summaryrefslogtreecommitdiffstats
path: root/drivers/power/supply
AgeCommit message (Collapse)AuthorLines
2026-02-21Convert 'alloc_flex' family to use the new default GFP_KERNEL argumentLinus Torvalds-2/+2
This is the exact same thing as the 'alloc_obj()' version, only much smaller because there are a lot fewer users of the *alloc_flex() interface. As with alloc_obj() version, this was done entirely with mindless brute force, using the same script, except using 'flex' in the pattern rather than 'objs*'. Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2026-02-21Convert 'alloc_obj' family to use the new default GFP_KERNEL argumentLinus Torvalds-3/+3
This was done entirely with mindless brute force, using git grep -l '\<k[vmz]*alloc_objs*(.*, GFP_KERNEL)' | xargs sed -i 's/\(alloc_objs*(.*\), GFP_KERNEL)/\1)/' to convert the new alloc_obj() users that had a simple GFP_KERNEL argument to just drop that argument. Note that due to the extreme simplicity of the scripting, any slightly more complex cases spread over multiple lines would not be triggered: they definitely exist, but this covers the vast bulk of the cases, and the resulting diff is also then easier to check automatically. For the same reason the 'flex' versions will be done as a separate conversion. Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2026-02-21treewide: Replace kmalloc with kmalloc_obj for non-scalar typesKees Cook-6/+5
This is the result of running the Coccinelle script from scripts/coccinelle/api/kmalloc_objs.cocci. The script is designed to avoid scalar types (which need careful case-by-case checking), and instead replace kmalloc-family calls that allocate struct or union object instances: Single allocations: kmalloc(sizeof(TYPE), ...) are replaced with: kmalloc_obj(TYPE, ...) Array allocations: kmalloc_array(COUNT, sizeof(TYPE), ...) are replaced with: kmalloc_objs(TYPE, COUNT, ...) Flex array allocations: kmalloc(struct_size(PTR, FAM, COUNT), ...) are replaced with: kmalloc_flex(*PTR, FAM, COUNT, ...) (where TYPE may also be *VAR) The resulting allocations no longer return "void *", instead returning "TYPE *". Signed-off-by: Kees Cook <kees@kernel.org>
2026-01-30power: supply: bd71828: Use dev_err_probe()Matti Vaittinen-6/+3
The driver uses separate error printing and error returning at probe() for locations where the error value is hard-coded and can't be EPROBE_DEFER. This helps to omit the extra return value check which is done in dev_err_probe(). Using the dev_err_probe() has some other benefits besides handling the -EPROBE_DEFER though, like standardizing the print for error numbers. Some believe thes outweigh the benefit of skipping the extra check. Use dev_err_probe() consistently in the bd71828 power-supply probe. Signed-off-by: Matti Vaittinen <mazziesaccount@gmail.com> Link: https://patch.msgid.link/aWi_GG74sZRfajA_@mva-rohm Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-01-30Merge tag 'ib-mfd-clk-gpio-power-regulator-rtc-v6.20' into psy-nextSebastian Reichel-31/+129
Merge immutable branch between MFD, Clk, GPIO, Power, Regulator and RTC due for the v6.20 merge window to apply further cleanups on top of the BD72720 power-supply driver contained in this branch. Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-01-30power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymerVal Packett-1/+2
On the Dell Latitude 7455, the firmware uses "LiP" with a lowercase 'i' for the battery chemistry type, but only all-uppercase "LIP" was being recognized. Add the CamelCase variant to the check to fix the "Unknown battery technology" warning. Fixes: 202ac22b8e2e ("power: supply: qcom_battmgr: Add lithium-polymer entry") Signed-off-by: Val Packett <val@packett.cool> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Link: https://patch.msgid.link/20260120235831.479038-1-val@packett.cool Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-01-30power: supply: wm97xx: Use devm_power_supply_register()Waqar Hameed-12/+4
Instead of handling the registration manually, use the automatic `devres` variant `devm_power_supply_register()`. This is less error prone and cleaner. Signed-off-by: Waqar Hameed <waqar.hameed@axis.com> Link: https://patch.msgid.link/b0b366d302f0605c8555dd68ed32973959f133bb.1769158280.git.waqar.hameed@axis.com Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-01-30power: supply: wm97xx: Use devm_kcalloc()Waqar Hameed-11/+5
Instead of handling the memory allocation manually, use the automatic `devres` variant `devm_kcalloc()`. This is less error prone and eliminates the `goto`-path. Signed-off-by: Waqar Hameed <waqar.hameed@axis.com> Link: https://patch.msgid.link/5ac93f5b0fa417bb5d9e93b9302a18f2c04d4077.1769158280.git.waqar.hameed@axis.com Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-01-30power: supply: pm8916_lbc: Fix use-after-free for extcon in IRQ handlerWaqar Hameed-5/+5
Using the `devm_` variant for requesting IRQ _before_ the `devm_` variant for allocating/registering the `extcon` handle, means that the `extcon` handle will be deallocated/unregistered _before_ the interrupt handler (since `devm_` naturally deallocates in reverse allocation order). This means that during removal, there is a race condition where an interrupt can fire just _after_ the `extcon` handle has been freed, *but* just _before_ the corresponding unregistration of the IRQ handler has run. This will lead to the IRQ handler calling `extcon_set_state_sync()` with a freed `extcon` handle. Which usually crashes the system or otherwise silently corrupts the memory... Fix this racy use-after-free by making sure the IRQ is requested _after_ the registration of the `extcon` handle. Fixes: f8d7a3d21160 ("power: supply: Add driver for pm8916 lbc") Signed-off-by: Waqar Hameed <waqar.hameed@axis.com> Reviewed-by: Nikita Travkin <nikita@trvn.ru> Link: https://patch.msgid.link/e2a4cd2fcd42b6cd97d856c17c097289a2aed393.1769163273.git.waqar.hameed@axis.com Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-01-13power: supply: bd71828-power: Support ROHM BD72720Matti Vaittinen-18/+116
