Re: [PATCH v4 06/16] iio: adc: at91-sama5d2_adc: adapt the driver for sama7d65

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] The custom `DEFINE_FREE` implementation for `nvmem_cell_put` fails to check for error pointers, causing a kernel panic when `nvmem_cell_get` fails.
--

--- Patch [6]: [PATCH v4 06/16] iio: adc: at91-sama5d2_adc: adapt the driver for sama7d65 ---
commit ded9daef979dc15e3d8816ca33992bea7aa02c01
Author: Varshini Rajendran <varshini.rajendran@microchip.com>

    iio: adc: at91-sama5d2_adc: adapt the driver for sama7d65
    
    Add support for sama7d65 ADC. The differences are highlighted with the
    compatible. The calibration data layout is the main difference.

> diff --git a/drivers/iio/adc/at91-sama5d2_adc.c b/drivers/iio/adc/at91-sama5d2_adc.c
> index 63481ecb94f5e..a54691b38244f 100644
> --- a/drivers/iio/adc/at91-sama5d2_adc.c
> +++ b/drivers/iio/adc/at91-sama5d2_adc.c
[ ... ]
> @@ -768,6 +777,24 @@ static const struct at91_adc_platform sama7g5_platform = {
>  	.temp_calib_layout = &sama7g5_temp_calib,
>  };
>  
> +static const struct at91_adc_platform sama7d65_platform = {
> +	.layout = &sama7g5_layout,
> +	.adc_channels = &at91_sama7g5_adc_channels,
> +	.nr_channels = AT91_SAMA7G5_SINGLE_CHAN_CNT +
> +		       AT91_SAMA7G5_DIFF_CHAN_CNT +
> +		       AT91_SAMA7G5_TEMP_CHAN_CNT,
> +	.max_channels = ARRAY_SIZE(at91_sama7g5_adc_channels),
> +	.max_index = AT91_SAMA7G5_MAX_CHAN_IDX,
> +	.hw_trig_cnt = AT91_SAMA7G5_HW_TRIG_CNT,
> +	.osr_mask = GENMASK(18, 16),
> +	.oversampling_avail = { 1, 4, 16, 64, 256 },
> +	.oversampling_avail_no = 5,
> +	.chan_realbits = 16,
> +	.temp_sensor = true,

[Severity: High]
Could enabling the temperature sensor here expose this new platform to a panic
during probe?

When at91_adc_temp_sensor_init() is called for platforms with a temperature
sensor, it uses nvmem_cell_get() which returns an error pointer on failure:

	struct nvmem_cell *temp_calib __free(nvmem_cell_put) =
		nvmem_cell_get(dev, "temperature_calib");
	if (IS_ERR(temp_calib)) {
		if (PTR_ERR(temp_calib) != -ENOENT)
			dev_err(dev, "Failed to get temperature_calib cell!\n");
		return PTR_ERR(temp_calib);
	}

Because DEFINE_FREE for nvmem_cell_put is implemented with a simple check
instead of verifying for error pointers:

DEFINE_FREE(nvmem_cell_put, struct nvmem_cell *, if (_T) nvmem_cell_put(_T))

If nvmem_cell_get() fails, the ERR_PTR is evaluated as true by the cleanup
macro and passed directly to nvmem_cell_put(). This will immediately attempt
to dereference the error pointer, causing a kernel panic.

> +	.temp_chan = AT91_SAMA7G5_ADC_TEMP_CHANNEL,
> +	.temp_calib_layout = &sama7d65_temp_calib,
> +};
> +

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260727122633.117435-1-varshini.rajendran@microchip.com?part=6