[PATCH can 0/4] can: fix probing and use of device_get_match_data()

[PATCH can 0/4] can: fix probing and use of device_get_match_data()

[Marc Kleine-Budde]

With patch 5e6c3454b405 ("net: can: Use device_get_match_data()") several
CAN drivers were converted to device_get_match_data(). The author assumed
that error checking for matching and match data is not necessary.

This misses the fact that that drivers on the platform bus can forcefully
bound using driver_override and device_get_match_data() will return NULL.

By using device_get_match_data(), this change broke probing for
m68k/coldfire, which still uses platform devices.

This series adds missing NULL pointer checks and fixes probing for the
flexcan on m68k/coldfire.

Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
---
Marc Kleine-Budde (4):
      can: c_can: c_can_plat_probe(): reject devices without match data
      can: flexcan: flexcan_probe(): fix probing for m68k/coldfire and reject devices without match data
      can: xilinx_can: xcan_probe(): reject devices without match data
      can: rcar_canfd: rcar_canfd_probe(): reject devices without match data

 drivers/net/can/c_can/c_can_platform.c | 2 ++
 drivers/net/can/flexcan/flexcan-core.c | 5 +++++
 drivers/net/can/rcar/rcar_canfd.c      | 2 ++
 drivers/net/can/xilinx_can.c           | 2 ++
 4 files changed, 11 insertions(+)
---
base-commit: ead6fa9a0ab194f02a2f36d634b193e9c5f9a1c6
base-tree: git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git main
change-id: 20261114-fix-device_get_match_data-11dc9cd85ec7

Best regards,
--  
Marc Kleine-Budde <mkl@pengutronix.de>

[PATCH can 1/4] can: c_can: c_can_plat_probe(): reject devices without match data

[Marc Kleine-Budde]

A device bound through driver_override need not match an entry in
of_match_table or id_table. In that case device_get_match_data() returns
NULL, but c_can_plat_probe() dereferences the result.

Reject devices without match data before continuing probe.

Fixes: 5e6c3454b405 ("net: can: Use device_get_match_data()")
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
---
 drivers/net/can/c_can/c_can_platform.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/can/c_can/c_can_platform.c b/drivers/net/can/c_can/c_can_platform.c
index 75607b1afd2e..b6012cd713ce 100644
--- a/drivers/net/can/c_can/c_can_platform.c
+++ b/drivers/net/can/c_can/c_can_platform.c
@@ -266,6 +266,8 @@ static int c_can_plat_probe(struct platform_device *pdev)
 	struct device_node *np = pdev->dev.of_node;
 
 	drvdata = device_get_match_data(&pdev->dev);
+	if (!drvdata)
+		return -ENODEV;
 
 	/* get the appropriate clk */
 	clk = devm_clk_get(&pdev->dev, NULL);

-- 
2.53.0

Re: [PATCH can 1/4] can: c_can: c_can_plat_probe(): reject devices without match data

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Medium] can: c_can: c_can_plat_probe() rejects c_can_id_table matches
  with -ENODEV
--

commit e910ae3e03adb41c30f60d29d9b4c11824109fe5
Author: Marc Kleine-Budde <mkl@pengutronix.de>

can: c_can: c_can_plat_probe(): reject devices without match data

This commit rejects devices in c_can_plat_probe() when
device_get_match_data() returns NULL.

> diff --git a/drivers/net/can/c_can/c_can_platform.c b/drivers/net/can/c_can/c_can_platform.c
> index 75607b1afd2e9..b6012cd713cee 100644
> --- a/drivers/net/can/c_can/c_can_platform.c
> +++ b/drivers/net/can/c_can/c_can_platform.c
> @@ -266,6 +266,8 @@ static int c_can_plat_probe(struct platform_device *pdev)
>  	struct device_node *np = pdev->dev.of_node;
>  
>  	drvdata = device_get_match_data(&pdev->dev);
> +	if (!drvdata)
> +		return -ENODEV;

[Severity: Medium]
Does this reject non-fwnode platform devices matched via c_can_id_table?

device_get_match_data() only queries dev_fwnode(dev) and never inspects
struct platform_driver.id_table.  Because c_can_plat_driver registers
.id_table = c_can_id_table with .driver_data pointers, devices matched
through c_can_id_table get NULL from device_get_match_data() and fail
probe with -ENODEV unless platform_get_device_id(pdev) is checked as a
fallback (as done prior to 5e6c3454b405 ("net: can: Use
device_get_match_data()")).

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261114-fix-device_get_match_data-v1-0-2d82025e9646@pengutronix.de?part=1

[PATCH can 2/4] can: flexcan: flexcan_probe(): fix probing for m68k/coldfire and reject devices without match data

[Marc Kleine-Budde]

When determining the device details was reworked in commit 5e6c3454b405
("net: can: Use device_get_match_data()") there was no replacement for the
previous handling of non-of instantiated devices via the device's id_entry
which then results in a NULL pointer exception. The only in-tree provider
of such a device is arch/m68k/coldfire/device.c.