The ROHM BD72720 is a power management IC with a charger and coulomb counter block which is closely related to the charger / coulomb counter found from the BD71815, BD71828, BD71879 which are all supported by the bd71828-power driver. Due to the similarities it makes sense to support also the BD72720 with the same driver. Add basic support for the charger logic on ROHM BD72720. Signed-off-by: Matti Vaittinen <mazziesaccount@gmail.com> Link: https://patch.msgid.link/fb74c0cab3dfe534135d26dbbb9c66699678c2de.1765804226.git.mazziesaccount@gmail.com Signed-off-by: Lee Jones <lee@kernel.org>
2026-01-13power: supply: bd71828: Support wider register addressesMatti Vaittinen-13/+13
The BD71828 power-supply driver assumes register addresses to be 8-bit. The new BD72720 will use stacked register maps to hide paging which is done using secondary I2C slave address. This requires use of 9-bit register addresses in the power-supply driver (added offset 0x100 to the 8-bit hardware register addresses). The cost is slightly used memory consumption as the members in the struct pwr_regs will be changed from u8 to unsigned int, which means 3 byte increase / member / instance. This is currently 14 members (expected to possibly be increased when adding new variants / new functionality which may introduce new registers, but not expected to grow much) and 2 instances (will be 3 instances when BD72720 gets added). So, even if the number of registers grew to 50 it'd be 150 bytes / instance. Assuming we eventually supported 5 variants, it'd be 5 * 150 bytes, which stays very reasonable considering systems we are dealing with. As a side note, we can reduce the "wasted space / member / instance" from 3 bytes to 1 byte, by using u16 instead of the unsigned int if needed. I rather use unsigned int to be initially prepared for devices with 32 bit registers if there is no need to count bytes. Signed-off-by: Matti Vaittinen <mazziesaccount@gmail.com> Reviewed-by: Sebastian Reichel <sebastian.reichel@collabora.com> Link: https://patch.msgid.link/57c87f7e2082a666f0adeafcd11f673c0af7d326.1765804226.git.mazziesaccount@gmail.com Signed-off-by: Lee Jones <lee@kernel.org>
2026-01-12power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed()Waqar Hameed-15/+19
In `probe()`, `request_irq()` is called before allocating/registering a `power_supply` handle. If an interrupt is fired between the call to `request_irq()` and `power_supply_register()`, the `power_supply` handle will be used uninitialized in `power_supply_changed()` in `wm97xx_bat_update()` (triggered from the interrupt handler). This will lead to a `NULL` pointer dereference since Fix this racy `NULL` pointer dereference by making sure the IRQ is requested _after_ the registration of the `power_supply` handle. Since the IRQ is the last thing requests in the `probe()` now, remove the error path for freeing it. Instead add one for unregistering the `power_supply` handle when IRQ request fails. Fixes: 7c87942aef52 ("wm97xx_battery: Use irq to detect charger state") Signed-off-by: Waqar Hameed <waqar.hameed@axis.com> Link: https://patch.msgid.link/97b55f0479a932eea7213844bf66f28a974e27a2.1766270196.git.waqar.hameed@axis.com Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-01-12power: supply: ab8500_chargalg: improve kernel-docRandy Dunlap-6/+9
Correct "bad line" warnings and add descriptions for missing entries to avoid these warnings: ab8500_chargalg.c:173: warning: bad line: is set ab8500_chargalg.c:179: warning: bad line: increased ab8500_chargalg.c:247: warning: Function parameter or struct member 't_hyst_norm' not described in 'ab8500_chargalg' ab8500_chargalg.c:247: warning: Function parameter or struct member 't_hyst_lowhigh' not described in 'ab8500_chargalg' ab8500_chargalg.c:247: warning: Function parameter or struct member 'ccm' not described in 'ab8500_chargalg' ab8500_chargalg.c:247: warning: Function parameter or struct member 'ac_chg' not described in 'ab8500_chargalg' ab8500_chargalg.c:247: warning: Function parameter or struct member 'usb_chg' not described in 'ab8500_chargalg' ab8500_chargalg.c:308: warning: Function parameter or struct member 'state' not described in 'ab8500_chargalg_state_to' ab8500_chargalg.c:773: warning: Function parameter or struct member 'di' not described in 'ab8500_chargalg_chg_curr_maxim' Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Reviewed-by: Linus Walleij <linus.walleij@linaro.org> Link: https://patch.msgid.link/20251111060009.1959425-1-rdunlap@infradead.org Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-01-12power: supply: sysfs: Constify pointer passed to dev_attr_psp()Krzysztof Kozlowski-3/+3
Memory pointer by pointer passed to dev_attr_psp() is not modified, so with help of container_of_const() (preferred than container_of()) can be made pointer to const for code safety. Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Link: https://patch.msgid.link/20251126171859.72465-2-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-01-12power: supply: bq27xxx: fix wrong errno when bus ops are unsupportedHaotian Zhang-3/+3
bq27xxx_write(), bq27xxx_read_block(), and bq27xxx_write_block() return -EPERM when the bus callback pointer is NULL. A NULL callback indicates the operation is not supported by the bus/driver, not that permission is denied. Return -EOPNOTSUPP instead of -EPERM when di->bus.write/ read_bulk/write_bulk is NULL. Fixes: 14073f6614f6 ("power: supply: bq27xxx: Add bulk transfer bus methods") Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn> Reviewed-by: Matt Ranostay <matt@ranostay.sg> Link: https://patch.msgid.link/20251204083436.1367-1-vulab@iscas.ac.cn Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-01-12power: supply: sbs-battery: Fix use-after-free in power_supply_changed()Waqar Hameed-18/+18
