From nobody Tue Apr 14 13:58:40 2026 Received: from out162-62-57-87.mail.qq.com (out162-62-57-87.mail.qq.com [162.62.57.87]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7FF5631327A; Tue, 14 Apr 2026 06:46:00 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=162.62.57.87 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776149166; cv=none; b=RHiKH12JETM2jqynGyrL581XNe1xHePRzDQnvCTzKjBGDZQLDvRaFPCGYr1XiK4sAQdyL2CN/jv+4PlnaOHm6ER85+vln3/6HqiR3VsI/jCDzSa6R2xDHLhLDaodI4Avj4QBP8BVh2zT/qrFonlGpWZDRop+8JfRYvqsXZ1BWL8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776149166; c=relaxed/simple; bh=DpZCdQs4b8+LwP5vOJC4yNhUFG0XN7Mekxfml7YimkM=; h=Message-ID:From:To:Cc:Subject:Date:MIME-Version; b=eGnVFKGoYIl5L5mM7GMdYDteHSyljGqEuAnJt5JcEGtLCN1TGWvFAth+lfuicv2rYLY2ec0RLXvqHpuh6VF49aI0iDDFHED+FlX2B2S9poUfk3tc8Hzhys8dIncj6fvH9yxJEwFQsTchmtCV9vHwCFThsZ4ykadtm7XYGB/2IzY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com; spf=pass smtp.mailfrom=qq.com; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b=LyDzYp2/; arc=none smtp.client-ip=162.62.57.87 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=qq.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b="LyDzYp2/" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qq.com; s=s201512; t=1776149157; bh=WwN0f6XKuujjTb0gJTYkPaL3YR7Zj7pYP0YCfeToHmM=; h=From:To:Cc:Subject:Date; b=LyDzYp2/qnniIqlQutalDnANRc+cIsTvp97b0vDKcdKwQZ8ArSHYAB82Vb7fvwFSA U94/6A2EoB455+dUOsggCEkqk/Te+BZaWo6d2tPiIyFXG55m/3q10sqttIS92kDW+k 9yHOECmK1ANmz2dfJhP24a8ytl4MyAb9GBVTWp3Q= Received: from NTT-kernel-dev ([60.247.85.88]) by newxmesmtplogicsvrsza63-0.qq.com (NewEsmtp) with SMTP id B75018D0; Tue, 14 Apr 2026 14:45:53 +0800 X-QQ-mid: xmsmtpt1776149153trz5913pw Message-ID: X-QQ-XMAILINFO: NVJuObMcvoCvI7KlUgVHao/m62b+xO7xT4B6qbN2gQn4HfCZ9e92aJPs0t7VQB vKjtNIwr2fVXevhyoun5GPYxJyKtTdNqaClLInwtoWmugGrXT728H6ZUeFweVfwWWx56JIvS10eZ zbVRLrQ4I4nZnTgXwrc22HWRsu2YpFHfia5/Jmx6aH9WTHGtok6ugz6knvCxTrmwOvaD0c5A/ray ijxqZopytqR5N7cO1VtMTM/XdLjrM1/ELtMRdb1R0IbwY+jatmIh5cqkNZ/LtgbfFt6s6Il6GqTD HAyWfL8tc7gj8eYvzr4dIu8A+q+SwjLGj1b7to77QhwFl28PxwwBZazhlGrAIDX5kit1XDpRwkQ5 vV8xXON6YvEwCws5Rj/SsHd8eLu3JAFG+yiVbSN7HEPm4rhgr55gSP8198HLpGbk1+Kamz6xqbeu oRPH0qtcfCZva7toVlrfZsUKC+3dTlwqqTYwYNQVdUkDaLyyoAJpm9bHVcbZRgBNU1Am5cIOnH// lM1KBEyNUFcjUJpG3eRbx6VW2fHDZJmh11zmaWf4mSwoyBI0R97bisJtH98AJljm/klWsFIkLW0R 9eYPf19YGOdfT3fKGdMUHRNeAgUlNb7SQLKArZnJj5rlLrTdH9fiLg1DqYqFnnPG6qNFUbV8xXbp oMvtwb0FQQsiT4EM2NbVRxLSRjXEWcfEdVdIouJuX1wrFlI1vfCksj2tgsXJHYKqueW/C1NqjGCW dzhJq+ISVcpSP31MnIYZZINyzsnLprUoACnY+g7Hnf+hevLh5t+j76yh9e4ufGdEt4X1N0QFV9ue bRt4negeBEbhQGgc69AL6YgjKVITN3YgHDWMgBJg1fB1HdoMKjOi8udJ0I/xAymRuijKAgnK4CvH dTacAVvR9hZcY00kF9GIJxRG71ixz2W/q9aiPGk2NczcYR33Gm9mVqJtMESSLxRLhyuo9NEKq5xU D3yiS9y4+GEv6dEszyOMGn86Rbe94nK0tpHhqwMwMWVkhVYlYGpTHw9X6W3K5xpC+mqAyp4PCmub FyapwFkwpug+kqQw9zwmXr4QxAqGrxFXEVvBKkX0xQuDHSDXovY/DxJy9l2XXlsMFu/A5qvSn3zd CG3rq5 X-QQ-XMRINFO: M/715EihBoGS47X28/vv4NpnfpeBLnr4Qg== From: Fang Wang <32840572@qq.com> To: maudspierings@gocontroll.com, gregkh@linuxfoundation.org, stable@vger.kernel.org Cc: patches@lists.linux.dev, linux-kernel@vger.kernel.org, jic23@kernel.org, lars@metafoo.de, dimitri.fedrau@liebherr.com, markus.koeniger@liebherr.com, andy@kernel.org, linux-iio@vger.kernel.org, Jonathan.Cameron@huawei.com Subject: [PATCH 6.6.y] iio: common: st_sensors: Fix use of uninitialize device structs Date: Tue, 14 Apr 2026 14:45:53 +0800 X-OQ-MSGID: <20260414064553.151857-1-32840572@qq.com> X-Mailer: git-send-email 2.34.