[PATCH] can: c_can: Use platform id data when OF data is absent

[PATCH] can: c_can: Use platform id data when OF data is absent

[Pengpeng Hou]

The platform driver keeps controller metadata in both the OF match table
and the platform id table.  Probe reads the metadata with
device_get_match_data(), which does not fall back to platform id-table
driver_data.

When the device is matched through the platform id table, drvdata can
therefore be NULL before it is dereferenced for msg_obj_num and the
controller type.  Fall back to platform_get_device_id() when firmware
match data is not available.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
---
 drivers/net/can/c_can/c_can_platform.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/net/can/c_can/c_can_platform.c b/drivers/net/can/c_can/c_can_platform.c
index 19c86b94a40e..564c9e5b4c2c 100644
--- a/drivers/net/can/c_can/c_can_platform.c
+++ b/drivers/net/can/c_can/c_can_platform.c
@@ -263,9 +263,17 @@ static int c_can_plat_probe(struct platform_device *pdev)
 	int irq;
 	struct clk *clk;
 	const struct c_can_driver_data *drvdata;
+	const struct platform_device_id *id;
 	struct device_node *np = pdev->dev.of_node;
 
 	drvdata = device_get_match_data(&pdev->dev);
+	if (!drvdata) {
+		id = platform_get_device_id(pdev);
+		if (!id)
+			return -ENODEV;
+
+		drvdata = (const struct c_can_driver_data *)id->driver_data;
+	}
 
 	/* get the appropriate clk */
 	clk = devm_clk_get(&pdev->dev, NULL);
-- 
2.50.1 (Apple Git-155)

Re: [PATCH] can: c_can: Use platform id data when OF data is absent

[Vincent Mailhol]

On 24/06/2026 at 07:49, Pengpeng Hou wrote:
> The platform driver keeps controller metadata in both the OF match table
> and the platform id table.  Probe reads the metadata with
> device_get_match_data(), which does not fall back to platform id-table
> driver_data.
> 
> When the device is matched through the platform id table, drvdata can
> therefore be NULL before it is dereferenced for msg_obj_num and the
> controller type.  Fall back to platform_get_device_id() when firmware
> match data is not available.

So, you are telling me that this patch fixes a NULL pointer
dereference? In that case, it needs to be backported. Please add a
Fixes: tag.

Fixes: 5e6c3454b405 ("net: can: Use device_get_match_data()")

> Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
> ---
>  drivers/net/can/c_can/c_can_platform.c | 8 ++++++++
>  1 file changed, 8 insertions(+)
> 
> diff --git a/drivers/net/can/c_can/c_can_platform.c b/drivers/net/can/c_can/c_can_platform.c
> index 19c86b94a40e..564c9e5b4c2c 100644
> --- a/drivers/net/can/c_can/c_can_platform.c
> +++ b/drivers/net/can/c_can/c_can_platform.c
> @@ -263,9 +263,17 @@ static int c_can_plat_probe(struct platform_device *pdev)
>  	int irq;
>  	struct clk *clk;
>  	const struct c_can_driver_data *drvdata;
> +	const struct platform_device_id *id;
>  	struct device_node *np = pdev->dev.of_node;
>  
>  	drvdata = device_get_match_data(&pdev->dev);
> +	if (!drvdata) {
> +		id = platform_get_device_id(pdev);
> +		if (!id)
> +			return -ENODEV;
> +
> +		drvdata = (const struct c_can_driver_data *)id->driver_data;
> +	}

Reduce the visibility of id:

	if (!drvdata) {
		const struct platform_device_id *id;

		id = platform_get_device_id(pdev);
		if (!id)
			return -ENODEV;

		drvdata = (const struct c_can_driver_data *)id->driver_data;
	}

>  
>  	/* get the appropriate clk */
>  	clk = devm_clk_get(&pdev->dev, NULL);

With the Fixes: tag added and above nitpick addressed:

Reviewed-by: Vincent Mailhol <mailhol@kernel.org>


Yours sincerely,
Vincent Mailhol

Re: [PATCH] can: c_can: Use platform id data when OF data is absent

[Vincent Mailhol]

On 24/06/2026 at 11:53, Vincent Mailhol wrote:
> On 24/06/2026 at 07:49, Pengpeng Hou wrote:
>> The platform driver keeps controller metadata in both the OF match table
>> and the platform id table.  Probe reads the metadata with
>> device_get_match_data(), which does not fall back to platform id-table
>> driver_data.
>>
>> When the device is matched through the platform id table, drvdata can
>> therefore be NULL before it is dereferenced for msg_obj_num and the
>> controller type.  Fall back to platform_get_device_id() when firmware
>> match data is not available.
> 
> So, you are telling me that this patch fixes a NULL pointer
> dereference? In that case, it needs to be backported. Please add a
> Fixes: tag.

Also, were you able to trigger that NULL pointer dereference?

