Re: [PATCH] iio: adc: ltc2496: Fix possible null-ptr-deref in ltc2496_probe()

[Jonathan Cameron <jic23@kernel.org>]

On Wed, 28 Sep 2022 04:09:48 +0000
Wei Yongjun <weiyongjun@huaweicloud.com> wrote:

> From: Wei Yongjun <weiyongjun1@huawei.com>
> 
> KASAN report null-ptr-deref as follows:
> 
> KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
> CPU: 0 PID: 282 Comm: python3 Tainted: G N 6.0.0-rc7-next-20220927+ #153
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
> RIP: 0010:ltc2497core_probe+0x77/0x440 [ltc2497_core]
> Call Trace:
>  <TASK>
>  ltc2496_probe+0xf4/0x150
>  spi_probe+0x158/0x1f0 drivers/spi/spi.c:421
>  call_driver_probe drivers/base/dd.c:560 [inline]
>  really_probe+0x207/0x750 drivers/base/dd.c:639
>  __driver_probe_device+0x229/0x2a0 drivers/base/dd.c:778
>  device_driver_attach+0xb8/0x1e0 drivers/base/dd.c:1105
> 
> This happend when probe ltc2496 device with spi device id but without
> dts, device_get_match_data() return null chip_info. Fix it by adding
> null check for chip_info in ltc2496_probe().

What tree are you based on?  When I look at this file I'm not seeing a
spi_device_id table so how is it matching?

Also I'd prefer a more comprehensive fix that ensured the same data is
available via the spi_device_id table and uses that if
device_get_match_data() == NULL.

Jonathan

> 
> Fixes: 1695c52a1260 ("drivers: iio: adc: ltc2497: Rename the LTC2499 iio device")
> Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
> 
> diff --git a/drivers/iio/adc/ltc2496.c b/drivers/iio/adc/ltc2496.c
> index 2593fa4322eb..a7353c3dd006 100644
> --- a/drivers/iio/adc/ltc2496.c
> +++ b/drivers/iio/adc/ltc2496.c
> @@ -76,6 +76,8 @@ static int ltc2496_probe(struct spi_device *spi)
>  	st->spi = spi;
>  	st->common_ddata.result_and_measure = ltc2496_result_and_measure;
>  	st->common_ddata.chip_info = device_get_match_data(dev);
> +	if (!st->common_ddata.chip_info)
> +		return -ENODEV;
>  
>  	return ltc2497core_probe(dev, indio_dev);
>  }