Following by the below discussion, there's the potential UAF issue
between regulator and mfd.
https://lore.kernel.org/all/20221128143601.1698148-1-yangyingliang@huawei.com/

From the analysis of Yingliang

CPU A				|CPU B
mt6370_probe()			|
  devm_mfd_add_devices()	|
				|mt6370_regulator_probe()
				|  regulator_register()
				|    //allocate init_data and add it to devres
				|    regulator_of_get_init_data()
i2c_unregister_device()		|
  device_del()			|
    devres_release_all()	|
      // init_data is freed	|
      release_nodes()		|
				|  // using init_data causes UAF
				|  regulator_register()

It's common to use mfd core to create child device for the regulator.
In order to do the DT lookup for init data, the child that registered
the regulator would pass its parent as the parameter. And this causes
init data resource allocated to its parent, not itself. The issue happen
when parent device is going to release and regulator core is still doing
some operation of init data constraint for the regulator of child device.

To fix it, this patch expand 'regulator_register' API to use the
different devices for init data allocation and DT lookup.
Reported-by: NYang Yingliang <yangyingliang@huawei.com>
Signed-off-by: NChiYuan Huang <cy_huang@richtek.com>
Link: https://lore.kernel.org/r/1670311341-32664-1-git-send-email-u0084500@gmail.comSigned-off-by: NMark Brown <broonie@kernel.org>

Several regulator schemas are missing 'unevaluatedProperties' constraint
which means any extra properties are allowed. Upon adding the
constraint, there's numerous warnings from using the deprecated
'regulator-compatible' property. Remove the usage as examples shouldn't
be using long since deprecated properties.
Signed-off-by: NRob Herring <robh@kernel.org>
Acked-by: NLee Jones <lee@kernel.org>
Acked-by: NSebastian Reichel <sebastian.reichel@collabora.com>
Acked-by: NBartosz Golaszewski <bartosz.golaszewski@linaro.org>
Link: https://lore.kernel.org/r/20221206211554.92005-1-robh@kernel.orgSigned-off-by: NMark Brown <broonie@kernel.org>

The reg_node needs to be released through of_node_put() in the error
handling path when of_irq_get_byname() failed.

Fixes: 390af53e ("regulator: qcom-labibb: Implement short-circuit and over-current IRQs")
Signed-off-by: NYuan Can <yuancan@huawei.com>
Link: https://lore.kernel.org/r/20221203062109.115043-1-yuancan@huawei.comSigned-off-by: NMark Brown <broonie@kernel.org>

Merge series from Alexandre Mergnat <amergnat@baylibre.com>:

This adds regulator support for the MT6357 PMIC.

Add regulator driver for the MT6357 PMIC.
Signed-off-by: NFabien Parent <fparent@baylibre.com>
Reviewed-by: NAngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Signed-off-by: NAlexandre Mergnat <amergnat@baylibre.com>
Link: https://lore.kernel.org/r/20221005-mt6357-support-v7-7-477e60126749@baylibre.comSigned-off-by: NMark Brown <broonie@kernel.org>

Add YAML schema for the MediaTek MT6357 regulators.
Signed-off-by: NFabien Parent <fparent@baylibre.com>
Reviewed-by: NKrzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Signed-off-by: NAlexandre Mergnat <amergnat@baylibre.com>
Link: https://lore.kernel.org/r/20221005-mt6357-support-v7-2-477e60126749@baylibre.comSigned-off-by: NMark Brown <broonie@kernel.org>

I got some resource leak reports while doing fault injection test:

