<feed xmlns='http://www.w3.org/2005/Atom'>
<title>linux-toradex.git/drivers/power, branch v3.14.57</title>
<subtitle>Linux kernel for Apalis and Colibri modules</subtitle>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/'/>
<entry>
<title>power: bq24190_charger: suppress build warning</title>
<updated>2015-11-09T20:50:24+00:00</updated>
<author>
<name>Lad, Prabhakar</name>
<email>prabhakar.csengg@gmail.com</email>
</author>
<published>2014-12-04T14:56:04+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=f7aae006ddea262b6c6b4eee94c1392093ba6579'/>
<id>f7aae006ddea262b6c6b4eee94c1392093ba6579</id>
<content type='text'>
commit 31f50e48e3e4ea9d503285a389d6a1b5349d66c0 upstream.

This patch fixes following build warning:

In file included from include/linux/printk.h:261:0,
                 from include/linux/kernel.h:13,
                 from include/linux/list.h:8,
                 from include/linux/module.h:9,
                 from drivers/power/bq24190_charger.c:11:
drivers/power/bq24190_charger.c: In function ‘bq24190_irq_handler_thread’:
include/linux/dynamic_debug.h:86:20: warning: ‘ss_reg’ may be used uninitialized in this function [-Wmaybe-uninitialized]
   __dynamic_dev_dbg(&amp;descriptor, dev, fmt, \
                    ^
drivers/power/bq24190_charger.c:1211:5: note: ‘ss_reg’ was declared here
  u8 ss_reg, f_reg;
     ^
In file included from include/linux/printk.h:261:0,
                 from include/linux/kernel.h:13,
                 from include/linux/list.h:8,
                 from include/linux/module.h:9,
                 from drivers/power/bq24190_charger.c:11:
include/linux/dynamic_debug.h:86:20: warning: ‘f_reg’ may be used uninitialized in this function [-Wmaybe-uninitialized]
   __dynamic_dev_dbg(&amp;descriptor, dev, fmt, \
                    ^
drivers/power/bq24190_charger.c:1211:13: note: ‘f_reg’ was declared here
  u8 ss_reg, f_reg;

Signed-off-by: Lad, Prabhakar &lt;prabhakar.csengg@gmail.com&gt;
Signed-off-by: Sebastian Reichel &lt;sre@kernel.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 31f50e48e3e4ea9d503285a389d6a1b5349d66c0 upstream.

This patch fixes following build warning:

In file included from include/linux/printk.h:261:0,
                 from include/linux/kernel.h:13,
                 from include/linux/list.h:8,
                 from include/linux/module.h:9,
                 from drivers/power/bq24190_charger.c:11:
drivers/power/bq24190_charger.c: In function ‘bq24190_irq_handler_thread’:
include/linux/dynamic_debug.h:86:20: warning: ‘ss_reg’ may be used uninitialized in this function [-Wmaybe-uninitialized]
   __dynamic_dev_dbg(&amp;descriptor, dev, fmt, \
                    ^
drivers/power/bq24190_charger.c:1211:5: note: ‘ss_reg’ was declared here
  u8 ss_reg, f_reg;
     ^
In file included from include/linux/printk.h:261:0,
                 from include/linux/kernel.h:13,
                 from include/linux/list.h:8,
                 from include/linux/module.h:9,
                 from drivers/power/bq24190_charger.c:11:
include/linux/dynamic_debug.h:86:20: warning: ‘f_reg’ may be used uninitialized in this function [-Wmaybe-uninitialized]
   __dynamic_dev_dbg(&amp;descriptor, dev, fmt, \
                    ^
drivers/power/bq24190_charger.c:1211:13: note: ‘f_reg’ was declared here
  u8 ss_reg, f_reg;

Signed-off-by: Lad, Prabhakar &lt;prabhakar.csengg@gmail.com&gt;
Signed-off-by: Sebastian Reichel &lt;sre@kernel.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>power_supply: lp8788-charger: Fix leaked power supply on probe fail</title>
<updated>2015-05-06T19:59:11+00:00</updated>
<author>
<name>Krzysztof Kozlowski</name>
<email>k.kozlowski@samsung.com</email>
</author>
<published>2015-02-20T13:32:25+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=a421928b30cdb0cb6d641dfa1d94a949cf3b461a'/>
<id>a421928b30cdb0cb6d641dfa1d94a949cf3b461a</id>
<content type='text'>
commit a7117f81e8391e035c49b3440792f7e6cea28173 upstream.

Driver forgot to unregister charger power supply if registering of
battery supply failed in probe(). In such case the memory associated
with power supply leaked.

Signed-off-by: Krzysztof Kozlowski &lt;k.kozlowski@samsung.com&gt;
Fixes: 98a276649358 ("power_supply: Add new lp8788 charger driver")
Signed-off-by: Sebastian Reichel &lt;sre@kernel.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit a7117f81e8391e035c49b3440792f7e6cea28173 upstream.

