linux-toradex.git/drivers/mfd/tps65910.c, branch v3.14.33 Linux kernel for Apalis and Colibri modules mfd: tps65910: Fix possible invalid pointer dereference on regmap_add_irq_chip fail 2014-05-06T14:59:25+00:00 Krzysztof Kozlowski k.kozlowski@samsung.com 2014-03-12T15:50:44+00:00 9ae64846e73d519426778a0cad99b17d2a8a38c9 commit 483e2dfdbc94751430e41db9973985f5b054d322 upstream. Fixes: 4aab3fadad32 ("mfd: tps65910: Move interrupt implementation code to mfd file") tps65910_irq_init() sets 'tps65910->chip_irq' before calling regmap_add_irq_chip(). If the regmap_add_irq_chip() call fails in memory allocation of regmap_irq_chip_data members then: 1. The 'tps65910->chip_irq' will still hold some value 2. 'tps65910->irq_data' will be pointing to already freed memory (because regmap_add_irq_chip() will free it on error) This results in invalid memory access during driver remove because the tps65910_irq_exit() tests whether 'tps65910->chip_irq' is not zero. Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com> Signed-off-by: Lee Jones <lee.jones@linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit 483e2dfdbc94751430e41db9973985f5b054d322 upstream.

Fixes: 4aab3fadad32 ("mfd: tps65910: Move interrupt implementation code to mfd file")

tps65910_irq_init() sets 'tps65910->chip_irq' before calling
regmap_add_irq_chip(). If the regmap_add_irq_chip() call fails in
memory allocation of regmap_irq_chip_data members then:

1. The 'tps65910->chip_irq' will still hold some value
2. 'tps65910->irq_data' will be pointing to already freed memory
   (because regmap_add_irq_chip() will free it on error)

This results in invalid memory access during driver remove because the
tps65910_irq_exit() tests whether 'tps65910->chip_irq' is not zero.

Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
mfd: ti: Constify struct mfd_cell where possible 2014-01-06T09:13:29+00:00 Geert Uytterhoeven geert@linux-m68k.org 2013-11-18T13:33:02+00:00 30fe2b5bd5cd732a329ef31062d9d96eee7d18e4 As of commit 03e361b25ee8dfb1fd9b890072c23c4aae01c6c7 ("mfd: Stop setting refcounting pointers in original mfd_cell arrays"), the "cell" parameter of mfd_add_devices() is "const" again. Hence make all cell data passed to mfd_add_devices() const where possible. Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org> Signed-off-by: Lee Jones <lee.jones@linaro.org> 
As of commit 03e361b25ee8dfb1fd9b890072c23c4aae01c6c7 ("mfd: Stop setting
refcounting pointers in original mfd_cell arrays"), the "cell" parameter of
mfd_add_devices() is "const" again. Hence make all cell data passed to
mfd_add_devices() const where possible.

Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Merge tag 'mfd-lee-3.13-1' of git://git.linaro.org/people/ljones/mfd 2013-10-25T09:03:48+00:00 Samuel Ortiz sameo@linux.intel.com 2013-10-25T09:03:48+00:00 8df5a1ba67b1a4b1560472359c30a5b1e3ebcc78 mfd-lee-3.13-1 MFD patches due for v3.13. 
mfd-lee-3.13-1

MFD patches due for v3.13.
mfd: tps65910: Remove warning during dt node parsing 2013-10-24T10:08:22+00:00 Laxman Dewangan ldewangan@nvidia.com 2012-09-26T12:48:04+00:00 34c5c735a89bc0ad5fab1c29b9f425b77fbb7ae7 Driver throw the warning message if dt node does not have the info for VMBCH-Threshold and VMBCH2-Threshold. These properties are optional property and hence it is not mandatory to have these on DT node and in this case it should not throw the warning message. It creates noise from driver as follows: [ 0.384605] tps65910 4-002d: VMBCH-Threshold not specified [ 0.384616] tps65910 4-002d: VMBCH2-Threshold not specified Removing the warning message from driver. Signed-off-by: Laxman Dewangan <ldewangan@nvidia.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com> 
Driver throw the warning message if dt node does not
have the info for VMBCH-Threshold and VMBCH2-Threshold.
These properties are optional property and hence it
is not mandatory to have these on DT node and in this case
it should not throw the warning message.
It creates noise from driver as follows:
[    0.384605] tps65910 4-002d: VMBCH-Threshold not specified
[    0.384616] tps65910 4-002d: VMBCH2-Threshold not specified

Removing the warning message from driver.

Signed-off-by: Laxman Dewangan <ldewangan@nvidia.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
mfd: tps65910: Include linux/of.h header 2013-10-23T15:22:08+00:00 Sachin Kamat sachin.kamat@linaro.org 2013-10-16T08:56:55+00:00 1fead3f399ce7b508b05d0cc9d06d534ffac952c 'of_match_ptr' is defined in linux/of.h. Include it explicitly to avoid breakage in the future. Signed-off-by: Sachin Kamat <sachin.kamat@linaro.org> Signed-off-by: Lee Jones <lee.jones@linaro.org> 
'of_match_ptr' is defined in linux/of.h. Include it explicitly to
avoid breakage in the future.

