Re: [PATCH v5 07/13] Input: adp5585: use devm_blocking_notifier_chain_register()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] This problem wasn't introduced by this patch, but there is a potential NULL pointer dereference due to an unchecked `platform_get_device_id()` return value.
--

--- Patch [7]: [PATCH v5 07/13] Input: adp5585: use devm_blocking_notifier_chain_register() ---
commit 7fdada2980ba610dca31ca2b97c993a21524a85f
Author: Eliav Farber <farbere@amazon.com>

Input: adp5585: use devm_blocking_notifier_chain_register()

This commit replaces the manual registration and devm cleanup of the
blocking notifier chain with a single call to
devm_blocking_notifier_chain_register().

> diff --git a/drivers/input/keyboard/adp5585-keys.c b/drivers/input/keyboard/adp5585-keys.c
> index 4208229e13561..012558237674e 100644
> --- a/drivers/input/keyboard/adp5585-keys.c
> +++ b/drivers/input/keyboard/adp5585-keys.c
[ ... ]
>  static int adp5585_keys_probe(struct platform_device *pdev)
>  {
>  	const struct platform_device_id *id = platform_get_device_id(pdev);

[Severity: High]
This isn't a bug introduced by this patch, but is it possible for
platform_get_device_id() to return a null pointer here and cause a panic
when id->driver_data is dereferenced?

Looking at adp5585_keys_probe(), the returned id is not checked before
accessing id->driver_data:

drivers/input/keyboard/adp5585-keys.c:adp5585_keys_probe() {
        const struct platform_device_id *id = platform_get_device_id(pdev);
        ...
        kpad->info = (const struct adp5585_kpad_chip *)id->driver_data;
}

If a privileged user writes an arbitrary string to the driver_override
sysfs attribute of a platform device and binds it to this driver,
platform_get_device_id() will return null because the bound device
name doesn't match the driver's id_table. Does this code need a null
pointer check to prevent a local denial of service?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260816060648.4030-1-farbere@amazon.com?part=7