[PATCH v1 0/3] regcache: Avoid accessing non-initialised cache

[PATCH v1 0/3] regcache: Avoid accessing non-initialised cache

[Andy Shevchenko]

FIXME cover letter

Some caches may not allow writes before full initialisation is done.
In particular on REGMAP_MAPLE caches when we want to populate cache
with the values (reg_defaults_raw == NULL && num_reg_defaults_raw != 0)
from HW, the NULL pointer dereference may happen. Address this by moving
the IO after cache initialisation is done.

Andy Shevchenko (3):
  regcache: Remove duplicate check in regcache_hw_init()
  regcache: Split regcache_count_cacheable_registers() helper
  regcache: Move HW readback after cache initialisation

 drivers/base/regmap/regcache.c | 44 ++++++++++++++++++++--------------
 1 file changed, 26 insertions(+), 18 deletions(-)

-- 
2.50.1

[PATCH v1 1/3] regcache: Remove duplicate check in regcache_hw_init()

[Andy Shevchenko]

The regcache_hw_init() is never called without preliminary check
for num_reg_defaults_raw not being 0. Thus, remove duplicate in
the function.

Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
---
 drivers/base/regmap/regcache.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/drivers/base/regmap/regcache.c b/drivers/base/regmap/regcache.c
index 319c342bf5a0..1d55f43ff081 100644
--- a/drivers/base/regmap/regcache.c
+++ b/drivers/base/regmap/regcache.c
@@ -50,9 +50,6 @@ static int regcache_hw_init(struct regmap *map)
 	unsigned int reg, val;
 	void *tmp_buf;
 
-	if (!map->num_reg_defaults_raw)
-		return -EINVAL;
-
 	/* calculate the size of reg_defaults */
 	for (count = 0, i = 0; i < map->num_reg_defaults_raw; i++)
 		if (regmap_readable(map, i * map->reg_stride) &&
-- 
2.50.1

[PATCH v1 2/3] regcache: Split regcache_count_cacheable_registers() helper

[Andy Shevchenko]

The introduced helper allows to check for the non-cacheable configurations
earlier during initialisation.

Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
---
 drivers/base/regmap/regcache.c | 30 +++++++++++++++++++-----------
 1 file changed, 19 insertions(+), 11 deletions(-)

diff --git a/drivers/base/regmap/regcache.c b/drivers/base/regmap/regcache.c
index 1d55f43ff081..0a78ab0dc9fb 100644
--- a/drivers/base/regmap/regcache.c
+++ b/drivers/base/regmap/regcache.c
@@ -42,13 +42,10 @@ void regcache_sort_defaults(struct reg_default *defaults, unsigned int ndefaults
 }
 EXPORT_SYMBOL_GPL(regcache_sort_defaults);
 
-static int regcache_hw_init(struct regmap *map)
+static int regcache_count_cacheable_registers(struct regmap *map)
 {
-	int i, j;
-	int ret;
 	int count;
-	unsigned int reg, val;
-	void *tmp_buf;
+	int i;
 
 	/* calculate the size of reg_defaults */
 	for (count = 0, i = 0; i < map->num_reg_defaults_raw; i++)
@@ -57,10 +54,18 @@ static int regcache_hw_init(struct regmap *map)
 			count++;
 
 	/* all registers are unreadable or volatile, so just bypass */
-	if (!count) {
+	if (!count)
 		map->cache_bypass = true;
-		return 0;
-	}
+
+	return count;
+}
+
+static int regcache_hw_init(struct regmap *map, int count)
+{
+	int i, j;
+	int ret;
+	unsigned int reg, val;
+	void *tmp_buf;
 
 	map->num_reg_defaults = count;
 	map->reg_defaults = kmalloc_array(count, sizeof(struct reg_default),
@@ -130,6 +135,7 @@ static int regcache_hw_init(struct regmap *map)
 
 int regcache_init(struct regmap *map, const struct regmap_config *config)
 {
+	int count = 0;
 	int ret;
 	int i;
 	void *tmp_buf;
@@ -194,15 +200,17 @@ int regcache_init(struct regmap *map, const struct regmap_config *config)
 			return -ENOMEM;
 		map->reg_defaults = tmp_buf;
 	} else if (map->num_reg_defaults_raw) {
+		count = regcache_count_cacheable_registers(map);
+		if (map->cache_bypass)
+			return 0;
+
 		/* Some devices such as PMICs don't have cache defaults,
 		 * we cope with this by reading back the HW registers and
 		 * crafting the cache defaults by hand.
 		 */
-		ret = regcache_hw_init(map);
+		ret = regcache_hw_init(map, count);
 		if (ret < 0)
 			return ret;
-		if (map->cache_bypass)
-			return 0;
 	}
 
 	if (!map->max_register_is_set && map->num_reg_defaults_raw) {
-- 
2.50.1

[PATCH v1 3/3] regcache: Move HW readback after cache initialisation

[Andy Shevchenko]

