kernel/git/next/linux-next.git/drivers/pwm, branch master

pwm: lp3943: fix NULL pointer dereference for an unconfigured channel

2026-09-08T17:12:19+00:00

lp3943_pwm_probe() unconditionally registers a pwmchip with LP3943_NUM_PWMS(2) hwpwm channels, but lp3943_pwm_parse_dt() only populates pdata->pwms[i] for the channels whose ti,pwm0/ti,pwm1 property is actually present in the devicetree (the binding explicitly allows each PWM generator to drive zero or more outputs, and lp3943_pwm_parse_dt() only fails outright with -ENODATA if *neither* property is present). A devicetree that configures only one of the two channels leaves pdata->pwms[] NULL for the other. lp3943_pwm_request_map() dereferences pdata->pwms[hwpwm] with no NULL check: pwm_map->output = pdata->pwms[hwpwm]->output; pwm_map->num_outputs = pdata->pwms[hwpwm]->num_outputs; so requesting the unconfigured channel (e.g. exporting it from sysfs) crashes with a NULL pointer dereference instead of failing cleanly. Return -ENODEV from lp3943_pwm_request_map() when the channel was never configured, before the pointer is dereferenced. The caller, lp3943_pwm_request(), already propagates an ERR_PTR return correctly (it does so today for the existing -EBUSY case). Reported-by: Sashiko AI review Closes: https://sashiko.dev/#/patchset/6a9d4c6b.79b5ea6e.147aa1.5883@mx.google.com?part=1 Signed-off-by: Manush Prajwal Link: https://patch.msgid.link/6a9d5187.d63de05c.175391.a17c@mx.google.com Fixes: af66b3c0934e ("pwm: Add LP3943 PWM driver") Signed-off-by: Uwe Kleine-König

pwm: mtk-disp: Fix period readback

2026-09-08T09:50:38+00:00

The period value stored in the register is the number of clock cycles - 1. Account for the offset when calculating the period in nanoseconds. This fixes the discrepancy reported by the pwm core when CONFIG_PWM_DEBUG=1: mediatek-disp-pwm 1100e000.pwm: .apply is not idempotent (ena=1 pol=0 281500/499875) -> (ena=1 pol=0 281500/499750) Calculation discrepancy in the driver was found by AI run by a colleague while debugging another PWM related issue. Check against SoC datasheet and fix done by the author. Fixes: 3f2b16734914 ("pwm: mtk-disp: Implement atomic API .get_state()") Cc: Jitao Shi Signed-off-by: Chen-Yu Tsai Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: Fei Shao Link: https://patch.msgid.link/20260827105738.8570-1-wenst@chromium.org [ukleinek: Adapt comment accordingly] Signed-off-by: Uwe Kleine-König

pwm: ipq: Prevent potential 32-bit integer overflow in hi_div calculation

2026-09-07T09:37:08+00:00

In ipq_pwm_get_state(), hi_div was calculated as: hi_div = hi_dur * (pre_div + 1); hi_dur and (pre_div + 1) are both unsigned int (32-bit) values. Evaluating their multiplication using 32-bit arithmetic before assigning to the 64-bit u64 hi_div variable can overflow 32-bit unsigned math. While effective_div explicitly uses (u64)(pwm_div + 1) * (pre_div + 1) to prevent overflow, hi_div was missing the (u64) cast. Fix this by casting hi_dur to (u64) before multiplication, matching the precision used for effective_div. Fixes: c436e3e9c265 ("pwm: Driver for qualcomm ipq6018 pwm block") Signed-off-by: Surendra Singh Chouhan Link: https://patch.msgid.link/20260724044854.33274-1-kr494167@gmail.com Signed-off-by: Uwe Kleine-König