Using the `devm_` variant for requesting IRQ _before_ the `devm_` variant for allocating/registering the `power_supply` handle, means that the `power_supply` handle will be deallocated/unregistered _before_ the interrupt handler (since `devm_` naturally deallocates in reverse allocation order). This means that during removal, there is a race condition where an interrupt can fire just _after_ the `power_supply` handle has been freed, *but* just _before_ the corresponding unregistration of the IRQ handler has run. This will lead to the IRQ handler calling `power_supply_changed()` with a freed `power_supply` handle. Which usually crashes the system or otherwise silently corrupts the memory... Note that there is a similar situation which can also happen during `probe()`; the possibility of an interrupt firing _before_ registering the `power_supply` handle. This would then lead to the nasty situation of using the `power_supply` handle *uninitialized* in `power_supply_changed()`. Fix this racy use-after-free by making sure the IRQ is requested _after_ the registration of the `power_supply` handle. Keep the old behavior of just printing a warning in case of any failures during the IRQ request and finishing the probe successfully. Fixes: d2cec82c2880 ("power: sbs-battery: Request threaded irq and fix dev callback cookie") Signed-off-by: Waqar Hameed <waqar.hameed@axis.com> Reviewed-by: Phil Reid <preid@electromag.com.au> Link: https://patch.msgid.link/0ef896e002495e615157b482d18a437af19ddcd0.1766268280.git.waqar.hameed@axis.com Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-01-12power: supply: rt9455: Fix use-after-free in power_supply_changed()Waqar Hameed-8/+9
Using the `devm_` variant for requesting IRQ _before_ the `devm_` variant for allocating/registering the `power_supply` handle, means that the `power_supply` handle will be deallocated/unregistered _before_ the interrupt handler (since `devm_` naturally deallocates in reverse allocation order). This means that during removal, there is a race condition where an interrupt can fire just _after_ the `power_supply` handle has been freed, *but* just _before_ the corresponding unregistration of the IRQ handler has run. This will lead to the IRQ handler calling `power_supply_changed()` with a freed `power_supply` handle. Which usually crashes the system or otherwise silently corrupts the memory... Note that there is a similar situation which can also happen during `probe()`; the possibility of an interrupt firing _before_ registering the `power_supply` handle. This would then lead to the nasty situation of using the `power_supply` handle *uninitialized* in `power_supply_changed()`. Fix this racy use-after-free by making sure the IRQ is requested _after_ the registration of the `power_supply` handle. Fixes: e86d69dd786e ("power_supply: Add support for Richtek RT9455 battery charger") Signed-off-by: Waqar Hameed <waqar.hameed@axis.com> Link: https://patch.msgid.link/1567d831e04c3e2fcb9e18dd36b7bcba4634581a.1766268280.git.waqar.hameed@axis.com Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-01-12power: supply: pm8916_lbc: Fix use-after-free in power_supply_changed()Waqar Hameed-9/+9
Using the `devm_` variant for requesting IRQ _before_ the `devm_` variant for allocating/registering the `power_supply` handle, means that the `power_supply` handle will be deallocated/unregistered _before_ the interrupt handler (since `devm_` naturally deallocates in reverse allocation order). This means that during removal, there is a race condition where an interrupt can fire just _after_ the `power_supply` handle has been freed, *but* just _before_ the corresponding unregistration of the IRQ handler has run. This will lead to the IRQ handler calling `power_supply_changed()` with a freed `power_supply` handle. Which usually crashes the system or otherwise silently corrupts the memory... Note that there is a similar situation which can also happen during `probe()`; the possibility of an interrupt firing _before_ registering the `power_supply` handle. This would then lead to the nasty situation of using the `power_supply` handle *uninitialized* in `power_supply_changed()`. Fix this racy use-after-free by making sure the IRQ is requested _after_ the registration of the `power_supply` handle. Fixes: f8d7a3d21160 ("power: supply: Add driver for pm8916 lbc") Signed-off-by: Waqar Hameed <waqar.hameed@axis.com> Reviewed-by: Nikita Travkin <nikita@trvn.ru> Link: https://patch.msgid.link/64d8dd3675a4e59fa32c3e0ef451f12d1f7ed18f.1766268280.git.waqar.hameed@axis.com Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-01-12power: supply: pm8916_bms_vm: Fix use-after-free in power_supply_changed()Waqar Hameed-9/+9
