Re: [PATCH v2 2/3] mfd: aat2870: Convert to use OF bindings

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 3 potential issue(s) to consider:
- [High] regulator: UAF and memory leak due to shared static array in of_regulator_match
- [Medium] video: backlight: functional regression when led-max-microamp is missing
- [Low] video: backlight: incompatible pointer type in device_property_read_u32
--

commit 084e352aa2d7fee86a0e56df75d5d10cdd400379
Author: Svyatoslav Ryhel <clamor95@gmail.com>
Subject: mfd: aat2870: Convert to use OF bindings

This patch converts the AAT2870 driver to use OF bindings, replacing the
MFD registration API with of_platform_populate() and adding dedicated
compatible strings for its sub-devices. It also updates the regulator and
backlight child drivers to parse properties directly from the device tree
and removes redundant platform data.

In drivers/regulator/aat2870-regulator.c around line 133, there is a static
array defined for aat2870_regulator_matches. Later in aat2870_regulator_probe()
around line 171, this shared static array is passed directly to
of_regulator_match().

[Severity: High]
Could passing this shared static array to of_regulator_match() cause a
use-after-free or memory leak if multiple AAT2870 devices are probed?
of_regulator_match() actively mutates the passed array to store device nodes
and binds its lifetime to the device via devres. If a second device probes,
it would overwrite the array, leaking the first device's nodes. Upon unbind,
devres would drop references to whatever nodes are currently in the array,
potentially causing a double-free or use-after-free for the remaining
references.

In drivers/video/backlight/aat2870_bl.c around line 141 in aat2870_bl_probe(),
the code calls device_property_read_u32() to read led-max-microamp into
aat2870_bl->max_current.

[Severity: Low]
Does this trigger an incompatible pointer types compiler warning?
aat2870_bl->max_current is declared as an int, but device_property_read_u32()
expects a u32 pointer.

Also in drivers/video/backlight/aat2870_bl.c around line 141, the max_current
value is read via device_property_read_u32() without prior initialization.

[Severity: Medium]
Will the backlight permanently disable itself if the led-max-microamp property
is omitted from the device tree? If the property is missing, max_current
remains 0. Passing 0 into clamp(0, 450, 27900) returns 450. When 450 is
divided by AAT2870_CURRENT_STEP (which is 900), the result evaluates to 0.
Since the brightness calculation multiplies by max_current, this appears to
leave the backlight permanently disabled under these conditions.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261004164121.193514-1-clamor95@gmail.com?part=2