Re: [PATCH v2 2/2] pinctrl: apple: Add t8140-pinctrl support

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] pinctrl: apple: NULL pointer deref in apple_gpio_set_reg() due to lazy init
- [High] pinctrl: apple: unhandled ERR_PTR from failed regmap init causes crash
--

commit e83219f35e40fdd986984c342182dca31136d937
Author: Yureka Lilian <yureka@cyberchaos.dev>

pinctrl: apple: Add t8140-pinctrl support
    
Ensure the regmap does not attempt to read REG_GPIOx of any of the pins
marked with gpio-reserved-ranges. For this purpose, move the regmap_init
just before the first regmap_read, at which point the valid_mask has
been populated from the gpio-reserved-ranges device tree property.

> diff --git a/drivers/pinctrl/pinctrl-apple-gpio.c b/drivers/pinctrl/pinctrl-apple-gpio.c
> index 6305b96aaa733..6b26a23d283c5 100644
> --- a/drivers/pinctrl/pinctrl-apple-gpio.c
> +++ b/drivers/pinctrl/pinctrl-apple-gpio.c
[ ... ]
> @@ -90,6 +98,13 @@ static u32 apple_gpio_get_reg(struct apple_gpio_pinctrl *pctl,
>  	int ret;
>  	u32 val;
>  
> +	if (!pctl->map)	{
> +		pctl->map = devm_regmap_init_mmio(pctl->dev, pctl->base, &regmap_config);
> +		if (IS_ERR(pctl->map))
> +			return dev_err_probe(pctl->dev, PTR_ERR(pctl->map),
> +					"Failed to create regmap\n");

[Severity: High]
If devm_regmap_init_mmio() fails here, pctl->map is assigned an ERR_PTR but
is never cleared.

Will subsequent calls to apple_gpio_get_reg() bypass this lazy
initialization check since pctl->map is no longer NULL, and dereference
the unhandled ERR_PTR in the following regmap_read() call?

[Severity: High]
Since pctl->map is now lazily initialized only in apple_gpio_get_reg(), what
happens if apple_gpio_set_reg() is called first?

If the device tree contains pinctrl hogs, or a consumer device requests a
pinmux before the first GPIO read triggers this lazy initialization,
apple_gpio_pinmux_set() can call apple_gpio_set_reg().

apple_gpio_set_reg() will then blindly pass the NULL pctl->map to
regmap_update_bits():

drivers/pinctrl/pinctrl-apple-gpio.c:apple_gpio_set_reg() {
	regmap_update_bits(pctl->map, REG_GPIO(pin), mask, value);
}

Could this result in a NULL pointer dereference causing a kernel panic?

> +	}
> +
>  	ret = regmap_read(pctl->map, REG_GPIO(pin), &val);
>  	if (ret)
>  		return 0;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260926-apple-pinctrl-t8140-v2-0-620bd11cd2a1@cyberchaos.dev?part=2