Re: [PATCH] pinctrl: rk805: fix ordering of gpio and pinctrl registration

[Heiko Stuebner <heiko@sntech.de>]

Am Freitag, 30. Oktober 2026, 13:05:40 Mitteleuropäische Normalzeit schrieb sashiko-bot@kernel.org:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [High] pinctrl: rk805: NULL dereference in gpiochip_get_data() via pinconf
> --
> 
> commit a49ae4e9bf527300ce287085a0623b150f2db443
> Author: Heiko Stuebner <heiko.stuebner@cherry.de>
> 
> pinctrl: rk805: fix ordering of gpio and pinctrl registration
> 
> This commit reorders rk805_pinctrl_probe() so that devm_pinctrl_register() is
> called before devm_gpiochip_add_data(), ensuring the GPIO chip and its pin
> ranges are torn down before the pinctrl device during devres release.
> 
> > diff --git a/drivers/pinctrl/pinctrl-rk805.c b/drivers/pinctrl/pinctrl-rk805.c
> > index 22f576337faa9..8e04da3ef0f3a 100644
> > --- a/drivers/pinctrl/pinctrl-rk805.c
> > +++ b/drivers/pinctrl/pinctrl-rk805.c
> > @@ -663,13 +663,6 @@ static int rk805_pinctrl_probe(struct platform_device *pdev)
> >  		return -EINVAL;
> >  	}
> >  
> > -	/* Add gpio chip */
> > -	ret = devm_gpiochip_add_data(&pdev->dev, &pci->gpio_chip, pci);
> > -	if (ret < 0) {
> > -		dev_err(&pdev->dev, "Couldn't add gpiochip\n");
> > -		return ret;
> > -	}
> > -
> >  	/* Add pinctrl */
> >  	pci->pctl = devm_pinctrl_register(&pdev->dev, &pci->pinctrl_desc, pci);
> >  	if (IS_ERR(pci->pctl)) {
> > @@ -677,6 +670,13 @@ static int rk805_pinctrl_probe(struct platform_device *pdev)
> >  		return PTR_ERR(pci->pctl);
> >  	}
> >  
> > +	/* Add gpio chip */
> > +	ret = devm_gpiochip_add_data(&pdev->dev, &pci->gpio_chip, pci);
> > +	if (ret < 0) {
> > +		dev_err(&pdev->dev, "Couldn't add gpiochip\n");
> > +		return ret;
> > +	}
> 
> [Severity: High]
> Can registering pinctrl before the gpio_chip cause a NULL pointer dereference
> in gpiochip_get_data() when pinconf callbacks run?
> 
> In rk805_pinctrl_probe(), device_set_node() attaches the parent PMIC fwnode to
> pdev->dev, and devm_pinctrl_register() immediately claims default pinctrl hogs
> via:
> 
>   devm_pinctrl_register()
>     pinctrl_register()
>       pinctrl_enable()
>         pinctrl_claim_hogs()
>           create_pinctrl()
>           pinctrl_select_state()
>             pinctrl_commit_state()
>               pinconf_apply_setting()
>                 rk805_pinconf_set()

that is a correct finding.

It seems the correct way to resolve this, is to switch from
devm_pinctrl_register() to the newer devm_pinctrl_register_and_init()
and calling pinctrl_enable() at the appropritate time in the driver
as suggested by the documentation.


Heiko