Re: [PATCH] hwmon: (mp5990) Publish the OF module aliases

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Unsafe fallback matching logic causes a NULL pointer dereference when probed via ACPI PRP0001.
--

commit 8c03c546eec5de58e0c8478c39f38b64125e7713
Author: hpp.iscas <hppiscas@163.com>

hwmon: (mp5990) Publish the OF module aliases

MP5990 and MP5998 Device Tree clients are matched through mp5990_of_match. Only
the I2C ID table is currently published, although Device Tree clients emit OF
modalias events.

> diff --git a/drivers/hwmon/pmbus/mp5990.c b/drivers/hwmon/pmbus/mp5990.c
> index f8a5d1b42ff7a..d5143956d4780 100644
> --- a/drivers/hwmon/pmbus/mp5990.c
> +++ b/drivers/hwmon/pmbus/mp5990.c
> @@ -213,6 +213,7 @@ static const struct of_device_id mp5990_of_match[] = {
>  	{ .compatible = "mps,mp5998", .data = (void *)mp5998 },
>  	{}
>  };
> +MODULE_DEVICE_TABLE(of, mp5990_of_match);

[Severity: High]
This isn't a bug introduced by this patch, but I noticed a potential NULL
pointer dereference in mp5990_probe():

drivers/hwmon/pmbus/mp5990.c:mp5990_probe() {
    ...
	if (client->dev.of_node)
		chip = (uintptr_t)of_device_get_match_data(&client->dev);
	else
		chip = i2c_match_id(mp5990_id, client)->driver_data;
    ...
}

If the driver is probed via an ACPI PRP0001 node, client->dev.of_node is NULL.
The probe function will fall back to the else branch and call i2c_match_id().

Because the client's name is derived from ACPI (e.g., 'PRP0001:00') and is
absent from mp5990_id, i2c_match_id() will return NULL.

Could the unconditional dereference of ->driver_data cause a kernel panic
in this scenario?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260905133721.65588-1-hppiscas@163.com?part=1