Driver forgot to unregister charger power supply if registering of
battery supply failed in probe(). In such case the memory associated
with power supply leaked.

Signed-off-by: Krzysztof Kozlowski &lt;k.kozlowski@samsung.com&gt;
Fixes: 98a276649358 ("power_supply: Add new lp8788 charger driver")
Signed-off-by: Sebastian Reichel &lt;sre@kernel.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>power_supply: twl4030_madc: Check return value of power_supply_register</title>
<updated>2015-05-06T19:59:10+00:00</updated>
<author>
<name>Krzysztof Kozlowski</name>
<email>k.kozlowski@samsung.com</email>
</author>
<published>2015-02-20T13:32:22+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=934debf41fc7ffdc168620555308b8a045df27a0'/>
<id>934debf41fc7ffdc168620555308b8a045df27a0</id>
<content type='text'>
commit 68c3ed6fa7e0d69529ced772d650ab128916a81d upstream.

The return value of power_supply_register() call was not checked and
even on error probe() function returned 0. If registering failed then
during unbind the driver tried to unregister power supply which was not
actually registered.

This could lead to memory corruption because power_supply_unregister()
unconditionally cleans up given power supply.

Signed-off-by: Krzysztof Kozlowski &lt;k.kozlowski@samsung.com&gt;
Fixes: da0a00ebc239 ("power: Add twl4030_madc battery driver.")
Signed-off-by: Sebastian Reichel &lt;sre@kernel.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 68c3ed6fa7e0d69529ced772d650ab128916a81d upstream.

The return value of power_supply_register() call was not checked and
even on error probe() function returned 0. If registering failed then
during unbind the driver tried to unregister power supply which was not
actually registered.

This could lead to memory corruption because power_supply_unregister()
unconditionally cleans up given power supply.

Signed-off-by: Krzysztof Kozlowski &lt;k.kozlowski@samsung.com&gt;
Fixes: da0a00ebc239 ("power: Add twl4030_madc battery driver.")
Signed-off-by: Sebastian Reichel &lt;sre@kernel.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>power: gpio-charger: balance enable/disable_irq_wake calls</title>
<updated>2015-03-06T22:43:26+00:00</updated>
<author>
<name>Dmitry Eremin-Solenikov</name>
<email>dbaryshkov@gmail.com</email>
</author>
<published>2015-01-15T02:00:37+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=f8801fcbb7346754a91498f22909ef3b5a7ae819'/>
<id>f8801fcbb7346754a91498f22909ef3b5a7ae819</id>
<content type='text'>
commit faeed51bb65ce0241052d8dc24ac331ade12e976 upstream.

enable_irq_wakeup returns 0 in case it correctly enabled the IRQ to
generate the wakeup event (and thus resume should call disable_irq_wake).
Currently gpio-charger driver has this logic inverted. Correct that thus
correcting enable/disable_irq_wake() calls balance.

Signed-off-by: Dmitry Eremin-Solenikov &lt;dbaryshkov@gmail.com&gt;
Signed-off-by: Sebastian Reichel &lt;sre@kernel.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit faeed51bb65ce0241052d8dc24ac331ade12e976 upstream.

enable_irq_wakeup returns 0 in case it correctly enabled the IRQ to
generate the wakeup event (and thus resume should call disable_irq_wake).
Currently gpio-charger driver has this logic inverted. Correct that thus
correcting enable/disable_irq_wake() calls balance.

Signed-off-by: Dmitry Eremin-Solenikov &lt;dbaryshkov@gmail.com&gt;
Signed-off-by: Sebastian Reichel &lt;sre@kernel.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>power: bq24190: Fix ignored supplicants</title>
<updated>2015-03-06T22:43:26+00:00</updated>
<author>
<name>Krzysztof Kozlowski</name>
<email>k.kozlowski@samsung.com</email>
</author>
<published>2015-01-05T08:51:48+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=30383a2526367313e23df1ef8aa305dbedcb14ca'/>
<id>30383a2526367313e23df1ef8aa305dbedcb14ca</id>
<content type='text'>
commit 478913fdbdfd4a781d91c993eb86838620fe7421 upstream.

The driver mismatched 'num_supplicants' with 'num_supplies' of
power_supply structure.

It provided list of supplicants (power_supply.supplied_to) but did
not set the number of supplicants. Instead it set the num_supplies which
is used when iterating over number of supplies (power_supply.supplied_from).

As a result the list of supplicants was ignored by core because its size
was 0.

Signed-off-by: Krzysztof Kozlowski &lt;k.kozlowski@samsung.com&gt;
Fixes: d7bf353fd0aa ("bq24190_charger: Add support for TI BQ24190 Battery Charger")
Signed-off-by: Sebastian Reichel &lt;sre@kernel.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 478913fdbdfd4a781d91c993eb86838620fe7421 upstream.

The driver mismatched 'num_supplicants' with 'num_supplies' of
power_supply structure.

It provided list of supplicants (power_supply.supplied_to) but did
not set the number of supplicants. Instead it set the num_supplies which
is used when iterating over number of supplies (power_supply.supplied_from).

As a result the list of supplicants was ignored by core because its size
was 0.

Signed-off-by: Krzysztof Kozlowski &lt;k.kozlowski@samsung.com&gt;
Fixes: d7bf353fd0aa ("bq24190_charger: Add support for TI BQ24190 Battery Charger")
Signed-off-by: Sebastian Reichel &lt;sre@kernel.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>power_supply: 88pm860x: Fix leaked power supply on probe fail</title>
<updated>2015-03-06T22:43:25+00:00</updated>
<author>
<name>Krzysztof Kozlowski</name>
<email>k.kozlowski@samsung.com</email>
</author>
<published>2015-01-27T15:51:54+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=3764df9c37d3874d6ac10e82b84d102845f7adae'/>
<id>3764df9c37d3874d6ac10e82b84d102845f7adae</id>
<content type='text'>
commit 24727b45b484e8937dcde53fa8d1aa70ac30ec0c upstream.

Driver forgot to unregister power supply if request_threaded_irq()
failed in probe(). In such case the memory associated with power supply
leaked.

Signed-off-by: Krzysztof Kozlowski &lt;k.kozlowski@samsung.com&gt;
Fixes: a830d28b48bf ("power_supply: Enable battery-charger for 88pm860x")
Signed-off-by: Sebastian Reichel &lt;sre@kernel.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 24727b45b484e8937dcde53fa8d1aa70ac30ec0c upstream.

Driver forgot to unregister power supply if request_threaded_irq()
failed in probe(). In such case the memory associated with power supply
leaked.

Signed-off-by: Krzysztof Kozlowski &lt;k.kozlowski@samsung.com&gt;
Fixes: a830d28b48bf ("power_supply: Enable battery-charger for 88pm860x")
Signed-off-by: Sebastian Reichel &lt;sre@kernel.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>power: bq2415x_charger: Fix memory leak on DTS parsing error</title>
<updated>2014-11-21T17:23:03+00:00</updated>
<author>
<name>Krzysztof Kozlowski</name>
<email>k.kozlowski@samsung.com</email>
</author>
<published>2014-10-15T14:25:10+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=699c202790c66f5ff7fff2ac598f4b106c5d2f5e'/>
<id>699c202790c66f5ff7fff2ac598f4b106c5d2f5e</id>
<content type='text'>
commit 21e863b233553998737e1b506c823a00bf012e00 upstream.

Memory allocated for 'name' was leaking if required binding properties
were not present.

The memory for 'name' was allocated early at probe with kasprintf(). It
was freed in error paths executed before and after parsing DTS but not
in that error path.

Fix the error path for parsing device tree properties.

Signed-off-by: Krzysztof Kozlowski &lt;k.kozlowski@samsung.com&gt;
Fixes: faffd234cf85 ("bq2415x_charger: Add DT support")
Signed-off-by: Sebastian Reichel &lt;sre@kernel.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 21e863b233553998737e1b506c823a00bf012e00 upstream.

Memory allocated for 'name' was leaking if required binding properties
were not present.

The memory for 'name' was allocated early at probe with kasprintf(). It
was freed in error paths executed before and after parsing DTS but not
in that error path.

Fix the error path for parsing device tree properties.

Signed-off-by: Krzysztof Kozlowski &lt;k.kozlowski@samsung.com&gt;
Fixes: faffd234cf85 ("bq2415x_charger: Add DT support")
Signed-off-by: Sebastian Reichel &lt;sre@kernel.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>power: bq2415x_charger: Properly handle ENODEV from power_supply_get_by_phandle</title>
<updated>2014-11-21T17:23:03+00:00</updated>
<author>
<name>Krzysztof Kozlowski</name>
<email>k.kozlowski@samsung.com</email>
</author>
<published>2014-10-15T14:25:09+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=169aa821d1a3694d488c39f748b903e5084095bf'/>
<id>169aa821d1a3694d488c39f748b903e5084095bf</id>
<content type='text'>
commit 0eaf437aa14949d2230aeab7364f4ab47901304a upstream.

The power_supply_get_by_phandle() on error returns ENODEV or NULL.
The driver later expects obtained pointer to power supply to be
valid or NULL. If it is not NULL then it dereferences it in
bq2415x_notifier_call() which would lead to dereferencing ENODEV-value
pointer.

Properly handle the power_supply_get_by_phandle() error case by
replacing error value with NULL. This indicates that usb charger
detection won't be used.