pwm: loongson: Reload PWM configuration through counter reset

2026-09-07T09:25:23+00:00

The Loongson PWM controller latches the LOW and PERIOD registers only at the start of each PWM period. After disabling and re-enabling the PWM, the controller resumes from the previous counter value and completes the current period before re-latching the updated LOW and PERIOD values. Reset the PWM counter when disabling the PWM and release it when enabling the PWM so that the updated LOW and PERIOD values are latched before the PWM starts running again. Fixes: 2b62c89448dd ("pwm: Add Loongson PWM controller support") Signed-off-by: Keguang Zhang Link: https://patch.msgid.link/20260715-pwm-loongson-fix-v3-2-0aab2847eaa7@gmail.com [ukleinek: Note LOW refers to the register currently named LOONGSON_PWM_REG_DUTY. That name is wrong, the fix is still under discussion.] Signed-off-by: Uwe Kleine-König

pwm: Fix typos in comments

2026-09-07T08:03:42+00:00

Fix typos in comments, reported by scripts/checkpatch.pl using the misspelling list in scripts/spelling.txt. Only touches comments, no code changes. Assisted-by: Cursor:claude-opus-5 Signed-off-by: Hemanth Selam Link: https://patch.msgid.link/20260907062659.15500-1-hemanth.selam@gmail.com Signed-off-by: Uwe Kleine-König

pwm: iqs620a: Use devm_blocking_notifier_chain_register()

2026-08-31T21:27:14+00:00

Replace the blocking_notifier_chain_register() + devm_add_action_or_reset() pattern with a single call to devm_blocking_notifier_chain_register(), removing the iqs620_pwm_notifier_unregister() callback. Signed-off-by: Eliav Farber Link: https://patch.msgid.link/20260816060648.4030-3-farbere@amazon.com Signed-off-by: Uwe Kleine-König

pwm: renesas-tpu: Fix runtime PM reference leak

2026-08-31T21:27:02+00:00

tpu_pwm_timer_start() used pm_runtime_get_sync() without checking its return value before touching the TPU clock. A failed runtime resume was therefore ignored, and the callback continued into register access. Use pm_runtime_resume_and_get() and propagate a failed resume. Keep the matching put when clock preparation fails after a successful resume. tpu_pwm_disable() also needs to propagate a failed start so that the PWM apply callback does not access registers while runtime PM is inactive. This issue was found by a static analysis checker and confirmed by manual source review. Fixes: 99b82abb0a35 ("pwm: Add Renesas TPU PWM driver") Signed-off-by: Ruoyu Wang Link: https://patch.msgid.link/20260814134143.1388120-1-ruoyuw560@gmail.com Signed-off-by: Uwe Kleine-König

