From: Sasha Levin <sashal@kernel.org>
To: patches@lists.linux.dev, stable@vger.kernel.org
Cc: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>,
Lee Jones <lee@kernel.org>, Sasha Levin <sashal@kernel.org>,
cw00.choi@samsung.com, krzk@kernel.org,
linux-kernel@vger.kernel.org
Subject: [PATCH AUTOSEL 5.15 5/7] mfd: max14577: Fix wakeup source leaks on device unbind
Date: Fri, 6 Jun 2025 11:44:05 -0400 [thread overview]
Message-ID: <20250606154408.548320-5-sashal@kernel.org> (raw)
In-Reply-To: <20250606154408.548320-1-sashal@kernel.org>
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
[ Upstream commit d905d06e64b0eb3da43af6186c132f5282197998 ]
Device can be unbound, so driver must also release memory for the wakeup
source.
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Link: https://lore.kernel.org/r/20250406-mfd-device-wakekup-leak-v1-3-318e14bdba0a@linaro.org
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
Now let me understand the difference between the fixes - the historical
commits show two patterns:
1. Using `devm_device_init_wakeup()` - automatically handles cleanup
2. Manual cleanup by calling `device_init_wakeup(dev, false)` in remove
functions
Let me check if this specific commit has `Cc: stable@vger.kernel.org` in
the message:
Based on my analysis of this commit and comparison with the similar
historical commits, here is my assessment:
**YES**
This commit should be backported to stable kernel trees for the
following reasons:
## Analysis
### **Code Change Analysis**
The commit adds a single line in the `max14577_i2c_remove()` function:
```c
+ device_init_wakeup(max14577->dev, false);
```
This addition occurs at drivers/mfd/max14577.c:459, right before
`mfd_remove_devices()` is called.
### **Bug Fix Characteristics**
1. **Memory Leak Fix**: The commit fixes a wakeup source memory leak
that occurs when the device is unbound. When `device_init_wakeup(dev,
true)` is called during probe (line 442), it allocates memory for
wakeup source structures. Without the corresponding cleanup call,
this memory is leaked on device removal.
2. **Small and Contained**: The fix is minimal - a single line addition
that mirrors the cleanup pattern used throughout the kernel.
3. **Low Risk**: The change has extremely low regression risk since it
only adds proper cleanup that should have been there originally.
### **Comparison with Historical Similar Commits**
Looking at the provided historical commits, there are two categories:
**YES commits (backported)**:
- `gpio: mpc8xxx: Fix wakeup source leaks on device unbind` - Same exact
pattern and includes `Cc: stable@vger.kernel.org`
- `gpio: zynq: Fix wakeup source leaks on device unbind` - Same exact
pattern and includes `Cc: stable@vger.kernel.org`
**NO commits (not backported)**:
- IIO driver commits that use `devm_device_init_wakeup()` instead of
manual cleanup
The key difference is that the YES commits use the same fix pattern as
this MFD commit - manual cleanup in the remove function, while the NO
commits use the `devm_` managed approach that automatically handles
cleanup.
### **Impact Assessment**
- **User Impact**: Memory leaks on device unbind affect systems where
MFD devices are frequently bound/unbound
- **Subsystem**: MFD (Multi-Function Device) is a core kernel subsystem
used by many embedded systems
- **Regression Risk**: Minimal - adding proper cleanup cannot cause
functional regression
### **Stable Tree Criteria Met**
1. ✅ Fixes an important bug (memory leak)
2. ✅ Small and contained change
3. ✅ No architectural changes
4. ✅ Minimal risk of regression
5. ✅ Follows established patterns seen in other backported commits
The commit follows the exact same pattern as the GPIO driver commits
that were successfully backported to stable trees (commits #1 and #2 in
the historical examples), making it a clear candidate for backporting.
drivers/mfd/max14577.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/mfd/max14577.c b/drivers/mfd/max14577.c
index be185e9d5f16b..c9e56145b08bd 100644
--- a/drivers/mfd/max14577.c
+++ b/drivers/mfd/max14577.c
@@ -467,6 +467,7 @@ static int max14577_i2c_remove(struct i2c_client *i2c)
{
struct max14577 *max14577 = i2c_get_clientdata(i2c);
+ device_init_wakeup(max14577->dev, false);
mfd_remove_devices(max14577->dev);
regmap_del_irq_chip(max14577->irq, max14577->irq_data);
if (max14577->dev_type == MAXIM_DEVICE_TYPE_MAX77836)
--
2.39.5
next prev parent reply other threads:[~2025-06-06 15:44 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-06-06 15:44 [PATCH AUTOSEL 5.15 1/7] cifs: Fix cifs_query_path_info() for Windows NT servers Sasha Levin
2025-06-06 15:44 ` [PATCH AUTOSEL 5.15 2/7] NFSv4: Always set NLINK even if the server doesn't support it Sasha Levin
2025-06-06 15:44 ` [PATCH AUTOSEL 5.15 3/7] NFSv4.2: fix listxattr to return selinux security label Sasha Levin
2025-06-06 15:44 ` [PATCH AUTOSEL 5.15 4/7] mailbox: Not protect module_put with spin_lock_irqsave Sasha Levin
2025-06-06 15:44 ` Sasha Levin [this message]
2025-06-06 15:44 ` [PATCH AUTOSEL 5.15 6/7] leds: multicolor: Fix intensity setting while SW blinking Sasha Levin
2025-06-06 15:44 ` [PATCH AUTOSEL 5.15 7/7] hwmon: (pmbus/max34440) Fix support for max34451 Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20250606154408.548320-5-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=cw00.choi@samsung.com \
--cc=krzk@kernel.org \
--cc=krzysztof.kozlowski@linaro.org \
--cc=lee@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=patches@lists.linux.dev \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox