[PATCH v3 0/2] wcd934x fixes

[PATCH v3 0/2] wcd934x fixes

[David Heidelberg via B4 Relay]

$subj

Signed-off-by: David Heidelberg <david@ixit.cz>
---
Changes in v3:
- Capitalize commit names. (Sashiko)
- Add commit addressing the NULL deref when of_irq_get fails. (Sashiko)
- Link to v2: https://patch.msgid.link/20260903-wcd-dma-v2-1-189cff560a28@ixit.cz

Changes in v2:
- Use dma_coerce_mask_and_coherent. (Lee)
- Link to v1: https://patch.msgid.link/20260823-wcd-dma-v1-1-95e44a315ccf@ixit.cz

---
David Heidelberg (2):
      mfd: wcd934x: Fix NULL pointer dereference on IRQ probe deferral
      mfd: wcd934x: Set DMA mask on parent to silence "DMA mask not set"

 drivers/mfd/wcd934x.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)
---
base-commit: 7079a12d7506b07fb53b54a664bfad5fa9b16d70
change-id: 20260823-wcd-dma-bd621ee39887

Best regards,
--  
David Heidelberg <david@ixit.cz>

[PATCH v3 1/2] mfd: wcd934x: Fix NULL pointer dereference on IRQ probe deferral

[David Heidelberg via B4 Relay]

From: David Heidelberg <david@ixit.cz>

ddata->dev is only assigned at the end of wcd934x_slim_probe(), but the
of_irq_get() error path has passed it to the error print since the
driver was added, while it is still NULL.

This used to be harmless with dev_err(), which copes with a NULL device
and was skipped on -EPROBE_DEFER. Since the switch to dev_err_probe(), a
deferred IRQ reaches device_set_deferred_probe_reason() ->
dev_driver_string(), which dereferences the NULL pointer and crashes
during probe. Use dev, which is already valid at this point.

Cc: stable@vger.kernel.org
Fixes: 0f1b1b899521 ("mfd: wcd934x: Simplify with dev_err_probe()")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://lore.kernel.org/mfd/20260903145651.AC1311F00ACA@smtp.kernel.org/
Signed-off-by: David Heidelberg <david@ixit.cz>
---
 drivers/mfd/wcd934x.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/mfd/wcd934x.c b/drivers/mfd/wcd934x.c
index 3c3080e8c8cf7..3a939e7ad3da5 100644
--- a/drivers/mfd/wcd934x.c
+++ b/drivers/mfd/wcd934x.c
@@ -218,17 +218,17 @@ static int wcd934x_slim_probe(struct slim_device *sdev)
 	int ret;
 
 	ddata = devm_kzalloc(dev, sizeof(*ddata), GFP_KERNEL);
 	if (!ddata)
 		return	-ENOMEM;
 
 	ddata->irq = of_irq_get(np, 0);
 	if (ddata->irq < 0)
-		return dev_err_probe(ddata->dev, ddata->irq,
+		return dev_err_probe(dev, ddata->irq,
 				     "Failed to get IRQ\n");
 
 	ddata->extclk = devm_clk_get(dev, "extclk");
 	if (IS_ERR(ddata->extclk))
 		return dev_err_probe(dev, PTR_ERR(ddata->extclk),
 				     "Failed to get extclk");
 
 	ddata->supplies[0].supply = "vdd-buck";

-- 
2.55.0

[PATCH v3 2/2] mfd: wcd934x: Set DMA mask on parent to silence "DMA mask not set"

[David Heidelberg via B4 Relay]

From: David Heidelberg <david@ixit.cz>

The wcd934x MFD parent (a slim_device) never initializes its
dma_mask/coherent_dma_mask. When the DT-aware children pass through
of_dma_configure() this triggers the "DMA mask not set" warning for
each child.

Cc: stable@vger.kernel.org
Fixes: f959dcd6ddfd ("dma-direct: Fix potential NULL pointer dereference")
Assisted-by: tencent:hy3
Signed-off-by: David Heidelberg <david@ixit.cz>
---
 drivers/mfd/wcd934x.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/mfd/wcd934x.c b/drivers/mfd/wcd934x.c
index 3a939e7ad3da5..fc17c39791301 100644
--- a/drivers/mfd/wcd934x.c
+++ b/drivers/mfd/wcd934x.c
@@ -1,12 +1,13 @@
 // SPDX-License-Identifier: GPL-2.0
 // Copyright (c) 2019, Linaro Limited
 
 #include <linux/clk.h>
+#include <linux/dma-mapping.h>
 #include <linux/gpio/consumer.h>
 #include <linux/interrupt.h>
 #include <linux/kernel.h>
 #include <linux/mfd/core.h>
 #include <linux/mfd/wcd934x/registers.h>
 #include <linux/mfd/wcd934x/wcd934x.h>
 #include <linux/module.h>
 #include <linux/of.h>
@@ -212,16 +213,21 @@ static int wcd934x_slim_status(struct slim_device *sdev,
 static int wcd934x_slim_probe(struct slim_device *sdev)
 {
 	struct device *dev = &sdev->dev;
 	struct device_node *np = dev->of_node;
 	struct wcd934x_ddata *ddata;
 	struct gpio_desc *reset_gpio;
 	int ret;
 
+	ret = dma_coerce_mask_and_coherent(dev, DMA_BIT_MASK(32));
+	if (ret)
+		return dev_err_probe(dev, ret,
+				     "Failed to set dma mask\n");
+
 	ddata = devm_kzalloc(dev, sizeof(*ddata), GFP_KERNEL);
 	if (!ddata)
 		return	-ENOMEM;
 
 	ddata->irq = of_irq_get(np, 0);
 	if (ddata->irq < 0)
 		return dev_err_probe(dev, ddata->irq,
 				     "Failed to get IRQ\n");

