From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx0b-0031df01.pphosted.com (mx0b-0031df01.pphosted.com [205.220.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8B32926ED25 for ; Thu, 21 May 2026 14:25:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.180.131 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779373556; cv=none; b=LggLAUC79wY9+hvrp7z0xDgkZfDs18MkGlMVxqKEpXob60yFVvF60OgaV66GcBqF0m9/46/jL+6fTNfE/LiL9RQ2KZ9Ni2m6B8jYZR4ABLllgfgbFiriSSmh2Qm05ztw9mbXoVzPbURs5TiZKFjfUC4VfZv6qgK+4fX9iUBUzwg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779373556; c=relaxed/simple; bh=8lzAaweTOBR1/gQqUUXs/sDM6QW7IkiaEhZOIhrtp7o=; h=From:Subject:Date:Message-Id:MIME-Version:Content-Type:To:Cc; b=GrqnnmMZN44l0mW/khJoB0a+rYAn4RjdbsSYwxmEG0OQkLlSMnZQu5wOAFeMcgo5i8PUzpddQglGCR4oBU+lipM/mQ9LyUtaLirKh1RtE5FIpQwgGkuTEpf77aQG8j9XddmtFWjeVknlfRPXuaJ96NVbzFcgABT6PxwRMtY11Pk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=XS05NErn; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=Keqlwctj; arc=none smtp.client-ip=205.220.180.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="XS05NErn"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="Keqlwctj" Received: from pps.filterd (m0279869.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 64L9AOX51731435 for ; Thu, 21 May 2026 14:25:53 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:message-id :mime-version:subject:to; s=qcppdkim1; bh=CuUmaIvHZSC3Udvwfr39CU bTusybXSEyTfz9LwKF+7M=; b=XS05NErnoS9Bz+GKHyvdrqsRDr4JqrrReHn5jG UoZsNZpucJUxC9RNYAngrr/Eu+0PLccxuvcsGh7C50Oh4WkhrxypFiaT/NAwHSSA jHCstMWG1akShvpAnJrnX0cv+LcudAeShauY7Ljow++CgHwRVtzBA7OJEFvTrLRD oRHg3tVG8PfaTJCBkkMZbeMi2z5ItfWVkManrk4vwDN5nzgukDxNrTmGhEsUuZB+ hxOepYfQSzcf+uzDksbIX7cuH5P6pLP4v5/SXIvGmtAN+Z5Umf9hTP4Vl7Blvn2B /jT8nGAeKmM81T6pC8b3UIJ1pBgPilyO16UzP0UPrJw5B31g== Received: from mail-vs1-f69.google.com (mail-vs1-f69.google.com [209.85.217.69]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4e9c7f5u32-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Thu, 21 May 2026 14:25:53 +0000 (GMT) Received: by mail-vs1-f69.google.com with SMTP id ada2fe7eead31-63a6257148cso4434045137.2 for ; Thu, 21 May 2026 07:25:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1779373553; x=1779978353; darn=vger.kernel.org; h=cc:to:content-transfer-encoding:mime-version:message-id:date :subject:from:from:to:cc:subject:date:message-id:reply-to; bh=CuUmaIvHZSC3Udvwfr39CUbTusybXSEyTfz9LwKF+7M=; b=KeqlwctjsyWCTYniePitRrrScbTdcgau/LCuHzaQFvxN63NZ+MAMdqYNd9CkkTPQur gyL3vAr5rJk4/wc69PVqLYHo5dpnKz3T3VXtMVMrrUx45rzzxf9crPXP0eMrOMTutxpW 5HC9/5Zn+gAwSX+4mKF3zFUe7+SApumxj76iox6hUke/+I098t7DXZjT7f98Nh9+HtSB P4mpXqYXezM6yNYMUWCGawLWqnEtnhARt6SIA3om0yDnOmz4p8gP8P1XqzpXSGL6LX+S prqmIpJkerl0VTURUAB7SJxpcr+KmxHZjfWHARdEEC363pu8cOr9xWD/DcdpJZ4kLEy0 nv6w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779373553; x=1779978353; h=cc:to:content-transfer-encoding:mime-version:message-id:date :subject:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=CuUmaIvHZSC3Udvwfr39CUbTusybXSEyTfz9LwKF+7M=; b=gizKr8egQE89tjo050kbGVpV771r8cxS6A+4Y1DCeUf+FzsFTJEFv3fuNPFcZjpL9q lxxMqF7Bdnue9CpyMhsSbZD9PMnHbW5Ht9XRb9pop2vBjSG48HFD2UnZ/wEc5LIZq/5M 0BMqx5MApjyf18KKLqg7EDqtIZdDvS+hFCFsHxrqVZ7UQRR8nRn8ff6ACa3hT4cLYnb0 G9pchLFF5E6Liay/lxj+PQzi1/W1X3FrOxawReImgIfMhcGvN1LbbAVEYpaMRpDrUIgr 36n5GWv0F+kMctHOM9/voQ7l8/SW7+Y5hVNFP7CyG9ME7MXeifMh7+KMo6BMwFCC5cxG m6yA== X-Gm-Message-State: AOJu0YyslvzbUxX7QI89lSKd+h2jQoCdE6CPSvPKQphWAg2FNV6/Ob5H UI0Z6iZ8zmoEv9bsb5QkwNKgjux5CF2YnLbcyXduCe2GfdbWC9zHRHtbmjFI2Fd03uVn0JNTdOc Lp3AKfgAsTZL/xUZF3N2pf2PYdanFL1hBbHTcsSvulp2AzqmS7I1ov72YqBN2AS6oC9o= X-Gm-Gg: Acq92OHPDtFHWdQ/hIq7r5yKD7h1k0EomLXxTYWFX6IS1p5vHoIwBRAT7+KrGbSv3ys RYMlTPyEafBCGXou9rDdJBhL5GMTnZB4/Z6yklX1GmHawu0fh6HF7DGSdlXBkbh8cQQtguaSSUl eOR/rVR6DabNlQVBQC5aAxm2bgta9gDyMinREqQm7UskVao6QdUwJ24gwhACaoK27JYPaMnSpk2 zNlxeAWnOcZ9lxseBrA70SdnnILKOXjZqOuXe1W74IUDydwuHaP7jQcBSRigBd0YDxXq7+2Bd82 SDEIXafWiqYSn897WddT/sTQWLOno3bsEtEyd+eYqGvNyeS0L9A6YhymDYqvlfNZOXz7yAOnVJz np0VWzrNyRxJk3ESkPODtcbr0oGKIxdSBPO0Qqk/WP6QH2pWZPEk= X-Received: by 2002:a05:6102:3fa6:b0:66b:a0d7:abc4 with SMTP id ada2fe7eead31-6737b27fe6amr1936401137.0.1779373552518; Thu, 21 May 2026 07:25:52 -0700 (PDT) X-Received: by 2002:a05:6102:3fa6:b0:66b:a0d7:abc4 with SMTP id ada2fe7eead31-6737b27fe6amr1936333137.0.1779373552008; Thu, 21 May 2026 07:25:52 -0700 (PDT) Received: from brgl-qcom.local ([2a01:cb1d:dc:7e00:bb10:ae82:b7c3:d15a]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4903c9abbadsm30441925e9.8.2026.05.21.07.25.50 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 21 May 2026 07:25:51 -0700 (PDT) From: Bartosz Golaszewski Subject: [PATCH v4 00/10] nvmem: rework nvmem core and allow unbinding with active consumers Date: Thu, 21 May 2026 16:25:33 +0200 Message-Id: <20260521-nvmem-unbind-v4-0-7fa136759491@oss.qualcomm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit X-B4-Tracking: v=1; b=H4sIAN0VD2oC/3XM3wqCMBTH8VeJXTfZzpl/1lXvEV1sOnOQs1yOQ nz3phCS1M2B74HfZyTe9NZ4ctiNpDfBetu5GGK/I2Wj3MVQW8UmwCBjnAvqQmtaOjhtXUWzHHU KdVkIxUic3HpT2+fCnc6xG+sfXf9a9MDn7wfKvqHAKaO51oJxpblUxbHzPrkP6lp2bZvEQ2Yvw GoA4MaAaLCqRlQSsSrVHwNXQ4DcGBgNUJkUtUxRpvqHMU3TG67uhes3AQAA X-Change-ID: 20260114-nvmem-unbind-673b52fc84a0 To: Srinivas Kandagatla , Bartosz Golaszewski , Johan Hovold , Loic Poulain Cc: linux-kernel@vger.kernel.org, brgl@kernel.org, Bartosz Golaszewski , stable@vger.kernel.org X-Mailer: b4 0.14.2 X-Developer-Signature: v=1; a=openpgp-sha256; l=4097; i=bartosz.golaszewski@oss.qualcomm.com; h=from:subject:message-id; bh=8lzAaweTOBR1/gQqUUXs/sDM6QW7IkiaEhZOIhrtp7o=; b=owEBbQKS/ZANAwAKAQWdLsv/NoTDAcsmYgBqDxXjfYjL4fZsgGfnZdQs0plThAVVOzed33P5y 4heS69kULqJAjMEAAEKAB0WIQSR5RMt5bVGHXuiZfwFnS7L/zaEwwUCag8V4wAKCRAFnS7L/zaE w8WpEACc1XeQ7qA6gmARMTAjOR6UylCwo0elFRlfYd07AeId3po7O3kQh1ZfJALQuudPb0eadHx dEb7k0hNma6JmFDCC6sWZBY8Y3S9HcvjdYhqm0F81X0XTH31SQ5MTDXMS3g9oNqyC69JS0LvVjN