Re: [PATCH v8 2/8] iio: dac: ad5686: missing NULL check on match data

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] I2C and SPI transfer buffers physically overlap or share the same cacheline, leading to potential data corruption during concurrent DMA mapping.
--

--- Patch [2]: [PATCH v8 2/8] iio: dac: ad5686: missing NULL check on match data ---
commit ab85ded3e88725bf58719fd51bdcdcb05af5fa48
Author: Rodrigo Alencar <rodrigo.alencar@analog.com>

iio: dac: ad5686: missing NULL check on match data

This commit adds a missing NULL check for the chip_info pointer in
ad5686_probe() to prevent a crash when binding via driver_override with an
unknown device name.

Fixes: 0eb1728461a1 ("iio: dac: ad5686: drop enum id")
Reported-by: sashiko-bot@kernel.org
Closes: https://lore.kernel.org/all/20260710113149.53EC51F000E9@smtp.kernel.org/

> diff --git a/drivers/iio/dac/ad5686.c b/drivers/iio/dac/ad5686.c
> index 713fe71ad1e7b..d34250647aa47 100644
> --- a/drivers/iio/dac/ad5686.c
> +++ b/drivers/iio/dac/ad5686.c
> @@ -479,6 +479,9 @@ int ad5686_probe(struct device *dev,
>  	struct iio_dev *indio_dev;
>  	int ret, i;
>  
> +	if (!chip_info)
> +		return -ENODEV;
> +
>  	indio_dev = devm_iio_device_alloc(dev, sizeof(*st));
>  	if (indio_dev == NULL)
>  		return  -ENOMEM;

[Severity: High]
This is a pre-existing issue, but I noticed a potential DMA cacheline sharing
and overlap problem with the transfer buffers used in this driver.

In drivers/iio/dac/ad5686.h:struct ad5686_state, the data array is defined as:

	union {
		__be32 d32;
		__be16 d16;
		u8 d8[4];
	} data[3] __aligned(IIO_DMA_MINALIGN);

The __aligned attribute applies to the start of the array, but individual
elements (data[1], data[2]) still share the same cacheline.

In drivers/iio/dac/ad5686-spi.c:ad5686_spi_read(), the SPI transfer sets up
simultaneous TX and RX using these elements:

		}, {
			.tx_buf = &st->data[1].d8[1],
			.rx_buf = &st->data[2].d8[1],
			.len = 3,
		},

Can this lead to data corruption on non-cache-coherent architectures? If the
SPI master uses DMA, mapping memory regions that share a cacheline for both
DMA_TO_DEVICE and DMA_FROM_DEVICE might violate DMA API constraints, as cache
invalidation for the RX buffer could corrupt the TX buffer data.

Similarly, in drivers/iio/dac/ad5696-i2c.c:ad5686_i2c_read(), the I2C transfer
uses physically overlapping memory regions for TX and RX:

	struct i2c_msg msg[2] = {
		{
			.addr = i2c->addr,
			.flags = i2c->flags,
			.len = 3,
			.buf = &st->data[0].d8[1],
		},
		{
			.addr = i2c->addr,
			.flags = i2c->flags | I2C_M_RD,
			.len = 2,
			.buf = (char *)&st->data[0].d16,
		},
	};

Could this overlapping buffer setup cause similar DMA data corruption issues
when reading from the I2C bus?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260716-ad5686-new-features-v8-0-ebb0051af5e5@analog.com?part=2