From 0dd6770a72f138dabea9eae87f3da6ffa68f0d06 Mon Sep 17 00:00:00 2001 From: Chenyuan Yang Date: Sat, 11 Jan 2025 12:18:03 -0600 Subject: [PATCH 1/2] w1: fix NULL pointer dereference in probe The w1_uart_probe() function calls w1_uart_serdev_open() (which includes devm_serdev_device_open()) before setting the client ops via serdev_device_set_client_ops(). This ordering can trigger a NULL pointer dereference in the serdev controller's receive_buf handler, as it assumes serdev->ops is valid when SERPORT_ACTIVE is set. This is similar to the issue fixed in commit 5e700b384ec1 ("platform/chrome: cros_ec_uart: properly fix race condition") where devm_serdev_device_open() was called before fully initializing the device. Fix the race by ensuring client ops are set before enabling the port via w1_uart_serdev_open(). Fixes: a3c08804364e ("w1: add UART w1 bus driver") Signed-off-by: Chenyuan Yang Acked-by: Christoph Winklhofer Link: https://lore.kernel.org/r/20250111181803.2283611-1-chenyuan0y@gmail.com Signed-off-by: Krzysztof Kozlowski --- drivers/w1/masters/w1-uart.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/w1/masters/w1-uart.c b/drivers/w1/masters/w1-uart.c index a31782e56ba7..c87eea347806 100644 --- a/drivers/w1/masters/w1-uart.c +++ b/drivers/w1/masters/w1-uart.c @@ -372,11 +372,11 @@ static int w1_uart_probe(struct serdev_device *serdev) init_completion(&w1dev->rx_byte_received); mutex_init(&w1dev->rx_mutex); + serdev_device_set_drvdata(serdev, w1dev); + serdev_device_set_client_ops(serdev, &w1_uart_serdev_ops); ret = w1_uart_serdev_open(w1dev); if (ret < 0) return ret; - serdev_device_set_drvdata(serdev, w1dev); - serdev_device_set_client_ops(serdev, &w1_uart_serdev_ops); return w1_add_master_device(&w1dev->bus); } From 33c145297840dddf0dc23d5822159c26aba920d3 Mon Sep 17 00:00:00 2001 From: Huisong Li Date: Fri, 24 Jan 2025 10:26:34 +0800 Subject: [PATCH 2/2] w1: w1_therm: w1: Use HWMON_CHANNEL_INFO macro to simplify code Use HWMON_CHANNEL_INFO macro to simplify code. Signed-off-by: Huisong Li Link: https://lore.kernel.org/r/20250124022635.16647-9-lihuisong@huawei.com Signed-off-by: Krzysztof Kozlowski --- drivers/w1/slaves/w1_therm.c | 12 +----------- 1 file changed, 1 insertion(+), 11 deletions(-) diff --git a/drivers/w1/slaves/w1_therm.c b/drivers/w1/slaves/w1_therm.c index c85e80c7e130..9ccedb3264fb 100644 --- a/drivers/w1/slaves/w1_therm.c +++ b/drivers/w1/slaves/w1_therm.c @@ -444,18 +444,8 @@ static int w1_read(struct device *dev, enum hwmon_sensor_types type, } } -static const u32 w1_temp_config[] = { - HWMON_T_INPUT, - 0 -}; - -static const struct hwmon_channel_info w1_temp = { - .type = hwmon_temp, - .config = w1_temp_config, -}; - static const struct hwmon_channel_info * const w1_info[] = { - &w1_temp, + HWMON_CHANNEL_INFO(temp, HWMON_T_INPUT), NULL };