Re: [PATCH v2 3/6] mfd: lm3533: Add support for VIN power supply

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The `lm3533_cells` array is allocated on the stack without initialization, leading to memory corruption and kernel panics.
--

commit d39c7ac544b69e1a515d2b34cf44f319c6f00c0a
Author: Svyatoslav Ryhel <clamor95@gmail.com>

mfd: lm3533: Add support for VIN power supply

This commit adds support for a 2.7V-5.5V vin power supply to the
lm3533 core driver. It acquires the regulator in the probe function
and toggles it during the enable and disable sequences.

> diff --git a/drivers/mfd/lm3533-core.c b/drivers/mfd/lm3533-core.c
> index 8495e91198711..519f8c16a3f35 100644
> --- a/drivers/mfd/lm3533-core.c
> +++ b/drivers/mfd/lm3533-core.c
[ ... ]
> @@ -324,7 +336,9 @@ static int lm3533_device_init(struct lm3533 *lm3533)
>  	u32 count = 0, reg;
>  	int ret;
>  
> -	lm3533_enable(lm3533);
> +	ret = lm3533_enable(lm3533);
> +	if (ret)
> +		return ret;
>  
>  	device_for_each_child_node_scoped(lm3533->dev, child) {
>  		if (!fwnode_device_is_available(child))

[Severity: High]
This isn't a bug introduced by this patch, but it was introduced earlier in
this patch series (in "mfd: lm3533: Convert to use OF bindings") and
remains unfixed.

Does this code pass uninitialized stack memory to the mfd core?

In lm3533_device_init(), the array is declared on the stack without zero
initialization:

	struct mfd_cell lm3533_cells[LM3533_CELLS_MAX];

When processing the child nodes, only specific fields like name, id, and
of_compatible are assigned. All other fields in the mfd_cell structs,
such as pdata_size, resources, and num_resources, remain populated with
uninitialized stack garbage.

When this array is passed to mfd_add_devices(), the mfd core processes
these garbage values. If pdata_size contains a non-zero garbage value,
mfd_add_device() will call kmemdup() on the garbage platform_data
pointer, which could result in an immediate kernel panic.

Furthermore, if an available child node does not match any of the
supported compatible strings, count is still incremented:

	device_for_each_child_node_scoped(lm3533->dev, child) {
		...
		if (fwnode_device_is_compatible(child, "ti,lm3533-als")) {
			...
		}
		...
		count++;
	}

Could this cause a completely uninitialized cell (with a garbage name
pointer) to be processed? This could also lead to a crash during mfd
registration.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260528135123.103745-1-clamor95@gmail.com?part=3