On Sat, 16 Dec 2023 14:46:11 -0300
Marcelo Schmitt <marcelo.schmitt@xxxxxxxxxx> wrote:
> Previous version of ad7091r event handler received the ADC state pointer
> and retrieved the iio device from driver data field with dev_get_drvdata().
> However, no driver data have ever been set, which led to null pointer
> dereference when running the event handler.
>
> Pass the iio device to the event handler and retrieve the ADC state struct
> from it so we avoid the null pointer dereference and save the driver from
> filling the driver data field.
>
> Fixes: ca69300173b6 ("iio: adc: Add support for AD7091R5 ADC")
> Signed-off-by: Marcelo Schmitt <marcelo.schmitt@xxxxxxxxxx>
Given we are late in the cycle, I've applied this to the togreg branch of iio.git
and it will hopefully go in during the merge window rather than before.
Marked it for stable though so should get backported appropriately.
Thanks,
Jonathan
> ---
> drivers/iio/adc/ad7091r-base.c | 6 +++---
> 1 file changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/iio/adc/ad7091r-base.c b/drivers/iio/adc/ad7091r-base.c
> index 8e252cde735b..0e5d3d2e9c98 100644
> --- a/drivers/iio/adc/ad7091r-base.c
> +++ b/drivers/iio/adc/ad7091r-base.c
> @@ -174,8 +174,8 @@ static const struct iio_info ad7091r_info = {
>
> static irqreturn_t ad7091r_event_handler(int irq, void *private)
> {
> - struct ad7091r_state *st = (struct ad7091r_state *) private;
> - struct iio_dev *iio_dev = dev_get_drvdata(st->dev);
> + struct iio_dev *iio_dev = private;
> + struct ad7091r_state *st = iio_priv(iio_dev);
> unsigned int i, read_val;
> int ret;
> s64 timestamp = iio_get_time_ns(iio_dev);
> @@ -234,7 +234,7 @@ int ad7091r_probe(struct device *dev, const char *name,
> if (irq) {
> ret = devm_request_threaded_irq(dev, irq, NULL,
> ad7091r_event_handler,
> - IRQF_TRIGGER_FALLING | IRQF_ONESHOT, name, st);
> + IRQF_TRIGGER_FALLING | IRQF_ONESHOT, name, iio_dev);
> if (ret)
> return ret;
> }
