<feed xmlns='http://www.w3.org/2005/Atom'>
<title>linux-toradex.git/drivers/gpio, branch v4.15</title>
<subtitle>Linux kernel for Apalis and Colibri modules</subtitle>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/'/>
<entry>
<title>gpio: mmio: Also read bits that are zero</title>
<updated>2018-01-16T22:42:36+00:00</updated>
<author>
<name>Linus Walleij</name>
<email>linus.walleij@linaro.org</email>
</author>
<published>2018-01-16T08:51:51+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=07c7b6a52503ac13ae357a8b3ef3456590a64b65'/>
<id>07c7b6a52503ac13ae357a8b3ef3456590a64b65</id>
<content type='text'>
The code for .get_multiple() has bugs:

1. The simple .get_multiple() just reads a register, masks it
and sets the return value. This is not correct: we only want to
assign values (whether 0 or 1) to the bits that are set in the
mask. Fix this by using &amp;= ~mask to clear all bits in the mask
and then |= val &amp; mask to set the corresponding bits from the
read.

2. The bgpio_get_multiple_be() call has a similar problem: it
uses the |= operator to set the bits, so only the bits in the
mask are affected, but it misses to clear all returned bits
from the mask initially, so some bits will be returned
erroneously set to 1.

3. The bgpio_get_set_multiple() again fails to clear the bits
from the mask.

4. find_next_bit() wasn't handled correctly, use a totally
different approach for one function and change the other
function to follow the design pattern of assigning the first
bit to -1, then use bit + 1 in the for loop and &lt; num_iterations
as break condition.

Fixes: 80057cb417b2 ("gpio-mmio: Use the new .get_multiple() callback")
Cc: Bartosz Golaszewski &lt;brgl@bgdev.pl&gt;
Reported-by: Clemens Gruber &lt;clemens.gruber@pqgruber.com&gt;
Tested-by: Clemens Gruber &lt;clemens.gruber@pqgruber.com&gt;
Reported-by: Lukas Wunner &lt;lukas@wunner.de&gt;
Signed-off-by: Linus Walleij &lt;linus.walleij@linaro.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
The code for .get_multiple() has bugs:

1. The simple .get_multiple() just reads a register, masks it
and sets the return value. This is not correct: we only want to
assign values (whether 0 or 1) to the bits that are set in the
mask. Fix this by using &amp;= ~mask to clear all bits in the mask
and then |= val &amp; mask to set the corresponding bits from the
read.

2. The bgpio_get_multiple_be() call has a similar problem: it
uses the |= operator to set the bits, so only the bits in the
mask are affected, but it misses to clear all returned bits
from the mask initially, so some bits will be returned
erroneously set to 1.

3. The bgpio_get_set_multiple() again fails to clear the bits
from the mask.

4. find_next_bit() wasn't handled correctly, use a totally
different approach for one function and change the other
function to follow the design pattern of assigning the first
bit to -1, then use bit + 1 in the for loop and &lt; num_iterations
as break condition.

Fixes: 80057cb417b2 ("gpio-mmio: Use the new .get_multiple() callback")
Cc: Bartosz Golaszewski &lt;brgl@bgdev.pl&gt;
Reported-by: Clemens Gruber &lt;clemens.gruber@pqgruber.com&gt;
Tested-by: Clemens Gruber &lt;clemens.gruber@pqgruber.com&gt;
Reported-by: Lukas Wunner &lt;lukas@wunner.de&gt;
Signed-off-by: Linus Walleij &lt;linus.walleij@linaro.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>gpio: Add missing open drain/source handling to gpiod_set_value_cansleep()</title>
<updated>2018-01-10T13:17:17+00:00</updated>
<author>
<name>Geert Uytterhoeven</name>
<email>geert+renesas@glider.be</email>
</author>
<published>2018-01-09T18:08:21+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=1e77fc82110ac36febf46c1e2782f504f7d23099'/>
<id>1e77fc82110ac36febf46c1e2782f504f7d23099</id>
<content type='text'>
Since commit f11a04464ae57e8d ("i2c: gpio: Enable working over slow
can_sleep GPIOs"), probing the i2c RTC connected to an i2c-gpio bus on
r8a7740/armadillo fails with:

    rtc-s35390a 0-0030: error resetting chip
    rtc-s35390a: probe of 0-0030 failed with error -5

