On Mon, 2023-03-27 at 22:02 +0200, Fabrizio Lamarque wrote: > Fix ad7192.c NULL pointer dereference in ad7192_setup() when > accessing > indio_dev structure while populating input rages, causing a kernel > panic. > Fixed by calling spi_set_drvdata after indio_dev is allocated. > > Additional details > > Kernel panic log > [ 5.763067] Unable to handle kernel NULL pointer dereference at > virtual address 00000208 > [...] > [ 6.265076] [<c063b94c>] (driver_register) from [<c070e59c>] > (__spi_register_driver+0xd8/0xe4) > [ 6.273757] r5:c0b88c7c r4:00000000 > [ 6.277351] [<c070e4c4>] (__spi_register_driver) from [<c0e4c288>] > (ad7192_driver_init+0x20/0x28) > [ 6.286305] r9:c107fe00 r8:c107fe00 r7:00000000 r6:c0e56854 > r5:c0e4c268 r4:c40fa000 > [ 6.294070] [<c0e4c268>] (ad7192_driver_init) from [<c01023d0>] > (do_one_initcall+0x58/0x2ac) > [ 6.302569] [<c0102378>] (do_one_initcall) from [<c0e01594>] > (kernel_init_freeable+0x1c4/0x254) > [...] > [ 6.387349] Kernel panic - not syncing: Attempted to kill init! > exitcode=0x0000000b > [ 6.395049] ---[ end Kernel panic - not syncing: Attempted to kill > init! exitcode=0x0000000b ] > > The patch is against the current tree, but it applies without > modifications to 5.x (the driver has not changed much since then). > Reproduced in kernel version 5.15.x. Newer driver versions are > affected by the same issue. > > Pointer to indio_dev structure is obtained via spi_get_drvdata() at > the beginning of function ad7192_setup(), but the > spi->dev->driver_data member is not initialized here, hence a NULL > pointer is returned. > > By comparing every other iio adc driver, whenever there is a call to > spi_get_drvdata() there is also one to spi_set_drvdata() within probe > function. > It should also be noted that the indio_dev structure is accessed just > to get the number of bits for the converter, and no other driver > calls > spi_get_drvdata within probe. > After the patch is applied the system boots correctly and the ADC is > mapped within sysfs. > > Signed-off-by: Fabrizio Lamarque <fl.scratchpad@xxxxxxxxx> > --- linux/drivers/iio/adc/ad7192.c 2023-03-13 19:32:42.646239506 Thanks for the fix. This is missing a fixes tag though... With that: Reviewed-by: nuno.sa@xxxxxxxxxx
