From: Lee Jones <lee@kernel.org>
To: lee@kernel.org, Binbin Zhou <zhoubinbin@loongson.cn>,
Chong Qiao <qiaochong@loongson.cn>,
Andy Shevchenko <andriy.shevchenko@linux.intel.com>,
Corey Minyard <corey@minyard.net>,
Huacai Chen <chenhuacai@kernel.org>,
mfd@lists.linux.dev, linux-kernel@vger.kernel.org
Subject: [PATCH v2 04/27] mfd: ls2kbmc: Allocate simplefb platform_data on the heap
Date: Tue, 27 Oct 2026 09:30:33 +0000 [thread overview]
Message-ID: <20261027093306.2812695-5-lee@kernel.org> (raw)
In-Reply-To: <20261027093306.2812695-1-lee@kernel.org>
ls2k_bmc_probe() declares struct simplefb_platform_data on the stack and
assigns its address to the display MFD cell. Although mfd_add_device()
deep-copies platform_data via platform_device_add_data() before
ls2k_bmc_probe() returns, the shallow mfd_cell copy attached to the
child platform device retains a stale pointer to the expired stack
frame.
Allocate the simplefb_platform_data structure on the heap via
devm_kzalloc() prior to devm_mfd_add_devices() so the pointer remains
valid for the lifetime of the child platform device.
Fixes: 0d64f6d1ffe9 ("mfd: ls2kbmc: Introduce Loongson-2K BMC core driver")
Closes: https://sashiko.dev/#/bug/linux-4e2dd9cb-310b-4bba-b305-ffacc738285c
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Acked-by: Binbin Zhou <zhoubinbin@loongson.cn>
Signed-off-by: Lee Jones <lee@kernel.org>
---
drivers/mfd/ls2k-bmc-core.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
diff --git a/drivers/mfd/ls2k-bmc-core.c b/drivers/mfd/ls2k-bmc-core.c
index e245bdee8226..3e3bc835262e 100644
--- a/drivers/mfd/ls2k-bmc-core.c
+++ b/drivers/mfd/ls2k-bmc-core.c
@@ -470,7 +470,7 @@ static int ls2k_bmc_parse_mode(struct pci_dev *pdev, struct simplefb_platform_da
static int ls2k_bmc_probe(struct pci_dev *dev, const struct pci_device_id *id)
{
- struct simplefb_platform_data pd;
+ struct simplefb_platform_data *pd;
struct ls2k_bmc_ddata *ddata;
resource_size_t base;
int ret;
@@ -489,12 +489,16 @@ static int ls2k_bmc_probe(struct pci_dev *dev, const struct pci_device_id *id)
if (ret)
return ret;
- ret = ls2k_bmc_parse_mode(dev, &pd);
+ pd = devm_kzalloc(&dev->dev, sizeof(*pd), GFP_KERNEL);
+ if (!pd)
+ return -ENOMEM;
+
+ ret = ls2k_bmc_parse_mode(dev, pd);
if (ret)
return ret;
- ls2k_bmc_cells[LS2K_BMC_DISPLAY].platform_data = &pd;
- ls2k_bmc_cells[LS2K_BMC_DISPLAY].pdata_size = sizeof(pd);
+ ls2k_bmc_cells[LS2K_BMC_DISPLAY].platform_data = pd;
+ ls2k_bmc_cells[LS2K_BMC_DISPLAY].pdata_size = sizeof(*pd);
base = pci_resource_start(dev, 0) + LS2K_DISPLAY_RES_START;
/* Remove conflicting efifb device */
--
2.56.0.307.g5fe7bd680c-goog
next prev parent reply other threads:[~2026-10-27 10:36 UTC|newest]
Thread overview: 31+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-27 9:30 [PATCH v2 00/27] mfd: Assorted resource lifetime, teardown, and error-handling fixes Lee Jones
2026-10-27 9:30 ` [PATCH v2 01/27] mfd: nct6694: Allocate USB DMA buffers with kzalloc_obj() Lee Jones
2026-10-27 9:30 ` [PATCH v2 02/27] mfd: ls2kbmc: Unregister GPIO GSI via devm_add_action_or_reset() Lee Jones
2026-10-27 9:30 ` [PATCH v2 03/27] mfd: ls2kbmc: Cancel reset work on teardown via devm_work_autocancel() Lee Jones