More debug code reveals:

    i2c i2c-0: master_xfer[0] R, addr=0x30, len=1
    i2c i2c-0: NAK from device addr 0x30 msg #0
    s35390a_get_reg: ret = -6

Commit 02e479808b5d62f8 ("gpio: Alter semantics of *raw* operations to
actually be raw") moved open drain/source handling from
gpiod_set_raw_value_commit() to gpiod_set_value(), but forgot to take
into account that gpiod_set_value_cansleep() also needs this handling.
The i2c protocol mandates that i2c signals are open drain, hence i2c
communication fails.

Fix this by adding the missing handling to gpiod_set_value_cansleep(),
using a new common helper gpiod_set_value_nocheck().

Fixes: 02e479808b5d62f8 ("gpio: Alter semantics of *raw* operations to actually be raw")
Signed-off-by: Geert Uytterhoeven &lt;geert+renesas@glider.be&gt;
[removed underscore syntax, added kerneldoc]
Signed-off-by: Linus Walleij &lt;linus.walleij@linaro.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Since commit f11a04464ae57e8d ("i2c: gpio: Enable working over slow
can_sleep GPIOs"), probing the i2c RTC connected to an i2c-gpio bus on
r8a7740/armadillo fails with:

    rtc-s35390a 0-0030: error resetting chip
    rtc-s35390a: probe of 0-0030 failed with error -5

More debug code reveals:

    i2c i2c-0: master_xfer[0] R, addr=0x30, len=1
    i2c i2c-0: NAK from device addr 0x30 msg #0
    s35390a_get_reg: ret = -6

Commit 02e479808b5d62f8 ("gpio: Alter semantics of *raw* operations to
actually be raw") moved open drain/source handling from
gpiod_set_raw_value_commit() to gpiod_set_value(), but forgot to take
into account that gpiod_set_value_cansleep() also needs this handling.
The i2c protocol mandates that i2c signals are open drain, hence i2c
communication fails.

Fix this by adding the missing handling to gpiod_set_value_cansleep(),
using a new common helper gpiod_set_value_nocheck().

Fixes: 02e479808b5d62f8 ("gpio: Alter semantics of *raw* operations to actually be raw")
Signed-off-by: Geert Uytterhoeven &lt;geert+renesas@glider.be&gt;
[removed underscore syntax, added kerneldoc]
Signed-off-by: Linus Walleij &lt;linus.walleij@linaro.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>genirq/irqdomain: Rename early argument of irq_domain_activate_irq()</title>
<updated>2017-12-29T20:13:04+00:00</updated>
<author>
<name>Thomas Gleixner</name>
<email>tglx@linutronix.de</email>
</author>
<published>2017-12-29T15:59:06+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=702cb0a02813299d6911b775c637906ae21b737d'/>
<id>702cb0a02813299d6911b775c637906ae21b737d</id>
<content type='text'>
The 'early' argument of irq_domain_activate_irq() is actually used to
denote reservation mode. To avoid confusion, rename it before abuse
happens.

No functional change.

