[PATCH 0/5] gpio: fix IRQ handling and probe error paths in five drivers

[PATCH 0/5] gpio: fix IRQ handling and probe error paths in five drivers

[shao.mingyin]

Five independent fixes in drivers/gpio/.  One stops an IRQ mask write
from enabling every other line in the bank, two stop probe from
swallowing -EPROBE_DEFER so that the controller is retried once its
parent interrupt controller is ready, one makes the 104-IDI-48 IRQ
status register accessible again, and one keeps a missing device
property from being mistaken for a multi-gigabyte allocation.

The patches touch five separate drivers and have no shared dependency;
they are ordered by severity and can be reviewed, applied and taken
individually:

  1/5 gpio: rcar: don't clobber INTMSK when disabling a single line
  2/5 gpio: aspeed-sgpio: propagate IRQ setup error in probe
  3/5 gpio: 104-idi-48: fix max_register blocking the IRQ register
  4/5 gpio: brcmstb: don't turn platform_get_irq errors into -ENOENT
  5/5 gpio: line-mux: fix unsigned truncation of property count error

1/5 is a one-line read-modify-write in the R-Car mask path; 2/5 and 4/5
return the original platform_get_irq() error, including -EPROBE_DEFER;
3/5 raises max_register by one to cover the IRQ status/enable register;
5/5 makes the property count signed and rejects non-positive values.

All five are single-file changes under drivers/gpio/ and pass git apply
and checkpatch.  All go through the GPIO tree.

Shao Mingyin (5):
  gpio: rcar: don't clobber INTMSK when disabling a single line
  gpio: aspeed-sgpio: propagate IRQ setup error in probe
  gpio: 104-idi-48: fix max_register blocking the IRQ register
  gpio: brcmstb: don't turn platform_get_irq errors into -ENOENT
  gpio: line-mux: fix unsigned truncation of property count error

 drivers/gpio/gpio-104-idi-48.c   | 2 +-
 drivers/gpio/gpio-aspeed-sgpio.c | 4 +++-
 drivers/gpio/gpio-brcmstb.c      | 4 ++--
 drivers/gpio/gpio-line-mux.c     | 4 ++--
 drivers/gpio/gpio-rcar.c         | 2 +-
 5 files changed, 9 insertions(+), 7 deletions(-)

---
base-commit: 7649ba73f9e7e1e04d0b46213e39c79ae09dd55c

[PATCH 1/5] gpio: rcar: don't clobber INTMSK when disabling a single line

[shao.mingyin]

From: Shao Mingyin <shao.mingyin@zte.com.cn>

gpio_rcar_irq_disable() writes ~BIT(hwirq) to the whole INTMSK register,
which clears the bit of the line being disabled but sets every other bit
in the bank to 1.  Since a set bit in INTMSK means "interrupt enabled"
(gpio_rcar_irq_handler() only handles lines whose INTMSK bit is set),
this disables one GPIO interrupt while collateral-enabling all the
other GPIO interrupts of the bank, which can cause a storm of spurious
cascaded interrupts on level-triggered lines.

Do a read-modify-write to clear only the line being disabled.

Fixes: 119f5e448d32 ("gpio: Renesas R-Car GPIO driver V3")
Cc: stable@vger.kernel.org
Signed-off-by: Shao Mingyin <shao.mingyin@zte.com.cn>
---
 drivers/gpio/gpio-rcar.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpio/gpio-rcar.c b/drivers/gpio/gpio-rcar.c
index 1192e1f1c6..239d78a2ae 100644
--- a/drivers/gpio/gpio-rcar.c
+++ b/drivers/gpio/gpio-rcar.c
@@ -129,7 +129,7 @@
 	struct gpio_rcar_priv *p = gpiochip_get_data(gc);
 	irq_hw_number_t hwirq = irqd_to_hwirq(d);
 
