diff mbox series

[08/13] pcmcia: replace linux/gpio.h inclusions

Message ID 20260629132633.1300009-9-arnd@kernel.org (mailing list archive)
State New
Headers
Series treewide: replace linux/gpio.h |

Commit Message

Arnd Bergmann June 29, 2026, 1:26 p.m. UTC 
From: Arnd Bergmann <arnd@arndb.de>

The pcmcia drivers all use the legacy interfaces, so convert to
include linux/gpio/legacy.h instead.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
---
 drivers/pcmcia/bcm63xx_pcmcia.c | 2 +-
 drivers/pcmcia/db1xxx_ss.c      | 2 +-
 drivers/pcmcia/sa1100_h3600.c   | 2 +-
 drivers/pcmcia/soc_common.c     | 2 +-
 drivers/pcmcia/xxs1500_ss.c     | 2 +-
 5 files changed, 5 insertions(+), 5 deletions(-)

Comments

sashiko-bot@kernel.org June 30, 2026, 1:28 p.m. UTC | #1 
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Invalid resource cleanup on error path leading to potential double-free of a devres-managed GPIO descriptor.
--

commit a1a20647914d78d6a15655dea889e9d53c734136
Author: Arnd Bergmann <arnd@arndb.de>

pcmcia: replace linux/gpio.h inclusions

The pcmcia drivers all use the legacy interfaces, so convert to
include linux/gpio/legacy.h instead.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>

[ ... ]

> diff --git a/drivers/pcmcia/sa1100_h3600.c b/drivers/pcmcia/sa1100_h3600.c
> index 10cb99c20a7f5..6c52d90795eb4 100644
> --- a/drivers/pcmcia/sa1100_h3600.c
> +++ b/drivers/pcmcia/sa1100_h3600.c
> @@ -11,7 +11,7 @@
>  #include <linux/interrupt.h>
>  #include <linux/init.h>
>  #include <linux/delay.h>
> -#include <linux/gpio.h>
> +#include <linux/gpio/legacy.h>

[Severity: High]
This isn't a bug introduced by this patch, but I noticed a pre-existing
issue while reviewing the GPIO include changes.

Does the error path in h3600_pcmcia_hw_init() cause a double-free of a
devres-managed GPIO descriptor?

If gpio_request(H3XXX_EGPIO_OPT_NVRAM_ON) or subsequent legacy GPIO requests
fail, the code jumps to or falls through to the err01 label:

drivers/pcmcia/sa1100_h3600.c:h3600_pcmcia_hw_init() {
    ...
err06:  gpio_free(H3XXX_EGPIO_CARD_RESET);
err05:  gpio_free(H3XXX_EGPIO_OPT_RESET);
err04:  gpio_free(H3XXX_EGPIO_OPT_ON);
err03:  gpio_free(H3XXX_EGPIO_OPT_NVRAM_ON);
err01:  gpio_free(H3XXX_GPIO_PCMCIA_IRQ0);
        return err;
}

The err01 label incorrectly frees H3XXX_GPIO_PCMCIA_IRQ0. This GPIO is
managed by devres and was not explicitly requested using gpio_request() in
this function. 

When devres cleans up the failed probe, it will attempt to free the GPIO
again. This could lead to a double-free, gpiolib state corruption, kernel
warnings, or accidentally freeing a GPIO acquired by a concurrent driver.
Arnd Bergmann June 30, 2026, 1:36 p.m. UTC | #2 
On Tue, Jun 30, 2026, at 15:28, sashiko-bot@kernel.org wrote:
> [Severity: High]
> This isn't a bug introduced by this patch, but I noticed a pre-existing
> issue while reviewing the GPIO include changes.
>
> Does the error path in h3600_pcmcia_hw_init() cause a double-free of a
> devres-managed GPIO descriptor?

Yes, there are many bugs in the old pcmcia drivers. I expect that
we will remove these soon, as I plan to drop all the sa1100 and pxa
board files early next year.

     Arnd
diff mbox series

Patch

diff --git a/drivers/pcmcia/bcm63xx_pcmcia.c b/drivers/pcmcia/bcm63xx_pcmcia.c
index 724fd6ee0fd0..1612b5d76975 100644
--- a/drivers/pcmcia/bcm63xx_pcmcia.c
+++ b/drivers/pcmcia/bcm63xx_pcmcia.c
@@ -14,7 +14,7 @@ 
 #include <linux/slab.h>
 #include <linux/delay.h>
 #include <linux/pci.h>
-#include <linux/gpio.h>
+#include <linux/gpio/legacy.h>
 
 #include <bcm63xx_regs.h>
 #include <bcm63xx_io.h>
diff --git a/drivers/pcmcia/db1xxx_ss.c b/drivers/pcmcia/db1xxx_ss.c
index 7b896d7dbc9f..410d24762f13 100644
--- a/drivers/pcmcia/db1xxx_ss.c
+++ b/drivers/pcmcia/db1xxx_ss.c
@@ -23,7 +23,7 @@ 
  */
 
 #include <linux/delay.h>
-#include <linux/gpio.h>
+#include <linux/gpio/legacy.h>
 #include <linux/interrupt.h>
 #include <linux/pm.h>
 #include <linux/module.h>
diff --git a/drivers/pcmcia/sa1100_h3600.c b/drivers/pcmcia/sa1100_h3600.c
index 10cb99c20a7f..6c52d90795eb 100644
--- a/drivers/pcmcia/sa1100_h3600.c
+++ b/drivers/pcmcia/sa1100_h3600.c
@@ -11,7 +11,7 @@ 
 #include <linux/interrupt.h>
 #include <linux/init.h>
 #include <linux/delay.h>
-#include <linux/gpio.h>
+#include <linux/gpio/legacy.h>
 
 #include <mach/hardware.h>
 #include <asm/irq.h>
diff --git a/drivers/pcmcia/soc_common.c b/drivers/pcmcia/soc_common.c
index 87aa3f667117..23585e3968e9 100644
--- a/drivers/pcmcia/soc_common.c
+++ b/drivers/pcmcia/soc_common.c
@@ -32,8 +32,8 @@ 
 
 
 #include <linux/cpufreq.h>
-#include <linux/gpio.h>
 #include <linux/gpio/consumer.h>
+#include <linux/gpio/legacy.h>
 #include <linux/init.h>
 #include <linux/interrupt.h>
 #include <linux/io.h>
diff --git a/drivers/pcmcia/xxs1500_ss.c b/drivers/pcmcia/xxs1500_ss.c
index 8a8aae1843b5..ba1bd0f9d9f8 100644
--- a/drivers/pcmcia/xxs1500_ss.c
+++ b/drivers/pcmcia/xxs1500_ss.c
@@ -7,7 +7,7 @@ 
  */
 
 #include <linux/delay.h>
-#include <linux/gpio.h>
+#include <linux/gpio/legacy.h>
 #include <linux/interrupt.h>
 #include <linux/io.h>
 #include <linux/ioport.h>