Fixes: 72491643469a ("genirq/irqdomain: Update irq_domain_ops.activate() signature")
Signed-off-by: Thomas Gleixner &lt;tglx@linutronix.de&gt;
Cc: Alexandru Chirvasitu &lt;achirvasub@gmail.com&gt;
Cc: Andy Shevchenko &lt;andriy.shevchenko@linux.intel.com&gt;
Cc: Dou Liyang &lt;douly.fnst@cn.fujitsu.com&gt;
Cc: Pavel Machek &lt;pavel@ucw.cz&gt;
Cc: Maciej W. Rozycki &lt;macro@linux-mips.org&gt;
Cc: Mikael Pettersson &lt;mikpelinux@gmail.com&gt;
Cc: Josh Poulson &lt;jopoulso@microsoft.com&gt;
Cc: Mihai Costache &lt;v-micos@microsoft.com&gt;
Cc: Stephen Hemminger &lt;sthemmin@microsoft.com&gt;
Cc: Marc Zyngier &lt;marc.zyngier@arm.com&gt;
Cc: linux-pci@vger.kernel.org
Cc: Haiyang Zhang &lt;haiyangz@microsoft.com&gt;
Cc: Dexuan Cui &lt;decui@microsoft.com&gt;
Cc: Simon Xiao &lt;sixiao@microsoft.com&gt;
Cc: Saeed Mahameed &lt;saeedm@mellanox.com&gt;
Cc: Jork Loeser &lt;Jork.Loeser@microsoft.com&gt;
Cc: Bjorn Helgaas &lt;bhelgaas@google.com&gt;
Cc: devel@linuxdriverproject.org
Cc: KY Srinivasan &lt;kys@microsoft.com&gt;
Cc: Alan Cox &lt;alan@linux.intel.com&gt;
Cc: Sakari Ailus &lt;sakari.ailus@intel.com&gt;,
Cc: linux-media@vger.kernel.org

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
The 'early' argument of irq_domain_activate_irq() is actually used to
denote reservation mode. To avoid confusion, rename it before abuse
happens.

No functional change.

Fixes: 72491643469a ("genirq/irqdomain: Update irq_domain_ops.activate() signature")
Signed-off-by: Thomas Gleixner &lt;tglx@linutronix.de&gt;
Cc: Alexandru Chirvasitu &lt;achirvasub@gmail.com&gt;
Cc: Andy Shevchenko &lt;andriy.shevchenko@linux.intel.com&gt;
Cc: Dou Liyang &lt;douly.fnst@cn.fujitsu.com&gt;
Cc: Pavel Machek &lt;pavel@ucw.cz&gt;
Cc: Maciej W. Rozycki &lt;macro@linux-mips.org&gt;
Cc: Mikael Pettersson &lt;mikpelinux@gmail.com&gt;
Cc: Josh Poulson &lt;jopoulso@microsoft.com&gt;
Cc: Mihai Costache &lt;v-micos@microsoft.com&gt;
Cc: Stephen Hemminger &lt;sthemmin@microsoft.com&gt;
Cc: Marc Zyngier &lt;marc.zyngier@arm.com&gt;
Cc: linux-pci@vger.kernel.org
Cc: Haiyang Zhang &lt;haiyangz@microsoft.com&gt;
Cc: Dexuan Cui &lt;decui@microsoft.com&gt;
Cc: Simon Xiao &lt;sixiao@microsoft.com&gt;
Cc: Saeed Mahameed &lt;saeedm@mellanox.com&gt;
Cc: Jork Loeser &lt;Jork.Loeser@microsoft.com&gt;
Cc: Bjorn Helgaas &lt;bhelgaas@google.com&gt;
Cc: devel@linuxdriverproject.org
Cc: KY Srinivasan &lt;kys@microsoft.com&gt;
Cc: Alan Cox &lt;alan@linux.intel.com&gt;
Cc: Sakari Ailus &lt;sakari.ailus@intel.com&gt;,
Cc: linux-media@vger.kernel.org

</pre>
</div>
</content>
</entry>
<entry>
<title>gpio: brcmstb: Make really use of the new lockdep class</title>
<updated>2017-12-29T15:37:09+00:00</updated>
<author>
<name>Thomas Gleixner</name>
<email>tglx@linutronix.de</email>
</author>
<published>2017-12-29T15:29:15+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=8880c13734af33635118a1e9567dadc7f9ddb7a8'/>
<id>8880c13734af33635118a1e9567dadc7f9ddb7a8</id>
<content type='text'>
The recent extension of irq_set_lockdep_class() with a second argument
added the new lockdep class to the mrcmstb driver, but used the already
existing lockdep class as second argument, which leaves the new lockdep
class defined but unused.

Use the new lockdep class as that's what the change intended to do.