Signed-off-by: Sachin Kamat <sachin.kamat@linaro.org>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Merge tag 'mfd-3.8-1' of git://git.kernel.org/pub/scm/linux/kernel/git/sameo/mfd-2.6 2012-12-17T02:55:20+00:00 Linus Torvalds torvalds@linux-foundation.org 2012-12-17T02:55:20+00:00 2dfea3803dcf70983d14ce1dcbb3e97a7459a28b Pull MFS update from Samuel Ortiz: "This is the MFD patch set for the 3.8 merge window. We have several new drivers, most of the time coming with their sub devices drivers: - Austria Microsystem's AS3711 - Nano River's viperboard - TI's TPS80031, AM335x TS/ADC, - Realtek's MMC/memstick card reader - Nokia's retu We also got some notable cleanups and improvements: - tps6586x got converted to IRQ domains. - tps65910 and tps65090 moved to the regmap IRQ API. - STMPE is now Device Tree aware. - A general twl6040 and twl-core cleanup, with moves to the regmap I/O and IRQ APIs and a conversion to the recently added PWM framework. - sta2x11 gained regmap support. Then the rest is mostly tiny cleanups and fixes, among which we have Mark's wm5xxx and wm8xxx patchset." Far amount of annoying but largely trivial conflicts. Many due to __devinit/exit removal, others due to one or two of the new drivers also having come in through another tree. * tag 'mfd-3.8-1' of git://git.kernel.org/pub/scm/linux/kernel/git/sameo/mfd-2.6: (119 commits) mfd: tps6507x: Convert to devm_kzalloc mfd: stmpe: Update DT support for stmpe driver mfd: wm5102: Add readback of DSP status 3 register mfd: arizona: Log if we fail to create the primary IRQ domain mfd: tps80031: MFD_TPS80031 needs to select REGMAP_IRQ mfd: tps80031: Add terminating entry for tps80031_id_table mfd: sta2x11: Fix potential NULL pointer dereference in __sta2x11_mfd_mask() mfd: wm5102: Add tuning for revision B mfd: arizona: Defer patch initialistation until after first device boot mfd: tps65910: Fix wrong ack_base register mfd: tps65910: Remove unused data mfd: stmpe: Get rid of irq_invert_polarity mfd: ab8500-core: Fix invalid free of devm_ allocated data mfd: wm5102: Mark DSP memory regions as volatile mfd: wm5102: Correct default for LDO1_CONTROL_2 mfd: arizona: Register haptics devices mfd: wm8994: Make current device behaviour the default mfd: tps65090: MFD_TPS65090 needs to select REGMAP_IRQ mfd: Fix stmpe.c build when OF is not enabled mfd: jz4740-adc: Use devm_kzalloc ... 
Pull MFS update from Samuel Ortiz:
 "This is the MFD patch set for the 3.8 merge window.

  We have several new drivers, most of the time coming with their sub
  devices drivers:

   - Austria Microsystem's AS3711
   - Nano River's viperboard
   - TI's TPS80031, AM335x TS/ADC,
   - Realtek's MMC/memstick card reader
   - Nokia's retu

  We also got some notable cleanups and improvements:

   - tps6586x got converted to IRQ domains.
   - tps65910 and tps65090 moved to the regmap IRQ API.
   - STMPE is now Device Tree aware.
   - A general twl6040 and twl-core cleanup, with moves to the regmap
     I/O and IRQ APIs and a conversion to the recently added PWM
     framework.
   - sta2x11 gained regmap support.

  Then the rest is mostly tiny cleanups and fixes, among which we have
  Mark's wm5xxx and wm8xxx patchset."

Far amount of annoying but largely trivial conflicts.  Many due to
__devinit/exit removal, others due to one or two of the new drivers also
having come in through another tree.

* tag 'mfd-3.8-1' of git://git.kernel.org/pub/scm/linux/kernel/git/sameo/mfd-2.6: (119 commits)
  mfd: tps6507x: Convert to devm_kzalloc
  mfd: stmpe: Update DT support for stmpe driver
  mfd: wm5102: Add readback of DSP status 3 register
  mfd: arizona: Log if we fail to create the primary IRQ domain
  mfd: tps80031: MFD_TPS80031 needs to select REGMAP_IRQ
  mfd: tps80031: Add terminating entry for tps80031_id_table
  mfd: sta2x11: Fix potential NULL pointer dereference in __sta2x11_mfd_mask()
  mfd: wm5102: Add tuning for revision B
  mfd: arizona: Defer patch initialistation until after first device boot
  mfd: tps65910: Fix wrong ack_base register
  mfd: tps65910: Remove unused data
  mfd: stmpe: Get rid of irq_invert_polarity
  mfd: ab8500-core: Fix invalid free of devm_ allocated data
  mfd: wm5102: Mark DSP memory regions as volatile
  mfd: wm5102: Correct default for LDO1_CONTROL_2
  mfd: arizona: Register haptics devices
  mfd: wm8994: Make current device behaviour the default
  mfd: tps65090: MFD_TPS65090 needs to select REGMAP_IRQ
  mfd: Fix stmpe.c build when OF is not enabled
  mfd: jz4740-adc: Use devm_kzalloc
  ...
mfd: tps65910: Fix wrong ack_base register 2012-11-30T11:20:48+00:00 Kim, Milo Milo.Kim@ti.com 2012-11-29T06:42:12+00:00 0582c0fafc36e4a1f2067ea8377c9902cc7997bf The interrupt status registers of TPS65910/1 should be cleared when the associated interrupt event occurs. This work is done in the regmap irq thread - using 'ack_base' register. The ACK registers should be fixed as status register, not mask registers. This patch fixes the infinite interrupt event problem by clearing interrupt status registers. Tested on the AM3517 Craneboard. Signed-off-by: Milo(Woogyom) Kim <milo.kim@ti.com> Acked-by: Laxman Dewangan <ldewangan@nvidia.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com> 
The interrupt status registers of TPS65910/1 should be cleared
when the associated interrupt event occurs.
This work is done in the regmap irq thread - using 'ack_base' register.
The ACK registers should be fixed as status register, not mask registers.

