[PATCH] usb: typec: nb7vpq904m: Set client data in probe to avoid crash on remove

[PATCH] usb: typec: nb7vpq904m: Set client data in probe to avoid crash on remove

[Chaz Bailey]

nb7vpq904m_probe() allocates struct nb7vpq904m but neglects to call
i2c_set_clientdata(client, nb7).

In nb7vpq904m_remove(), i2c_get_clientdata(client) returns NULL, leading
to a NULL pointer dereference when accessing nb7->retimer or nb7->sw.

Set client data upon successful allocation in probe.

Fixes: 88d8f3ac9c67 ("usb: typec: add support for the nb7vpq904m Type-C Linear Redriver")
Cc: stable@vger.kernel.org
Signed-off-by: Chaz Bailey <charles.s.bailey@gmail.com>
---
 drivers/usb/typec/mux/nb7vpq904m.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/usb/typec/mux/nb7vpq904m.c b/drivers/usb/typec/mux/nb7vpq904m.c
index d1fa26ff44..52e3c9db35 100644
--- a/drivers/usb/typec/mux/nb7vpq904m.c
+++ b/drivers/usb/typec/mux/nb7vpq904m.c
@@ -396,6 +396,7 @@ static int nb7vpq904m_probe(struct i2c_client *client)
 		return -ENOMEM;
 
 	nb7->client = client;
+	i2c_set_clientdata(client, nb7);
 
 	nb7->regmap = devm_regmap_init_i2c(client, &nb7_regmap);
 	if (IS_ERR(nb7->regmap)) {
-- 
2.55.0

Re: [PATCH] usb: typec: nb7vpq904m: Set client data in probe to avoid crash on remove

[sashiko-bot]

> nb7vpq904m_probe() allocates struct nb7vpq904m but neglects to call
> i2c_set_clientdata(client, nb7).
> 
> In nb7vpq904m_remove(), i2c_get_clientdata(client) returns NULL, leading
> to a NULL pointer dereference when accessing nb7->retimer or nb7->sw.
> 
> Set client data upon successful allocation in probe.
> 
> Fixes: 88d8f3ac9c67 ("usb: typec: add support for the nb7vpq904m Type-C Linear Redriver")
> Cc: stable@vger.kernel.org
> Signed-off-by: Chaz Bailey <charles.s.bailey@gmail.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261016080517.156248-1-charles.s.bailey@gmail.com?part=1

Re: [PATCH] usb: typec: nb7vpq904m: Set client data in probe to avoid crash on remove

[Krishna Kurapati]

On 10/16/2026 1:35 PM, Chaz Bailey wrote:
> nb7vpq904m_probe() allocates struct nb7vpq904m but neglects to call
> i2c_set_clientdata(client, nb7).
> 
> In nb7vpq904m_remove(), i2c_get_clientdata(client) returns NULL, leading
> to a NULL pointer dereference when accessing nb7->retimer or nb7->sw.
> 
> Set client data upon successful allocation in probe.
> 
> Fixes: 88d8f3ac9c67 ("usb: typec: add support for the nb7vpq904m Type-C Linear Redriver")
> Cc: stable@vger.kernel.org
> Signed-off-by: Chaz Bailey <charles.s.bailey@gmail.com>

Minor nit:

Instead of "neglects to call i2c_set_clientdata", mention that "client 
data is not set during probe".

With that,

Reviewed-by: Krishna Kurapati <krishna.kurapati@oss.qualcomm.com>

> ---
>   drivers/usb/typec/mux/nb7vpq904m.c | 1 +
>   1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/usb/typec/mux/nb7vpq904m.c b/drivers/usb/typec/mux/nb7vpq904m.c
> index d1fa26ff44..52e3c9db35 100644
> --- a/drivers/usb/typec/mux/nb7vpq904m.c
> +++ b/drivers/usb/typec/mux/nb7vpq904m.c
> @@ -396,6 +396,7 @@ static int nb7vpq904m_probe(struct i2c_client *client)
>   		return -ENOMEM;
>   
>   	nb7->client = client;
> +	i2c_set_clientdata(client, nb7);
>   
>   	nb7->regmap = devm_regmap_init_i2c(client, &nb7_regmap);
>   	if (IS_ERR(nb7->regmap)) {