Restore retrieving the devtype_data via platform_get_device_id().

Also a device bound through driver_override need not match an entry in
of_match_table or id_table. In that case device_get_match_data() returns
NULL, but flexcan_probe() dereferences the result.

Reject devices without match data before continuing probe.

Fixes: 5e6c3454b405 ("net: can: Use device_get_match_data()")
Cc: stable@vger.kernel.org
Reported-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
Closes: https://lore.kernel.org/all/20260618140147.142489-2-u.kleine-koenig@baylibre.com/
Reported-by: Marc Kleine-Budde <mkl@pengutronix.de>
Closes: https://lore.kernel.org/all/20260528-fluorescent-sage-ladybug-43261b-mkl@pengutronix.de/
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
---
 drivers/net/can/flexcan/flexcan-core.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/net/can/flexcan/flexcan-core.c b/drivers/net/can/flexcan/flexcan-core.c
index 86b40abe9e76..2bb9e4184eb5 100644
--- a/drivers/net/can/flexcan/flexcan-core.c
+++ b/drivers/net/can/flexcan/flexcan-core.c
@@ -2148,6 +2148,11 @@ static int flexcan_probe(struct platform_device *pdev)
 		return PTR_ERR(regs);
 
 	devtype_data = device_get_match_data(&pdev->dev);
+	if (!devtype_data && platform_get_device_id(pdev))
+		devtype_data = (struct flexcan_devtype_data *)
+			platform_get_device_id(pdev)->driver_data;
+	if (!devtype_data)
+		return -ENODEV;
 
 	if ((devtype_data->quirks & FLEXCAN_QUIRK_SUPPORT_FD) &&
 	    !((devtype_data->quirks &

-- 
2.53.0

Re: [PATCH can 2/4] can: flexcan: flexcan_probe(): fix probing for m68k/coldfire and reject devices without match data

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found no new issues
in this patch, but noticed 1 related pre-existing issue it does not
introduce:
- [Medium] can: flexcan: PM runtime double put in flexcan_probe() [1]
--

commit 358ff5ffd9961920463407d0074c445e652d7609
Author: Marc Kleine-Budde <mkl@pengutronix.de>

can: flexcan: flexcan_probe(): fix probing for m68k/coldfire and reject devices without match data

This commit restores falling back to platform_get_device_id() in
flexcan_probe() for non-OF devices and returns -ENODEV when no match data
is found.

> diff --git a/drivers/net/can/flexcan/flexcan-core.c b/drivers/net/can/flexcan/flexcan-core.c
> index 86b40abe9e767..2bb9e4184eb57 100644
> --- a/drivers/net/can/flexcan/flexcan-core.c
> +++ b/drivers/net/can/flexcan/flexcan-core.c
> @@ -2148,6 +2148,11 @@ static int flexcan_probe(struct platform_device *pdev)
>  		return PTR_ERR(regs);
>  
>  	devtype_data = device_get_match_data(&pdev->dev);
> +	if (!devtype_data && platform_get_device_id(pdev))
> +		devtype_data = (struct flexcan_devtype_data *)
> +			platform_get_device_id(pdev)->driver_data;
> +	if (!devtype_data)
> +		return -ENODEV;
>  
>  	if ((devtype_data->quirks & FLEXCAN_QUIRK_SUPPORT_FD) &&
>  	    !((devtype_data->quirks &

[Severity: Medium]
This problem wasn't introduced by this patch, but does flexcan_probe() drop
the PM runtime reference twice [1] when flexcan_setup_stop_mode()
fails?

flexcan_probe() acquires a reference with pm_runtime_get_noresume(), and
register_flexcandev() drops it with pm_runtime_put() before returning 0.  If
flexcan_setup_stop_mode() then fails, the error path falls through from
failed_setup_stop_mode to failed_register and calls pm_runtime_put_noidle()
a second time, underflowing the usage counter:

drivers/net/can/flexcan/flexcan-core.c:flexcan_probe() {
	...
	err = register_flexcandev(dev);
	if (err) {
		dev_err(&pdev->dev, "registering netdev failed\n");
		goto failed_register;
	}

	err = flexcan_setup_stop_mode(pdev);
	if (err < 0) {
		dev_err_probe(&pdev->dev, err, "setup stop mode failed\n");
		goto failed_setup_stop_mode;
	}
	...
 failed_setup_stop_mode:
	unregister_flexcandev(dev);
 failed_register:
	pm_runtime_put_noidle(&pdev->dev);
	pm_runtime_disable(&pdev->dev);
}

[1] https://sashiko.dev/#/bug/linux-34c83ee1-4b00-422c-b485-f3256591cdcf

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261114-fix-device_get_match_data-v1-0-2d82025e9646@pengutronix.de?part=2

[PATCH can 3/4] can: xilinx_can: xcan_probe(): reject devices without match data

[Marc Kleine-Budde]

A device bound through driver_override need not match an entry in
of_match_table. In that case device_get_match_data() returns NULL, but
xcan_probe() dereferences the result.

Reject devices without match data before continuing probe.