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Maud Spierings [ Upstream commit 9f92e93e257b33e73622640a9205f8642ec16ddd ] Throughout the various probe functions &indio_dev->dev is used before it is initialized. This caused a kernel panic in st_sensors_power_enable() when the call to devm_regulator_bulk_get_enable() fails and then calls dev_err_probe() with the uninitialized device. This seems to only cause a panic with dev_err_probe(), dev_err(), dev_warn() and dev_info() don't seem to cause a panic, but are fixed as well. The issue is reported and traced here: [1] Link: https://lore.kernel.org/all/AM7P189MB100986A83D2F28AF3FFAF976E39EA@AM= 7P189MB1009.EURP189.PROD.OUTLOOK.COM/ [1] Cc: stable@vger.kernel.org Signed-off-by: Maud Spierings Reviewed-by: Andy Shevchenko Link: https://... [1] Link: https://patch.msgid.link/20250527-st_iio_fix-v4-1-12d89801c761@gocont= roll.com Signed-off-by: Jonathan Cameron Signed-off-by: Fang Wang <32840572@qq.com> --- drivers/iio/accel/st_accel_core.c | 10 +++--- .../iio/common/st_sensors/st_sensors_core.c | 36 +++++++++---------- .../common/st_sensors/st_sensors_trigger.c | 20 +++++------ 3 files changed, 31 insertions(+), 35 deletions(-) diff --git a/drivers/iio/accel/st_accel_core.c b/drivers/iio/accel/st_accel= _core.c index 51d8de18e6d6..45d2268e042e 100644 --- a/drivers/iio/accel/st_accel_core.c +++ b/drivers/iio/accel/st_accel_core.c @@ -1342,6 +1342,7 @@ static int apply_acpi_orientation(struct iio_dev *ind= io_dev) union acpi_object *ont; union acpi_object *elements; acpi_status status; + struct device *parent =3D indio_dev->dev.parent; int ret =3D -EINVAL; unsigned int val; int i, j; @@ -1360,7 +1361,7 @@ static int apply_acpi_orientation(struct iio_dev *ind= io_dev) }; =20 =20 - adev =3D ACPI_COMPANION(indio_dev->dev.parent); + adev =3D ACPI_COMPANION(parent); if (!adev) return -ENXIO; =20 @@ -1369,8 +1370,7 @@ static int apply_acpi_orientation(struct iio_dev *ind= io_dev) if (status =3D=3D AE_NOT_FOUND) { return -ENXIO; } else if (ACPI_FAILURE(status)) { - dev_warn(&indio_dev->dev, "failed to execute _ONT: %d\n", - status); + dev_warn(parent, "failed to execute _ONT: %d\n", status); return status; } =20 @@ -1446,12 +1446,12 @@ static int apply_acpi_orientation(struct iio_dev *i= ndio_dev) } =20 ret =3D 0; - dev_info(&indio_dev->dev, "computed mount matrix from ACPI\n"); + dev_info(parent, "computed mount matrix from ACPI\n"); =20 out: kfree(buffer.pointer); if (ret) - dev_dbg(&indio_dev->dev, + dev_dbg(parent, "failed to apply ACPI orientation data: %d\n", ret); =20 return ret; diff --git a/drivers/iio/common/st_sensors/st_sensors_core.c b/drivers/iio/= common/st_sensors/st_sensors_core.c index c77d7bdcc121..78f5728417d5 100644 --- a/drivers/iio/common/st_sensors/st_sensors_core.c +++ b/drivers/iio/common/st_sensors/st_sensors_core.c @@ -154,7 +154,7 @@ static int st_sensors_set_fullscale(struct iio_dev *ind= io_dev, unsigned int fs) return err; =20 st_accel_set_fullscale_error: - dev_err(&indio_dev->dev, "failed to set new fullscale.\n"); + dev_err(indio_dev->dev.parent, "failed to set new fullscale.