tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

platform/x86: int3472: Fix double free of GPIO device during unregister

regulator_unregister() already frees the associated GPIO device. On
ThinkPad X9 (Lunar Lake), this causes a double free issue that leads to
random failures when other drivers (typically Intel THC) attempt to
allocate interrupts. The root cause is that the reference count of the
pinctrl_intel_platform module unexpectedly drops to zero when this
driver defers its probe.

This behavior can also be reproduced by unloading the module directly.

Fix the issue by removing the redundant release of the GPIO device
during regulator unregistration.

Cc: stable@vger.kernel.org
Fixes: 1e5d088a52c2 ("platform/x86: int3472: Stop using devm_gpiod_get()")
Signed-off-by: Qiu Wenbo <qiuwenbo@kylinsec.com.cn>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Reviewed-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Reviewed-by: Hans de Goede <hansg@kernel.org>
Reviewed-by: Daniel Scally <dan.scally@ideasonboard.com>
Link: https://patch.msgid.link/20251028063009.289414-1-qiuwenbo@gnome.org
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>

authored by

Qiu Wenbo and committed by
Ilpo Järvinen f0f7a3f5 34cbd6e0

+1 -5
+1 -4
drivers/platform/x86/intel/int3472/clk_and_regulator.c
··· 245 245 if (IS_ERR(regulator->rdev)) 246 246 return PTR_ERR(regulator->rdev); 247 247 248 - int3472->regulators[int3472->n_regulator_gpios].ena_gpio = gpio; 249 248 int3472->n_regulator_gpios++; 250 249 return 0; 251 250 } 252 251 253 252 void skl_int3472_unregister_regulator(struct int3472_discrete_device *int3472) 254 253 { 255 - for (int i = 0; i < int3472->n_regulator_gpios; i++) { 254 + for (int i = 0; i < int3472->n_regulator_gpios; i++) 256 255 regulator_unregister(int3472->regulators[i].rdev); 257 - gpiod_put(int3472->regulators[i].ena_gpio); 258 - } 259 256 }
-1
include/linux/platform_data/x86/int3472.h
··· 100 100 struct regulator_consumer_supply supply_map[GPIO_REGULATOR_SUPPLY_MAP_COUNT * 2]; 101 101 char supply_name_upper[GPIO_SUPPLY_NAME_LENGTH]; 102 102 char regulator_name[GPIO_REGULATOR_NAME_LENGTH]; 103 - struct gpio_desc *ena_gpio; 104 103 struct regulator_dev *rdev; 105 104 struct regulator_desc rdesc; 106 105 };