Devicetree
 help / color / mirror / Atom feed
From: sashiko-bot@kernel.org
To: "Dmitry Torokhov" <dmitry.torokhov@gmail.com>
Cc: devicetree@vger.kernel.org, conor+dt@kernel.org, robh@kernel.org
Subject: Re: [PATCH v2 2/3] powerpc/dts: pdm360ng: Convert ADS7845 touchscreen to DT bindings
Date: Mon, 20 Jul 2026 05:56:49 +0000	[thread overview]
Message-ID: <20260720055649.F33251F000E9@smtp.kernel.org> (raw)
In-Reply-To: <20260719-ads7846-pdm360ng-v2-2-1198bd108502@gmail.com>

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Unchecked Error Return / Uninitialized Memory in ads7846_setup_spi_msg
--

--- Patch [2]: [PATCH v2 2/3] powerpc/dts: pdm360ng: Convert ADS7845 touchscreen to DT bindings ---
commit 06fbaa99ffa69ed22e692eeb23d6d33c9a3cdfdd
Author: Dmitry Torokhov <dmitry.torokhov@gmail.com>

powerpc/dts: pdm360ng: Convert ADS7845 touchscreen to DT bindings

This commit updates the pdm360ng device tree to use the correct "ti,ads7845"
compatible string and native DT properties for the touchscreen. It removes the
reliance on legacy platform data injection for configuring the device.

> diff --git a/arch/powerpc/boot/dts/pdm360ng.dts b/arch/powerpc/boot/dts/pdm360ng.dts
> index 67c3b9db75d76..05e93ca294ee3 100644
> --- a/arch/powerpc/boot/dts/pdm360ng.dts
> +++ b/arch/powerpc/boot/dts/pdm360ng.dts
[ ... ]
> @@ -176,11 +177,12 @@ psc@11900 {
>  
>  			/* ADS7845 touch screen controller */
>  			ts@0 {
> -				compatible = "ti,ads7846";
> +				compatible = "ti,ads7845";
[ ... ]

While reviewing the touchscreen configuration changes, I noticed a detail in
the underlying driver's probe function:

drivers/input/touchscreen/ads7846.c:ads7846_probe() {
	...
	ads7846_setup_spi_msg(ts, pdata);

	ts->reg = devm_regulator_get(dev, "vcc");
	...
}

[Severity: High]
This is a pre-existing issue, but does this code ignore the return value of
ads7846_setup_spi_msg()?

If memory allocation inside ads7846_setup_spi_msg() fails, it returns
-ENOMEM, but spi_message_init() would be skipped. 

If probe continues and eventually calls ads7846_read_state(), it passes the
uninitialized ts->msg array to spi_sync(). Because the transfers list head
has NULL next and prev pointers in this scenario, could this result in an
immediate NULL pointer dereference inside the SPI core?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260719-ads7846-pdm360ng-v2-0-1198bd108502@gmail.com?part=2

  reply	other threads:[~2026-07-20  5:56 UTC|newest]

Thread overview: 5+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-07-20  5:37 [PATCH v2 0/3] powerpc: 512x: Convert ADS7845 touchscreen on PDM360NG to device tree Dmitry Torokhov
2026-07-20  5:37 ` [PATCH v2 1/3] powerpc/dts: mpc5121: Move GPIO controller properties to SoC dtsi Dmitry Torokhov
2026-07-20  5:37 ` [PATCH v2 2/3] powerpc/dts: pdm360ng: Convert ADS7845 touchscreen to DT bindings Dmitry Torokhov
2026-07-20  5:56   ` sashiko-bot [this message]
2026-07-20  5:37 ` [PATCH v2 3/3] powerpc/512x: Remove pdm360ng platform setup in favor of mpc512x_generic Dmitry Torokhov

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260720055649.F33251F000E9@smtp.kernel.org \
    --to=sashiko-bot@kernel.org \
    --cc=conor+dt@kernel.org \
    --cc=devicetree@vger.kernel.org \
    --cc=dmitry.torokhov@gmail.com \
    --cc=robh@kernel.org \
    --cc=sashiko-reviews@lists.linux.dev \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox