--- /dev/null
+From dad6e107b3cd9d20514e7799b7ad8674f81e3f30 Mon Sep 17 00:00:00 2001
+From: Benjamin Boortz <bennib@mailbox.org>
+Date: Mon, 20 Jul 2026 19:51:04 +0200
+Subject: pinctrl: bm1880: add missing select GENERIC_PINCONF
+
+From: Benjamin Boortz <bennib@mailbox.org>
+
+commit dad6e107b3cd9d20514e7799b7ad8674f81e3f30 upstream.
+
+drivers/pinctrl/pinctrl-bm1880.c initialises its pinconf_ops with
+.is_generic = true, but that field is only present when
+CONFIG_GENERIC_PINCONF is enabled (guarded by #ifdef in pinconf.h).
+The Kconfig entry for PINCTRL_BM1880 never selects GENERIC_PINCONF,
+so any config that enables CONFIG_PINCTRL_BM1880=y without
+CONFIG_GENERIC_PINCONF=y fails to compile:
+
+ drivers/pinctrl/pinctrl-bm1880.c:1288:10: error: 'const struct pinconf_ops' has no member named 'is_generic'
+
+Found by randconfig testing on arm64; tinyconfig reproducer below.
+Add the missing select to fix the build.
+
+Fixes: 49bd61ebce5f ("pinctrl: Add pinconf support for BM1880 SoC")
+Cc: stable@vger.kernel.org
+Signed-off-by: Benjamin Boortz <bennib@mailbox.org>
+Signed-off-by: Linus Walleij <linusw@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pinctrl/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/pinctrl/Kconfig
++++ b/drivers/pinctrl/Kconfig
+@@ -132,6 +132,7 @@ config PINCTRL_BM1880
+ depends on OF && (ARCH_BITMAIN || COMPILE_TEST)
+ default ARCH_BITMAIN
+ select PINMUX
++ select GENERIC_PINCONF
+ help
+ Pinctrl driver for Bitmain BM1880 SoC.
+
--- /dev/null
+From 015b5bcbcb622b32317642be91a7f79aa5413649 Mon Sep 17 00:00:00 2001
+From: Karl Mehltretter <kmehltretter@gmail.com>
+Date: Sun, 19 Jul 2026 14:11:40 +0200
+Subject: pinctrl: devicetree: don't free uninitialized dev_name on error path
+
+From: Karl Mehltretter <kmehltretter@gmail.com>
+
+commit 015b5bcbcb622b32317642be91a7f79aa5413649 upstream.
+
+dt_remember_or_free_map() duplicates dev_name for each map entry. If
+kstrdup_const() fails, dt_free_map() frees dev_name in all num_maps
+entries, including entries that have not been initialized.
+
+Some pinctrl drivers, including pinctrl-imx, allocate the map with
+kmalloc() and leave dev_name for the core to initialize. The untouched
+entries therefore contain uninitialized data which is passed to
+kfree_const().
+
+Reproduced on qemu's mcimx6ul-evk (pinctrl-imx) with failslab injection
+while binding the pinctrl-consuming device, under KASAN:
+
+ BUG: KASAN: double-free in dt_free_map+0x34/0xa4
+ Free of addr c425a900 by task init/1
+ kfree from dt_free_map+0x34/0xa4
+ dt_free_map from dt_remember_or_free_map+0x184/0x198
+ dt_remember_or_free_map from pinctrl_dt_to_map+0x33c/0x4c8
+ pinctrl_dt_to_map from create_pinctrl+0x9c/0x5c0
+
+Initialize all dev_name fields to NULL before duplicating the device
+name, making the full-map cleanup safe after a partial failure.
+
+Fixes: be4c60b563ed ("pinctrl: devicetree: Avoid taking direct reference to device name string")
+Cc: stable@vger.kernel.org
+Assisted-by: Claude:claude-fable-5
+Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
+Signed-off-by: Linus Walleij <linusw@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pinctrl/devicetree.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/pinctrl/devicetree.c
++++ b/drivers/pinctrl/devicetree.c
+@@ -69,6 +69,10 @@ static int dt_remember_or_free_map(struc
+ int i;
+ struct pinctrl_dt_map *dt_map;
+
++ /* Initialize dev_name before any allocation can fail */
++ for (i = 0; i < num_maps; i++)
++ map[i].dev_name = NULL;
++
+ /* Initialize common mapping table entry fields */
+ for (i = 0; i < num_maps; i++) {
+ const char *devname;
--- /dev/null
+From 25cb6e9a13123d1039cdc75b446ac52e1ebdc26d Mon Sep 17 00:00:00 2001
+From: Benjamin Boortz <bennib@mailbox.org>
+Date: Sun, 19 Jul 2026 11:41:46 +0200
+Subject: pinctrl: microchip-sgpio: add missing select REGMAP_MMIO
+
+From: Benjamin Boortz <bennib@mailbox.org>
+
+commit 25cb6e9a13123d1039cdc75b446ac52e1ebdc26d upstream.
+
+The driver calls ocelot_regmap_from_resource() via <linux/mfd/ocelot.h>,
+which internally uses devm_regmap_init_mmio() and requires REGMAP_MMIO.
+The Kconfig entry does not select REGMAP_MMIO, causing a build failure
+when no other driver in the config happens to pull in REGMAP_MMIO:
+
+ include/linux/mfd/ocelot.h:34:24: error: implicit declaration of function 'devm_regmap_init_mmio'
+
+Found by randconfig testing on arm64; tinyconfig reproducer below.
+
+Fixes: 2afbbab45c26 ("pinctrl: microchip-sgpio: update to support regmap")
+Cc: stable@vger.kernel.org
+Signed-off-by: Benjamin Boortz <bennib@mailbox.org>
+Reviewed-by: Andy Shevchenko <andy@kernel.org>
+Signed-off-by: Linus Walleij <linusw@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pinctrl/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/pinctrl/Kconfig
++++ b/drivers/pinctrl/Kconfig
+@@ -188,6 +188,7 @@ config PINCTRL_EQUILIBRIUM
+ select GENERIC_PINCONF
+ select GENERIC_PINCTRL_GROUPS
+ select GENERIC_PINMUX_FUNCTIONS
++ select REGMAP_MMIO
+ help
+ Equilibrium driver is a pinctrl and GPIO driver for Intel Lightning
+ Mountain network processor SoC that supports both the GPIO and pin
ipv6-fib6-fix-null-deref-in-fib6_walk_continue-on-mu.patch
af_unix-give-up-gc-if-msg_peek-intervened.patch
rhashtable-clear-stale-iter-p-on-table-restart.patch
+pinctrl-microchip-sgpio-add-missing-select-regmap_mmio.patch
+pinctrl-devicetree-don-t-free-uninitialized-dev_name-on-error-path.patch
+pinctrl-bm1880-add-missing-select-generic_pinconf.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