Using the `devm_` variant for requesting IRQ _before_ the `devm_` variant for allocating/registering the `power_supply` handle, means that the `power_supply` handle will be deallocated/unregistered _before_ the interrupt handler (since `devm_` naturally deallocates in reverse allocation order). This means that during removal, there is a race condition where an interrupt can fire just _after_ the `power_supply` handle has been freed, *but* just _before_ the corresponding unregistration of the IRQ handler has run. This will lead to the IRQ handler calling `power_supply_changed()` with a freed `power_supply` handle. Which usually crashes the system or otherwise silently corrupts the memory... Note that there is a similar situation which can also happen during `probe()`; the possibility of an interrupt firing _before_ registering the `power_supply` handle. This would then lead to the nasty situation of using the `power_supply` handle *uninitialized* in `power_supply_changed()`. Fix this racy use-after-free by making sure the IRQ is requested _after_ the registration of the `power_supply` handle. Fixes: 098bce1838e0 ("power: supply: Add pm8916 VM-BMS support") Signed-off-by: Waqar Hameed <waqar.hameed@axis.com> Reviewed-by: Nikita Travkin <nikita@trvn.ru> Link: https://patch.msgid.link/2749c09ff81fcac87ae48147e216135450d8c067.1766268280.git.waqar.hameed@axis.com Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-01-12power: supply: pf1550: Fix use-after-free in power_supply_changed()Waqar Hameed-16/+16
Using the `devm_` variant for requesting IRQ _before_ the `devm_` variant for allocating/registering the `power_supply` handle, means that the `power_supply` handle will be deallocated/unregistered _before_ the interrupt handler (since `devm_` naturally deallocates in reverse allocation order). This means that during removal, there is a race condition where an interrupt can fire just _after_ the `power_supply` handle has been freed, *but* just _before_ the corresponding unregistration of the IRQ handler has run. This will lead to the IRQ handler calling `power_supply_changed()` with a freed `power_supply` handle. Which usually crashes the system or otherwise silently corrupts the memory... Note that there is a similar situation which can also happen during `probe()`; the possibility of an interrupt firing _before_ registering the `power_supply` handle. This would then lead to the nasty situation of using the `power_supply` handle *uninitialized* in `power_supply_changed()`. Fix this racy use-after-free by making sure the IRQ is requested _after_ the registration of the `power_supply` handle. Fixes: 4b6b6433a97d ("power: supply: pf1550: add battery charger support") Signed-off-by: Waqar Hameed <waqar.hameed@axis.com> Reviewed-by: Samuel Kayode <samkay014@gmail.com> Link: https://patch.msgid.link/ae5a71b7e4dd2967d8fdcc531065cc71b17c86f5.1766268280.git.waqar.hameed@axis.com Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-01-12power: supply: goldfish: Fix use-after-free in power_supply_changed()Waqar Hameed-6/+6
Using the `devm_` variant for requesting IRQ _before_ the `devm_` variant for allocating/registering the `power_supply` handle, means that the `power_supply` handle will be deallocated/unregistered _before_ the interrupt handler (since `devm_` naturally deallocates in reverse allocation order). This means that during removal, there is a race condition where an interrupt can fire just _after_ the `power_supply` handle has been freed, *but* just _before_ the corresponding unregistration of the IRQ handler has run. This will lead to the IRQ handler calling `power_supply_changed()` with a freed `power_supply` handle. Which usually crashes the system or otherwise silently corrupts the memory... Note that there is a similar situation which can also happen during `probe()`; the possibility of an interrupt firing _before_ registering the `power_supply` handle. This would then lead to the nasty situation of using the `power_supply` handle *uninitialized* in `power_supply_changed()`. Fix this racy use-after-free by making sure the IRQ is requested _after_ the registration of the `power_supply` handle. Fixes: 84d7b7687489 ("power: Add battery driver for goldfish emulator") Signed-off-by: Waqar Hameed <waqar.hameed@axis.com> Link: https://patch.msgid.link/500a606bb6fb6f2bb8d797e19a00cea9dd7b03c1.1766268280.git.waqar.hameed@axis.com Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-01-12power: supply: cpcap-battery: Fix use-after-free in power_supply_changed()Waqar Hameed-4/+4
Using the `devm_` variant for requesting IRQ _before_ the `devm_` variant for allocating/registering the `power_supply` handle, means that the `power_supply` handle will be deallocated/unregistered _before_ the interrupt handler (since `devm_` naturally deallocates in reverse allocation order). This means that during removal, there is a race condition where an interrupt can fire just _after_ the `power_supply` handle has been freed, *but* just _before_ the corresponding unregistration of the IRQ handler has run. This will lead to the IRQ handler calling `power_supply_changed()` with a freed `power_supply` handle. Which usually crashes the system or otherwise silently corrupts the memory... Note that there is a similar situation which can also happen during `probe()`; the possibility of an interrupt firing _before_ registering the `power_supply` handle. This would then lead to the nasty situation of using the `power_supply` handle *uninitialized* in `power_supply_changed()`. Fix this racy use-after-free by making sure the IRQ is requested _after_ the registration of the `power_supply` handle. Fixes: 874b2adbed12 ("power: supply: cpcap-battery: Add a battery driver") Signed-off-by: Waqar Hameed <waqar.hameed@axis.com> Link: https://patch.msgid.link/81db58d610c9a51a68184f856cd431a934cccee2.1766268280.git.waqar.hameed@axis.com Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-01-12power: supply: bq25980: Fix use-after-free in power_supply_changed()Waqar Hameed-6/+6
