Re: [PATCH v9 14/36] pinctrl: airoha: add missed get_direction() function for gpio_chip

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Calling `gpiochip_get_data()` before the `gpio_chip` is registered causes a guaranteed NULL pointer dereference.
--

--- Patch [14]: [PATCH v9 14/36] pinctrl: airoha: add missed get_direction() function for gpio_chip ---
commit bbd3ee4d01c65dc100b15681639e2141c5e673a0
Author: Mikhail Kshevetskiy <mikhail.kshevetskiy@iopsys.eu>

pinctrl: airoha: add missed get_direction() function for gpio_chip

This commit adds the missing get_direction() function for the airoha
gpio_chip. It also reimplements the pinconf get_direction() function
to utilize this newly added function.

> diff --git a/drivers/pinctrl/airoha/pinctrl-airoha.c b/drivers/pinctrl/airoha/pinctrl-airoha.c
> index a1044babb2823..df1694296046c 100644
> --- a/drivers/pinctrl/airoha/pinctrl-airoha.c
> +++ b/drivers/pinctrl/airoha/pinctrl-airoha.c
[ ... ]
> @@ -2523,6 +2523,22 @@ static int airoha_gpio_get(struct gpio_chip *chip, unsigned int gpio)
>  	return err ? err : !!(val & BIT(pin));
>  }
>  
> +static int airoha_gpio_get_direction(struct gpio_chip *chip, unsigned int gpio)
> +{
> +	struct airoha_pinctrl *pinctrl = gpiochip_get_data(chip);

[Severity: High]
Will this result in a NULL pointer dereference if called early during boot?

When early pinctrl operations are executed (such as applying pin
configuration hogs during pinctrl_enable(), or via debugfs reads before
GPIO chip registration), airoha_pinconf_get_direction() is called.

This delegates to airoha_gpio_get_direction() passing the partially
initialized and unregistered gpio_chip:

drivers/pinctrl/airoha/pinctrl-airoha.c:airoha_pinconf_get_direction() {
    ...
    ret = airoha_gpio_get_direction(&pinctrl->gpiochip.chip, pin);
    ...
}

Because devm_gpiochip_add_data() has not been called yet in this path,
chip->gpiodev is strictly NULL. This causes a crash when
gpiochip_get_data() attempts to access gc->gpiodev->data.

Could this be restructured to avoid relying on the gpiochip_get_data()
accessor before the gpio_chip is fully registered?

> +	u32 val, mask;
> +	u8 index;
> +	int err;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260804160419.3592327-1-mikhail.kshevetskiy@iopsys.eu?part=14