MyRO6rX6Rpqd8rjRN0179IS1GqlpxJ5fZZ9eMO0yntBe8QzlP4jmQq9x4QI0CeOCQZueCxZ54AB PXnRv7i1/rQGoifmX2nqNJYqH+lTyT0EP3Kv1M1esKwOKd3Nxh7j7pwVLby+sLVPFQrGcKmJeEH d4G1ZiUADKQKaeDjsHpoxizCbLQpPaCMGUJVAZbooGYZw+cs/Jq/zr2brsjRwZ74tOBSZbGDJNZ k3FVY1mQG2/8geI0qOiOjoIiz5D8/BSYMAcmjAkQFYd8XsxPp0UNBl0CruyLAoyhBhgEBGwcY8H nj/UC5v340CSV/8e2AXbrDwBG20CDAtBZZbHZaJBOxPuNbmF+xU2dED7LnPMevMp3IdAS7GFsLn vsk8laNg07zG+5skAmF0GdOzkPFb80yOdk/8JP3qOY7Qw3QS/gm2e2HoYpjcHnp2EdC0G2R697K pNkAlPd/dR6Kp06CWYSdqJXqQMDVAtNfU83DdwwJN+AyfLb9QRkvs39xbLaBdKM47krUgqReg9T +jKJUVOq04C9F9w== X-Developer-Key: i=bartosz.golaszewski@oss.qualcomm.com; a=openpgp; fpr=169DEB6C0BC3C46013D2C79F11A72EA01471D772 X-Authority-Analysis: v=2.4 cv=c/ibhx9l c=1 sm=1 tr=0 ts=6a0f15f1 cx=c_pps a=5HAIKLe1ejAbszaTRHs9Ug==:117 a=xqWC_Br6kY4A:10 a=IkcTkHD0fZMA:10 a=NGcC8JguVDcA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=_glEPmIy2e8OvE2BGh3C:22 a=bC-a23v3AAAA:8 a=EUspDBNiAAAA:8 a=VwQbUJbxAAAA:8 a=L2BAdSLxVfnVBQOZ-uAA:9 a=QEXdDO2ut3YA:10 a=gYDTvv6II1OnSo0itH1n:22 a=FO4_E8m0qiDe52t0p3_H:22 X-Proofpoint-GUID: T7i9OW4w20yX51ja5Y8HGvgpePT1GmtE X-Proofpoint-ORIG-GUID: T7i9OW4w20yX51ja5Y8HGvgpePT1GmtE X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNTIxMDE0NCBTYWx0ZWRfX8u48XlogaK5r YMFmUBiZ+yhTZorbY3kE0+oyYzr2iWfuY5z/qCUG/9ysZSWEgJoGdBej8Ju4yN0aJpbl4cPwycp Ac+IXQB3RXyT/R3BbxkO3+rlvPtfF+ZWZAU/SZ+exeJMLy2RMpnqDBOAxfRgAg7XQxP2Y+LV+Fa sbCt4lweUEkcj5mu35quwd+7kEq9leLyg5tvplUhQ8fhYE8NQ7ziEcPiyu8OoQyOalC9mJ9qPGP 4FActDjjNQaihe+tsmZMquvNxeY0KTQ4ibpcgBxsV0M2BHph5S7+OZd6TE1rPns0wWRQQHdxlCM Zk7/Tc7uZ46TfZCtuP0LrXj5HmngyjEpLtJ8rIpuH1r/6+c6Ztwbvh2y5ALF1CBDN0wIxpmGXkr hX33vHcgoMD2fLSl7FNeOThsJNO0j9oDZAvpOofK9ROuSaNmqNhFbEGO0E1Rmk8Rw72b6aBz5wU EJlsWnkpPTDGsEnktoQ== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.51,FMLib:17.12.100.49 definitions=2026-05-21_02,2026-05-18_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 impostorscore=0 spamscore=0 priorityscore=1501 phishscore=0 bulkscore=0 clxscore=1015 malwarescore=0 adultscore=0 suspectscore=0 lowpriorityscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2605130000 definitions=main-2605210144 Sashiko pointed out some issues so this iteration fixes them. I'm also Cc'ing Loic who seems to have encountered the issue of unbinding with active consumers when working on the block nvmem provider. Nvmem is one of the subsystems vulnerable to object life-time issues. The memory nvmem core dereferences is owned by nvmem providers which can be unbound at any time and even though nvmem devices themselves are reference-counted, there's no synchronization with the provider modules. This typically is not a problem because thanks to fw_devlink, consumers get synchronously unbound before providers but it's enough to pass fw_devlink=off over the command line, unbind the nvmem controller with consumers still holding references to it and try to read/write in order to see fireworks in the kernel log. User-space can trigger it too if a device (for instance: i2c