Re: [PATCH v2] can: c_can: Use platform id data when OF data is absent

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] This problem wasn't introduced by this patch, but the regression fixed by this patch in `c_can_platform.c` is also present in `flexcan-core.c`, which was modified by the same original commit but remains unfixed. Commit 5e6c3454b405 incorrectly replaced `of_match_device()` and `platform_get_device_id()` checks with a single call to `device_get_match_data()`. Because `device_get_match_data()` does not fall back to `platform_device_id` tables, any driver matching via platform ID will receive a NULL pointer. In `flexcan-core.c`, the legacy non-DT platform "flexcan-mcf5441x" is matched via `flexcan_id_table`. When probed, `device_get_match_data()` returns NULL, which `flexcan_probe()` immediately dereferences (`devtype_data->quirks`), resulting in a kernel panic.
--

commit c16eef82e68ac57940a1f18250576d39cf8e239b
Author: Pengpeng Hou <pengpeng@iscas.ac.cn>

can: c_can: Use platform id data when OF data is absent
    
The platform driver keeps controller metadata in both the OF match table
and the platform id table. Probe reads the metadata with
device_get_match_data(), which does not fall back to platform id-table
driver_data.

When the device is matched through the platform id table, drvdata can
therefore be NULL before it is dereferenced for msg_obj_num and the
controller type. Fall back to platform_get_device_id() when firmware
match data is not available.

> diff --git a/drivers/net/can/c_can/c_can_platform.c b/drivers/net/can/c_can/c_can_platform.c
> index 19c86b94a40e4..d3529b4cc856e 100644
> --- a/drivers/net/can/c_can/c_can_platform.c
> +++ b/drivers/net/can/c_can/c_can_platform.c
> @@ -266,6 +266,14 @@ static int c_can_plat_probe(struct platform_device *pdev)
>  	struct device_node *np = pdev->dev.of_node;
>  
>  	drvdata = device_get_match_data(&pdev->dev);
> +	if (!drvdata) {
> +		const struct platform_device_id *id;
> +
> +		id = platform_get_device_id(pdev);
> +		if (!id)
> +			return -ENODEV;
> +		drvdata = (const struct c_can_driver_data *)id->driver_data;
> +	}

[Severity: High]
This isn't a bug introduced by this patch, but this patch fixes a regression
that seems to also be present in another driver modified by the same original
commit (5e6c3454b405).

In drivers/net/can/flexcan/flexcan-core.c in flexcan_probe(), the driver
matches via flexcan_id_table for the legacy non-DT platform flexcan-mcf5441x:

    devtype_data = device_get_match_data(&pdev->dev);

    if ((devtype_data->quirks & FLEXCAN_QUIRK_SUPPORT_FD) && ...

When probed on a non-DT platform device, device_get_match_data() returns
NULL, which is immediately dereferenced.

Should a similar fallback to platform_get_device_id() be added to
flexcan_probe() to prevent a NULL pointer dereference on these platforms?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260625054152.68413-1-pengpeng@iscas.ac.cn?part=1