Using the `devm_` variant for requesting IRQ _before_ the `devm_` variant for allocating/registering the `power_supply` handle, means that the `power_supply` handle will be deallocated/unregistered _before_ the interrupt handler (since `devm_` naturally deallocates in reverse allocation order). This means that during removal, there is a race condition where an interrupt can fire just _after_ the `power_supply` handle has been freed, *but* just _before_ the corresponding unregistration of the IRQ handler has run. This will lead to the IRQ handler calling `power_supply_changed()` with a freed `power_supply` handle. Which usually crashes the system or otherwise silently corrupts the memory... Note that there is a similar situation which can also happen during `probe()`; the possibility of an interrupt firing _before_ registering the `power_supply` handle. This would then lead to the nasty situation of using the `power_supply` handle *uninitialized* in `power_supply_changed()`. Fix this racy use-after-free by making sure the IRQ is requested _after_ the registration of the `power_supply` handle. Fixes: 5069185fc18e ("power: supply: bq25980: Add support for the BQ259xx family") Signed-off-by: Waqar Hameed <waqar.hameed@axis.com> Link: https://patch.msgid.link/8763035cadb959e14787b3837f2d3db61f6e1c34.1766268280.git.waqar.hameed@axis.com Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-01-12power: supply: bq256xx: Fix use-after-free in power_supply_changed()Waqar Hameed-6/+6
Using the `devm_` variant for requesting IRQ _before_ the `devm_` variant for allocating/registering the `power_supply` handle, means that the `power_supply` handle will be deallocated/unregistered _before_ the interrupt handler (since `devm_` naturally deallocates in reverse allocation order). This means that during removal, there is a race condition where an interrupt can fire just _after_ the `power_supply` handle has been freed, *but* just _before_ the corresponding unregistration of the IRQ handler has run. This will lead to the IRQ handler calling `power_supply_changed()` with a freed `power_supply` handle. Which usually crashes the system or otherwise silently corrupts the memory... Note that there is a similar situation which can also happen during `probe()`; the possibility of an interrupt firing _before_ registering the `power_supply` handle. This would then lead to the nasty situation of using the `power_supply` handle *uninitialized* in `power_supply_changed()`. Fix this racy use-after-free by making sure the IRQ is requested _after_ the registration of the `power_supply` handle. Fixes: 32e4978bb920 ("power: supply: bq256xx: Introduce the BQ256XX charger driver") Signed-off-by: Waqar Hameed <waqar.hameed@axis.com> Link: https://patch.msgid.link/39da6da8cc060fa0382ca859f65071e791cb6119.1766268280.git.waqar.hameed@axis.com Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-01-12power: supply: act8945a: Fix use-after-free in power_supply_changed()Waqar Hameed-8/+8
Using the `devm_` variant for requesting IRQ _before_ the `devm_` variant for allocating/registering the `power_supply` handle, means that the `power_supply` handle will be deallocated/unregistered _before_ the interrupt handler (since `devm_` naturally deallocates in reverse allocation order). This means that during removal, there is a race condition where an interrupt can fire just _after_ the `power_supply` handle has been freed, *but* just _before_ the corresponding unregistration of the IRQ handler has run. This will lead to the IRQ handler calling `power_supply_changed()` with a freed `power_supply` handle. Which usually crashes the system or otherwise silently corrupts the memory... Note that there is a similar situation which can also happen during `probe()`; the possibility of an interrupt firing _before_ registering the `power_supply` handle. This would then lead to the nasty situation of using the `power_supply` handle *uninitialized* in `power_supply_changed()`. Fix this racy use-after-free by making sure the IRQ is requested _after_ the registration of the `power_supply` handle. Fixes: a09209acd6a8 ("power: supply: act8945a_charger: Add status change update support") Signed-off-by: Waqar Hameed <waqar.hameed@axis.com> Link: https://patch.msgid.link/bcf3a23b5187df0bba54a8c8fe09f8b8a0031dee.1766268280.git.waqar.hameed@axis.com Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-01-12power: supply: ab8500: Fix use-after-free in power_supply_changed()Waqar Hameed-20/+20
Using the `devm_` variant for requesting IRQ _before_ the `devm_` variant for allocating/registering the `power_supply` handle, means that the `power_supply` handle will be deallocated/unregistered _before_ the interrupt handler (since `devm_` naturally deallocates in reverse allocation order). This means that during removal, there is a race condition where an interrupt can fire just _after_ the `power_supply` handle has been freed, *but* just _before_ the corresponding unregistration of the IRQ handler has run. This will lead to the IRQ handler calling `power_supply_changed()` with a freed `power_supply` handle. Which usually crashes the system or otherwise silently corrupts the memory... Note that there is a similar situation which can also happen during `probe()`; the possibility of an interrupt firing _before_ registering the `power_supply` handle. This would then lead to the nasty situation of using the `power_supply` handle *uninitialized* in `power_supply_changed()`. Commit 1c1f13a006ed ("power: supply: ab8500: Move to componentized binding") introduced this issue during a refactorization. Fix this racy use-after-free by making sure the IRQ is requested _after_ the registration of the `power_supply` handle. Fixes: 1c1f13a006ed ("power: supply: ab8500: Move to componentized binding") Signed-off-by: Waqar Hameed <waqar.hameed@axis.com> Reviewed-by: Linus Walleij <linusw@kernel.org> Link: https://patch.msgid.link/ccf83a09942cb8dda3dff70b2682f2c2e9cb97f2.1766268280.git.waqar.hameed@axis.com Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-01-12power: supply: ucs1002: Remove unused gpio include headerWaqar Hameed-1/+0