  OF: ERROR: memory leak, expected refcount 1 instead of 100,
  of_node_get()/of_node_put() unbalanced - destroy cset entry:
  attach overlay node /i2c/pmic@64/regulators/buck1

unreferenced object 0xffff88810deea000 (size 512):
  comm "490-i2c-rt5190a", pid 253, jiffies 4294859840 (age 5061.046s)
  hex dump (first 32 bytes):
    00 00 00 00 ad 4e ad de ff ff ff ff 00 00 00 00  .....N..........
    ff ff ff ff ff ff ff ff a0 1e 00 a1 ff ff ff ff  ................
  backtrace:
    [<00000000d78541e2>] kmalloc_trace+0x21/0x110
    [<00000000b343d153>] device_private_init+0x32/0xd0
    [<00000000be1f0c70>] device_add+0xb2d/0x1030
    [<00000000e3e6344d>] regulator_register+0xaf2/0x12a0
    [<00000000e2f5e754>] devm_regulator_register+0x57/0xb0
    [<000000008b898197>] rt5190a_probe+0x52a/0x861 [rt5190a_regulator]

unreferenced object 0xffff88810b617b80 (size 32):
  comm "490-i2c-rt5190a", pid 253, jiffies 4294859904 (age 5060.983s)
  hex dump (first 32 bytes):
    72 65 67 75 6c 61 74 6f 72 2e 32 38 36 38 2d 53  regulator.2868-S
    55 50 50 4c 59 00 ff ff 29 00 00 00 2b 00 00 00  UPPLY...)...+...
  backtrace:
    [<000000009da9280d>] __kmalloc_node_track_caller+0x44/0x1b0
    [<0000000025c6a4e5>] kstrdup+0x3a/0x70
    [<00000000790efb69>] create_regulator+0xc0/0x4e0
    [<0000000005ed203a>] regulator_resolve_supply+0x2d4/0x440
    [<0000000045796214>] regulator_register+0x10b3/0x12a0
    [<00000000e2f5e754>] devm_regulator_register+0x57/0xb0
    [<000000008b898197>] rt5190a_probe+0x52a/0x861 [rt5190a_regulator]

After calling regulator_resolve_supply(), the 'rdev->supply' is set
by set_supply(), after this set, in the error path, the resources
need be released, so call regulator_put() to avoid the leaks.

Fixes: aea6cb99 ("regulator: resolve supply after creating regulator")
Fixes: 8a866d52 ("regulator: core: Resolve supply name earlier to prevent double-init")
Signed-off-by: NYang Yingliang <yangyingliang@huawei.com>
Link: https://lore.kernel.org/r/20221202025111.496402-1-yangyingliang@huawei.comSigned-off-by: NMark Brown <broonie@kernel.org>

If create_regulator() fails in set_supply(), the module refcount
needs be put to keep refcount balanced.

Fixes: e2c09ae7 ("regulator: core: Increase refcount for regulator supply's module")
Signed-off-by: NYang Yingliang <yangyingliang@huawei.com>
Link: https://lore.kernel.org/r/20221201122706.4055992-2-yangyingliang@huawei.comSigned-off-by: NMark Brown <broonie@kernel.org>

I found a use_count leakage towards supply regulator of rdev with
boot-on option.

┌───────────────────┐           ┌───────────────────┐
│  regulator_dev A  │           │  regulator_dev B  │
│     (boot-on)     │           │     (boot-on)     │
│    use_count=0    │◀──supply──│    use_count=1    │
│                   │           │                   │
└───────────────────┘           └───────────────────┘

In case of rdev(A) configured with `regulator-boot-on', the use_count
of supplying regulator(B) will increment inside
regulator_enable(rdev->supply).

Thus, B will acts like always-on, and further balanced
regulator_enable/disable cannot actually disable it anymore.