Fix also memory leak of 'name' if power_supply_get_by_phandle() fails
with NULL and probe should defer.

Signed-off-by: Krzysztof Kozlowski &lt;k.kozlowski@samsung.com&gt;
Fixes: faffd234cf85 ("bq2415x_charger: Add DT support")
[small fix regarding the missing ti,usb-charger-detection info message]
Signed-off-by: Sebastian Reichel &lt;sre@kernel.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 0eaf437aa14949d2230aeab7364f4ab47901304a upstream.

The power_supply_get_by_phandle() on error returns ENODEV or NULL.
The driver later expects obtained pointer to power supply to be
valid or NULL. If it is not NULL then it dereferences it in
bq2415x_notifier_call() which would lead to dereferencing ENODEV-value
pointer.

Properly handle the power_supply_get_by_phandle() error case by
replacing error value with NULL. This indicates that usb charger
detection won't be used.

Fix also memory leak of 'name' if power_supply_get_by_phandle() fails
with NULL and probe should defer.

Signed-off-by: Krzysztof Kozlowski &lt;k.kozlowski@samsung.com&gt;
Fixes: faffd234cf85 ("bq2415x_charger: Add DT support")
[small fix regarding the missing ti,usb-charger-detection info message]
Signed-off-by: Sebastian Reichel &lt;sre@kernel.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>power: charger-manager: Fix accessing invalidated power supply after charger unbind</title>
<updated>2014-11-21T17:23:03+00:00</updated>
<author>
<name>Krzysztof Kozlowski</name>
<email>k.kozlowski@samsung.com</email>
</author>
<published>2014-10-13T13:34:31+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=1f863a274f70ce2f4bd467e4d090a396dfdbd5e5'/>
<id>1f863a274f70ce2f4bd467e4d090a396dfdbd5e5</id>
<content type='text'>
commit cdaf3e15385d3232b52287e50692506f8fd01a09 upstream.

The charger manager obtained in probe references to power supplies for
all chargers with power_supply_get_by_name() for later usage. However
if such charger driver was removed then this reference would point to
old power supply (from driver which was removed).

This lead to accessing invalid memory which could be observed with:
$ echo "max77693-charger" &gt; /sys/bus/platform/drivers/max77693-charger/unbind
$ grep . /sys/devices/virtual/power_supply/battery/charger.0/*
$ grep . /sys/devices/virtual/power_supply/battery/*
[   15.339817] Unable to handle kernel paging request at virtual address 0001c12c
[   15.346187] pgd = edd08000
[   15.348814] [0001c12c] *pgd=6dce2831, *pte=00000000, *ppte=00000000
[   15.355075] Internal error: Oops: 80000007 [#1] PREEMPT SMP ARM
[   15.360967] Modules linked in:
[   15.364010] CPU: 2 PID: 1388 Comm: grep Not tainted 3.17.0-next-20141007-00027-ga95e761db1b0 #245
[   15.372859] task: ee03ad00 ti: edcf6000 task.ti: edcf6000
[   15.378241] PC is at 0x1c12c