This patch fixes the infinite interrupt event problem by clearing
interrupt status registers.

Tested on the AM3517 Craneboard.

Signed-off-by: Milo(Woogyom) Kim <milo.kim@ti.com>
Acked-by: Laxman Dewangan <ldewangan@nvidia.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
mfd: tps65910: Remove unused data 2012-11-30T11:20:35+00:00 Kim, Milo Milo.Kim@ti.com 2012-11-29T08:48:26+00:00 0e5fca8106199f5c680bb93e75c16381c4c256ce The 'io_mutex' is not used anywhere. The regmap API supports the mutex internally, so no additional mutex is required. And 'domain' private data is unnecessary because the irq domain is already registered by using regmap_add_irq_chip(). Signed-off-by: Milo(Woogyom) Kim <milo.kim@ti.com> Acked-by: Laxman Dewangan <ldewangan@nvidia.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com> 
The 'io_mutex' is not used anywhere.
The regmap API supports the mutex internally, so no additional mutex
is required.

And 'domain' private data is unnecessary because the irq domain is
already registered by using regmap_add_irq_chip().

Signed-off-by: Milo(Woogyom) Kim <milo.kim@ti.com>
Acked-by: Laxman Dewangan <ldewangan@nvidia.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
mfd: remove use of __devexit 2012-11-28T20:22:27+00:00 Bill Pemberton wfp5p@virginia.edu 2012-11-19T18:26:01+00:00 4740f73fe5388ab5d22d552d2a0dacc62418a70c CONFIG_HOTPLUG is going away as an option so __devexit is no longer needed. Signed-off-by: Bill Pemberton <wfp5p@virginia.edu> Cc: Srinidhi Kasagar <srinidhi.kasagar@stericsson.com> Cc: Peter Tyser <ptyser@xes-inc.com> Cc: Daniel Walker <dwalker@fifo99.com> Cc: Bryan Huntsman <bryanh@codeaurora.org> Acked-by: David Brown <davidb@codeaurora.org> Acked-by: Linus Walleij <linus.walleij@linaro.org> Acked-by: Mark Brown <broonie@opensource.wolfsonmicro.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
CONFIG_HOTPLUG is going away as an option so __devexit is no
longer needed.

Signed-off-by: Bill Pemberton <wfp5p@virginia.edu>
Cc: Srinidhi Kasagar <srinidhi.kasagar@stericsson.com>
Cc: Peter Tyser <ptyser@xes-inc.com>
Cc: Daniel Walker <dwalker@fifo99.com>
Cc: Bryan Huntsman <bryanh@codeaurora.org>
Acked-by: David Brown <davidb@codeaurora.org>
Acked-by: Linus Walleij <linus.walleij@linaro.org>
Acked-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
mfd: remove use of __devinit 2012-11-28T20:20:19+00:00 Bill Pemberton wfp5p@virginia.edu 2012-11-19T18:23:04+00:00 f791be492f76dea7b0641ed227a60eeb2fa7e255 CONFIG_HOTPLUG is going away as an option so __devinit is no longer needed. Signed-off-by: Bill Pemberton <wfp5p@virginia.edu> Cc: Srinidhi Kasagar <srinidhi.kasagar@stericsson.com> Cc: Peter Tyser <ptyser@xes-inc.com> Cc: Daniel Walker <dwalker@fifo99.com> Cc: Bryan Huntsman <bryanh@codeaurora.org> Acked-by: David Brown <davidb@codeaurora.org> Acked-by: Mark Brown <broonie@opensource.wolfsonmicro.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
CONFIG_HOTPLUG is going away as an option so __devinit is no longer
needed.

Signed-off-by: Bill Pemberton <wfp5p@virginia.edu>
Cc: Srinidhi Kasagar <srinidhi.kasagar@stericsson.com>
Cc: Peter Tyser <ptyser@xes-inc.com>
Cc: Daniel Walker <dwalker@fifo99.com>
Cc: Bryan Huntsman <bryanh@codeaurora.org>
Acked-by: David Brown <davidb@codeaurora.org>
Acked-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>