However, B was also configured with `regulator-boot-on', we wish it
could be disabled afterwards.
Signed-off-by: NRui Zhang <zr.zhang@vivo.com>
Link: https://lore.kernel.org/r/20221201033806.2567812-1-zr.zhang@vivo.comSigned-off-by: NMark Brown <broonie@kernel.org>

Print error message for potential EPROBE_DEFER error using
dev_err_probe, which captures the reason in
/sys/kernel/debug/devices_deferred and otherwise silences
the message.
Signed-off-by: NSebastian Reichel <sebastian.reichel@collabora.com>
Link: https://lore.kernel.org/r/20221020204251.108565-12-sebastian.reichel@collabora.comSigned-off-by: NMark Brown <broonie@kernel.org>

Reduce usage of 'struct rk808' (driver data of the parent MFD), so
that only the chip variant field is still being accessed directly.
This allows restructuring the MFD driver to support SPI based
PMICs.
Acked-by: NMark Brown <broonie@kernel.org>
Signed-off-by: NSebastian Reichel <sebastian.reichel@collabora.com>
Link: https://lore.kernel.org/r/20221020204251.108565-3-sebastian.reichel@collabora.comSigned-off-by: NMark Brown <broonie@kernel.org>

Linux 6.1-rc4 which should get my CI working on RPi3s again.

Since commit 0166dc11 ("of: make CONFIG_OF user selectable"), it
is possible to test-build any driver which depends on OF on any
architecture by explicitly selecting OF. Therefore depending on
COMPILE_TEST as an alternative is no longer needed.

It is actually better to always build such drivers with OF enabled,
so that the test builds are closer to how each driver will actually be
built on its intended target. Building them without OF may not test
much as the compiler will optimize out potentially large parts of the
code. In the worst case, this could even pop false positive warnings.
Dropping COMPILE_TEST here improves the quality of our testing and
avoids wasting time on non-existent issues.

As a minor optimization, this also lets us drop several occurrences of
of_match_ptr(), __maybe_unused and some ifdef guarding, as we now know
what all of this will resolve to, we might as well save cpp some work.
Signed-off-by: NJean Delvare <jdelvare@suse.de>
Cc: Liam Girdwood <lgirdwood@gmail.com>
Cc: Mark Brown <broonie@kernel.org>
Cc: Icenowy Zheng <icenowy@aosc.io>
Link: https://lore.kernel.org/r/20221124144708.64371b98@endymion.delvareSigned-off-by: NMark Brown <broonie@kernel.org>

.probe_new() doesn't get the i2c_device_id * parameter, so determine
that explicitly in the probe function.
Signed-off-by: NUwe Kleine-König <u.kleine-koenig@pengutronix.de>
Acked-for-MFD-by: NLee Jones <lee@kernel.org>
Acked-for-Backlight-by: NLee Jones <lee@kernel.org>
Link: https://lore.kernel.org/r/20221118224540.619276-555-uwe@kleine-koenig.orgSigned-off-by: NMark Brown <broonie@kernel.org>

.probe_new() doesn't get the i2c_device_id * parameter, so determine
that explicitly in the probe function.
Signed-off-by: NUwe Kleine-König <u.kleine-koenig@pengutronix.de>
Acked-for-MFD-by: NLee Jones <lee@kernel.org>
Acked-for-Backlight-by: NLee Jones <lee@kernel.org>
Link: https://lore.kernel.org/r/20221118224540.619276-554-uwe@kleine-koenig.orgSigned-off-by: NMark Brown <broonie@kernel.org>

.probe_new() doesn't get the i2c_device_id * parameter, so determine
that explicitly in the probe function.
Signed-off-by: NUwe Kleine-König <u.kleine-koenig@pengutronix.de>
Acked-for-MFD-by: NLee Jones <lee@kernel.org>
Acked-for-Backlight-by: NLee Jones <lee@kernel.org>
Link: https://lore.kernel.org/r/20221118224540.619276-543-uwe@kleine-koenig.orgSigned-off-by: NMark Brown <broonie@kernel.org>

.probe_new() doesn't get the i2c_device_id * parameter, so determine
that explicitly in the probe function.
Signed-off-by: NUwe Kleine-König <u.kleine-koenig@pengutronix.de>
Acked-for-MFD-by: NLee Jones <lee@kernel.org>
Acked-for-Backlight-by: NLee Jones <lee@kernel.org>
Link: https://lore.kernel.org/r/20221118224540.619276-542-uwe@kleine-koenig.orgSigned-off-by: NMark Brown <broonie@kernel.org>