[   15.381113] LR is at is_ext_pwr_online+0x30/0x6c
[   15.385706] pc : [&lt;0001c12c&gt;]    lr : [&lt;c0339fc4&gt;]    psr: a0000013
[   15.385706] sp : edcf7e88  ip : 00000000  fp : 00000000
[   15.397161] r10: eeb02c08  r9 : c04b1f84  r8 : eeb02c00
[   15.402369] r7 : edc69a10  r6 : eea6ac10  r5 : eea6ac10  r4 : 00000004
[   15.408878] r3 : 0001c12c  r2 : edcf7e8c  r1 : 00000004  r0 : ee914418
[   15.415390] Flags: NzCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment user
[   15.422506] Control: 10c5387d  Table: 6dd0804a  DAC: 00000015
[   15.428236] Process grep (pid: 1388, stack limit = 0xedcf6240)
[   15.434050] Stack: (0xedcf7e88 to 0xedcf8000)
[   15.438395] 7e80:                   ee03ad00 00000000 edcf7f80 eea6aca8 edcf7ec4 c033b7b0
[   15.446554] 7ea0: 00000001 ee1cc3f0 00000004 c06e1e44 eebdc000 c06e1e44 eeb02c00 c0337144
[   15.454713] 7ec0: ee2dac68 c005cffc ee1cc3c0 c06e1e44 00000fff 00001000 eebdc000 c0278ca8
[   15.462872] 7ee0: c0278c8c ee1cc3c0 eeb7ce00 c014422c edcf7f20 00008000 ee1cc3c0 ee9a48c0
[   15.471030] 7f00: 00000001 00000001 edcf7f80 c0142d94 c0142d70 c01060f4 00021000 ee1cc3f0
[   15.479190] 7f20: 00000000 00000000 c06a2150 eebdc000 2e7ec000 ee9a48c0 00008000 00021000
[   15.487349] 7f40: edcf7f80 00008000 edcf6000 00021000 00021000 c00e39a4 00000000 ee9a48c0
[   15.495508] 7f60: 00004000 00000000 00000000 ee9a48c0 ee9a48c0 00008000 00021000 c00e3aa0
[   15.503668] 7f80: 00000000 00000000 0001f2e0 0001f2e0 00021000 00001000 00000003 c000f364
[   15.511826] 7fa0: 00000000 c000f1a0 0001f2e0 00021000 00000003 00021000 00008000 00000000
[   15.519986] 7fc0: 0001f2e0 00021000 00001000 00000003 00000001 000205e8 00000000 00021000
[   15.528145] 7fe0: 00008000 bebbe910 0000a7ad b6edc49c 60000010 00000003 aaaaaaaa aaaaaaaa
[   15.536320] [&lt;c0339fc4&gt;] (is_ext_pwr_online) from [&lt;c033b7b0&gt;] (charger_get_property+0x170/0x314)
[   15.545164] [&lt;c033b7b0&gt;] (charger_get_property) from [&lt;c0337144&gt;] (power_supply_show_property+0x48/0x20c)
[   15.554719] [&lt;c0337144&gt;] (power_supply_show_property) from [&lt;c0278ca8&gt;] (dev_attr_show+0x1c/0x48)
[   15.563577] [&lt;c0278ca8&gt;] (dev_attr_show) from [&lt;c014422c&gt;] (sysfs_kf_seq_show+0x84/0x104)
[   15.571725] [&lt;c014422c&gt;] (sysfs_kf_seq_show) from [&lt;c0142d94&gt;] (kernfs_seq_show+0x24/0x28)
[   15.579973] [&lt;c0142d94&gt;] (kernfs_seq_show) from [&lt;c01060f4&gt;] (seq_read+0x1b0/0x484)
[   15.587614] [&lt;c01060f4&gt;] (seq_read) from [&lt;c00e39a4&gt;] (vfs_read+0x88/0x144)
[   15.594552] [&lt;c00e39a4&gt;] (vfs_read) from [&lt;c00e3aa0&gt;] (SyS_read+0x40/0x8c)
[   15.601417] [&lt;c00e3aa0&gt;] (SyS_read) from [&lt;c000f1a0&gt;] (ret_fast_syscall+0x0/0x48)
[   15.608877] Code: bad PC value
[   15.611991] ---[ end trace a88fcc95208db283 ]---