Fixes: 39c3fd58952d ("kernel/irq: Extend lockdep class for request mutex")
Reported-by: Ingo Molnar &lt;mingo@kernel.org&gt;
Signed-off-by: Thomas Gleixner &lt;tglx@linutronix.de&gt;
Cc: Andrew Lunn &lt;andrew@lunn.ch&gt;
Cc: linus.walleij@linaro.org
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
The recent extension of irq_set_lockdep_class() with a second argument
added the new lockdep class to the mrcmstb driver, but used the already
existing lockdep class as second argument, which leaves the new lockdep
class defined but unused.

Use the new lockdep class as that's what the change intended to do.

Fixes: 39c3fd58952d ("kernel/irq: Extend lockdep class for request mutex")
Reported-by: Ingo Molnar &lt;mingo@kernel.org&gt;
Signed-off-by: Thomas Gleixner &lt;tglx@linutronix.de&gt;
Cc: Andrew Lunn &lt;andrew@lunn.ch&gt;
Cc: linus.walleij@linaro.org
</pre>
</div>
</content>
</entry>
<entry>
<title>kernel/irq: Extend lockdep class for request mutex</title>
<updated>2017-12-28T11:26:35+00:00</updated>
<author>
<name>Andrew Lunn</name>
<email>andrew@lunn.ch</email>
</author>
<published>2017-12-02T17:11:04+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=39c3fd58952d7599d367c84c1330b785d91d6088'/>
<id>39c3fd58952d7599d367c84c1330b785d91d6088</id>
<content type='text'>
The IRQ code already has support for lockdep class for the lock mutex
in an interrupt descriptor. Extend this to add a second class for the
request mutex in the descriptor. Not having a class is resulting in
false positive splats in some code paths.

Signed-off-by: Andrew Lunn &lt;andrew@lunn.ch&gt;
Signed-off-by: Thomas Gleixner &lt;tglx@linutronix.de&gt;
Acked-by: linus.walleij@linaro.org
Cc: grygorii.strashko@ti.com
Cc: f.fainelli@gmail.com
Link: https://lkml.kernel.org/r/1512234664-21555-1-git-send-email-andrew@lunn.ch

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
The IRQ code already has support for lockdep class for the lock mutex
in an interrupt descriptor. Extend this to add a second class for the
request mutex in the descriptor. Not having a class is resulting in
false positive splats in some code paths.

Signed-off-by: Andrew Lunn &lt;andrew@lunn.ch&gt;
Signed-off-by: Thomas Gleixner &lt;tglx@linutronix.de&gt;
Acked-by: linus.walleij@linaro.org
Cc: grygorii.strashko@ti.com
Cc: f.fainelli@gmail.com
Link: https://lkml.kernel.org/r/1512234664-21555-1-git-send-email-andrew@lunn.ch

</pre>
</div>
</content>
</entry>
<entry>
<title>gpio: fix "gpio-line-names" property retrieval</title>
<updated>2017-12-22T14:24:31+00:00</updated>
<author>
<name>Christophe Leroy</name>
<email>christophe.leroy@c-s.fr</email>
</author>
<published>2017-12-15T14:02:33+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=822703354774ec935169cbbc8d503236bcb54fda'/>
<id>822703354774ec935169cbbc8d503236bcb54fda</id>
<content type='text'>
Following commit 9427ecbed46cc ("gpio: Rework of_gpiochip_set_names()
to use device property accessors"), "gpio-line-names" DT property is
not retrieved anymore when chip-&gt;parent is not set by the driver.
This is due to OF based property reads having been replaced by device
based property reads.

This patch fixes that by making use of
fwnode_property_read_string_array() instead of
device_property_read_string_array() and handing over either
of_fwnode_handle(chip-&gt;of_node) or dev_fwnode(chip-&gt;parent)
to that function.

Fixes: 9427ecbed46cc ("gpio: Rework of_gpiochip_set_names() to use device property accessors")
Cc: stable@vger.kernel.org
Signed-off-by: Christophe Leroy &lt;christophe.leroy@c-s.fr&gt;
Acked-by: Mika Westerberg &lt;mika.westerberg@linux.intel.com&gt;
Signed-off-by: Linus Walleij &lt;linus.walleij@linaro.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Following commit 9427ecbed46cc ("gpio: Rework of_gpiochip_set_names()
to use device property accessors"), "gpio-line-names" DT property is
not retrieved anymore when chip-&gt;parent is not set by the driver.
This is due to OF based property reads having been replaced by device
based property reads.