.probe_new() doesn't get the i2c_device_id * parameter, so determine
that explicitly in the probe function.
Signed-off-by: NUwe Kleine-König <u.kleine-koenig@pengutronix.de>
Acked-for-MFD-by: NLee Jones <lee@kernel.org>
Acked-for-Backlight-by: NLee Jones <lee@kernel.org>
Link: https://lore.kernel.org/r/20221118224540.619276-539-uwe@kleine-koenig.orgSigned-off-by: NMark Brown <broonie@kernel.org>

Merge series from Abel Vesa <abel.vesa@linaro.org>:

This patchset adds regulator support for the new Qualcomm PM8550 PMIC.

Merge series from Matti Vaittinen <mazziesaccount@gmail.com>:

Minor (printing) improvements for ROHM regulator drivers.

This series:

 - Drops an unnecessary info print from bd718x7.
   (Added a fixes tag for this but not really sure if worth
   adding to stable)
 - Convert the ROHM BDxxxxx PMIC regulator drivers to use dev_err_probe().
 - Change the probe logic for bd718x7 to favor the more usual devm-style
   where errors are returned immediately.

Add the rpmh regulators found in PM8550 PMIC and its variants,
along with their compatibles and configuration data. They also
contain some FT-SMPS 525, so add their configuration as well.
Signed-off-by: NAbel Vesa <abel.vesa@linaro.org>
Reviewed-by: NKonrad Dybcio <konrad.dybcio@linaro.org>
Link: https://lore.kernel.org/r/20221123153638.721254-3-abel.vesa@linaro.orgSigned-off-by: NMark Brown <broonie@kernel.org>

Add compatible string for PM8550 used in SM8550 boards.
Signed-off-by: NAbel Vesa <abel.vesa@linaro.org>
Link: https://lore.kernel.org/r/20221123153638.721254-2-abel.vesa@linaro.orgSigned-off-by: NMark Brown <broonie@kernel.org>

.probe_new() doesn't get the i2c_device_id * parameter, so determine
that explicitly in the probe function.
Signed-off-by: NUwe Kleine-König <u.kleine-koenig@pengutronix.de>
Acked-for-MFD-by: NLee Jones <lee@kernel.org>
Acked-for-Backlight-by: NLee Jones <lee@kernel.org>
Link: https://lore.kernel.org/r/20221118224540.619276-560-uwe@kleine-koenig.orgSigned-off-by: NMark Brown <broonie@kernel.org>

.probe_new() doesn't get the i2c_device_id * parameter, so determine
that explicitly in the probe function.
Signed-off-by: NUwe Kleine-König <u.kleine-koenig@pengutronix.de>
Acked-for-MFD-by: NLee Jones <lee@kernel.org>
Acked-for-Backlight-by: NLee Jones <lee@kernel.org>
Link: https://lore.kernel.org/r/20221118224540.619276-558-uwe@kleine-koenig.orgSigned-off-by: NMark Brown <broonie@kernel.org>

.probe_new() doesn't get the i2c_device_id * parameter, so determine
that explicitly in the probe function.
Signed-off-by: NUwe Kleine-König <u.kleine-koenig@pengutronix.de>
Acked-for-MFD-by: NLee Jones <lee@kernel.org>
Acked-for-Backlight-by: NLee Jones <lee@kernel.org>
Link: https://lore.kernel.org/r/20221118224540.619276-552-uwe@kleine-koenig.orgSigned-off-by: NMark Brown <broonie@kernel.org>

.probe_new() doesn't get the i2c_device_id * parameter, so determine
that explicitly in the probe function.
Signed-off-by: NUwe Kleine-König <u.kleine-koenig@pengutronix.de>
Acked-for-MFD-by: NLee Jones <lee@kernel.org>
Acked-for-Backlight-by: NLee Jones <lee@kernel.org>
Link: https://lore.kernel.org/r/20221118224540.619276-550-uwe@kleine-koenig.orgSigned-off-by: NMark Brown <broonie@kernel.org>