-	gpio_rcar_write(p, INTMSK, ~BIT(hwirq));
+	gpio_rcar_write(p, INTMSK, gpio_rcar_read(p, INTMSK) & ~BIT(hwirq));
 	gpiochip_disable_irq(gc, hwirq);
 }

[PATCH 2/5] gpio: aspeed-sgpio: propagate IRQ setup error in probe

[shao.mingyin]

From: Shao Mingyin <shao.mingyin@zte.com.cn>

aspeed_sgpio_probe() ignores the return value of
aspeed_sgpio_setup_irqs().  That function returns the result of
platform_get_irq(), so on failure - in particular -EPROBE_DEFER while
the parent interrupt controller is still probing - the driver carries on
and registers the gpiochip with no interrupt support, and the deferred
probe is never retried, leaving GPIO interrupts permanently broken.

The "interrupts" property is mandatory for this device, so propagate the
error from probe.

Fixes: 7db47faae79b ("gpio: aspeed: Add SGPIO driver")
Cc: stable@vger.kernel.org
Signed-off-by: Shao Mingyin <shao.mingyin@zte.com.cn>
---
 drivers/gpio/gpio-aspeed-sgpio.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/gpio/gpio-aspeed-sgpio.c b/drivers/gpio/gpio-aspeed-sgpio.c
index 4225261f61..9df0082270 100644
--- a/drivers/gpio/gpio-aspeed-sgpio.c
+++ b/drivers/gpio/gpio-aspeed-sgpio.c
@@ -686,7 +686,9 @@
 	gpio->chip.label = dev_name(&pdev->dev);
 	gpio->chip.base = -1;
 
-	aspeed_sgpio_setup_irqs(gpio, pdev);
+	rc = aspeed_sgpio_setup_irqs(gpio, pdev);
+	if (rc)
+		return rc;
 
 	rc = devm_gpiochip_add_data(&pdev->dev, &gpio->chip, gpio);
 	if (rc < 0)

[PATCH 3/5] gpio: 104-idi-48: fix max_register blocking the IRQ register

[shao.mingyin]

From: Shao Mingyin <shao.mingyin@zte.com.cn>

The regmap config declares max_register = 0x6, but the device's IRQ
status/enable register lives at offset 0x7 (IDI48_IRQ_STATUS /
IDI48_IRQ_ENABLE, also listed in the readable/precious ranges and used
as status_base/unmask_base by the regmap-irq chip).  regmap_readable()
and regmap_writeable() both return false for any register above
max_register, so regmap_read() of the status register fails with -EIO
inside regmap_irq_thread() and no GPIO interrupt is ever delivered.

Raise max_register to 0x7 so the IRQ register is accessible.

Fixes: e28432a77365 ("gpio: 104-idi-48: Migrate to the regmap-irq API")
Cc: stable@vger.kernel.org
Signed-off-by: Shao Mingyin <shao.mingyin@zte.com.cn>
---
 drivers/gpio/gpio-104-idi-48.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpio/gpio-104-idi-48.c b/drivers/gpio/gpio-104-idi-48.c
index fb017569cf..493d1fe708 100644
--- a/drivers/gpio/gpio-104-idi-48.c
+++ b/drivers/gpio/gpio-104-idi-48.c
@@ -78,7 +78,7 @@
 	.reg_stride = 1,
 	.val_bits = 8,
 	.io_port = true,
-	.max_register = 0x6,
+	.max_register = 0x7,
 	.wr_table = &idi_48_wr_table,
 	.rd_table = &idi_48_rd_table,
 	.precious_table = &idi_48_precious_table,

Re: [PATCH 3/5] gpio: 104-idi-48: fix max_register blocking the IRQ register

[William Breathitt Gray]