> Fixes: 5e6c3454b405 ("net: can: Use device_get_match_data()")
> 
>> Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
>> ---
>>  drivers/net/can/c_can/c_can_platform.c | 8 ++++++++
>>  1 file changed, 8 insertions(+)
>>
>> diff --git a/drivers/net/can/c_can/c_can_platform.c b/drivers/net/can/c_can/c_can_platform.c
>> index 19c86b94a40e..564c9e5b4c2c 100644
>> --- a/drivers/net/can/c_can/c_can_platform.c
>> +++ b/drivers/net/can/c_can/c_can_platform.c
>> @@ -263,9 +263,17 @@ static int c_can_plat_probe(struct platform_device *pdev)
>>  	int irq;
>>  	struct clk *clk;
>>  	const struct c_can_driver_data *drvdata;
>> +	const struct platform_device_id *id;
>>  	struct device_node *np = pdev->dev.of_node;
>>  
>>  	drvdata = device_get_match_data(&pdev->dev);
>> +	if (!drvdata) {
>> +		id = platform_get_device_id(pdev);
>> +		if (!id)
>> +			return -ENODEV;
>> +
>> +		drvdata = (const struct c_can_driver_data *)id->driver_data;
>> +	}
> 
> Reduce the visibility of id:
> 
> 	if (!drvdata) {
> 		const struct platform_device_id *id;
> 
> 		id = platform_get_device_id(pdev);
> 		if (!id)
> 			return -ENODEV;
> 
> 		drvdata = (const struct c_can_driver_data *)id->driver_data;
> 	}
> 
>>  
>>  	/* get the appropriate clk */
>>  	clk = devm_clk_get(&pdev->dev, NULL);
> 
> With the Fixes: tag added and above nitpick addressed:
> 
> Reviewed-by: Vincent Mailhol <mailhol@kernel.org>


Yours sincerely,
Vincent Mailhol

[PATCH v2] can: c_can: Use platform id data when OF data is absent

[Pengpeng Hou]

The platform driver keeps controller metadata in both the OF match table
and the platform id table. Probe reads the metadata with
device_get_match_data(), which does not fall back to platform id-table
driver_data.

When the device is matched through the platform id table, drvdata can
therefore be NULL before it is dereferenced for msg_obj_num and the
controller type. Fall back to platform_get_device_id() when firmware
match data is not available.

Fixes: 5e6c3454b405 ("net: can: Use device_get_match_data()")
Cc: stable@vger.kernel.org
Reviewed-by: Vincent Mailhol <mailhol@kernel.org>
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
---
Changes in v2:
- Add the Fixes tag requested by Vincent.
- Scope the platform id variable inside the fallback block.
- Carry Vincent's Reviewed-by for the requested v2 shape.

 drivers/net/can/c_can/c_can_platform.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/net/can/c_can/c_can_platform.c b/drivers/net/can/c_can/c_can_platform.c
index 19c86b94a40e..8a0c88839d24 100644
--- a/drivers/net/can/c_can/c_can_platform.c
+++ b/drivers/net/can/c_can/c_can_platform.c
@@ -267,6 +267,14 @@ static int c_can_plat_probe(struct platform_device *pdev)
 	struct device_node *np = pdev->dev.of_node;
 
 	drvdata = device_get_match_data(&pdev->dev);
+	if (!drvdata) {
+		const struct platform_device_id *id;
+
+		id = platform_get_device_id(pdev);
+		if (!id)
+			return -ENODEV;
+		drvdata = (const struct c_can_driver_data *)id->driver_data;
+	}
 
 	/* get the appropriate clk */
 	clk = devm_clk_get(&pdev->dev, NULL);
-- 
2.50.1

Re: [PATCH v2] can: c_can: Use platform id data when OF data is absent

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] This problem wasn't introduced by this patch, but the regression fixed by this patch in `c_can_platform.c` is also present in `flexcan-core.c`, which was modified by the same original commit but remains unfixed. Commit 5e6c3454b405 incorrectly replaced `of_match_device()` and `platform_get_device_id()` checks with a single call to `device_get_match_data()`. Because `device_get_match_data()` does not fall back to `platform_device_id` tables, any driver matching via platform ID will receive a NULL pointer. In `flexcan-core.c`, the legacy non-DT platform "flexcan-mcf5441x" is matched via `flexcan_id_table`. When probed, `device_get_match_data()` returns NULL, which `flexcan_probe()` immediately dereferences (`devtype_data->quirks`), resulting in a kernel panic.
--

commit c16eef82e68ac57940a1f18250576d39cf8e239b
Author: Pengpeng Hou <pengpeng@iscas.ac.cn>

can: c_can: Use platform id data when OF data is absent
    
The platform driver keeps controller metadata in both the OF match table
and the platform id table. Probe reads the metadata with
device_get_match_data(), which does not fall back to platform id-table
driver_data.

When the device is matched through the platform id table, drvdata can
therefore be NULL before it is dereferenced for msg_obj_num and the
controller type. Fall back to platform_get_device_id() when firmware
match data is not available.

> diff --git a/drivers/net/can/c_can/c_can_platform.c b/drivers/net/can/c_can/c_can_platform.c
> index 19c86b94a40e4..d3529b4cc856e 100644
> --- a/drivers/net/can/c_can/c_can_platform.c
> +++ b/drivers/net/can/c_can/c_can_platform.c
> @@ -266,6 +266,14 @@ static int c_can_plat_probe(struct platform_device *pdev)
>  	struct device_node *np = pdev->dev.of_node;
>  
>  	drvdata = device_get_match_data(&pdev->dev);
> +	if (!drvdata) {
> +		const struct platform_device_id *id;
> +
> +		id = platform_get_device_id(pdev);
> +		if (!id)
> +			return -ENODEV;
> +		drvdata = (const struct c_can_driver_data *)id->driver_data;
> +	}

[Severity: High]
This isn't a bug introduced by this patch, but this patch fixes a regression
that seems to also be present in another driver modified by the same original
commit (5e6c3454b405).

In drivers/net/can/flexcan/flexcan-core.c in flexcan_probe(), the driver
matches via flexcan_id_table for the legacy non-DT platform flexcan-mcf5441x:

    devtype_data = device_get_match_data(&pdev->dev);

    if ((devtype_data->quirks & FLEXCAN_QUIRK_SUPPORT_FD) && ...

When probed on a non-DT platform device, device_get_match_data() returns
NULL, which is immediately dereferenced.

Should a similar fallback to platform_get_device_id() be added to
flexcan_probe() to prevent a NULL pointer dereference on these platforms?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260625054152.68413-1-pengpeng@iscas.ac.cn?part=1