.probe_new() doesn't get the i2c_device_id * parameter, so determine
that explicitly in the probe function.
Signed-off-by: NUwe Kleine-König <u.kleine-koenig@pengutronix.de>
Acked-for-MFD-by: NLee Jones <lee@kernel.org>
Acked-for-Backlight-by: NLee Jones <lee@kernel.org>
Link: https://lore.kernel.org/r/20221118224540.619276-547-uwe@kleine-koenig.orgSigned-off-by: NMark Brown <broonie@kernel.org>

.probe_new() doesn't get the i2c_device_id * parameter, so determine
that explicitly in the probe function.
Signed-off-by: NUwe Kleine-König <u.kleine-koenig@pengutronix.de>
Acked-for-MFD-by: NLee Jones <lee@kernel.org>
Acked-for-Backlight-by: NLee Jones <lee@kernel.org>
Link: https://lore.kernel.org/r/20221118224540.619276-545-uwe@kleine-koenig.orgSigned-off-by: NMark Brown <broonie@kernel.org>

.probe_new() doesn't get the i2c_device_id * parameter, so determine
that explicitly in the probe function.
Signed-off-by: NUwe Kleine-König <u.kleine-koenig@pengutronix.de>
Acked-by: NMichael Hennerich <michael.hennerich@analog.com>
Acked-for-MFD-by: NLee Jones <lee@kernel.org>
Acked-for-Backlight-by: NLee Jones <lee@kernel.org>
Link: https://lore.kernel.org/r/20221118224540.619276-540-uwe@kleine-koenig.orgSigned-off-by: NMark Brown <broonie@kernel.org>

Use kfree_const() to free supply_name conditionally in create_regulator()
as supply_name may be allocated from kmalloc() or directly from .rodata
section.

Fixes: 87fe29b6 ("regulator: push allocations in create_regulator() outside of lock")
Signed-off-by: NWang ShaoBo <bobo.shaobowang@huawei.com>
Link: https://lore.kernel.org/r/20221123034616.3609537-1-bobo.shaobowang@huawei.comSigned-off-by: NMark Brown <broonie@kernel.org>

The dev_err_probe() has (at least) following benefits over dev_err()
when printing an error print for a failed function call at a device
driver probe:
        - Omit error level print if error is 'EPRBE_DEFER'
        - Standardized print format for returned error
        - return the error value allowing shortening calls like:

        if (ret) {
                dev_err(...);
                return ret;
        }

        to

        if (ret)
                return dev_err_probe(...);

Convert the ROHM BD718x7 regulator driver to use the dev_err_probe() when
returned error is not hard-coded constant.

NOTE:
This commit also changes the error handling path to return immediately
from a spot where the error is spotted instead of using a single point
of exit.
Signed-off-by: NMatti Vaittinen <mazziesaccount@gmail.com>
Link: https://lore.kernel.org/r/fee54c2d04bb41b51381e31523f9ed31575206d2.1669203610.git.mazziesaccount@gmail.comSigned-off-by: NMark Brown <broonie@kernel.org>

The dev_err_probe() has (at least) following benefits over dev_err()
when printing an error print for a failed function call at a device
driver probe:
        - Omit error level print if error is 'EPRBE_DEFER'
        - Standardized print format for returned error
        - return the error value allowing shortening calls like:

        if (ret) {
                dev_err(...);
                return ret;
        }

        to

        if (ret)
                return dev_err_probe(...);

Convert the ROHM BD71828, ROHM BD71815 and ROHM BD9576 regulator drivers
to use the dev_err_probe() when returned error is not hard-coded constant.
Signed-off-by: NMatti Vaittinen <mazziesaccount@gmail.com>
Link: https://lore.kernel.org/r/0b644da4a8f58558ffe474d2593f85c46de2f965.1669203610.git.mazziesaccount@gmail.comSigned-off-by: NMark Brown <broonie@kernel.org>

A device-tree node name was printed when bd718x7 driver's feedback-loop
feature was developed. This print was accidentally left in driver. The
info-level print just pollutes the log.

