Re: [PATCH 6/6] hwmon: (pmbus/max20830): add support for max20830c and max20840c

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Missing NULL check for the return value of i2c_get_match_data() leads to a potential NULL pointer dereference.
--

commit 44325aff0c44d84d978feed33af57c60c31e89f3
Author: Alexis Czezar Torreno <alexisczezar.torreno@analog.com>

hwmon: (pmbus/max20830): add support for max20830c and max20840c

This commit adds support for the MAX20830C and MAX20840C step-down DC-DC
switching regulators with PMBus interfaces. It updates the driver to handle
multiple device types by introducing chip-specific information structures
and matching data.

> diff --git a/drivers/hwmon/pmbus/max20830.c b/drivers/hwmon/pmbus/max20830.c
> index a3abd24437e8e..252c77beb243c 100644
> --- a/drivers/hwmon/pmbus/max20830.c
> +++ b/drivers/hwmon/pmbus/max20830.c
[ ... ]
> @@ -60,11 +83,14 @@ static struct pmbus_driver_info max20830_info = {
>  
>  static int max20830_probe(struct i2c_client *client)
>  {
> +	const struct max20830_chip_info *chip;
>  	u8 buf[I2C_SMBUS_BLOCK_MAX + 1] = {};
>  	struct max20830_data *data;
>  	struct gpio_desc *enable_gpio;
>  	int ret;
>  
> +	chip = i2c_get_match_data(client);
> +

[Severity: High]
Can this result in a NULL pointer dereference if i2c_get_match_data() returns
NULL?

If an I2C device is instantiated via sysfs using driver_override with a
device name that doesn't exist in the driver's ID tables, table matching is
bypassed and i2c_get_match_data() will return NULL.

>  	data = devm_kzalloc(&client->dev, sizeof(*data), GFP_KERNEL);
>  	if (!data)
>  		return -ENOMEM;
[ ... ]
>  	if (i2c_check_functionality(client->adapter, I2C_FUNC_SMBUS_READ_BLOCK_DATA)) {
> -		/* Reads 9 Data bytes from MAX20830 */
>  		ret = i2c_smbus_read_block_data(client, PMBUS_IC_DEVICE_ID, buf);
>  		if (ret < 0)
>  			return dev_err_probe(&client->dev, ret,
>  					     "Failed to read IC_DEVICE_ID\n");
>  	} else {
> -		/* Reads 1 length byte + 9 Data bytes from MAX20830 */
> +		/* Reads 1 length byte + data bytes */
>  		ret = i2c_smbus_read_i2c_block_data(client, PMBUS_IC_DEVICE_ID,
> -						    MAX20830_IC_DEVICE_ID_LENGTH + 1,
> -						    buf);
> +						    chip->id_length + 1, buf);

The chip pointer is then dereferenced here when reading chip->id_length without
first checking if it is valid. Should there be a validation check on chip after
it is obtained from i2c_get_match_data()?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260630-dev-max20830c-v1-0-a02786bde470@analog.com?part=6