This patch fixes that by making use of
fwnode_property_read_string_array() instead of
device_property_read_string_array() and handing over either
of_fwnode_handle(chip-&gt;of_node) or dev_fwnode(chip-&gt;parent)
to that function.

Fixes: 9427ecbed46cc ("gpio: Rework of_gpiochip_set_names() to use device property accessors")
Cc: stable@vger.kernel.org
Signed-off-by: Christophe Leroy &lt;christophe.leroy@c-s.fr&gt;
Acked-by: Mika Westerberg &lt;mika.westerberg@linux.intel.com&gt;
Signed-off-by: Linus Walleij &lt;linus.walleij@linaro.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>gpio: gpio-reg: fix build</title>
<updated>2017-12-22T14:24:31+00:00</updated>
<author>
<name>Grygorii Strashko</name>
<email>grygorii.strashko@ti.com</email>
</author>
<published>2017-12-06T17:37:45+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=8bb65fc06c08f027980a917648e1cf6e4d51c5ad'/>
<id>8bb65fc06c08f027980a917648e1cf6e4d51c5ad</id>
<content type='text'>
Revert changes introduced by commit f0fbe7bce733 ("gpio: Move irqdomain
into struct gpio_irq_chip") as they are not aplicable to this driver.

Reported-by: Russell King - ARM Linux &lt;linux@armlinux.org.uk&gt;
Fixes: f0fbe7bce733 ("gpio: Move irqdomain into struct gpio_irq_chip")
Signed-off-by: Grygorii Strashko &lt;grygorii.strashko@ti.com&gt;
Signed-off-by: Linus Walleij &lt;linus.walleij@linaro.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Revert changes introduced by commit f0fbe7bce733 ("gpio: Move irqdomain
into struct gpio_irq_chip") as they are not aplicable to this driver.

Reported-by: Russell King - ARM Linux &lt;linux@armlinux.org.uk&gt;
Fixes: f0fbe7bce733 ("gpio: Move irqdomain into struct gpio_irq_chip")
Signed-off-by: Grygorii Strashko &lt;grygorii.strashko@ti.com&gt;
Signed-off-by: Linus Walleij &lt;linus.walleij@linaro.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>gpio: pca953x: fix vendor prefix for PCA9654</title>
<updated>2017-12-02T21:41:43+00:00</updated>
<author>
<name>Sergei Shtylyov</name>
<email>sergei.shtylyov@cogentembedded.com</email>
</author>
<published>2017-11-16T20:18:32+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=8a64e557f399090f5d1917b2f32a065da2b12be1'/>
<id>8a64e557f399090f5d1917b2f32a065da2b12be1</id>
<content type='text'>
Despite commit 55020c8056a8 ("of: Add vendor prefix for ON Semiconductor
Corp.") was made long ago, the latter commit 9f49f6dd0473 ("gpio: pca953x:
add onsemi,pca9654 id") made use of another, undocumented vendor prefix.
Since such prefix doesn't seem to be used in any device trees, I think we
can just fix the "compatible" string in the driver and the bindings and be
done with that...

Fixes: 9f49f6dd0473 ("gpio: pca953x: add onsemi,pca9654 id")
Signed-off-by: Sergei Shtylyov &lt;sergei.shtylyov@cogentembedded.com&gt;
Acked-by: Rob Herring &lt;robh@kernel.org&gt;
Signed-off-by: Linus Walleij &lt;linus.walleij@linaro.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Despite commit 55020c8056a8 ("of: Add vendor prefix for ON Semiconductor
Corp.") was made long ago, the latter commit 9f49f6dd0473 ("gpio: pca953x:
add onsemi,pca9654 id") made use of another, undocumented vendor prefix.
Since such prefix doesn't seem to be used in any device trees, I think we
can just fix the "compatible" string in the driver and the bindings and be
done with that...