The charger-manager should get reference to charger power supply on
each use of get_property callback.

Signed-off-by: Krzysztof Kozlowski &lt;k.kozlowski@samsung.com&gt;
Fixes: 3bb3dbbd56ea ("power_supply: Add initial Charger-Manager driver")
Signed-off-by: Sebastian Reichel &lt;sre@kernel.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit cdaf3e15385d3232b52287e50692506f8fd01a09 upstream.

The charger manager obtained in probe references to power supplies for
all chargers with power_supply_get_by_name() for later usage. However
if such charger driver was removed then this reference would point to
old power supply (from driver which was removed).

This lead to accessing invalid memory which could be observed with:
$ echo "max77693-charger" &gt; /sys/bus/platform/drivers/max77693-charger/unbind
$ grep . /sys/devices/virtual/power_supply/battery/charger.0/*
$ grep . /sys/devices/virtual/power_supply/battery/*
[   15.339817] Unable to handle kernel paging request at virtual address 0001c12c
[   15.346187] pgd = edd08000
[   15.348814] [0001c12c] *pgd=6dce2831, *pte=00000000, *ppte=00000000
[   15.355075] Internal error: Oops: 80000007 [#1] PREEMPT SMP ARM
[   15.360967] Modules linked in:
[   15.364010] CPU: 2 PID: 1388 Comm: grep Not tainted 3.17.0-next-20141007-00027-ga95e761db1b0 #245
[   15.372859] task: ee03ad00 ti: edcf6000 task.ti: edcf6000
[   15.378241] PC is at 0x1c12c
[   15.381113] LR is at is_ext_pwr_online+0x30/0x6c
[   15.385706] pc : [&lt;0001c12c&gt;]    lr : [&lt;c0339fc4&gt;]    psr: a0000013
[   15.385706] sp : edcf7e88  ip : 00000000  fp : 00000000
[   15.397161] r10: eeb02c08  r9 : c04b1f84  r8 : eeb02c00
[   15.402369] r7 : edc69a10  r6 : eea6ac10  r5 : eea6ac10  r4 : 00000004
[   15.408878] r3 : 0001c12c  r2 : edcf7e8c  r1 : 00000004  r0 : ee914418
[   15.415390] Flags: NzCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment user
[   15.422506] Control: 10c5387d  Table: 6dd0804a  DAC: 00000015
[   15.428236] Process grep (pid: 1388, stack limit = 0xedcf6240)
[   15.434050] Stack: (0xedcf7e88 to 0xedcf8000)
[   15.438395] 7e80:                   ee03ad00 00000000 edcf7f80 eea6aca8 edcf7ec4 c033b7b0
[   15.446554] 7ea0: 00000001 ee1cc3f0 00000004 c06e1e44 eebdc000 c06e1e44 eeb02c00 c0337144
[   15.454713] 7ec0: ee2dac68 c005cffc ee1cc3c0 c06e1e44 00000fff 00001000 eebdc000 c0278ca8
[   15.462872] 7ee0: c0278c8c ee1cc3c0 eeb7ce00 c014422c edcf7f20 00008000 ee1cc3c0 ee9a48c0
[   15.471030] 7f00: 00000001 00000001 edcf7f80 c0142d94 c0142d70 c01060f4 00021000 ee1cc3f0
[   15.479190] 7f20: 00000000 00000000 c06a2150 eebdc000 2e7ec000 ee9a48c0 00008000 00021000
[   15.487349] 7f40: edcf7f80 00008000 edcf6000 00021000 00021000 c00e39a4 00000000 ee9a48c0
[   15.495508] 7f60: 00004000 00000000 00000000 ee9a48c0 ee9a48c0 00008000 00021000 c00e3aa0
[   15.503668] 7f80: 00000000 00000000 0001f2e0 0001f2e0 00021000 00001000 00000003 c000f364
[   15.511826] 7fa0: 00000000 c000f1a0 0001f2e0 00021000 00000003 00021000 00008000 00000000
[   15.519986] 7fc0: 0001f2e0 00021000 00001000 00000003 00000001 000205e8 00000000 00021000
[   15.528145] 7fe0: 00008000 bebbe910 0000a7ad b6edc49c 60000010 00000003 aaaaaaaa aaaaaaaa
[   15.536320] [&lt;c0339fc4&gt;] (is_ext_pwr_online) from [&lt;c033b7b0&gt;] (charger_get_property+0x170/0x314)
[   15.545164] [&lt;c033b7b0&gt;] (charger_get_property) from [&lt;c0337144&gt;] (power_supply_show_property+0x48/0x20c)
[   15.554719] [&lt;c0337144&gt;] (power_supply_show_property) from [&lt;c0278ca8&gt;] (dev_attr_show+0x1c/0x48)
[   15.563577] [&lt;c0278ca8&gt;] (dev_attr_show) from [&lt;c014422c&gt;] (sysfs_kf_seq_show+0x84/0x104)
[   15.571725] [&lt;c014422c&gt;] (sysfs_kf_seq_show) from [&lt;c0142d94&gt;] (kernfs_seq_show+0x24/0x28)
[   15.579973] [&lt;c0142d94&gt;] (kernfs_seq_show) from [&lt;c01060f4&gt;] (seq_read+0x1b0/0x484)
[   15.587614] [&lt;c01060f4&gt;] (seq_read) from [&lt;c00e39a4&gt;] (vfs_read+0x88/0x144)
[   15.594552] [&lt;c00e39a4&gt;] (vfs_read) from [&lt;c00e3aa0&gt;] (SyS_read+0x40/0x8c)
[   15.601417] [&lt;c00e3aa0&gt;] (SyS_read) from [&lt;c000f1a0&gt;] (ret_fast_syscall+0x0/0x48)
[   15.608877] Code: bad PC value
[   15.611991] ---[ end trace a88fcc95208db283 ]---

The charger-manager should get reference to charger power supply on
each use of get_property callback.

Signed-off-by: Krzysztof Kozlowski &lt;k.kozlowski@samsung.com&gt;
Fixes: 3bb3dbbd56ea ("power_supply: Add initial Charger-Manager driver")
Signed-off-by: Sebastian Reichel &lt;sre@kernel.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>power: charger-manager: Fix accessing invalidated power supply after fuel gauge unbind</title>
<updated>2014-11-21T17:23:03+00:00</updated>
<author>
<name>Krzysztof Kozlowski</name>
<email>k.kozlowski@samsung.com</email>
</author>
<published>2014-10-13T13:34:30+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=122d385ba70565ff11d3dc0383d07819f2e9a612'/>
<id>122d385ba70565ff11d3dc0383d07819f2e9a612</id>
<content type='text'>
commit bdbe81445407644492b9ac69a24d35e3202d773b upstream.

The charger manager obtained reference to fuel gauge power supply in probe
with power_supply_get_by_name() for later usage. However if fuel gauge
driver was removed and re-added then this reference would point to old
power supply (from driver which was removed).

