Re: [PATCH] serial: mvebu-uart: drop of_match_ptr for ID table

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Medium] serial: mvebu-uart: NULL dereference in mvebu_uart_probe() on
  PRP0001 match
--

commit 3010b076c87d51f51ddcc431e71fb7901421ff0f
Author: Bramuel Barack <bramwelbarack89@gmail.com>

serial: mvebu-uart: drop of_match_ptr for ID table

This commit removes the of_match_ptr() wrapper around mvebu_uart_of_match
in mvebu_uart_platform_driver.

> diff --git a/drivers/tty/serial/mvebu-uart.c b/drivers/tty/serial/mvebu-uart.c
> index 8a61517d81f21..4026f4c0bf2cf 100644
> --- a/drivers/tty/serial/mvebu-uart.c
> +++ b/drivers/tty/serial/mvebu-uart.c
> @@ -1015,7 +1015,7 @@ static struct platform_driver mvebu_uart_platform_driver = {
>  	.probe	= mvebu_uart_probe,
>  	.driver	= {
>  		.name  = "mvebu-uart",
> -		.of_match_table = of_match_ptr(mvebu_uart_of_match),
> +		.of_match_table = mvebu_uart_of_match,

[Severity: Medium]
Can this cause a NULL pointer dereference in mvebu_uart_probe() when a
device matches via ACPI PRP0001?

drivers/tty/serial/mvebu-uart.c:mvebu_uart_probe() {
	...
	const struct of_device_id *match = of_match_device(mvebu_uart_of_match,
							   &pdev->dev);
	...
	mvuart->data = (struct mvebu_uart_driver_data *)match->data;
	...
}

When a device binds via ACPI PRP0001 (or when CONFIG_OF is disabled),
of_match_device() returns NULL because pdev->dev.of_node is NULL, and
mvebu_uart_probe() then unconditionally dereferences match->data.  Using
device_get_match_data(&pdev->dev) would support both DT and ACPI PRP0001
matching.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261115150742.24126-1-bramwelbarack89@gmail.com?part=1