Merge tag 'driver-core-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core

2026-08-19T17:42:18+00:00

Pull driver core updates from Danilo Krummrich: "container_of: - Apply typeof_member(), remove the local __mptr variable to eliminate variable shadowing warnings on nested container_of() calls, and remove unnecessary parentheses core: - Add driver name to probe debug print for initcall_debug - Avoid repeatedly printing the same 'Fixed dependency cycle' log - Unwind device_add() on attribute creation failure in attribute_container_add_class_device() - Remove statistics group if encryption group creation fails in transport_add_class_device() debugfs: - Fix lockdown check for mmap_prepare() - Warn if file creation failed due to uninitialized debugfs device property: - Implement fw_devlink support for software nodes by adding software_node_add_links(), which creates fwnode links from DEV_PROP_REF properties to enable automatic probe ordering. Add kunit-managed fwnode helpers and test coverage - Fix infinite loop in fwnode_for_each_child_node() when the secondary fwnode has more than one child. Add test cases - Fix out-of-bounds access in software_node_get_reference_args() when called with index -1 (UINT_MAX) - Refactor to use RAII approach with __free() - Add Bartosz Golaszewski as software node reviewer firmware loader: - Fix race where a sysfs fallback request can complete before being queued as pending, leading to a use-after-free on the next fallback request - Reject 0-size built-in firmware and fail the build on empty firmware files in CONFIG_EXTRA_FIRMWARE kobject: - Provide __KOBJ_ATTR() and __KOBJ_ATTR_RO/WO() initialization macros and allow the constification of kobject attributes, enabling them to reside in read-only memory platform: - Provide platform_device_set_of_node(), platform_device_set_fwnode(), and platform_device_set_of_node_from_dev() helpers that encapsulate firmware node reference counting for dynamically allocated platform devices Convert all in-tree users that manually assigned dev.of_node or dev.fwnode, fixing a pre-existing refcount bug in powermac. Switch to counting references of all firmware node types, not only OF nodes - Unify the release path for dynamically allocated platform devices by removing platform_device_release_full(). Amend the fwnode setter API contract to warn if a primary software node is overwritten. Add KUnit tests for correct software node removal on device unregistration Rust: - Auxiliary: - Add registration_data_with() closure-based API for invariant ForLt types - Debugfs: - Migrate BinaryWriter and BinaryReaderMut trait requirements from kernel::transmute traits to zerocopy traits - Device: - Add BoundInternal device context and InternalBoundContext trait for bus abstractions that need internal access to a bound device. - Make the lifetime on Core and CoreInternal invariant to prevent coercion to shorter lifetimes - Devres: - Fix race between concurrent revokers where the losing revoker could return before the winning revoker finished dropping the inner data, causing use-after-free. - Ensure revocation is complete before the device finishes unbinding by making the synchronization bidirectional. - Add DevresLt, a wrapper around Devres that shortens 'static back to the caller's borrow scope. Implement ForLt and CovariantForLt for Bar, IoMem, and ExclusiveIoMem - Driver: - Switch from index-based to pointer-based device ID info lookup, storing static references in driver_data. Centralize device ID handling in device_id.rs, removing the open-coded ACPI/OF matching logic and duplicate ID table from driver.rs - I/O: - Make I/O regions typed (with a dynamically-sized Region type for the existing untyped case), create view types representing subregions of a mapped I/O region, and add io_project!() for safely creating subviews. - Split Io into a base trait (IoBase) and an extension trait (Io) with a blanket implementation, preventing implementers from overriding provided methods that unsafe code relies on. - Add a SysMem backend for shared system memory with volatile access, and make Coherent implement Io via an I/O view type. Add IoSysMap as sum type of Mmio and SysMem. Add copying methods (memcpy_{from,to}io()) and read_val()/write_val() for typed access. - Replace dma_read!()/dma_write!() with io_read!()/io_write!() for primitives and copying methods for aggregates; drop the old macros. Convert nova-core to use I/O projection. - Fix internal shortcut rule dispatch in the register!() macro, remove unused rule arguments, and use path fragments for alias destinations - IRQ: - Make irq::Registration compatible with lifetime-bound drivers by removing the 'static bound on Handler/ThreadedHandler and replacing Devres with direct request_irq()/free_irq() calls. Handlers can now directly own lifetime-bound device resources - PCI: - Convert IrqVectorRegistration to a lifetime-annotated owning type, giving drivers explicit control over the allocation lifetime. IrqVector embeds a resolved IrqRequest, making the conversion infallible. Remove the redundant request_irq()/request_threaded_irq() wrappers from pci::Device. - Add pci_irq_type() C helper and expose it via irq_type() on IrqVectorRegistration and IrqVector, returning PCI_IRQ_MSIX, PCI_IRQ_MSI, or PCI_IRQ_INTX. - Mark pci::Device refcount methods inline - Serdev: - Add Rust abstractions for the serial device bus, including serdev::Driver trait, serdev::Device wrapping struct serdev_device, and serdev::Adapter implementing RegistrationOps. Includes a sample driver. Markus Probst takes over as serdev maintainer for both C and Rust code - Misc: - Split ForLt into a base trait (providing the Of<'a> GAT) and an unsafe CovariantForLt subtrait guaranteeing covariance, enabling invariant types (e.g. those containing Mutex<&'bound T>) to participate in the ForLt abstraction. - Fix Coherent read past EOF returning -ERANGE instead of zero. - Fix firmware example UB by avoiding null-pointer ARef misc: - Avoid iattr allocation in kernfs listxattr by using kernfs_iattrs_noalloc(). - Unregister SoC bus on early device registration failure. - Remove unused DMA_FENCE_TRACE Kconfig symbol. - Fix /sys/module path in comment. - Refactor ISA bus init to remove nested blocks. - Remove redundant nodemask clears in numa_init(). - Add kernel-doc for fwnode_operations and sys_soc.h, mark internal property data as private for kernel-doc, and add property.h/fwnode.h to driver-api infrastructure docs. - Add MAINTAINERS entry for sys_soc.h" * tag 'driver-core-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core: (129 commits) rust: pci: expose the allocated interrupt type PCI: Add pci_irq_type() to query the allocated interrupt type rust: pci: remove request_irq() and request_threaded_irq() from Device rust: pci: resolve IRQ in index() and embed IrqRequest in IrqVector rust: pci: convert IrqVectorRegistration to a lifetime-managed owning type kernfs: avoid iattr allocation in listxattr rust: serdev: use ThisModule::as_ptr() instead of field access ACPI/IORT: use platform_device_set_fwnode() ACPI/APMT: use platform_device_set_fwnode() firmware_loader: do not queue completed sysfs fallback requests rust: pci: Mark Device refcount methods inline rust: irq: make Registration compatible with lifetime-bound drivers rust: net/phy: remove expansion from doc rust: dma: return zero for Coherent reads past EOF rust: io: register: use path fragment for alias destination rust: io: register: remove unused rule arguments rust: io: register: dispatch shortcut rules internally MAINTAINERS: add sys_soc.h to DRIVER CORE rust: debugfs: remove unsafe blocks from traits impl for Vec rust: debugfs: migrate debugfs traits requirements to zerocopy ...

