Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'regulator-fix-v6.16-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator
Pull regulator fixes from Mark Brown:
"A few driver fixes (the GPIO one being potentially nasty, though it
has been there for a while without anyone reporting it), and one core
fix for the rarely used combination of coupled regulators and
unbinding"
* tag 'regulator-fix-v6.16-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:
regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods
regulator: mp886x: Fix ID table driver_data
regulator: sy8824x: Fix ID table driver_data
regulator: tps65219: Fix devm_kmalloc size allocation
regulator: core: fix NULL dereference on unbind due to stale coupling data
+25
-20
+1
drivers/regulator/core.c
+1
drivers/regulator/core.c
+4
-4
drivers/regulator/gpio-regulator.c
+4
-4
drivers/regulator/gpio-regulator.c
···
260
260
return -ENOMEM;
261
261
}
262
262
263
-
drvdata->gpiods = devm_kzalloc(dev, sizeof(struct gpio_desc *),
264
-
GFP_KERNEL);
263
+
drvdata->gpiods = devm_kcalloc(dev, config->ngpios,
264
+
sizeof(struct gpio_desc *), GFP_KERNEL);
265
+
if (!drvdata->gpiods)
266
+
return -ENOMEM;
265
267
266
268
if (config->input_supply) {
267
269
drvdata->desc.supply_name = devm_kstrdup(&pdev->dev,
···
276
274
}
277
275
}
278
276
279
-
if (!drvdata->gpiods)
280
-
return -ENOMEM;
281
277
for (i = 0; i < config->ngpios; i++) {
282
278
drvdata->gpiods[i] = devm_gpiod_get_index(dev,
283
279
NULL,
+2
-1
drivers/regulator/mp886x.c
+2
-1
drivers/regulator/mp886x.c
···
348
348
MODULE_DEVICE_TABLE(of, mp886x_dt_ids);
349
349
350
350
static const struct i2c_device_id mp886x_id[] = {
351
-
{ "mp886x", (kernel_ulong_t)&mp8869_ci },
351
+
{ "mp8867", (kernel_ulong_t)&mp8867_ci },
352
+
{ "mp8869", (kernel_ulong_t)&mp8869_ci },
352
353
{ },
353
354
};
354
355
MODULE_DEVICE_TABLE(i2c, mp886x_id);
+4
-1
drivers/regulator/sy8824x.c
+4
-1
drivers/regulator/sy8824x.c
···
213
213
MODULE_DEVICE_TABLE(of, sy8824_dt_ids);
214
214
215
215
static const struct i2c_device_id sy8824_id[] = {
216
-
{ "sy8824", (kernel_ulong_t)&sy8824c_cfg },
216
+
{ "sy8824c", (kernel_ulong_t)&sy8824c_cfg },
217
+
{ "sy8824e", (kernel_ulong_t)&sy8824e_cfg },
218
+
{ "sy20276", (kernel_ulong_t)&sy20276_cfg },
219
+
{ "sy20278", (kernel_ulong_t)&sy20278_cfg },
217
220
{ }
218
221
};
219
222
MODULE_DEVICE_TABLE(i2c, sy8824_id);
+14
-14
drivers/regulator/tps65219-regulator.c
+14
-14
drivers/regulator/tps65219-regulator.c
···
436
436
pmic->rdesc[i].name);
437
437
}
438
438
439
-
irq_data = devm_kmalloc(tps->dev, pmic->common_irq_size, GFP_KERNEL);
440
-
if (!irq_data)
441
-
return -ENOMEM;
442
-
443
439
for (i = 0; i < pmic->common_irq_size; ++i) {
444
440
irq_type = &pmic->common_irq_types[i];
445
441
irq = platform_get_irq_byname(pdev, irq_type->irq_name);
446
442
if (irq < 0)
447
443
return -EINVAL;
448
444
449
-
irq_data[i].dev = tps->dev;
450
-
irq_data[i].type = irq_type;
445
+
irq_data = devm_kmalloc(tps->dev, sizeof(*irq_data), GFP_KERNEL);
446
+
if (!irq_data)
447
+
return -ENOMEM;
448
+
449
+
irq_data->dev = tps->dev;
450
+
irq_data->type = irq_type;
451
451
error = devm_request_threaded_irq(tps->dev, irq, NULL,
452
452
tps65219_regulator_irq_handler,
453
453
IRQF_ONESHOT,
454
454
irq_type->irq_name,
455
-
&irq_data[i]);
455
+
irq_data);
456
456
if (error)
457
457
return dev_err_probe(tps->dev, PTR_ERR(rdev),
458
458
"Failed to request %s IRQ %d: %d\n",
459
459
irq_type->irq_name, irq, error);
460
460
}
461
-
462
-
irq_data = devm_kmalloc(tps->dev, pmic->dev_irq_size, GFP_KERNEL);
463
-
if (!irq_data)
464
-
return -ENOMEM;
465
461
466
462
for (i = 0; i < pmic->dev_irq_size; ++i) {
467
463
irq_type = &pmic->irq_types[i];
···
465
469
if (irq < 0)
466
470
return -EINVAL;
467
471
468
-
irq_data[i].dev = tps->dev;
469
-
irq_data[i].type = irq_type;
472
+
irq_data = devm_kmalloc(tps->dev, sizeof(*irq_data), GFP_KERNEL);
473
+
if (!irq_data)
474
+
return -ENOMEM;
475
+
476
+
irq_data->dev = tps->dev;
477
+
irq_data->type = irq_type;
470
478
error = devm_request_threaded_irq(tps->dev, irq, NULL,
471
479
tps65219_regulator_irq_handler,
472
480
IRQF_ONESHOT,
473
481
irq_type->irq_name,
474
-
&irq_data[i]);
482
+
irq_data);
475
483
if (error)
476
484
return dev_err_probe(tps->dev, PTR_ERR(rdev),
477
485
"Failed to request %s IRQ %d: %d\n",