Re: [PATCH v3 2/2] gpio: axiado: add AX3005 SGPIO controller support

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] The IRQ domain is instantiated and published before the driver's internal state (`sgpio->gpio`) is fully initialized, allowing concurrent IRQ requests to cause a NULL pointer dereference.
--

commit 4babc207a066bfa307e830995ecabfdcf12404d1
Author: Petar Stepanovic <pstepanovic@axiado.com>

gpio: axiado: add AX3005 SGPIO controller support
    
Add support for the Axiado AX3005 SGPIO controller.
    
Each SGPIO position provides one input GPIO and one output GPIO with
fixed directions. The driver registers the controller as a gpio_chip,
supports interrupts on input GPIOs, and uses regmap for register access.

> diff --git a/drivers/gpio/gpio-axiado-sgpio.c b/drivers/gpio/gpio-axiado-sgpio.c
> new file mode 100644
> index 0000000000000..a7c970217c59e
> --- /dev/null
> +++ b/drivers/gpio/gpio-axiado-sgpio.c
[ ... ]
> +static int axiado_sgpio_irq_request_resources(struct irq_data *d)
> +{
> +	struct axiado_sgpio *sgpio = irq_data_get_irq_chip_data(d);
> +
> +	return gpio_regmap_reqres_irq(sgpio->gpio, d->hwirq);
> +}
[ ... ]
> +static int axiado_sgpio_probe(struct platform_device *pdev)
> +{
[ ... ]
> +	d_info.fwnode = dev_fwnode(&pdev->dev);
> +	d_info.size = ngpio;
> +	d_info.hwirq_max = ngpio;
> +	d_info.ops = &axiado_sgpio_domain_ops;
> +	d_info.host_data = sgpio;
> +
> +	sgpio->domain = devm_irq_domain_instantiate(&pdev->dev, &d_info);
> +	if (IS_ERR(sgpio->domain))
> +		return PTR_ERR(sgpio->domain);
> +
> +	config.parent = &pdev->dev;
> +	config.regmap = sgpio->regmap;
> +	config.ngpio = ngpio;
> +	config.reg_dat_base = GPIO_REGMAP_ADDR(sgpio->regs->din_ss);
> +	config.reg_set_base = GPIO_REGMAP_ADDR(sgpio->regs->dout_ss);
> +	config.reg_mask_xlate = axiado_sgpio_reg_mask_xlate;
> +	config.fixed_direction_output = sgpio->dir_out;
> +	config.irq_domain = sgpio->domain;
> +	config.drvdata = sgpio;
> +
> +	sgpio->gpio = devm_gpio_regmap_register(&pdev->dev, &config);

[Severity: High]
Could concurrent IRQ mapping trigger a NULL pointer dereference here?

The IRQ domain is instantiated and published by devm_irq_domain_instantiate()
before sgpio->gpio is assigned by devm_gpio_regmap_register().

If a consumer driver probes concurrently and resolves the IRQ via the
device tree, it can call request_irq(), which invokes
axiado_sgpio_irq_request_resources().

That callback will dereference sgpio->gpio before it has been set:

	return gpio_regmap_reqres_irq(sgpio->gpio, d->hwirq);

> +	if (IS_ERR(sgpio->gpio))
> +		return dev_err_probe(&pdev->dev, PTR_ERR(sgpio->gpio),
> +				     "Could not register gpiochip\n");

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260903-axiado-ax3000-sgpio-controller-v3-0-b30820e1b858@axiado.com?part=2