[PATCH net 00/10] net: pse-pd: assorted lifetime and error-path fixes

[Carlo Szelinsky]

Fixes for the PSE core and two of its drivers, found while working on
the PSE controller teardown. Two patches depend on the one before them:
6 is only safe with the locked check from 5, and 8 relies on 7 to give
back a budget that was already reserved.

 1  The kfifo is too small: podl-pse-regulator and any controller with
    0 or 1 lines cannot register.
 2  A module reference leaks when reading the port state fails.
 3  A failed IRQ request stays in pcdev->irq, so unregister disables a
    line another device may own.
 4  The notification worker can read a PHY that was already freed.
 5  Setting a power limit checks the PI state without the lock.
 6  A power domain shared by two controllers is freed when the one that
    created it unbinds.
 7  pd692x0 leaks its manager power budget when probe fails.
 8  pd692x0 crashes on a manager supply that is not resolved yet.
 9  si3474 logs through an I2C client it has already unregistered.
 10 A low voltage reading overflows the current for a power limit and
    hits a BUG_ON().

Testing: every patch builds on its own with W=1 and is checkpatch
clean. 1, 4 and 6 were tested in QEMU (arm64, KASAN, lockdep, kmemleak)
with a test-only fake PSE controller: net/main shows the kfifo failure
and use-after-free reports, the series is clean. The other patches are
build-tested only. Together with the PSE core fixes and the decouple
series, the series also runs on a Hasivo S600WP (hs104), including
setting power limits.

Pending work:
 - "net: pse-pd: fix use-after-free of PI array on controller
   unregister" [1] applies with this series in either order.
 - The PSE core fixes for net-next [2] conflict with 5 and 6; the note
   in their patch 2 explains how to merge them.

Not fixed here: a shared power domain's supply handle belongs to the PI
regulator of the controller that created it, so it goes stale when
that controller unbinds. That is older than this series.

[1] https://lore.kernel.org/netdev/20260813200653.980170-1-github@xxxxxxxxxxxx/
[2] https://lore.kernel.org/netdev/20261018081853.47484-1-github@xxxxxxxxxxxx/

Carlo Szelinsky (10):
  net: pse-pd: size the notification kfifo after defaulting nr_lines
  net: pse-pd: fix module refcount leak in pse_control_get_internal()
  net: pse-pd: do not keep a failed IRQ in pcdev->irq
  net: pse-pd: do not reach a freed PHY from the notification worker
  net: pse-pd: check the PI state under the lock when setting a power
    limit
  net: pse-pd: do not tie a shared power domain to its creator's devres
  net: pse-pd: pd692x0: release the manager power budget through devres
  net: pse-pd: pd692x0: defer probe while a manager supply is unresolved
  net: pse-pd: si3474: fix use-after-free in ancillary client error path
  net: pse-pd: reject a power limit whose current does not fit an int

 drivers/net/pse-pd/pd692x0.c  |  31 ++++--
 drivers/net/pse-pd/pse_core.c | 171 +++++++++++++++++++++++-----------
 drivers/net/pse-pd/si3474.c   |   4 +-
 3 files changed, 140 insertions(+), 66 deletions(-)


base-commit: aaaaf87ea99b8766c9a8aa0e71aa42e6bc8a5320
-- 
2.43.0