On Sat, Nov 07, 2026 at 04:12:55PM +0800, shao.mingyin@zte.com.cn wrote:
> From: Shao Mingyin <shao.mingyin@zte.com.cn>
> 
> The regmap config declares max_register = 0x6, but the device's IRQ
> status/enable register lives at offset 0x7 (IDI48_IRQ_STATUS /
> IDI48_IRQ_ENABLE, also listed in the readable/precious ranges and used
> as status_base/unmask_base by the regmap-irq chip).  regmap_readable()
> and regmap_writeable() both return false for any register above
> max_register, so regmap_read() of the status register fails with -EIO
> inside regmap_irq_thread() and no GPIO interrupt is ever delivered.
> 
> Raise max_register to 0x7 so the IRQ register is accessible.
> 
> Fixes: e28432a77365 ("gpio: 104-idi-48: Migrate to the regmap-irq API")
> Cc: stable@vger.kernel.org
> Signed-off-by: Shao Mingyin <shao.mingyin@zte.com.cn>

Acked-by: William Breathitt Gray <wbg@kernel.org>

[PATCH 4/5] gpio: brcmstb: don't turn platform_get_irq errors into -ENOENT

[shao.mingyin]

From: Shao Mingyin <shao.mingyin@zte.com.cn>

When the "interrupt-controller" property is present, brcmstb_gpio_probe()
maps any platform_get_irq() failure to -ENOENT.  This swallows
-EPROBE_DEFER (the parent interrupt controller may not be probed yet),
so the device never gets retried and the GPIO controller is permanently
unavailable.  Return the original error code instead.

Fixes: 19a7b6940b78 ("gpio: brcmstb: Add interrupt and wakeup source support")
Cc: stable@vger.kernel.org
Signed-off-by: Shao Mingyin <shao.mingyin@zte.com.cn>
---
 drivers/gpio/gpio-brcmstb.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpio/gpio-brcmstb.c b/drivers/gpio/gpio-brcmstb.c
index 3b1aaea639..e23e8f267f 100644
--- a/drivers/gpio/gpio-brcmstb.c
+++ b/drivers/gpio/gpio-brcmstb.c
@@ -655,7 +655,7 @@
 	if (of_property_read_bool(np, "interrupt-controller")) {
 		priv->parent_irq = platform_get_irq(pdev, 0);
-		if (priv->parent_irq <= 0)
-			return -ENOENT;
+		if (priv->parent_irq < 0)
+			return priv->parent_irq;
 	} else {
 		priv->parent_irq = -ENOENT;
 	}

[PATCH 5/5] gpio: line-mux: fix unsigned truncation of property count error

[shao.mingyin]

From: Shao Mingyin <shao.mingyin@zte.com.cn>

device_property_count_u32() returns an int and reports errors with a
negative errno (e.g. -EINVAL when the "gpio-line-mux-states" property is
missing).  Storing that into an unsigned int turns -EINVAL into a huge
value, so the "if (!ngpio)" guard never triggers and struct_size() then
computes a huge size.  The allocation fails with -ENOMEM, hiding the
real error; struct_size() saturates on overflow, so this is not an
undersized allocation on 32-bit builds either.

Use a signed int for the count and reject non-positive values.

Fixes: 2b03d9a40cd1 ("gpio: add gpio-line-mux driver")
Signed-off-by: Shao Mingyin <shao.mingyin@zte.com.cn>
---
 drivers/gpio/gpio-line-mux.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpio/gpio-line-mux.c b/drivers/gpio/gpio-line-mux.c
index b4452d956b..19e4212de2 100644
--- a/drivers/gpio/gpio-line-mux.c
+++ b/drivers/gpio/gpio-line-mux.c
@@ -48,12 +48,12 @@
 {
 	struct device *dev = &pdev->dev;
 	struct gpio_lmux *glm;
-	unsigned int ngpio;
+	int ngpio;
 	size_t size;
 	int ret;
 
 	ngpio = device_property_count_u32(dev, "gpio-line-mux-states");
-	if (!ngpio)
+	if (ngpio <= 0)
 		return -EINVAL;
 
 	size = struct_size(glm, gpio_mux_states, ngpio);