Re: [PATCH 3/3] arm64: dts: apple: Add pmgr-misc nodes to t60xx

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Pre-existing error handling bug where the return value of `devm_platform_ioremap_resource_byname()` is incorrectly checked against NULL instead of IS_ERR, leading to an invalid pointer dereference.
--

commit 7d3a9b5b08e4210f6d81e35e862b055c17a322ad
Author: Sasha Finkelstein <k@chaosmail.tech>

arm64: dts: apple: Add pmgr-misc nodes to t60xx

This patch adds the PMGR misc control nodes to the device tree for the M1/2
Pro, Max, and Ultra series devices. It defines the register regions and
power domains for these power-management nodes.

> diff --git a/arch/arm64/boot/dts/apple/t600x-die0.dtsi b/arch/arm64/boot/dts/apple/t600x-die0.dtsi
> index f715b19efd167..3271d234b483a 100644
> --- a/arch/arm64/boot/dts/apple/t600x-die0.dtsi
> +++ b/arch/arm64/boot/dts/apple/t600x-die0.dtsi
> @@ -24,6 +24,13 @@ aic: interrupt-controller@28e100000 {
>  		power-domains = <&ps_aic>;
>  	};
>  
> +	pmgr_misc: power-management@28e20c000 {
> +		compatible = "apple,t6000-pmgr-misc";
> +		reg = <0x2 0x8e20c000 0 0x400>,
> +			<0x2 0x8e20c800 0 0x400>;
> +		reg-names = "fabric-ps", "dcs-ps";
> +	};
> +

[Severity: High]
This isn't a bug introduced by this patch, but adding this device tree node
will trigger the probe function in drivers/soc/apple/apple-pmgr-misc.c, which
has a pre-existing error handling issue.

Could this cause a kernel panic during boot if the resource fails to map?

In drivers/soc/apple/apple-pmgr-misc.c:apple_pmgr_init_device(), the
resource mapping is handled like this:

	base = devm_platform_ioremap_resource_byname(
		to_platform_device(misc->dev), name);
	if (!base)
		return false;

	val = readl_relaxed(base + APPLE_CLKGEN_PSTATE);

Should this check be IS_ERR(base) instead of !base?

If the resource mapping fails, devm_platform_ioremap_resource_byname()
returns an ERR_PTR (such as ERR_PTR(-EINVAL)). The !base check will evaluate
to false, allowing the error pointer to be directly dereferenced as a
memory address by readl_relaxed().

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260702-pmgr-misc-v1-0-4f075a3a95c1@chaosmail.tech?part=3