Re: [PATCH 3/9] watchdog: w83627hf_wdt: Use private driver data structure

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Possible NULL pointer dereference of `id` in `wdt_probe` if device is matched via `driver_override`.
--

--- Patch [3]: [PATCH 3/9] watchdog: w83627hf_wdt: Use private driver data structure ---
commit a08865ae24d92d72840774e0d257ddcdf06b2ed4
Author: Paul Louvel <paul.louvel@bootlin.com>

watchdog: w83627hf_wdt: Use private driver data structure
    
Allocating a per-device data structure is a common practice in the Linux
driver model. Add one that will be used to store chip-specific register
offsets, and configuration.

> diff --git a/drivers/watchdog/w83627hf_wdt.c b/drivers/watchdog/w83627hf_wdt.c
> index 993e65ce4447c..72e167f37885f 100644
> --- a/drivers/watchdog/w83627hf_wdt.c
> +++ b/drivers/watchdog/w83627hf_wdt.c
[ ... ]
> @@ -471,28 +464,44 @@ static int wdt_probe(struct platform_device *pdev)
>  {
>  	const struct platform_device_id *id = platform_get_device_id(pdev);
>  	enum chips chip = id->driver_data;
                          ^^^^^^^^^^^^^^^

[Severity: High]
Can platform_get_device_id() return NULL here?

If a user with root privileges writes the name of this driver ("w83627hf_wdt")
to the driver_override sysfs attribute of an arbitrary platform device and
forces it to bind, the device might not match any entry in the driver's
wdt_ids table.

In this case, platform_get_device_id() would return NULL, causing a NULL
pointer dereference when accessing id->driver_data.

Note that this issue appears to have been introduced when the driver was
converted to the platform driver model in patch 2 of this series.

[ ... ]
> +	data = devm_kzalloc(&pdev->dev, sizeof(*data), GFP_KERNEL);
> +	if (!data)
> +		return -ENOMEM;
> +
> +	data->info.options = WDIOF_SETTIMEOUT | WDIOF_KEEPALIVEPING | WDIOF_MAGICCLOSE;
> +	snprintf(data->info.identity, sizeof(data->info.identity),
> +		 "%s Watchdog", id->name);
                                ^^^^^^^^

[Severity: High]
Does this also cause a NULL pointer dereference if id is NULL under the same
driver_override condition?

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260725-w83627hf_wdt-improvements-v1-0-4e9a1b4e8297@bootlin.com?part=3