[PATCH] regulator: core: fix NULL dereference on unbind due to stale coupling data

[PATCH] regulator: core: fix NULL dereference on unbind due to stale coupling data

[Alessandro Carminati]

Failing to reset coupling_desc.n_coupled after freeing coupled_rdevs can
lead to NULL pointer dereference when regulators are accessed post-unbind.

This can happen during runtime PM or other regulator operations that rely
on coupling metadata.

For example, on ridesx4, unbinding the 'reg-dummy' platform device triggers
a panic in regulator_lock_recursive() due to stale coupling state.

Ensure n_coupled is set to 0 to prevent access to invalid pointers.

Signed-off-by: Alessandro Carminati <acarmina@redhat.com>
---
 drivers/regulator/core.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index 7a248dc8d2e2..cbd6d53ebfb5 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -5639,6 +5639,7 @@ static void regulator_remove_coupling(struct regulator_dev *rdev)
 				 ERR_PTR(err));
 	}
 
+	rdev->coupling_desc.n_coupled = 0;
 	kfree(rdev->coupling_desc.coupled_rdevs);
 	rdev->coupling_desc.coupled_rdevs = NULL;
 }
-- 
2.34.1

Re: [PATCH] regulator: core: fix NULL dereference on unbind due to stale coupling data

[Mark Brown]

On Thu, 26 Jun 2025 08:38:09 +0000, Alessandro Carminati wrote:
> Failing to reset coupling_desc.n_coupled after freeing coupled_rdevs can
> lead to NULL pointer dereference when regulators are accessed post-unbind.
> 
> This can happen during runtime PM or other regulator operations that rely
> on coupling metadata.
> 
> For example, on ridesx4, unbinding the 'reg-dummy' platform device triggers
> a panic in regulator_lock_recursive() due to stale coupling state.
> 
> [...]

Applied to

   https://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator.git for-next

Thanks!

[1/1] regulator: core: fix NULL dereference on unbind due to stale coupling data
      commit: ca46946a482238b0cdea459fb82fc837fb36260e

All being well this means that it will be integrated into the linux-next
tree (usually sometime in the next 24 hours) and sent to Linus during
the next merge window (or sooner if it is a bug fix), however if
problems are discovered then the patch may be dropped or reverted.

You may get further e-mails resulting from automated or manual testing
and review of the tree, please engage with people reporting problems and
send followup patches addressing any issues that are reported if needed.

If any updates are required or you are submitting further changes they
should be sent as incremental updates against current git, existing
patches will not be replaced.

Please add any relevant lists and maintainers to the CCs when replying
to this mail.

Thanks,
Mark