public inbox for linux-arm-kernel@lists.infradead.org
 help / color / mirror / Atom feed
From: Sasha Levin <sashal@kernel.org>
To: patches@lists.linux.dev, stable@vger.kernel.org
Cc: Chen Ni <nichen@iscas.ac.cn>, Mark Brown <broonie@kernel.org>,
	Sasha Levin <sashal@kernel.org>,
	fengzheng923@gmail.com, wens@kernel.org,
	jernej.skrabec@gmail.com, samuel@sholland.org,
	linux-sound@vger.kernel.org,
	linux-arm-kernel@lists.infradead.org,
	linux-sunxi@lists.linux.dev
Subject: [PATCH AUTOSEL 6.19-6.1] ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio
Date: Fri, 13 Feb 2026 20:00:02 -0500	[thread overview]
Message-ID: <20260214010245.3671907-122-sashal@kernel.org> (raw)
In-Reply-To: <20260214010245.3671907-1-sashal@kernel.org>

From: Chen Ni <nichen@iscas.ac.cn>

[ Upstream commit 74823db9ba2e13f3ec007b354759b3d8125e462c ]

Add check for the return value of devm_regmap_init_mmio() and return the
error if it fails in order to catch the error.

Signed-off-by: Chen Ni <nichen@iscas.ac.cn>
Link: https://patch.msgid.link/20260127033250.2044608-1-nichen@iscas.ac.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---

LLM Generated explanations, may be completely bogus:

## Analysis

### Commit Message Analysis

The commit adds a missing error check for `devm_regmap_init_mmio()` in
the sun50i-dmic audio driver's probe function. The message is
straightforward - it's adding a return value check that was missing.

### Code Change Analysis

The change is a 3-line addition:
```c
if (IS_ERR(host->regmap))
    return dev_err_probe(&pdev->dev, PTR_ERR(host->regmap),
                         "failed to initialise regmap\n");
```

This is inserted right after `devm_regmap_init_mmio()` returns into
`host->regmap`. Without this check, if `devm_regmap_init_mmio()` fails,
`host->regmap` will contain an ERR_PTR value. The driver then continues
execution and eventually uses this regmap pointer in subsequent
operations (regmap reads/writes), which would cause a NULL pointer
dereference or other crash since the ERR_PTR would be interpreted as a
valid pointer.

### Bug Mechanism

If `devm_regmap_init_mmio()` fails (e.g., memory allocation failure
inside regmap), the error pointer gets stored in `host->regmap`. Later,
when the driver tries to use regmap APIs with this invalid pointer, it
will crash. This is a real bug - a missing error check that leads to use
of an error pointer as a valid pointer.

### Severity Assessment

- **Trigger**: `devm_regmap_init_mmio()` would need to fail, which is
  uncommon but possible (memory pressure, internal regmap errors)
- **Consequence**: Kernel crash/oops when the invalid regmap pointer is
  subsequently used
- **Likelihood**: Low probability but non-zero, especially under memory
  pressure

### Stable Kernel Criteria

1. **Obviously correct and tested**: Yes - this follows the exact same
   pattern as all surrounding error checks in the same function. It's a
   textbook missing error check fix.
2. **Fixes a real bug**: Yes - missing error check on a function that
   can fail, leading to use of an ERR_PTR as a valid pointer.
3. **Important issue**: Moderate - it's a potential NULL deref/crash,
   though the trigger condition is uncommon.
4. **Small and contained**: Yes - 3 lines added, single file, no
   behavioral change on success path.
5. **No new features**: Correct - purely defensive error checking.
6. **Applies cleanly**: The change is self-contained with no
   dependencies.

### Risk Assessment

- **Risk**: Extremely low. The change only affects the error path. On
  the success path, behavior is identical.
- **Benefit**: Prevents a kernel crash if regmap initialization fails.
- **Pattern**: This is a very common type of stable fix - adding missing
  error checks in driver probe functions.

### Concerns

This is a fairly minor fix for an uncommon failure path in a specific
ARM SoC audio driver. The user base is limited to Allwinner sun50i
platforms. However, the fix is trivially correct, has zero risk of
regression, and prevents a real (if unlikely) crash.

### Decision

The fix is small, obviously correct, follows existing patterns in the
same function, prevents a potential crash from using an ERR_PTR, and has
essentially zero regression risk. It meets all stable kernel criteria.

**YES**

 sound/soc/sunxi/sun50i-dmic.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/sound/soc/sunxi/sun50i-dmic.c b/sound/soc/sunxi/sun50i-dmic.c
index bab1e29c99887..eddfebe166169 100644
--- a/sound/soc/sunxi/sun50i-dmic.c
+++ b/sound/soc/sunxi/sun50i-dmic.c
@@ -358,6 +358,9 @@ static int sun50i_dmic_probe(struct platform_device *pdev)
 
 	host->regmap = devm_regmap_init_mmio(&pdev->dev, base,
 					     &sun50i_dmic_regmap_config);
+	if (IS_ERR(host->regmap))
+		return dev_err_probe(&pdev->dev, PTR_ERR(host->regmap),
+				     "failed to initialise regmap\n");
 
 	/* Clocks */
 	host->bus_clk = devm_clk_get(&pdev->dev, "bus");
-- 
2.51.0



      parent reply	other threads:[~2026-02-14  1:07 UTC|newest]

Thread overview: 11+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
     [not found] <20260214010245.3671907-1-sashal@kernel.org>
2026-02-14  0:58 ` [PATCH AUTOSEL 6.19-5.15] drm/v3d: Set DMA segment size to avoid debug warnings Sasha Levin
2026-02-14  0:58 ` [PATCH AUTOSEL 6.19-6.12] ASoC: fsl: imx-rpmsg: use snd_soc_find_dai_with_mutex() in probe Sasha Levin
2026-02-14  0:58 ` [PATCH AUTOSEL 6.19-5.10] drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release Sasha Levin
2026-02-14  0:58 ` [PATCH AUTOSEL 6.19-5.15] spi: stm32: fix Overrun issue at < 8bpw Sasha Levin
2026-02-14  0:58 ` [PATCH AUTOSEL 6.19-5.10] drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback Sasha Levin
2026-02-14  0:58 ` [PATCH AUTOSEL 6.19-6.1] media: rkisp1: Fix filter mode register configuration Sasha Levin
2026-02-14  0:58 ` [PATCH AUTOSEL 6.19-5.15] drm/atmel-hlcdc: don't reject the commit if the src rect has fractional parts Sasha Levin
2026-02-14  0:59 ` [PATCH AUTOSEL 6.19-5.10] gpio: aspeed-sgpio: Change the macro to support deferred probe Sasha Levin
2026-02-14  0:59 ` [PATCH AUTOSEL 6.19] drm/atmel-hlcdc: destroy properly the plane state in the reset callback Sasha Levin
2026-02-14  0:59 ` [PATCH AUTOSEL 6.19-6.6] media: mediatek: vcodec: Don't try to decode 422/444 VP9 Sasha Levin
2026-02-14  1:00 ` Sasha Levin [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260214010245.3671907-122-sashal@kernel.org \
    --to=sashal@kernel.org \
    --cc=broonie@kernel.org \
    --cc=fengzheng923@gmail.com \
    --cc=jernej.skrabec@gmail.com \
    --cc=linux-arm-kernel@lists.infradead.org \
    --cc=linux-sound@vger.kernel.org \
    --cc=linux-sunxi@lists.linux.dev \
    --cc=nichen@iscas.ac.cn \
    --cc=patches@lists.linux.dev \
    --cc=samuel@sholland.org \
    --cc=stable@vger.kernel.org \
    --cc=wens@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox