[PATCH] leds: is31fl32xx: Fix NULL pointer dereference when binding via I2C ID table

[PATCH] leds: is31fl32xx: Fix NULL pointer dereference when binding via I2C ID table

[Rosen Penev]

If the device binds via the I2C ID table (e.g., fallback matching by
node name, sysfs new_device, or software node),
device_get_match_data() in is31fl32xx_probe() returns NULL because
the is31fl32xx_id table entries have no .driver_data.

Without a NULL check, is31fl32xx_parse_dt() will unconditionally
dereference cdef when checking cdef->output_frequency_setting_reg,
and is31fl32xx_parse_child_dt() will dereference cdef->channels,
leading to a NULL pointer dereference and kernel oops.

Add a NULL check for cdef alongside the existing child count check in
is31fl32xx_probe(), returning -EINVAL if no match data is available.

Fixes: 2779f4724b2f ("leds: various: use device_get_match_data")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Rosen Penev <rosenp@gmail.com>
---
 drivers/leds/leds-is31fl32xx.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/leds/leds-is31fl32xx.c b/drivers/leds/leds-is31fl32xx.c
index 285085d27453..7bb0295b0b49 100644
--- a/drivers/leds/leds-is31fl32xx.c
+++ b/drivers/leds/leds-is31fl32xx.c
@@ -577,7 +577,7 @@ static int is31fl32xx_probe(struct i2c_client *client)
 	cdef = device_get_match_data(dev);
 
 	count = device_get_child_node_count(dev);
-	if (!count)
+	if (!cdef || !count)
 		return -EINVAL;
 
 	priv = devm_kzalloc(dev, struct_size(priv, leds, count),
-- 
2.56.0

Re: [PATCH] leds: is31fl32xx: Fix NULL pointer dereference when binding via I2C ID table

[sashiko-bot]

> If the device binds via the I2C ID table (e.g., fallback matching by
> node name, sysfs new_device, or software node),
> device_get_match_data() in is31fl32xx_probe() returns NULL because
> the is31fl32xx_id table entries have no .driver_data.
> 
> Without a NULL check, is31fl32xx_parse_dt() will unconditionally
> dereference cdef when checking cdef->output_frequency_setting_reg,
> and is31fl32xx_parse_child_dt() will dereference cdef->channels,
> leading to a NULL pointer dereference and kernel oops.
> 
> Add a NULL check for cdef alongside the existing child count check in
> is31fl32xx_probe(), returning -EINVAL if no match data is available.
> 
> Fixes: 2779f4724b2f ("leds: various: use device_get_match_data")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Signed-off-by: Rosen Penev <rosenp@gmail.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261005194923.161411-1-rosenp@gmail.com?part=1

Re: [PATCH] leds: is31fl32xx: Fix NULL pointer dereference when binding via I2C ID table

[Griffin Kroah-Hartman]

On Mon, 05 Oct 2026 12:49:23 -0700, Rosen Penev <rosenp@gmail.com> wrote:
> leds: is31fl32xx: Fix NULL pointer dereference when binding via I2C ID table

Reviewed-by: Griffin Kroah-Hartman <griffin@kroah.com>

-- 
 

Re: [PATCH] leds: is31fl32xx: Fix NULL pointer dereference when binding via I2C ID table

[Lee Jones]

On Mon, 05 Oct 2026, Lee Jones wrote:

> --- checkpatch.pl: clean (0 issues) ---
> 
> On Mon, 05 Oct 2026, Rosen Penev wrote:
> 
> > If the device binds via the I2C ID table (e.g., fallback matching by
> > node name, sysfs new_device, or software node),
> > device_get_match_data() in is31fl32xx_probe() returns NULL because
> > the is31fl32xx_id table entries have no .driver_data.
> >
> > Without a NULL check, is31fl32xx_parse_dt() will unconditionally
> > dereference cdef when checking cdef->output_frequency_setting_reg,
> > and is31fl32xx_parse_child_dt() will dereference cdef->channels,
> > leading to a NULL pointer dereference and kernel oops.
> >
> > Add a NULL check for cdef alongside the existing child count check in
> > is31fl32xx_probe(), returning -EINVAL if no match data is available.
> >
> > Fixes: 2779f4724b2f ("leds: various: use device_get_match_data")
> > Cc: stable@vger.kernel.org
> > Assisted-by: LLM
> > Signed-off-by: Rosen Penev <rosenp@gmail.com>
> > ---
> >  drivers/leds/leds-is31fl32xx.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/drivers/leds/leds-is31fl32xx.c b/drivers/leds/leds-is31fl32xx.c
> > index 285085d27453..7bb0295b0b49 100644
> > --- a/drivers/leds/leds-is31fl32xx.c
> > +++ b/drivers/leds/leds-is31fl32xx.c
> > @@ -577,7 +577,7 @@ static int is31fl32xx_probe(struct i2c_client *client)
> >  	cdef = device_get_match_data(dev);
> >
> >  	count = device_get_child_node_count(dev);
> > -	if (!count)
> > +	if (!cdef || !count)
> >  		return -EINVAL;

If it's possible for devices to be autoloaded via is31fl32xx_id,
wouldn't it make more sense to populate its .driver_data instead?

Or, if that's not possible for some odd reason (which you must specify),
since this is an || it's odd to check the return values like this.  It
more inline with current coding guidelines to place the check below its
caller / allocator.

> >  	priv = devm_kzalloc(dev, struct_size(priv, leds, count),
> > -- 
> > 2.56.0
> >
> 
> -- 
> Lee Jones

-- 
Lee Jones