\n"); return err; } =20 @@ -231,8 +231,7 @@ int st_sensors_power_enable(struct iio_dev *indio_dev) ARRAY_SIZE(regulator_names), regulator_names); if (err) - return dev_err_probe(&indio_dev->dev, err, - "unable to enable supplies\n"); + return dev_err_probe(parent, err, "unable to enable supplies\n"); =20 return 0; } @@ -241,13 +240,14 @@ EXPORT_SYMBOL_NS(st_sensors_power_enable, IIO_ST_SENS= ORS); static int st_sensors_set_drdy_int_pin(struct iio_dev *indio_dev, struct st_sensors_platform_data *pdata) { + struct device *parent =3D indio_dev->dev.parent; struct st_sensor_data *sdata =3D iio_priv(indio_dev); =20 /* Sensor does not support interrupts */ if (!sdata->sensor_settings->drdy_irq.int1.addr && !sdata->sensor_settings->drdy_irq.int2.addr) { if (pdata->drdy_int_pin) - dev_info(&indio_dev->dev, + dev_info(parent, "DRDY on pin INT%d specified, but sensor does not support interrupts\= n", pdata->drdy_int_pin); return 0; @@ -256,29 +256,27 @@ static int st_sensors_set_drdy_int_pin(struct iio_dev= *indio_dev, switch (pdata->drdy_int_pin) { case 1: if (!sdata->sensor_settings->drdy_irq.int1.mask) { - dev_err(&indio_dev->dev, - "DRDY on INT1 not available.\n"); + dev_err(parent, "DRDY on INT1 not available.\n"); return -EINVAL; } sdata->drdy_int_pin =3D 1; break; case 2: if (!sdata->sensor_settings->drdy_irq.int2.mask) { - dev_err(&indio_dev->dev, - "DRDY on INT2 not available.\n"); + dev_err(parent, "DRDY on INT2 not available.\n"); return -EINVAL; } sdata->drdy_int_pin =3D 2; break; default: - dev_err(&indio_dev->dev, "DRDY on pdata not valid.\n"); + dev_err(parent, "DRDY on pdata not valid.\n"); return -EINVAL; } =20 if (pdata->open_drain) { if (!sdata->sensor_settings->drdy_irq.int1.addr_od && !sdata->sensor_settings->drdy_irq.int2.addr_od) - dev_err(&indio_dev->dev, + dev_err(parent, "open drain requested but unsupported.\n"); else sdata->int_pin_open_drain =3D true; @@ -336,6 +334,7 @@ EXPORT_SYMBOL_NS(st_sensors_dev_name_probe, IIO_ST_SENS= ORS); int st_sensors_init_sensor(struct iio_dev *indio_dev, struct st_sensors_platform_data *pdata) { + struct device *parent =3D indio_dev->dev.parent; struct st_sensor_data *sdata =3D iio_priv(indio_dev); struct st_sensors_platform_data *of_pdata; int err =3D 0; @@ -343,7 +342,7 @@ int st_sensors_init_sensor(struct iio_dev *indio_dev, mutex_init(&sdata->odr_lock); =20 /* If OF/DT pdata exists, it will take precedence of anything else */ - of_pdata =3D st_sensors_dev_probe(indio_dev->dev.parent, pdata); + of_pdata =3D st_sensors_dev_probe(parent, pdata); if (IS_ERR(of_pdata)) return PTR_ERR(of_pdata); if (of_pdata) @@ -370,7 +369,7 @@ int st_sensors_init_sensor(struct iio_dev *indio_dev, if (err < 0) return err; } else - dev_info(&indio_dev->dev, "Full-scale not possible\n"); + dev_info(parent, "Full-scale not possible\n"); =20 err =3D st_sensors_set_odr(indio_dev, sdata->odr); if (err < 0) @@ -405,7 +404,7 @@ int st_sensors_init_sensor(struct iio_dev *indio_dev, mask =3D sdata->sensor_settings->drdy_irq.int2.mask_od; } =20 - dev_info(&indio_dev->dev, + dev_info(parent, "set interrupt line to open drain mode on pin %d\n", sdata->drdy_int_pin); err =3D st_sensors_write_data_with_mask(indio_dev, addr, @@ -594,21 +593,20 @@ EXPORT_SYMBOL_NS(st_sensors_get_settings_index, IIO_S= T_SENSORS); int st_sensors_verify_id(struct iio_dev *indio_dev) { struct st_sensor_data *sdata =3D iio_priv(indio_dev); + struct device *parent =3D indio_dev->dev.parent; int wai, err; =20 if (sdata->sensor_settings->wai_addr) { err =3D regmap_read(sdata->regmap, sdata->sensor_settings->wai_addr, &wai); if (err < 0) { - dev_err(&indio_dev->dev, - "failed to read Who-Am-I register.