files changed, 34 insertions(+), 12 deletions(-) diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c index b536ac7ffa11..45ff4ceca1b9 100644 --- a/drivers/nvmem/core.c +++ b/drivers/nvmem/core.c @@ -57,25 +57,28 @@ static BLOCKING_NOTIFIER_HEAD(nvmem_notifier); static int __nvmem_reg_read(struct nvmem_device *nvmem, unsigned int offset, void *val, size_t bytes) { - if (!nvmem->reg_read) + struct nvmem_operations *ops = nvmem->ops; + + if (!ops->reg_read) return -EOPNOTSUPP; - return nvmem->reg_read(nvmem->priv, offset, val, bytes); + return ops->reg_read(nvmem->priv, offset, val, bytes); } static int __nvmem_reg_write(struct nvmem_device *nvmem, unsigned int offset, void *val, size_t bytes) { + struct nvmem_operations *ops = nvmem->ops; int ret, wr_ok; - if (!nvmem->reg_write) + if (!ops->reg_write) return -EOPNOTSUPP; ret = gpiod_set_value_cansleep(nvmem->wp_gpio, 0); if (ret) return ret; - wr_ok = nvmem->reg_write(nvmem->priv, offset, val, bytes); + wr_ok = ops->reg_write(nvmem->priv, offset, val, bytes); ret = gpiod_set_value_cansleep(nvmem->wp_gpio, 1); if (ret) @@ -286,6 +289,8 @@ static ssize_t bin_attr_nvmem_write(struct file *filp, struct kobject *kobj, static umode_t nvmem_bin_attr_get_umode(struct nvmem_device *nvmem) { + struct nvmem_operations *ops = nvmem->ops; + umode_t mode = 0400; if (!nvmem->root_only) @@ -294,10 +299,10 @@ static umode_t nvmem_bin_attr_get_umode(struct nvmem_device *nvmem) if (!nvmem->read_only) mode |= 0200; - if (!nvmem->reg_write) + if (!ops->reg_write) mode &= ~0200; - if (!nvmem->reg_read) + if (!ops->reg_read) mode &= ~0444; return mode; @@ -328,6 +333,7 @@ static umode_t nvmem_attr_is_visible(struct kobject *kobj, { struct device *dev = kobj_to_dev(kobj); struct nvmem_device *nvmem = to_nvmem_device(dev); + struct nvmem_operations *ops = nvmem->ops; /* * If the device has no .reg_write operation, do not allow @@ -336,7 +342,7 @@ static umode_t nvmem_attr_is_visible(struct kobject *kobj, * can be forced into read-write mode using the 'force_ro' * attribute. */ - if (attr == &dev_attr_force_ro.attr && !nvmem->reg_write) + if (attr == &dev_attr_force_ro.attr && !ops->reg_write) return 0; /* Attribute not visible */ return attr->mode; @@ -537,6 +543,7 @@ static void nvmem_release(struct device *dev) ida_free(&nvmem_ida, nvmem->id); gpiod_put(nvmem->wp_gpio); + kfree(nvmem->ops); kfree(nvmem); } @@ -881,6 +888,7 @@ EXPORT_SYMBOL_GPL(nvmem_layout_unregister); struct nvmem_device *nvmem_register(const struct nvmem_config *config) { + struct nvmem_operations *ops; struct nvmem_device *nvmem; int rval; @@ -894,8 +902,15 @@ struct nvmem_device *nvmem_register(const struct nvmem_config *config) if (!nvmem) return ERR_PTR(-ENOMEM); + ops = kzalloc_obj(*ops); + if (!ops) { + kfree(nvmem); + return ERR_PTR(-ENOMEM); + } + rval = ida_alloc(&nvmem_ida, GFP_KERNEL); if (rval < 0) { + kfree(ops); kfree(nvmem); return ERR_PTR(rval); } @@ -905,6 +920,7 @@ struct nvmem_device *nvmem_register(const struct nvmem_config *config) nvmem->dev.type = &nvmem_provider_type; nvmem->dev.bus = &nvmem_bus_type; nvmem->dev.parent = config->dev; + nvmem->ops = ops; device_initialize(&nvmem->dev); @@ -921,6 +937,9 @@ struct nvmem_device *nvmem_register(const struct nvmem_config *config) INIT_LIST_HEAD(&nvmem->cells); nvmem->fixup_dt_cell_info = config->fixup_dt_cell_info; + ops->reg_read = config->reg_read; + ops->reg_write = config->reg_write; + nvmem->owner = config->owner; if (!nvmem->owner && config->dev->driver) nvmem->owner = config->dev->driver->owner; @@ -930,8 +949,6 @@ struct nvmem_device *nvmem_register(const struct nvmem_config *config) nvmem->root_only = config->root_only; nvmem->priv = config->priv; nvmem->type = config->type; - nvmem->reg_read = config->reg_read; - nvmem->reg_write = config->reg_write; nvmem->keepout = config->keepout; nvmem->nkeepout = config->nkeepout; if (config->of_node) @@ -957,7 +974,7 @@ struct nvmem_device *nvmem_register(const struct nvmem_config *config) goto err_put_device; nvmem->read_only = device_property_present(config->dev, "read-only") || - config->read_only || !nvmem->reg_write; + config->read_only || !ops->reg_write; #ifdef CONFIG_NVMEM_SYSFS nvmem->dev.groups = nvmem_dev_groups; diff --git a/drivers/nvmem/internals.h b/drivers/nvmem/internals.h index 05d49c4f631f..4e610deeaa7b 100644 --- a/drivers/nvmem/internals.h +++ b/drivers/nvmem/internals.h @@ -7,6 +7,12 @@ #include #include +/* Hold pointers to callbacks owned by the nvmem provider module. */ +struct nvmem_operations { + nvmem_reg_read_t reg_read; + nvmem_reg_write_t reg_write; +}; + struct nvmem_device { struct module *owner; struct device dev; @@ -26,10 +32,9 @@ struct nvmem_device { struct nvmem_cell_info *cell); const struct nvmem_keepout *keepout; unsigned int nkeepout; - nvmem_reg_read_t reg_read; - nvmem_reg_write_t reg_write; struct gpio_desc *wp_gpio; struct nvmem_layout *layout; + struct nvmem_operations *ops; void *priv; bool sysfs_cells_populated; }; -- 2.53.0