-- 
2.55.0

Re: [PATCH v3 2/2] mfd: wcd934x: Set DMA mask on parent to silence "DMA mask not set"

[Lee Jones]

On Thu, 03 Sep 2026, David Heidelberg via B4 Relay wrote:

> From: David Heidelberg <david@ixit.cz>
> 
> The wcd934x MFD parent (a slim_device) never initializes its
> dma_mask/coherent_dma_mask. When the DT-aware children pass through
> of_dma_configure() this triggers the "DMA mask not set" warning for
> each child.
> 
> Cc: stable@vger.kernel.org
> Fixes: f959dcd6ddfd ("dma-direct: Fix potential NULL pointer dereference")
> Assisted-by: tencent:hy3
> Signed-off-by: David Heidelberg <david@ixit.cz>

Already applied.

> ---
>  drivers/mfd/wcd934x.c | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/drivers/mfd/wcd934x.c b/drivers/mfd/wcd934x.c
> index 3a939e7ad3da5..fc17c39791301 100644
> --- a/drivers/mfd/wcd934x.c
> +++ b/drivers/mfd/wcd934x.c
> @@ -1,12 +1,13 @@
>  // SPDX-License-Identifier: GPL-2.0
>  // Copyright (c) 2019, Linaro Limited
>  
>  #include <linux/clk.h>
> +#include <linux/dma-mapping.h>
>  #include <linux/gpio/consumer.h>
>  #include <linux/interrupt.h>
>  #include <linux/kernel.h>
>  #include <linux/mfd/core.h>
>  #include <linux/mfd/wcd934x/registers.h>
>  #include <linux/mfd/wcd934x/wcd934x.h>
>  #include <linux/module.h>
>  #include <linux/of.h>
> @@ -212,16 +213,21 @@ static int wcd934x_slim_status(struct slim_device *sdev,
>  static int wcd934x_slim_probe(struct slim_device *sdev)
>  {
>  	struct device *dev = &sdev->dev;
>  	struct device_node *np = dev->of_node;
>  	struct wcd934x_ddata *ddata;
>  	struct gpio_desc *reset_gpio;
>  	int ret;
>  
> +	ret = dma_coerce_mask_and_coherent(dev, DMA_BIT_MASK(32));
> +	if (ret)
> +		return dev_err_probe(dev, ret,
> +				     "Failed to set dma mask\n");
> +
>  	ddata = devm_kzalloc(dev, sizeof(*ddata), GFP_KERNEL);
>  	if (!ddata)
>  		return	-ENOMEM;
>  
>  	ddata->irq = of_irq_get(np, 0);
>  	if (ddata->irq < 0)
>  		return dev_err_probe(dev, ddata->irq,
>  				     "Failed to get IRQ\n");
> 
> -- 
> 2.55.0
> 
> 

-- 
Lee Jones

Re: [PATCH v3 0/2] wcd934x fixes

[Lee Jones]

On Thu, 03 Sep 2026 17:21:41 +0200, David Heidelberg wrote:
> $subj

Applied, thanks!

[1/2] mfd: wcd934x: Fix NULL pointer dereference on IRQ probe deferral
      commit: 1389a4a5877403e57573d6bc01c5b7790a4472ce
[2/2] mfd: wcd934x: Set DMA mask on parent to silence "DMA mask not set"
      (no commit info)

--
Lee Jones [李琼斯]

Re: (subset) [PATCH v3 1/2] mfd: wcd934x: Fix NULL pointer dereference on IRQ probe deferral

[Lee Jones]

On Thu, 03 Sep 2026 17:21:42 +0200, David Heidelberg wrote:
> ddata->dev is only assigned at the end of wcd934x_slim_probe(), but the
> of_irq_get() error path has passed it to the error print since the
> driver was added, while it is still NULL.
> 
> This used to be harmless with dev_err(), which copes with a NULL device
> and was skipped on -EPROBE_DEFER. Since the switch to dev_err_probe(), a
> deferred IRQ reaches device_set_deferred_probe_reason() ->
> dev_driver_string(), which dereferences the NULL pointer and crashes
> during probe. Use dev, which is already valid at this point.
> 
> [...]

Applied, thanks!

[1/2] mfd: wcd934x: Fix NULL pointer dereference on IRQ probe deferral
      commit: 1389a4a5877403e57573d6bc01c5b7790a4472ce

--
Lee Jones [李琼斯]

Re: (subset) [PATCH v3 1/2] mfd: wcd934x: Fix NULL pointer dereference on IRQ probe deferral

[Lee Jones]

On Wed, 16 Sep 2026, Lee Jones wrote:

> On Thu, 03 Sep 2026 17:21:42 +0200, David Heidelberg wrote:
> > ddata->dev is only assigned at the end of wcd934x_slim_probe(), but the
> > of_irq_get() error path has passed it to the error print since the
> > driver was added, while it is still NULL.
> > 
> > This used to be harmless with dev_err(), which copes with a NULL device
> > and was skipped on -EPROBE_DEFER. Since the switch to dev_err_probe(), a
> > deferred IRQ reaches device_set_deferred_probe_reason() ->
> > dev_driver_string(), which dereferences the NULL pointer and crashes
> > during probe. Use dev, which is already valid at this point.
> > 
> > [...]
> 
> Applied, thanks!
> 
> [1/2] mfd: wcd934x: Fix NULL pointer dereference on IRQ probe deferral
>       commit: 1389a4a5877403e57573d6bc01c5b7790a4472ce

Didn't apply initially, but I reworked it.

-- 
Lee Jones