\n"); - return err; + return dev_err_probe(parent, err, + "failed to read Who-Am-I register.\n"); } =20 if (sdata->sensor_settings->wai !=3D wai) { - dev_err(&indio_dev->dev, - "%s: WhoAmI mismatch (0x%x).\n", - indio_dev->name, wai); + dev_warn(parent, "%s: WhoAmI mismatch (0x%x).\n", + indio_dev->name, wai); return -EINVAL; } } diff --git a/drivers/iio/common/st_sensors/st_sensors_trigger.c b/drivers/i= io/common/st_sensors/st_sensors_trigger.c index a0df9250a69f..b900acd471bd 100644 --- a/drivers/iio/common/st_sensors/st_sensors_trigger.c +++ b/drivers/iio/common/st_sensors/st_sensors_trigger.c @@ -127,7 +127,7 @@ int st_sensors_allocate_trigger(struct iio_dev *indio_d= ev, sdata->trig =3D devm_iio_trigger_alloc(parent, "%s-trigger", indio_dev->name); if (sdata->trig =3D=3D NULL) { - dev_err(&indio_dev->dev, "failed to allocate iio trigger.\n"); + dev_err(parent, "failed to allocate iio trigger.\n"); return -ENOMEM; } =20 @@ -143,7 +143,7 @@ int st_sensors_allocate_trigger(struct iio_dev *indio_d= ev, case IRQF_TRIGGER_FALLING: case IRQF_TRIGGER_LOW: if (!sdata->sensor_settings->drdy_irq.addr_ihl) { - dev_err(&indio_dev->dev, + dev_err(parent, "falling/low specified for IRQ but hardware supports only rising/high:= will request rising/high\n"); if (irq_trig =3D=3D IRQF_TRIGGER_FALLING) irq_trig =3D IRQF_TRIGGER_RISING; @@ -156,21 +156,19 @@ int st_sensors_allocate_trigger(struct iio_dev *indio= _dev, sdata->sensor_settings->drdy_irq.mask_ihl, 1); if (err < 0) return err; - dev_info(&indio_dev->dev, + dev_info(parent, "interrupts on the falling edge or active low level\n"); } break; case IRQF_TRIGGER_RISING: - dev_info(&indio_dev->dev, - "interrupts on the rising edge\n"); + dev_info(parent, "interrupts on the rising edge\n"); break; case IRQF_TRIGGER_HIGH: - dev_info(&indio_dev->dev, - "interrupts active high level\n"); + dev_info(parent, "interrupts active high level\n"); break; default: /* This is the most preferred mode, if possible */ - dev_err(&indio_dev->dev, + dev_err(parent, "unsupported IRQ trigger specified (%lx), enforce rising edge\n", irq_t= rig); irq_trig =3D IRQF_TRIGGER_RISING; } @@ -179,7 +177,7 @@ int st_sensors_allocate_trigger(struct iio_dev *indio_d= ev, if (irq_trig =3D=3D IRQF_TRIGGER_FALLING || irq_trig =3D=3D IRQF_TRIGGER_RISING) { if (!sdata->sensor_settings->drdy_irq.stat_drdy.addr) { - dev_err(&indio_dev->dev, + dev_err(parent, "edge IRQ not supported w/o stat register.\n"); return -EOPNOTSUPP; } @@ -214,13 +212,13 @@ int st_sensors_allocate_trigger(struct iio_dev *indio= _dev, sdata->trig->name, sdata->trig); if (err) { - dev_err(&indio_dev->dev, "failed to request trigger IRQ.\n"); + dev_err(parent, "failed to request trigger IRQ.\n"); return err; } =20 err =3D devm_iio_trigger_register(parent, sdata->trig); if (err < 0) { - dev_err(&indio_dev->dev, "failed to register iio trigger.\n"); + dev_err(parent, "failed to register iio trigger.\n"); return err; } indio_dev->trig =3D iio_trigger_get(sdata->trig); --=20 2.34.1