This header file is not used anywhere in the driver. Remove it. Signed-off-by: Waqar Hameed <waqar.hameed@axis.com> Link: https://patch.msgid.link/dcff57bfbf0510c8b5bfd9d39de021607567a6e8.1766266985.git.waqar.hameed@axis.com Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-01-12power: supply: cw2015: Remove unused gpio include headerWaqar Hameed-1/+0
This header file is not used anywhere in the driver. Remove it. Signed-off-by: Waqar Hameed <waqar.hameed@axis.com> Link: https://patch.msgid.link/6c6ea228f39f3c01c0a89d8ba545be6f3ec13c2a.1766266985.git.waqar.hameed@axis.com Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-01-12power: supply: bq25980: Remove unused gpio include headerWaqar Hameed-1/+0
This header file is not used anywhere in the driver. Remove it. Signed-off-by: Waqar Hameed <waqar.hameed@axis.com> Link: https://patch.msgid.link/94cf6d7dc464e20abea543983b24828e51c64f93.1766266985.git.waqar.hameed@axis.com Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-01-12power: supply: bq256xx: Remove unused gpio include headerWaqar Hameed-1/+0
This header file is not used anywhere in the driver. Remove it. Signed-off-by: Waqar Hameed <waqar.hameed@axis.com> Link: https://patch.msgid.link/730eb504f7ae9d3fcdfeebb544bfe115c32e1064.1766266985.git.waqar.hameed@axis.com Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-01-12power: supply: bd99954: Remove unused gpio include headerWaqar Hameed-1/+0
This header file is not used anywhere in the driver. Remove it. Signed-off-by: Waqar Hameed <waqar.hameed@axis.com> Acked-by: Matti Vaittinen <mazziesaccount@gmail.com> Link: https://patch.msgid.link/ee74b461a8b8f02093e0beb519a1f0b8de7b64bc.1766266985.git.waqar.hameed@axis.com Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2025-12-04Merge tag 'for-v6.19' of ↵Linus Torvalds-22/+2113
git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply Pull power supply and reset updates from Sebastian Reichel: "Power-supply core: - documentation fixes power-supply drivers: - add BD71828 charger driver - add Richtek RT9756 driver - max77705: add adaptive input current support - max77705: add support for multiple devices - misc small fixes reset drivers: - add spacemit-p1 poweroff/reboot driver" * tag 'for-v6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply: Revert "power: supply: qcom_battmgr: support disabling charge control" Documentation: power: rt9756: Document exported sysfs entries power: supply: rt9756: Add Richtek RT9756 smart cap divider charger dt-bindings: power: supply: Add Richtek RT9756 smart cap divider charger driver: reset: spacemit-p1: add driver for poweroff/reboot power: supply: apm_power: only unset own apm_get_power_status power: supply: use ktime_divns() to avoid 64-bit division docs: power: clean up power_supply_class.rst power: supply: qcom_battmgr: support disabling charge control power: supply: qcom_battmgr: clamp charge control thresholds power: supply: wm831x: Check wm831x_set_bits() return value power: supply: rt9467: Prevent using uninitialized local variable in rt9467_set_value_from_ranges() power: supply: rt9467: Return error on failure in rt9467_set_value_from_ranges() power: supply: max17040: Check iio_read_channel_processed() return code power: supply: cw2015: Check devm_delayed_work_autocancel() return code power: supply: rt5033_charger: Fix device node reference leaks power: supply: max77705: Fix potential IRQ chip conflict when probing two devices power: supply: max77705_charger: implement aicl feature MAINTAINERS: Add entry for BD71828 charger power: supply: Add bd718(15/28/78) charger driver
2025-12-04Merge tag 'regulator-v6.19' of ↵Linus Torvalds-0/+653
git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator updates from Mark Brown: "This is a relatively busy release for the regulator API, as well as a good collection of new drivers we've got a little bit of core work and a bunch of cleanup throughout the subsystem: - Support for propagating undervoltage events to child regulators - Undo enables done on supplies when setting enabling regulators via constraints fails - Pull in some gpiolib changes adding support for shared GPIOs to the gpiolib core, using them to replace the open coded variant of this that we've had in the regulator API for a long time - Support for Fitipower FP9931 and JD9330, Mediatek MT6316, MT6363 and MT6373, NXP PF1550 and Qualcomm PMH01XX and PMCX0102 The PF1550 support was originally going to go via the MFD tree but Krzysztof's cleanup work overlapped with it so I pulled in Lee's signed tag with support for the device" * tag 'regulator-v6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: (50 commits) regulator: fp9931: Fix spelling mistake "failid" -> "failed" regulator: core: Protect regulator_supply_alias_list with regulator_list_mutex regulator: pf9453: Constify pointers to 'regulator_desc' wrap struct regulator: pca9450: Constify pointers to 'regulator_desc' wrap struct regulator: mt6358: Constify pointers to 'regulator_desc' wrap struct regulator: bd96801: Constify pointers to 'regulator_desc' wrap struct regulator: bd718x7: Constify pointers to 'regulator_desc' wrap struct regulator: bd71828: Constify pointers to 'regulator_desc' wrap struct regulator: bd71815: Constify pointers to 'regulator_desc' wrap struct regulator: Use container_of_const() when all types are const regulator: pca9450: Fix error code in probe() regulator: qcomm-labibb: replace use of system_wq with system_dfl_wq regulator: Add FP9931/JD9930 driver dt-bindings: regulator: Add Fitipower FP9931/JD9930 dt-bindings: vendor-prefixes: Add Fitipower regulator: make the subsystem aware of shared GPIOs regulator: renesas-usb-vbus-regulator: Remove unused headers regulator: pca9450: Add support for setting debounce settings regulator: dt-bindings: pca9540: add debounce timer configuration regulator: core: disable supply if enabling main regulator fails ...