Fixes: 9f49f6dd0473 ("gpio: pca953x: add onsemi,pca9654 id")
Signed-off-by: Sergei Shtylyov &lt;sergei.shtylyov@cogentembedded.com&gt;
Acked-by: Rob Herring &lt;robh@kernel.org&gt;
Signed-off-by: Linus Walleij &lt;linus.walleij@linaro.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>gpio: davinci: Assign first bank regs for unbanked case</title>
<updated>2017-11-30T14:40:01+00:00</updated>
<author>
<name>Keerthy</name>
<email>j-keerthy@ti.com</email>
</author>
<published>2017-11-10T11:13:17+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=7f8e2a85c1b0bd440ffe87be82c79fdc319e8291'/>
<id>7f8e2a85c1b0bd440ffe87be82c79fdc319e8291</id>
<content type='text'>
As per the re-design assign the first bank regs for unbanked
irq case. This was missed out in the original patch.

Signed-off-by: Keerthy &lt;j-keerthy@ti.com&gt;
Fixes: b5cf3fd827d2e1 ("gpio: davinci: Redesign driver to accommodate ngpios in one gpio chip")
Signed-off-by: Linus Walleij &lt;linus.walleij@linaro.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
As per the re-design assign the first bank regs for unbanked
irq case. This was missed out in the original patch.

Signed-off-by: Keerthy &lt;j-keerthy@ti.com&gt;
Fixes: b5cf3fd827d2e1 ("gpio: davinci: Redesign driver to accommodate ngpios in one gpio chip")
Signed-off-by: Linus Walleij &lt;linus.walleij@linaro.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>gpio: 74x164: Fix crash during .remove()</title>
<updated>2017-11-30T14:31:14+00:00</updated>
<author>
<name>Geert Uytterhoeven</name>
<email>geert+renesas@glider.be</email>
</author>
<published>2017-11-21T14:18:10+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=a158531f3c92467df0e93e000d58185acae78a6e'/>
<id>a158531f3c92467df0e93e000d58185acae78a6e</id>
<content type='text'>
Commit 7ebc194d0fd4bb0f ("gpio: 74x164: Introduce 'enable-gpios'
property") added a new member gpiod_oe to the end of the struct
gen_74x164_chip, after the zero-length buffer array.

However, this buffer is a flexible array, allocated together with the
structure during .probe().  As the buffer is no longer the last member,
writing to it corrupts the newly added member after it.
During device removal, the corrupted member will be used as a pointer,
leading to a crash.

This went unnoticed, as the flexible array was declared as "buffer[0]"
instead of "buffer[]", and thus did not trigger a "flexible array member
not at end of struct" error from gcc.

Move the gpiod_oe field up to fix this, and drop the zero from the array
size to prevent future similar bugs.

Fixes: 7ebc194d0fd4bb0f ("gpio: 74x164: Introduce 'enable-gpios' property")
Signed-off-by: Geert Uytterhoeven &lt;geert+renesas@glider.be&gt;
Reviewed-by: Fabio Estevam &lt;fabio.estevam@nxp.com&gt;
Signed-off-by: Linus Walleij &lt;linus.walleij@linaro.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Commit 7ebc194d0fd4bb0f ("gpio: 74x164: Introduce 'enable-gpios'
property") added a new member gpiod_oe to the end of the struct
gen_74x164_chip, after the zero-length buffer array.

However, this buffer is a flexible array, allocated together with the
structure during .probe().  As the buffer is no longer the last member,
writing to it corrupts the newly added member after it.
During device removal, the corrupted member will be used as a pointer,
leading to a crash.

This went unnoticed, as the flexible array was declared as "buffer[0]"
instead of "buffer[]", and thus did not trigger a "flexible array member
not at end of struct" error from gcc.

Move the gpiod_oe field up to fix this, and drop the zero from the array
size to prevent future similar bugs.

Fixes: 7ebc194d0fd4bb0f ("gpio: 74x164: Introduce 'enable-gpios' property")
Signed-off-by: Geert Uytterhoeven &lt;geert+renesas@glider.be&gt;
Reviewed-by: Fabio Estevam &lt;fabio.estevam@nxp.com&gt;
Signed-off-by: Linus Walleij &lt;linus.walleij@linaro.org&gt;
</pre>
</div>
</content>
</entry>
</feed>