eeprom on a cp2112 USB expander) is unplugged halfway through a long read. This series proposes to use SRCU to protect nvmem against accessing invalid memory after unbinding with active consumers and also reworks several places in nvmem core. The first patch is a fix that should land in v7.1, the rest is v7.2 material. Signed-off-by: Bartosz Golaszewski --- Changes in v4: - Restore the removed checks for the existence of reg_write/reg_read ops in sysfs callbacks as the attributes may be created with only a single operation available - Fix potential use-after-free when decrementing the references to nvmem device - Rename some local variables to better indicate their function - Initialize the cell list before calling device_initialize() as we iterate over it in release path unconditionally - Restore the nvmem != NULL check in nvmem_unregister() as sashiko pointed out there are users who rely on this API contract - Don't use rcu_dereference() with SRCU as it may trigger a false-positive lockdep alert - Synchronize the removal of nvmem->ops in error path in nvmem_register() as it's possible for it to be made available to the system before a subsequent failure later in the function - Link to v3: https://patch.msgid.link/20260429-nvmem-unbind-v3-0-2a694f95395b@oss.qualcomm.com Changes in v3: - Add Fixes tag to patch 1 - Don't check the presence of read/write callbacks in sysfs attributes as these are not visible without them - Rework mutex guards and drop unneeded helper variables - Fix mutex guard conversion: it accidentally converted nvmem_lookup_mutex locks to nvmem_mutex - Extend patch 5 to also rename __nvmem_device_get() to nvmem_device_match() - Call nvmem_sysfs_remove_compat() on unregister, not release - Split patch 7 into two: one removing the redundant kref and second adding SRCU - Link to v2: https://patch.msgid.link/20260223-nvmem-unbind-v2-0-0df33a933dca@oss.qualcomm.com Changes in v2: - add missing SRCU struct cleanup - improve the teardown path on error in nvmem_register() - Link to v1: https://lore.kernel.org/r/20260116-nvmem-unbind-v1-0-7bb401ab19a8@oss.qualcomm.com --- Bartosz Golaszewski (10): nvmem: core: fix use-after-free bugs in error paths nvmem: remove unused field from struct nvmem_device nvmem: return -EOPNOTSUPP to in-kernel users on missing callbacks nvmem: check the return value of gpiod_set_value_cansleep() nvmem: simplify locking with guard() nvmem: remove unneeded __nvmem_device_put() nvmem: split out the reg_read/write() callbacks out of struct nvmem_device nvmem: simplify nvmem_sysfs_remove_compat() nvmem: remove duplicated reference counting nvmem: protect nvmem_device::ops with SRCU drivers/nvmem/core.c | 319 ++++++++++++++++++++++++---------------------- drivers/nvmem/internals.h | 13 +- 2 files changed, 178 insertions(+), 154 deletions(-) --- base-commit: 7d9ebe5c8b1bd9f6ae73b47929761cd9a6287407 change-id: 20260114-nvmem-unbind-673b52fc84a0 Best regards, -- Bartosz Golaszewski