2025-11-26Fix Intel Dollar Cove TI battery driver 32-bit build errorLinus Torvalds-4/+6
The driver is doing a 64-bit divide, rather than using the proper helpers, causing link errors on i386 allyesconfig builds: x86_64-linux-ld: drivers/power/supply/intel_dc_ti_battery.o: in function `dc_ti_battery_get_voltage_and_current_now': intel_dc_ti_battery.c:(.text+0x5c): undefined reference to `__udivdi3' x86_64-linux-ld: intel_dc_ti_battery.c:(.text+0x96): undefined reference to `__udivdi3' and while fixing that, fix the double rounding: keep the timing difference in nanoseconds ('ktime'), and then just convert to usecs at the end. Not because the timing precision is likely to matter, but because doing it right also makes the code simpler. Reported-by: Guenter Roeck <linux@roeck-us.net> Cc: Hans de Goede <hansg@kernel.org> Cc: Sebastian Reichel <sebastian.reichel@collabora.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2025-11-03Revert "power: supply: qcom_battmgr: support disabling charge control"Sebastian Reichel-8/+4
The charge control disabling does not work as expected and needs more time to be figured out correctly. Drop this feature for now. Reported-by: Val Packett <val@packett.cool> Closes: https://lore.kernel.org/all/8f003bfb-8279-4c65-a271-c1e4a029043d@packett.cool/ Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2025-11-03power: supply: rt9756: Add Richtek RT9756 smart cap divider chargerChiYuan Huang-0/+971
Add support for RT9756 smart cap divider charger. The RT9759 is a high efficiency and high charge current charger. The maximum charge current is up to 8A. It integrates a dual-phase charge pump core with ADC monitoring. Signed-off-by: ChiYuan Huang <cy_huang@richtek.com> Link: https://patch.msgid.link/f682812069b6be2138bfdae2ff9a9c84994d5b64.1761894605.git.cy_huang@richtek.com Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2025-11-03power: supply: apm_power: only unset own apm_get_power_statusAhelenia Ziemiańska-1/+2
Mirroring drivers/macintosh/apm_emu.c, this means that modprobe apm_power && modprobe $anotherdriver && modprobe -r apm_power leaves $anotherdriver's apm_get_power_status instead of deleting it. Fixes: 3788ec932bfd ("[BATTERY] APM emulation driver for class batteries") Signed-off-by: Ahelenia Ziemiańska <nabijaczleweli@nabijaczleweli.xyz> Link: https://patch.msgid.link/xczpgox57hxbunkcbdl5fxhc4gnsajsipldfidi7355afezk64@tarta.nabijaczleweli.xyz Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2025-11-03power: supply: use ktime_divns() to avoid 64-bit divisionMichal Kubecek-2/+2
The build of intel_dc_ti_battery module on i386 (32-bit) fails with ERROR: modpost: "__udivdi3" [drivers/power/supply/intel_dc_ti_battery.ko] This is caused by 64-bit division of ktime values by NSEC_PER_USEC. Use ktime_divns() helper which handles the division correctly on 32-bit architectures. Fixes: 8c5795fe5527 ("power: supply: Add new Intel Dollar Cove TI battery driver") Signed-off-by: Michal Kubecek <mkubecek@suse.cz> Reviewed-by: Dhruva Gole <d-gole@ti.com> Reviewed-by: Hans de Goede <hansg@kernel.org> Link: https://patch.msgid.link/20251015075957.8F40620057@lion.mk-sys.cz Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2025-11-03power: supply: qcom_battmgr: support disabling charge controlVal Packett-4/+8
Existing userspace (in particular, upower) disables charge control by setting the start threshold to 0 and the stop threshold to 100. Handle that by actually setting the enable bit to 0 when a start threshold of 0 was requested. Fixes: cc3e883a0625 ("power: supply: qcom_battmgr: Add charge control support") Signed-off-by: Val Packett <val@packett.cool> Link: https://patch.msgid.link/20251012233333.19144-4-val@packett.cool Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2025-11-03power: supply: qcom_battmgr: clamp charge control thresholdsVal Packett-12/+2
The sysfs API documentation says that drivers "round written values to the nearest supported value" for charge_control_end_threshold. Let's do this for both thresholds, as userspace (e.g. upower) generally does not expect these writes to fail at all. Fixes: cc3e883a0625 ("power: supply: qcom_battmgr: Add charge control support") Signed-off-by: Val Packett <val@packett.cool> Link: https://patch.msgid.link/20251012233333.19144-3-val@packett.cool Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2025-11-03power: supply: wm831x: Check wm831x_set_bits() return valueIvan Abramov-2/+8
Since wm831x_set_bits() may return error, log failure and exit from wm831x_usb_limit_change() in such case. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 626b6cd5f52e ("power: wm831x_power: Support USB charger current limit management") Signed-off-by: Ivan Abramov <i.abramov@mt-integration.ru> Link: https://patch.msgid.link/20251009170553.566561-1-i.abramov@mt-integration.ru Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2025-11-03power: supply: rt9467: Prevent using uninitialized local variable in ↵Murad Masimov-1/+1
rt9467_set_value_from_ranges() There is a typo in rt9467_set_value_from_ranges() that can cause leaving local variable sel with an undefined value which is then used in regmap_field_write(). Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 6f7f70e3a8dd ("power: supply: rt9467: Add Richtek RT9467 charger driver") Signed-off-by: Murad Masimov <m.masimov@mt-integration.ru> Link: https://patch.msgid.link/20251009145308.1830893-1-m.masimov@mt-integration.ru Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2025-11-03power: supply: rt9467: Return error on failure in rt9467_set_value_from_ranges()Ivan Abramov-0/+4