Make sure that cache is initialised before calling any IO
using regmap, this makes sure that we won't access NULL or
invalid pointers in the cache which hasn't been initialised.

Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
---
 drivers/base/regmap/regcache.c | 19 +++++++++++--------
 1 file changed, 11 insertions(+), 8 deletions(-)

diff --git a/drivers/base/regmap/regcache.c b/drivers/base/regmap/regcache.c
index 0a78ab0dc9fb..3101f19e411b 100644
--- a/drivers/base/regmap/regcache.c
+++ b/drivers/base/regmap/regcache.c
@@ -203,14 +203,6 @@ int regcache_init(struct regmap *map, const struct regmap_config *config)
 		count = regcache_count_cacheable_registers(map);
 		if (map->cache_bypass)
 			return 0;
-
-		/* Some devices such as PMICs don't have cache defaults,
-		 * we cope with this by reading back the HW registers and
-		 * crafting the cache defaults by hand.
-		 */
-		ret = regcache_hw_init(map, count);
-		if (ret < 0)
-			return ret;
 	}
 
 	if (!map->max_register_is_set && map->num_reg_defaults_raw) {
@@ -228,6 +220,17 @@ int regcache_init(struct regmap *map, const struct regmap_config *config)
 			goto err_free;
 	}
 
+	if (count) {
+		/*
+		 * Some devices such as PMICs don't have cache defaults,
+		 * we cope with this by reading back the HW registers and
+		 * crafting the cache defaults by hand.
+		 */
+		ret = regcache_hw_init(map, count);
+		if (ret < 0)
+			goto err_exit;
+	}
+
 	if (map->num_reg_defaults && map->cache_ops->populate) {
 		dev_dbg(map->dev, "Populating %s cache\n", map->cache_ops->name);
 		map->lock(map->lock_arg);
-- 
2.50.1

Re: [PATCH v1 3/3] regcache: Move HW readback after cache initialisation

[Mark Brown]

[-- Attachment #1: Type: text/plain, Size: 316 bytes --]

On Tue, Feb 10, 2026 at 05:09:10PM +0100, Andy Shevchenko wrote:
> Make sure that cache is initialised before calling any IO
> using regmap, this makes sure that we won't access NULL or
> invalid pointers in the cache which hasn't been initialised.

This doesn't apply against current code, please check and resend.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: [PATCH v1 0/3] regcache: Avoid accessing non-initialised cache

[Mark Brown]

On Tue, 10 Feb 2026 17:09:07 +0100, Andy Shevchenko wrote:
> FIXME cover letter
> 
> Some caches may not allow writes before full initialisation is done.
> In particular on REGMAP_MAPLE caches when we want to populate cache
> with the values (reg_defaults_raw == NULL && num_reg_defaults_raw != 0)
> from HW, the NULL pointer dereference may happen. Address this by moving
> the IO after cache initialisation is done.
> 
> [...]

Applied to

   https://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap.git for-next

Thanks!

[1/3] regcache: Remove duplicate check in regcache_hw_init()
      commit: 1fcf171178f021ef2005d47e281544624b93c5a5
[2/3] regcache: Split regcache_count_cacheable_registers() helper
      commit: c2bcf62ca75c541ec4297e6ff02a68ddc2e02029
[3/3] regcache: Move HW readback after cache initialisation
      (no commit info)

All being well this means that it will be integrated into the linux-next
tree (usually sometime in the next 24 hours) and sent to Linus during
the next merge window (or sooner if it is a bug fix), however if
problems are discovered then the patch may be dropped or reverted.

You may get further e-mails resulting from automated or manual testing
and review of the tree, please engage with people reporting problems and
send followup patches addressing any issues that are reported if needed.

If any updates are required or you are submitting further changes they
should be sent as incremental updates against current git, existing
patches will not be replaced.

Please add any relevant lists and maintainers to the CCs when replying
to this mail.

Thanks,
Mark