2026-10-27 9:30 ` Lee Jones [this message]
2026-10-27 9:30 ` [PATCH v2 05/27] mfd: bd96801: Allocate watchdog IRQ resource on the heap Lee Jones
2026-10-27 9:30 ` [PATCH v2 06/27] mfd: ti_am335x_tscadc: Retrieve parent driver data via dev_get_drvdata() Lee Jones
2026-10-27 9:30 ` [PATCH v2 07/27] mfd: db8500-prcmu: Make AB8500 cell and IRQ resource static Lee Jones
2026-10-27 9:30 ` [PATCH v2 08/27] mfd: nct6694: Do not resubmit interrupt URB on endpoint stall (-EPIPE) Lee Jones
2026-10-27 9:30 ` [PATCH v2 09/27] mfd: ioc3: Request parent IRQ via request_irq() and free before domain removal Lee Jones
2026-10-27 9:30 ` [PATCH v2 10/27] mfd: intel-lpss: Remove registered MFD child devices on probe failure Lee Jones
2026-10-27 9:30 ` [PATCH v2 11/27] mfd: max8907: Manage power-off handler via devm_register_sys_off_handler() Lee Jones
2026-10-27 9:30 ` [PATCH v2 12/27] mfd: twl-core: Clear pm_power_off callback in twl_remove() Lee Jones
2026-10-27 9:30 ` [PATCH v2 13/27] mfd: twl-core: Clear twl_priv pointer on teardown and probe failure Lee Jones
2026-10-28 15:50 ` Andreas Kemnade
2026-10-27 9:30 ` [PATCH v2 14/27] mfd: loongson-se: Check return value of dma_set_mask_and_coherent() Lee Jones
2026-10-27 9:30 ` [PATCH v2 15/27] mfd: loongson-se: Zero-initialise controller command structures Lee Jones
2026-10-27 9:30 ` [PATCH v2 16/27] mfd: loongson-se: Reinitialise completions and wait uninterruptibly for commands Lee Jones
2026-10-27 9:30 ` [PATCH v2 17/27] mfd: loongson-se: Zero-allocate driver data and initialise engine completions in probe Lee Jones
2026-10-27 9:30 ` [PATCH v2 18/27] mfd: loongson-se: Prevent out-of-bounds engine access in se_irq_handler() Lee Jones
2026-10-27 9:30 ` [PATCH v2 19/27] mfd: loongson-se: Stop controller and mask interrupts on teardown and shutdown Lee Jones
2026-10-27 9:30 ` [PATCH v2 20/27] mfd: loongson-se: Validate engine ID, DMA buffer size, and IRQ registration Lee Jones
2026-10-27 9:30 ` [PATCH v2 21/27] mfd: abx500-core: Unregister device ops on devm release Lee Jones
2026-10-27 9:30 ` [PATCH v2 22/27] mfd: ab8500-core: Register sysfs attribute groups via devm_device_add_group() Lee Jones
2026-10-27 9:30 ` [PATCH v2 23/27] mfd: tps65217: Manage IRQ domain teardown via devres Lee Jones
2026-10-27 9:30 ` [PATCH v2 24/27] mfd: mt6397: Manage IRQ domain lifecycle with devres Lee Jones
2026-10-28 3:45 ` Chen-Yu Tsai
2026-10-27 9:30 ` [PATCH v2 25/27] mfd: mt6397: Unregister PM notifier on probe failure and unbind Lee Jones
2026-10-28 4:15 ` Chen-Yu Tsai
2026-10-27 9:30 ` [PATCH v2 26/27] i2c: cgbc: Propagate hardware errors when polling read status Lee Jones
2026-10-27 9:30 ` [PATCH v2 27/27] mfd: ti_am335x_tscadc: Remove redundant ti_tscadc_dev_get() helper Lee Jones
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261027093306.2812695-5-lee@kernel.org \
--to=lee@kernel.org \
--cc=andriy.shevchenko@linux.intel.com \
--cc=chenhuacai@kernel.org \
--cc=corey@minyard.net \
--cc=linux-kernel@vger.kernel.org \
--cc=mfd@lists.linux.dev \
--cc=qiaochong@loongson.cn \
--cc=zhoubinbin@loongson.cn \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®