Re: [PATCH v2 3/4] mfd: mt6397-core: add mt6323 EFUSE support

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Unchecked grandparent pointer dereference in mt6323_efuse_probe.
--

commit 9ff4fcd2490678b446194f62f1baf75c41828eff
Author: Roman Vivchar <rva333@protonmail.com>
Subject: mfd: mt6397-core: add mt6323 EFUSE support

This commit adds the mt6323 EFUSE to the mt6323 devices array in the MFD core.
This registration allows the corresponding efuse driver to probe using its
compatible string.

> diff --git a/drivers/mfd/mt6397-core.c b/drivers/mfd/mt6397-core.c
> index 3e58d0764c7e0..362737a1c4a9a 100644
> --- a/drivers/mfd/mt6397-core.c
> +++ b/drivers/mfd/mt6397-core.c
> @@ -125,6 +125,9 @@ static const struct resource mt6323_pwrc_resources[] = {
>  
>  static const struct mfd_cell mt6323_devs[] = {
>  	{
> +		.name = "mt6323-efuse",
> +		.of_compatible = "mediatek,mt6323-efuse",

[Severity: High]
Does adding this compatible string expose an unchecked pointer dereference
in the efuse driver?

Looking at mt6323_efuse_probe() in drivers/nvmem/mt6323-efuse.c:

mt6323_efuse_probe() {
    ...
    regmap = dev_get_regmap(dev->parent->parent, NULL);
    ...
}

If the driver is instantiated directly from a top-level device tree node via
this compatible string instead of as an MFD child, dev->parent will point to
the root platform bus. Because the platform bus has no parent,
dev->parent->parent evaluates to a NULL pointer.

Passing this NULL device pointer to dev_get_regmap() causes devres_find() to
unconditionally dereference it. Would it be safer to add a NULL check on
dev->parent and dev->parent->parent in the driver before doing this lookup
to prevent a kernel panic?

>  	}, {
>  		.name = "mt6323-rtc",

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260617-mt6323-nvmem-v2-0-4f30e36aa0f4@protonmail.com?part=3