Fixes: 5e6c3454b405 ("net: can: Use device_get_match_data()")
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
---
 drivers/net/can/xilinx_can.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/can/xilinx_can.c b/drivers/net/can/xilinx_can.c
index 43d7f22820b8..bbe6f9662cac 100644
--- a/drivers/net/can/xilinx_can.c
+++ b/drivers/net/can/xilinx_can.c
@@ -1895,6 +1895,8 @@ static int xcan_probe(struct platform_device *pdev)
 	}
 
 	devtype = device_get_match_data(&pdev->dev);
+	if (!devtype)
+		return -ENODEV;
 
 	hw_tx_max_property = devtype->flags & XCAN_FLAG_TX_MAILBOXES ?
 			     "tx-mailbox-count" : "tx-fifo-depth";

-- 
2.53.0

[PATCH can 4/4] can: rcar_canfd: rcar_canfd_probe(): reject devices without match data

[Marc Kleine-Budde]

A device bound through driver_override need not match an entry in
of_match_table. In that case device_get_match_data() returns NULL, but
rcar_canfd_probe() dereferences the result.

Reject devices without match data before continuing probe.

Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
---
 drivers/net/can/rcar/rcar_canfd.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/can/rcar/rcar_canfd.c b/drivers/net/can/rcar/rcar_canfd.c
index 000a6433f46d..9d463a9c1766 100644
--- a/drivers/net/can/rcar/rcar_canfd.c
+++ b/drivers/net/can/rcar/rcar_canfd.c
@@ -2113,6 +2113,8 @@ static int rcar_canfd_probe(struct platform_device *pdev)
 	int i;
 
 	info = of_device_get_match_data(dev);
+	if (!info)
+		return -ENODEV;
 
 	if (of_property_read_bool(dev->of_node, "renesas,no-can-fd"))
 		fdmode = false;			/* Classical CAN only mode */

-- 
2.53.0

Re: [PATCH can 4/4] can: rcar_canfd: rcar_canfd_probe(): reject devices without match data

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Low] can: rcar_canfd: missing Fixes trailer in rcar_canfd_probe() fix
--

commit cdc806522e3e7626b43c3c2411bfae563ed95e04
Author: Marc Kleine-Budde <mkl@pengutronix.de>

> can: rcar_canfd: rcar_canfd_probe(): reject devices without match data
>
> A device bound through driver_override need not match an entry in
> of_match_table. In that case device_get_match_data() returns NULL, but
> rcar_canfd_probe() dereferences the result.
>
> Reject devices without match data before continuing probe.
>
> Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>

[Severity: Low]
Since commit ce7c5382758b ("can: rcar_canfd: rcar_canfd_probe: Add struct
rcar_canfd_hw_info to driver data") changed the match data from an enum
value to a struct rcar_canfd_hw_info pointer and dereferenced info
without checking for NULL, should this include a Fixes tag?

  Fixes: ce7c5382758b ("can: rcar_canfd: rcar_canfd_probe: Add struct rcar_canfd_hw_info to driver data")

Also, rcar_canfd_probe() calls of_device_get_match_data() rather than
device_get_match_data().

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261114-fix-device_get_match_data-v1-0-2d82025e9646@pengutronix.de?part=4

Re: [PATCH can 4/4] can: rcar_canfd: rcar_canfd_probe(): reject devices without match data

[Marc Kleine-Budde]

[-- Attachment #1: Type: text/plain, Size: 1574 bytes --]

On 14.11.2026 13:03:20, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential
> issue to consider:
> - [Low] can: rcar_canfd: missing Fixes trailer in rcar_canfd_probe() fix
> --
>
> commit cdc806522e3e7626b43c3c2411bfae563ed95e04
> Author: Marc Kleine-Budde <mkl@pengutronix.de>
>
> > can: rcar_canfd: rcar_canfd_probe(): reject devices without match data
> >
> > A device bound through driver_override need not match an entry in
> > of_match_table. In that case device_get_match_data() returns NULL, but
> > rcar_canfd_probe() dereferences the result.
> >
> > Reject devices without match data before continuing probe.
> >
> > Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
>
> [Severity: Low]
> Since commit ce7c5382758b ("can: rcar_canfd: rcar_canfd_probe: Add struct
> rcar_canfd_hw_info to driver data") changed the match data from an enum
> value to a struct rcar_canfd_hw_info pointer and dereferenced info
> without checking for NULL, should this include a Fixes tag?
>
>   Fixes: ce7c5382758b ("can: rcar_canfd: rcar_canfd_probe: Add struct rcar_canfd_hw_info to driver data")
>
> Also, rcar_canfd_probe() calls of_device_get_match_data() rather than
> device_get_match_data().

Will fix.

Marc

pw-bot: cr

-- 
Pengutronix e.K.                 | Marc Kleine-Budde          |
Embedded Linux                   | https://www.pengutronix.de |
Vertretung Nürnberg              | Phone: +49-5121-206917-129 |
Amtsgericht Hildesheim, HRA 2686 | Fax:   +49-5121-206917-9   |

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]