[PATCH] iio: pressure: dps310: fix NULL pointer dereference on ACPI probe

[PATCH] iio: pressure: dps310: fix NULL pointer dereference on ACPI probe

[Rupesh Majhi]

When the device is enumerated through its ACPI HID (IFX3100),
i2c_client_get_device_id() returns NULL: the ACPI-derived client name
does not match the driver's i2c_device_id table. dps310_probe() then
dereferences that NULL pointer in "iio->name = id->name" and crashes the
kernel during probe.

The IIO device name is always "dps310", so set it directly and drop the
now-unused device-id lookup.

Fixes: 72ff282819d0 ("iio: pressure: dps310: Add ACPI HID table")
Cc: stable@vger.kernel.org
Signed-off-by: Rupesh Majhi <zoone.rupert@gmail.com>
---
 drivers/iio/pressure/dps310.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/iio/pressure/dps310.c b/drivers/iio/pressure/dps310.c
index f45af72a0554..45bdb8c7670f 100644
--- a/drivers/iio/pressure/dps310.c
+++ b/drivers/iio/pressure/dps310.c
@@ -845,7 +845,6 @@ static const struct iio_info dps310_info = {
 
 static int dps310_probe(struct i2c_client *client)
 {
-	const struct i2c_device_id *id = i2c_client_get_device_id(client);
 	struct dps310_data *data;
 	struct iio_dev *iio;
 	int rc;
@@ -858,7 +857,7 @@ static int dps310_probe(struct i2c_client *client)
 	data->client = client;
 	mutex_init(&data->lock);
 
-	iio->name = id->name;
+	iio->name = DPS310_DEV_NAME;
 	iio->channels = dps310_channels;
 	iio->num_channels = ARRAY_SIZE(dps310_channels);
 	iio->info = &dps310_info;
-- 
2.43.0

Re: [PATCH] iio: pressure: dps310: fix NULL pointer dereference on ACPI probe

[Andy Shevchenko]

On Sun, Jul 19, 2026 at 03:07:52AM +0300, Rupesh Majhi wrote:
> When the device is enumerated through its ACPI HID (IFX3100),
> i2c_client_get_device_id() returns NULL: the ACPI-derived client name
> does not match the driver's i2c_device_id table. dps310_probe() then
> dereferences that NULL pointer in "iio->name = id->name" and crashes the
> kernel during probe.
> 
> The IIO device name is always "dps310", so set it directly and drop the
> now-unused device-id lookup.

...

As a quick fix this patch is okay, the proper one is to go with chip_info
structure in the driver_data. where the name will be defined.

On top of that mutex_init() should be devm_mutex_init(), which is a fix,
and some cleanups:
- unused i2c_set_clientdata(); may be dropped
- C99 initialisers in ACPI ID table
- IWYU principle for the header inclusions
- some unneeded GENMASK()s due to use of sign_extend32()
- perhaps converting to use get_unaligned_xx() where it makes sense
- use time multipliers in _read_poll_timeout()
- use fsleep() and time multipliers instead of usleep_range()
- get rid of min_t(); perhaps replace with clamp() or min()
- use SI multipliers from units.h

-- 
With Best Regards,
Andy Shevchenko

Re: [PATCH] iio: pressure: dps310: fix NULL pointer dereference on ACPI probe

[Rupert Zoone]

  On Sun, Jul 19, 2026 at 12:06 PM +0300, Andy Shevchenko wrote:
  > As a quick fix this patch is okay, the proper one is to go with chip_info
  > structure in the driver_data. where the name will be defined.

  Thanks for the review. I'd like to keep this one as the minimal fix so it
  backports cleanly (it's Cc: stable). The chip_info/driver_data rework is a
  good idea, but I'll do it as follow-up on top rather than fold it into the
  stable fix.

  > On top of that mutex_init() should be devm_mutex_init(), which is a fix,
  > and some cleanups:
  > - unused i2c_set_clientdata(); may be dropped
  > - C99 initialisers in ACPI ID table
  > - IWYU principle for the header inclusions
  > - some unneeded GENMASK()s due to use of sign_extend32()
  > - perhaps converting to use get_unaligned_xx() where it makes sense
  > - use time multipliers in _read_poll_timeout()
  > - use fsleep() and time multipliers instead of usleep_range()
  > - get rid of min_t(); perhaps replace with clamp() or min()
  > - use SI multipliers from units.h

  Agreed on all of these, including the devm_mutex_init() change. I'll send
  them as a separate cleanup series once this fix and the triggered-buffer
  patch are in, so each change stays easy to review on its own.