The return value of rt9467_set_value_from_ranges() when setting AICL VTH is not checked, even though it may fail. Log error and return from rt9467_run_aicl() on fail. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 6f7f70e3a8dd ("power: supply: rt9467: Add Richtek RT9467 charger driver") Signed-off-by: Ivan Abramov <i.abramov@mt-integration.ru> Link: https://patch.msgid.link/20251009144725.562278-1-i.abramov@mt-integration.ru Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2025-11-03power: supply: max17040: Check iio_read_channel_processed() return codeIvan Abramov-1/+5
Since iio_read_channel_processed() may fail, return its exit code on error. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 814755c48f8b ("power: max17040: get thermal data from adc if available") Signed-off-by: Ivan Abramov <i.abramov@mt-integration.ru> Link: https://patch.msgid.link/20251008133648.559286-1-i.abramov@mt-integration.ru Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2025-11-03power: supply: cw2015: Check devm_delayed_work_autocancel() return codeIvan Abramov-1/+7
Since devm_delayed_work_autocancel() may fail, add return code check and exit cw_bat_probe() on error. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 0cb172a4918e ("power: supply: cw2015: Use device managed API to simplify the code") Signed-off-by: Ivan Abramov <i.abramov@mt-integration.ru> Link: https://patch.msgid.link/20251008120711.556021-1-i.abramov@mt-integration.ru Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2025-11-03power: supply: rt5033_charger: Fix device node reference leaksHaotian Zhang-0/+2
The device node pointers `np_conn` and `np_edev`, obtained from of_parse_phandle() and of_get_parent() respectively, are not released. This results in a reference count leak. Add of_node_put() calls after the last use of these device nodes to properly release their references and fix the leaks. Fixes: 8242336dc8a8 ("power: supply: rt5033_charger: Add cable detection and USB OTG supply") Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn> Link: https://patch.msgid.link/20250929113234.1726-1-vulab@iscas.ac.cn Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2025-11-03power: supply: max77705: Fix potential IRQ chip conflict when probing two ↵Krzysztof Kozlowski-4/+10
devices MAX77705 charger is most likely always a single device on the board, however nothing stops board designers to have two of them, thus same device driver could probe twice. Or user could manually try to probing second time. Device driver is not ready for that case, because it allocates statically 'struct regmap_irq_chip' as non-const and stores during probe in 'irq_drv_data' member a pointer to per-probe state container ('struct max77705_charger_data'). devm_regmap_add_irq_chip() does not make a copy of 'struct regmap_irq_chip' but stores the pointer. Second probe - either successful or failure - would overwrite the 'irq_drv_data' from previous device probe, so interrupts would be executed in a wrong context. Fixes: a6a494c8e3ce ("power: supply: max77705: Add charger driver for Maxim 77705") Cc: stable@vger.kernel.org Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Link: https://patch.msgid.link/20251023102905.71535-2-krzysztof.kozlowski@linaro.org Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2025-11-03power: supply: max77705_charger: implement aicl featureDzmitry Sankouski-0/+42
Adaptive input current allows charger to reduce it's current consumption, when source is not able to provide enough power. Signed-off-by: Dzmitry Sankouski <dsankouski@gmail.com> Link: https://patch.msgid.link/20250925-max77705_77976_charger_improvement-v6-1-972c716c17d1@gmail.com Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2025-11-03power: supply: Add bd718(15/28/78) charger driverAndreas Kemnade-0/+1059
Add charger driver for ROHM BD718(15/28/78) PMIC charger block. It is a stripped down version of the driver here: https://lore.kernel.org/lkml/dbd97c1b0d715aa35a8b4d79741e433d97c562aa.1637061794.git.matti.vaittinen@fi.rohmeurope.com/ For the ease of review and to do a step-by-step approach remove all the coloumb counter related stuff and do not sneak in BD71827 support. That also avoids non-trivial rebasing of the above series. Changes besides that: Replace the custom property by a standard one and do not use megaohms for the current sense resistor. Signed-off-by: Andreas Kemnade <andreas@kemnade.info> Reviewed-by: Matti Vaittinen <mazziesaccount@gmail.com> Acked-by: Sebastian Reichel <sebastian.reichel@collabora.com> Link: https://patch.msgid.link/20250918-bd71828-charger-v5-2-851164839c28@kemnade.info Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2025-10-21power: supply: pf1550: add battery charger supportSamuel Kayode-0/+653
Add support for the battery charger for pf1550 PMIC. Signed-off-by: Samuel Kayode <samuel.kayode@savoirfairelinux.com> Acked-by: Sebastian Reichel <sebastian.reichel@collabora.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Tested-by: Sean Nyekjaer <sean@geanix.com> Link: https://patch.msgid.link/20251001-pf1550-v12-5-a3302aa41687@savoirfairelinux.com Signed-off-by: Lee Jones <lee@kernel.org>