Re: [PATCH v4 02/16] iio: adc: at91-sama5d2_adc: use cleanup.h for NVMEM buffer

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] The custom `DEFINE_FREE(nvmem_cell_put)` wrapper does not guard against `ERR_PTR` values, leading to a kernel panic when `nvmem_cell_get()` fails.
--

--- Patch [2]: [PATCH v4 02/16] iio: adc: at91-sama5d2_adc: use cleanup.h for NVMEM buffer ---
commit dbed20984526e19bec7734326990be3251fc20e1
Author: Varshini Rajendran <varshini.rajendran@microchip.com>

iio: adc: at91-sama5d2_adc: use cleanup.h for NVMEM buffer

This commit updates at91_adc_temp_sensor_init() to use scope-based cleanup
helpers. It introduces a custom DEFINE_FREE wrapper for nvmem_cell_put
and uses __free(kfree) to simplify the error handling paths.

> diff --git a/drivers/iio/adc/at91-sama5d2_adc.c b/drivers/iio/adc/at91-sama5d2_adc.c
> --- a/drivers/iio/adc/at91-sama5d2_adc.c
> +++ b/drivers/iio/adc/at91-sama5d2_adc.c
> @@ -35,6 +35,8 @@
>  
>  #include <dt-bindings/iio/adc/at91-sama5d2_adc.h>
>  
> +DEFINE_FREE(nvmem_cell_put, struct nvmem_cell *, if (_T) nvmem_cell_put(_T))

[ ... ]

> @@ -2249,33 +2251,28 @@ static int at91_adc_temp_sensor_init(struct at91_adc_state *st,
>  				     struct device *dev)
>  {
[ ... ]
>  	/* Get the calibration data from NVMEM. */
> -	temp_calib = nvmem_cell_get(dev, "temperature_calib");
> +	struct nvmem_cell *temp_calib __free(nvmem_cell_put) =
> +		nvmem_cell_get(dev, "temperature_calib");
>  	if (IS_ERR(temp_calib)) {
> -		ret = PTR_ERR(temp_calib);
> -		if (ret != -ENOENT)
> +		if (PTR_ERR(temp_calib) != -ENOENT)
>  			dev_err(dev, "Failed to get temperature_calib cell!\n");
> -		return ret;
> +		return PTR_ERR(temp_calib);
>  	}

[Severity: High]
Can returning early here cause a panic when the cleanup function runs?

nvmem_cell_get() returns an ERR_PTR on failure, such as -ENOENT or
-EPROBE_DEFER. Because the DEFINE_FREE wrapper for nvmem_cell_put only
checks if the pointer is non-zero (if (_T)), an ERR_PTR evaluates to true.

This means that nvmem_cell_put() will be called with an invalid pointer,
which can trigger a kernel panic when it attempts to dereference it.

Could the DEFINE_FREE macro be updated to use if (!IS_ERR_OR_NULL(_T)) to
safely handle these error codes?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260727122633.117435-1-varshini.rajendran@microchip.com?part=2