Drop unnecessary pr_info()

Fixes: d2ad9811 ("regulator: bd718x7: Support external connection to scale voltages")
Signed-off-by: NMatti Vaittinen <mazziesaccount@gmail.com>
Link: https://lore.kernel.org/r/33fd99abf2451999938fef4ba6cf7b3f19e9b992.1669203610.git.mazziesaccount@gmail.comSigned-off-by: NMark Brown <broonie@kernel.org>

Merge branch 'i2c/client_device_id_helper-immutable' of https://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux into regulator-6.2

so we can apply I2C API fixups.

The probe function doesn't make use of the i2c_device_id * parameter so it
can be trivially converted.
Signed-off-by: NUwe Kleine-König <u.kleine-koenig@pengutronix.de>
Acked-for-MFD-by: NLee Jones <lee@kernel.org>
Acked-for-Backlight-by: NLee Jones <lee@kernel.org>
Link: https://lore.kernel.org/r/20221118224540.619276-559-uwe@kleine-koenig.orgSigned-off-by: NMark Brown <broonie@kernel.org>

The probe function doesn't make use of the i2c_device_id * parameter so it
can be trivially converted.
Signed-off-by: NUwe Kleine-König <u.kleine-koenig@pengutronix.de>
Acked-for-MFD-by: NLee Jones <lee@kernel.org>
Acked-for-Backlight-by: NLee Jones <lee@kernel.org>
Link: https://lore.kernel.org/r/20221118224540.619276-557-uwe@kleine-koenig.orgSigned-off-by: NMark Brown <broonie@kernel.org>

The probe function doesn't make use of the i2c_device_id * parameter so it
can be trivially converted.
Signed-off-by: NUwe Kleine-König <u.kleine-koenig@pengutronix.de>
Acked-for-MFD-by: NLee Jones <lee@kernel.org>
Acked-for-Backlight-by: NLee Jones <lee@kernel.org>
Link: https://lore.kernel.org/r/20221118224540.619276-556-uwe@kleine-koenig.orgSigned-off-by: NMark Brown <broonie@kernel.org>

The probe function doesn't make use of the i2c_device_id * parameter so it
can be trivially converted.
Signed-off-by: NUwe Kleine-König <u.kleine-koenig@pengutronix.de>
Acked-for-MFD-by: NLee Jones <lee@kernel.org>
Acked-for-Backlight-by: NLee Jones <lee@kernel.org>
Link: https://lore.kernel.org/r/20221118224540.619276-553-uwe@kleine-koenig.orgSigned-off-by: NMark Brown <broonie@kernel.org>

The probe function doesn't make use of the i2c_device_id * parameter so it
can be trivially converted.
Signed-off-by: NUwe Kleine-König <u.kleine-koenig@pengutronix.de>
Acked-for-MFD-by: NLee Jones <lee@kernel.org>
Acked-for-Backlight-by: NLee Jones <lee@kernel.org>
Link: https://lore.kernel.org/r/20221118224540.619276-551-uwe@kleine-koenig.orgSigned-off-by: NMark Brown <broonie@kernel.org>

The probe function doesn't make use of the i2c_device_id * parameter so it
can be trivially converted.
Signed-off-by: NUwe Kleine-König <u.kleine-koenig@pengutronix.de>
Acked-for-MFD-by: NLee Jones <lee@kernel.org>
Acked-for-Backlight-by: NLee Jones <lee@kernel.org>
Link: https://lore.kernel.org/r/20221118224540.619276-549-uwe@kleine-koenig.orgSigned-off-by: NMark Brown <broonie@kernel.org>