Merge tag 'pwm/for-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ukleinek/linux

2026-08-19T16:03:59+00:00

Pull pwm updates from Uwe Kleine-König: "A bunch of cleanups - in C and Rust - and a devicetree and driver extension for a new SoC variant. Thanks to Biju Das, Francis Laniel, Guru Das Srinagesh, Markus Elfring, Mikko Perttunen, Thierry Reding, and Yi-Wei Wang for their changes and further Alexandre Courbot, Benno Lossin, Chen Wang, Geert Uytterhoeven, Jon Hunter, Laurent Pinchart, Michal Wilczynski, Mikko Perttunen, and Rob Herring for valuable review feedback" * tag 'pwm/for-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ukleinek/linux: pwm: th1520: use vertical import style rust: pwm: replace `core::mem::zeroed` with `pin_init::zeroed` pwm: rzg2l-gpt: Drop unused rzg2l_gpt_chip parameter from rzg2l_gpt_calculate_prescale() pwm: Use seq_putc() calls in pwm_dbg_show() pwm: tegra: Add support for Tegra264 pwm: tegra: Parametrize duty and scale field widths pwm: tegra: Modify read/write accessors for multi-register channel pwm: tegra: Avoid hard-coded max clock frequency pwm: tegra: Prefix driver-local macros and functions dt-bindings: pwm: Document Tegra264 controller pwm: lpss-pci: Unify coding style of pci_device_id array pwm: Unify coding style of of_device_id arrays pwm: Unify coding style of acpi_device_id arrays pwm: Use named initializers for arrays of acpi_device_id pwm: pca9685: Drop unused assignment of acpi_device_id driver data pwm: pxa: Depend on OF and simplify accordingly pwm: Use named initializers for platform_device_id arrays pwm: mc33xs2410: Initialize spi_device_id arrays using member names

clocksource/drivers/samsung_pwm: Switch to raw_spinlock_t type

2026-08-13T16:13:15+00:00

Samsung PWM timer might be used as a clock source on some legacy systems. When PREEMPT_RT is enabled on ARM, regular spinlock is converted to a sleeping lock (mutex-based), which must not be used in atomic context such as hard interrupt handlers. Switch the samsung_pwm_lock to the raw_spinlock, which remains a true non-sleeping spinlock even under PREEMPT_RT. Fixes: 7aac482e6290 ("clocksource: samsung_pwm_timer: Make PWM spinlock global") Fixes: f11899894c0a ("clocksource: add samsung pwm timer driver") Signed-off-by: Marek Szyprowski Signed-off-by: Daniel Lezcano Reviewed-by: Krzysztof Kozlowski Reviewed-by: Sebastian Andrzej Siewior Acked-by: Uwe Kleine-König Link: https://patch.msgid.link/20260713085653.1145015-1-m.szyprowski@samsung.com