  Thanks,
  Rupesh

On Sun, Jul 19, 2026 at 12:06 PM Andy Shevchenko
<andriy.shevchenko@intel.com> wrote:
>
> On Sun, Jul 19, 2026 at 03:07:52AM +0300, Rupesh Majhi wrote:
> > When the device is enumerated through its ACPI HID (IFX3100),
> > i2c_client_get_device_id() returns NULL: the ACPI-derived client name
> > does not match the driver's i2c_device_id table. dps310_probe() then
> > dereferences that NULL pointer in "iio->name = id->name" and crashes the
> > kernel during probe.
> >
> > The IIO device name is always "dps310", so set it directly and drop the
> > now-unused device-id lookup.
>
> ...
>
> As a quick fix this patch is okay, the proper one is to go with chip_info
> structure in the driver_data. where the name will be defined.
>
> On top of that mutex_init() should be devm_mutex_init(), which is a fix,
> and some cleanups:
> - unused i2c_set_clientdata(); may be dropped
> - C99 initialisers in ACPI ID table
> - IWYU principle for the header inclusions
> - some unneeded GENMASK()s due to use of sign_extend32()
> - perhaps converting to use get_unaligned_xx() where it makes sense
> - use time multipliers in _read_poll_timeout()
> - use fsleep() and time multipliers instead of usleep_range()
> - get rid of min_t(); perhaps replace with clamp() or min()
> - use SI multipliers from units.h
>
> --
> With Best Regards,
> Andy Shevchenko
>
>

Re: [PATCH] iio: pressure: dps310: fix NULL pointer dereference on ACPI probe

[Jonathan Cameron]

On Sun, 19 Jul 2026 15:16:02 +0300
Rupert Zoone <zoone.rupert@gmail.com> wrote:

>   On Sun, Jul 19, 2026 at 12:06 PM +0300, Andy Shevchenko wrote:
>   > As a quick fix this patch is okay, the proper one is to go with chip_info
>   > structure in the driver_data. where the name will be defined.  

For this particular driver I'd not do that as it only supports one device.
Can leave bringing a chip_info structure in until someone sends support for
a second one.

> 
>   Thanks for the review. I'd like to keep this one as the minimal fix so it
>   backports cleanly (it's Cc: stable). The chip_info/driver_data rework is a
>   good idea, but I'll do it as follow-up on top rather than fold it into the
>   stable fix.
> 
>   > On top of that mutex_init() should be devm_mutex_init(), which is a fix,
>   > and some cleanups:
>   > - unused i2c_set_clientdata(); may be dropped
>   > - C99 initialisers in ACPI ID table
>   > - IWYU principle for the header inclusions
>   > - some unneeded GENMASK()s due to use of sign_extend32()
>   > - perhaps converting to use get_unaligned_xx() where it makes sense
>   > - use time multipliers in _read_poll_timeout()
>   > - use fsleep() and time multipliers instead of usleep_range()
>   > - get rid of min_t(); perhaps replace with clamp() or min()
>   > - use SI multipliers from units.h  
> 
>   Agreed on all of these, including the devm_mutex_init() change. I'll send
>   them as a separate cleanup series once this fix and the triggered-buffer
>   patch are in, so each change stays easy to review on its own.
Excellent.  I've applied this one to the fixes-togreg branch of iio.git

Thanks,

Jonathan

> 
>   Thanks,
>   Rupesh
> 
> On Sun, Jul 19, 2026 at 12:06 PM Andy Shevchenko
> <andriy.shevchenko@intel.com> wrote:
> >
> > On Sun, Jul 19, 2026 at 03:07:52AM +0300, Rupesh Majhi wrote:  
> > > When the device is enumerated through its ACPI HID (IFX3100),
> > > i2c_client_get_device_id() returns NULL: the ACPI-derived client name
> > > does not match the driver's i2c_device_id table. dps310_probe() then
> > > dereferences that NULL pointer in "iio->name = id->name" and crashes the
> > > kernel during probe.
> > >
> > > The IIO device name is always "dps310", so set it directly and drop the
> > > now-unused device-id lookup.  
> >
> > ...
> >
> > As a quick fix this patch is okay, the proper one is to go with chip_info
> > structure in the driver_data. where the name will be defined.
> >
> > On top of that mutex_init() should be devm_mutex_init(), which is a fix,
> > and some cleanups:
> > - unused i2c_set_clientdata(); may be dropped
> > - C99 initialisers in ACPI ID table
> > - IWYU principle for the header inclusions
> > - some unneeded GENMASK()s due to use of sign_extend32()
> > - perhaps converting to use get_unaligned_xx() where it makes sense
> > - use time multipliers in _read_poll_timeout()
> > - use fsleep() and time multipliers instead of usleep_range()
> > - get rid of min_t(); perhaps replace with clamp() or min()
> > - use SI multipliers from units.h
> >
> > --
> > With Best Regards,
> > Andy Shevchenko
> >
> >