This lead to accessing old (and probably invalid) memory which could be
observed with:
$ echo "12-0036" &gt; /sys/bus/i2c/drivers/max17042/unbind
$ echo "12-0036" &gt; /sys/bus/i2c/drivers/max17042/bind
$ cat /sys/devices/virtual/power_supply/battery/capacity
[  240.480084] INFO: task cat:1393 blocked for more than 120 seconds.
[  240.484799]       Not tainted 3.17.0-next-20141007-00028-ge60b6dd79570 #203
[  240.491782] "echo 0 &gt; /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[  240.499589] cat             D c0469530     0  1393      1 0x00000000
[  240.505947] [&lt;c0469530&gt;] (__schedule) from [&lt;c0469d3c&gt;] (schedule_preempt_disabled+0x14/0x20)
[  240.514449] [&lt;c0469d3c&gt;] (schedule_preempt_disabled) from [&lt;c046af08&gt;] (mutex_lock_nested+0x1bc/0x458)
[  240.523736] [&lt;c046af08&gt;] (mutex_lock_nested) from [&lt;c0287a98&gt;] (regmap_read+0x30/0x60)
[  240.531647] [&lt;c0287a98&gt;] (regmap_read) from [&lt;c032238c&gt;] (max17042_get_property+0x2e8/0x350)
[  240.540055] [&lt;c032238c&gt;] (max17042_get_property) from [&lt;c03247d8&gt;] (charger_get_property+0x264/0x348)
[  240.549252] [&lt;c03247d8&gt;] (charger_get_property) from [&lt;c0320764&gt;] (power_supply_show_property+0x48/0x1e0)
[  240.558808] [&lt;c0320764&gt;] (power_supply_show_property) from [&lt;c027308c&gt;] (dev_attr_show+0x1c/0x48)
[  240.567664] [&lt;c027308c&gt;] (dev_attr_show) from [&lt;c0141fb0&gt;] (sysfs_kf_seq_show+0x84/0x104)
[  240.575814] [&lt;c0141fb0&gt;] (sysfs_kf_seq_show) from [&lt;c0140b18&gt;] (kernfs_seq_show+0x24/0x28)
[  240.584061] [&lt;c0140b18&gt;] (kernfs_seq_show) from [&lt;c0104574&gt;] (seq_read+0x1b0/0x484)
[  240.591702] [&lt;c0104574&gt;] (seq_read) from [&lt;c00e1e24&gt;] (vfs_read+0x88/0x144)
[  240.598640] [&lt;c00e1e24&gt;] (vfs_read) from [&lt;c00e1f20&gt;] (SyS_read+0x40/0x8c)
[  240.605507] [&lt;c00e1f20&gt;] (SyS_read) from [&lt;c000e760&gt;] (ret_fast_syscall+0x0/0x48)
[  240.612952] 4 locks held by cat/1393:
[  240.616589]  #0:  (&amp;p-&gt;lock){+.+.+.}, at: [&lt;c01043f4&gt;] seq_read+0x30/0x484
[  240.623414]  #1:  (&amp;of-&gt;mutex){+.+.+.}, at: [&lt;c01417dc&gt;] kernfs_seq_start+0x1c/0x8c
[  240.631086]  #2:  (s_active#31){++++.+}, at: [&lt;c01417e4&gt;] kernfs_seq_start+0x24/0x8c
[  240.638777]  #3:  (&amp;map-&gt;mutex){+.+...}, at: [&lt;c0287a98&gt;] regmap_read+0x30/0x60

The charger-manager should get reference to fuel gauge power supply on
each use of get_property callback. The thermal zone 'tzd' field of
power supply should not be used because of the same reason.

Additionally this change solves also the issue with nested
thermal_zone_get_temp() calls and related false lockdep positive for
deadlock for thermal zone's mutex [1]. When fuel gauge is used as source of
temperature then the charger manager forwards its get_temp calls to fuel
gauge thermal zone. So actually different mutexes are used (one for
charger manager thermal zone and second for fuel gauge thermal zone) but
for lockdep this is one class of mutex.

The recursion is removed by retrieving temperature through power
supply's get_property().

In case external thermal zone is used ('cm-thermal-zone' property is
present in DTS) the recursion does not exist. Charger manager simply
exports POWER_SUPPLY_PROP_TEMP_AMBIENT property (instead of
POWER_SUPPLY_PROP_TEMP) thus no thermal zone is created for this power
supply.

[1] https://lkml.org/lkml/2014/10/6/309

Signed-off-by: Krzysztof Kozlowski &lt;k.kozlowski@samsung.com&gt;
Fixes: 3bb3dbbd56ea ("power_supply: Add initial Charger-Manager driver")
Signed-off-by: Sebastian Reichel &lt;sre@kernel.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit bdbe81445407644492b9ac69a24d35e3202d773b upstream.

The charger manager obtained reference to fuel gauge power supply in probe
with power_supply_get_by_name() for later usage. However if fuel gauge
driver was removed and re-added then this reference would point to old
power supply (from driver which was removed).

