[PATCH 1/1] pinctrl: canaan: k230: Fix NULL pointer dereference in device tree parsing

[PATCH 1/1] pinctrl: canaan: k230: Fix NULL pointer dereference in device tree parsing

[Jiayu Du]

When probing the k230 pinctrl driver, the kernel triggers a NULL pointer
dereference. The crash trace showed:
[    0.732084] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000068
[    0.740737] ...
[    0.776296] epc : k230_pinctrl_probe+0x1be/0x4fc

In k230_pinctrl_parse_functions(), we attempt to retrieve
the device pointer via info->pctl_dev->dev, but info->pctl_dev is only
initialized after k230_pinctrl_parse_dt() completes.
At the time of DT parsing, info->pctl_dev is still NULL, leading to the invalid
dereference of info->pctl_dev->dev.

Use the already available device pointer from platform_device
instead of accessing through uninitialized pctl_dev.

Signed-off-by: Jiayu Du <jiayu.riscv@isrc.iscas.ac.cn>
---
 drivers/pinctrl/pinctrl-k230.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/pinctrl/pinctrl-k230.c b/drivers/pinctrl/pinctrl-k230.c
index d716f23d83..20f7c0f70e 100644
--- a/drivers/pinctrl/pinctrl-k230.c
+++ b/drivers/pinctrl/pinctrl-k230.c
@@ -65,6 +65,7 @@ struct k230_pmx_func {
 };
 
 struct k230_pinctrl {
+	struct device		*dev;
 	struct pinctrl_desc	pctl;
 	struct pinctrl_dev	*pctl_dev;
 	struct regmap		*regmap_base;
@@ -470,7 +471,7 @@ static int k230_pinctrl_parse_groups(struct device_node *np,
 				     struct k230_pinctrl *info,
 				     unsigned int index)
 {
-	struct device *dev = info->pctl_dev->dev;
+	struct device *dev = info->dev;
 	const __be32 *list;
 	int size, i, ret;
 
@@ -511,7 +512,7 @@ static int k230_pinctrl_parse_functions(struct device_node *np,
 					struct k230_pinctrl *info,
 					unsigned int index)
 {
-	struct device *dev = info->pctl_dev->dev;
+	struct device *dev = info->dev;
 	struct k230_pmx_func *func;
 	struct k230_pin_group *grp;
 	static unsigned int idx, i;
@@ -596,6 +597,8 @@ static int k230_pinctrl_probe(struct platform_device *pdev)
 	if (!info)
 		return -ENOMEM;
 
+	info->dev = dev;
+
 	pctl = &info->pctl;
 
 	pctl->name	= "k230-pinctrl";
-- 
2.52.0

Re: [PATCH 1/1] pinctrl: canaan: k230: Fix NULL pointer dereference in device tree parsing

[Jiayu Du]

On Sun, Dec 28, 2025 at 04:50:05PM +0800, Jiayu Du wrote:
> When probing the k230 pinctrl driver, the kernel triggers a NULL pointer
> dereference. The crash trace showed:
> [    0.732084] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000068
> [    0.740737] ...
> [    0.776296] epc : k230_pinctrl_probe+0x1be/0x4fc
> 
> In k230_pinctrl_parse_functions(), we attempt to retrieve
> the device pointer via info->pctl_dev->dev, but info->pctl_dev is only
> initialized after k230_pinctrl_parse_dt() completes.
> At the time of DT parsing, info->pctl_dev is still NULL, leading to the invalid
> dereference of info->pctl_dev->dev.
> 
> Use the already available device pointer from platform_device
> instead of accessing through uninitialized pctl_dev.
> 
> Signed-off-by: Jiayu Du <jiayu.riscv@isrc.iscas.ac.cn>
Please ignore this patch. I'm sorry, I forgot to add the "fixes" tag.

I have resubmitted this patch. The link is provided here[1].

[1]: https://lore.kernel.org/all/20251228154947.194684-1-jiayu.riscv@isrc.iscas.ac.cn/