This lead to accessing old (and probably invalid) memory which could be
observed with:
$ echo "12-0036" &gt; /sys/bus/i2c/drivers/max17042/unbind
$ echo "12-0036" &gt; /sys/bus/i2c/drivers/max17042/bind
$ cat /sys/devices/virtual/power_supply/battery/capacity
[  240.480084] INFO: task cat:1393 blocked for more than 120 seconds.
[  240.484799]       Not tainted 3.17.0-next-20141007-00028-ge60b6dd79570 #203
[  240.491782] "echo 0 &gt; /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[  240.499589] cat             D c0469530     0  1393      1 0x00000000
[  240.505947] [&lt;c0469530&gt;] (__schedule) from [&lt;c0469d3c&gt;] (schedule_preempt_disabled+0x14/0x20)
[  240.514449] [&lt;c0469d3c&gt;] (schedule_preempt_disabled) from [&lt;c046af08&gt;] (mutex_lock_nested+0x1bc/0x458)
[  240.523736] [&lt;c046af08&gt;] (mutex_lock_nested) from [&lt;c0287a98&gt;] (regmap_read+0x30/0x60)
[  240.531647] [&lt;c0287a98&gt;] (regmap_read) from [&lt;c032238c&gt;] (max17042_get_property+0x2e8/0x350)
[  240.540055] [&lt;c032238c&gt;] (max17042_get_property) from [&lt;c03247d8&gt;] (charger_get_property+0x264/0x348)
[  240.549252] [&lt;c03247d8&gt;] (charger_get_property) from [&lt;c0320764&gt;] (power_supply_show_property+0x48/0x1e0)
[  240.558808] [&lt;c0320764&gt;] (power_supply_show_property) from [&lt;c027308c&gt;] (dev_attr_show+0x1c/0x48)
[  240.567664] [&lt;c027308c&gt;] (dev_attr_show) from [&lt;c0141fb0&gt;] (sysfs_kf_seq_show+0x84/0x104)
[  240.575814] [&lt;c0141fb0&gt;] (sysfs_kf_seq_show) from [&lt;c0140b18&gt;] (kernfs_seq_show+0x24/0x28)
[  240.584061] [&lt;c0140b18&gt;] (kernfs_seq_show) from [&lt;c0104574&gt;] (seq_read+0x1b0/0x484)
[  240.591702] [&lt;c0104574&gt;] (seq_read) from [&lt;c00e1e24&gt;] (vfs_read+0x88/0x144)
[  240.598640] [&lt;c00e1e24&gt;] (vfs_read) from [&lt;c00e1f20&gt;] (SyS_read+0x40/0x8c)
[  240.605507] [&lt;c00e1f20&gt;] (SyS_read) from [&lt;c000e760&gt;] (ret_fast_syscall+0x0/0x48)
[  240.612952] 4 locks held by cat/1393:
[  240.616589]  #0:  (&amp;p-&gt;lock){+.+.+.}, at: [&lt;c01043f4&gt;] seq_read+0x30/0x484
[  240.623414]  #1:  (&amp;of-&gt;mutex){+.+.+.}, at: [&lt;c01417dc&gt;] kernfs_seq_start+0x1c/0x8c
[  240.631086]  #2:  (s_active#31){++++.+}, at: [&lt;c01417e4&gt;] kernfs_seq_start+0x24/0x8c
[  240.638777]  #3:  (&amp;map-&gt;mutex){+.+...}, at: [&lt;c0287a98&gt;] regmap_read+0x30/0x60

The charger-manager should get reference to fuel gauge power supply on
each use of get_property callback. The thermal zone 'tzd' field of
power supply should not be used because of the same reason.

Additionally this change solves also the issue with nested
thermal_zone_get_temp() calls and related false lockdep positive for
deadlock for thermal zone's mutex [1]. When fuel gauge is used as source of
temperature then the charger manager forwards its get_temp calls to fuel
gauge thermal zone. So actually different mutexes are used (one for
charger manager thermal zone and second for fuel gauge thermal zone) but
for lockdep this is one class of mutex.

The recursion is removed by retrieving temperature through power
supply's get_property().

In case external thermal zone is used ('cm-thermal-zone' property is
present in DTS) the recursion does not exist. Charger manager simply
exports POWER_SUPPLY_PROP_TEMP_AMBIENT property (instead of
POWER_SUPPLY_PROP_TEMP) thus no thermal zone is created for this power
supply.

[1] https://lkml.org/lkml/2014/10/6/309

Signed-off-by: Krzysztof Kozlowski &lt;k.kozlowski@samsung.com&gt;
Fixes: 3bb3dbbd56ea ("power_supply: Add initial Charger-Manager driver")
Signed-off-by: Sebastian Reichel &lt;sre@kernel.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
</feed>
