[PATCH] iio: imu: adis: Fix NULL pointer dereference in adis_init

[PATCH] iio: imu: adis: Fix NULL pointer dereference in adis_init

[Radu Sabau via B4 Relay]

From: Radu Sabau <radu.sabau@analog.com>

The adis_init() function dereferences adis->ops to check if the
individual function pointers (write, read, reset) are NULL, but does
not first check if adis->ops itself is NULL.

Drivers like adis16480, adis16490, adis16545 and others do not set
custom ops and rely on adis_init() assigning the defaults. Since struct
adis is zero-initialized by devm_iio_device_alloc(), adis->ops is NULL
when adis_init() is called, causing a NULL pointer dereference:

    Unable to handle kernel NULL pointer dereference at virtual
    address 0000000000000000
    pc : adis_init+0xc0/0x118
    Call trace:
     adis_init+0xc0/0x118
     adis16480_probe+0xe0/0x670

Fix this by checking if adis->ops is NULL before dereferencing it,
falling through to assign the default ops in that case.

Fixes: 7f15d7a7d12d ("iio: imu: adis: Add reset to custom ops")
Signed-off-by: Radu Sabau <radu.sabau@analog.com>
---
adis_init() dereferences adis->ops to validate its function pointers
  before checking whether adis->ops itself is NULL. Drivers that rely on
  the default ops (adis16480, adis16490, adis16545, among others) never
  set adis->ops prior to calling adis_init(), so the field is NULL due to
  zero-initialisation by devm_iio_device_alloc(). The result is a kernel
  crash on probe:

      Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
      Hardware name: Raspberry Pi 5 Model B Rev 1.0 (DT)
      pc : adis_init+0xc0/0x118
      lr : adis_init+0x50/0x118
      Call trace:
       adis_init+0xc0/0x118
       adis16480_probe+0xe0/0x670
       spi_probe+0x8c/0xf8
       really_probe+0xc4/0x2b0

  The bug was introduced in 7f15d7 ("iio: imu: adis: Add reset to custom ops")
  which added the ops validation logic without a prior NULL check
  on the pointer itself.

  The fix is a one-line addition of !adis->ops to the condition, so that
  a NULL ops pointer is treated the same as an ops struct with all-NULL
  function pointers, both falling through to the default ops assignment.
  The validation path for partially-populated custom ops structs is
  unchanged.

  Tested on Raspberry Pi 5 with adis16545-3 connected over SPI. Without
  the fix the kernel crashes at adis_init+0xc0. With the fix the driver
  probes successfully and the device is accessible via the IIO subsystem.
---
 drivers/iio/imu/adis.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/iio/imu/adis.c b/drivers/iio/imu/adis.c
index d160147cce0b..e68bc1c36ed1 100644
--- a/drivers/iio/imu/adis.c
+++ b/drivers/iio/imu/adis.c
@@ -526,7 +526,7 @@ int adis_init(struct adis *adis, struct iio_dev *indio_dev,
 
 	adis->spi = spi;
 	adis->data = data;
-	if (!adis->ops->write && !adis->ops->read && !adis->ops->reset)
+	if (!adis->ops || (!adis->ops->write && !adis->ops->read && !adis->ops->reset))
 		adis->ops = &adis_default_ops;
 	else if (!adis->ops->write || !adis->ops->read || !adis->ops->reset)
 		return -EINVAL;

---
base-commit: 8bf22c33e7a172fbc72464f4cc484d23a6b412ba
change-id: 20260220-adis-fix-177ca0405d8a

Best regards,
-- 
Radu Sabau <radu.sabau@analog.com>

Re: [PATCH] iio: imu: adis: Fix NULL pointer dereference in adis_init

[Andy Shevchenko]

On Fri, Feb 20, 2026 at 03:36:17PM +0200, Radu Sabau via B4 Relay wrote:

> The adis_init() function dereferences adis->ops to check if the
> individual function pointers (write, read, reset) are NULL, but does
> not first check if adis->ops itself is NULL.
> 
> Drivers like adis16480, adis16490, adis16545 and others do not set
> custom ops and rely on adis_init() assigning the defaults. Since struct
> adis is zero-initialized by devm_iio_device_alloc(), adis->ops is NULL
> when adis_init() is called, causing a NULL pointer dereference:
> 
>     Unable to handle kernel NULL pointer dereference at virtual
>     address 0000000000000000

No need to wrap backtrace lines. It makes harder to understand the trace.

    Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000

>     pc : adis_init+0xc0/0x118
>     Call trace:
>      adis_init+0xc0/0x118
>      adis16480_probe+0xe0/0x670
> 
> Fix this by checking if adis->ops is NULL before dereferencing it,
> falling through to assign the default ops in that case.

...

> -	if (!adis->ops->write && !adis->ops->read && !adis->ops->reset)
> +	if (!adis->ops || (!adis->ops->write && !adis->ops->read && !adis->ops->reset))
>  		adis->ops = &adis_default_ops;
>  	else if (!adis->ops->write || !adis->ops->read || !adis->ops->reset)
>  		return -EINVAL;

Personally I wouldn't mix these two, and do rather

	if (!adis->ops)
		adis->ops = &adis_default_ops;

	// Actually the below check seems redundant to me, I would rather
	// expect that be absent in the first place.

	else if (!adis->ops->write && !adis->ops->read && !adis->ops->reset)
		adis->ops = &adis_default_ops;
	else if (!adis->ops->write || !adis->ops->read || !adis->ops->reset)
		return -EINVAL;

It also adds a flexibility to only cover missed callbacks in the future
(in case if we need that). But also see above comment.

-- 
With Best Regards,
Andy Shevchenko

RE: [PATCH] iio: imu: adis: Fix NULL pointer dereference in adis_init

[Miclaus, Antoniu]

> -----Original Message-----
> From: Radu Sabau via B4 Relay <devnull+radu.sabau.analog.com@kernel.org>
> Sent: Friday, February 20, 2026 3:36 PM
> To: Lars-Peter Clausen <lars@metafoo.de>; Hennerich, Michael
> <Michael.Hennerich@analog.com>; Sa, Nuno <Nuno.Sa@analog.com>;
> Jonathan Cameron <jic23@kernel.org>; David Lechner
> <dlechner@baylibre.com>; Andy Shevchenko <andy@kernel.org>; Budai,
> Robert <Robert.Budai@analog.com>; Miclaus, Antoniu
> <Antoniu.Miclaus@analog.com>; Gradinariu, Ramona
> <Ramona.Gradinariu@analog.com>
> Cc: Jonathan Cameron <Jonathan.Cameron@huawei.com>; linux-
> iio@vger.kernel.org; linux-kernel@vger.kernel.org; Sabau, Radu bogdan
> <Radu.Sabau@analog.com>
> Subject: [PATCH] iio: imu: adis: Fix NULL pointer dereference in adis_init
> 
> [External]
> 
> From: Radu Sabau <radu.sabau@analog.com>
> 
> The adis_init() function dereferences adis->ops to check if the
> individual function pointers (write, read, reset) are NULL, but does
> not first check if adis->ops itself is NULL.
> 
> Drivers like adis16480, adis16490, adis16545 and others do not set
> custom ops and rely on adis_init() assigning the defaults. Since struct
> adis is zero-initialized by devm_iio_device_alloc(), adis->ops is NULL
> when adis_init() is called, causing a NULL pointer dereference:
> 
>     Unable to handle kernel NULL pointer dereference at virtual
>     address 0000000000000000
>     pc : adis_init+0xc0/0x118
>     Call trace:
>      adis_init+0xc0/0x118
>      adis16480_probe+0xe0/0x670
> 
> Fix this by checking if adis->ops is NULL before dereferencing it,
> falling through to assign the default ops in that case.
> 
> Fixes: 7f15d7a7d12d ("iio: imu: adis: Add reset to custom ops")

I think you want to fix 3b29bcee8f6f ("iio: imu: adis: Add custom ops struct")
where it was first introduced. With this change and Andy's suggestions addressed:

Reviewed-by: Antoniu Miclaus <antoniu.miclaus@analog.com>

> Signed-off-by: Radu Sabau <radu.sabau@analog.com>
> ---
> adis_init() dereferences adis->ops to validate its function pointers
>   before checking whether adis->ops itself is NULL. Drivers that rely on
>   the default ops (adis16480, adis16490, adis16545, among others) never
>   set adis->ops prior to calling adis_init(), so the field is NULL due to
>   zero-initialisation by devm_iio_device_alloc(). The result is a kernel
>   crash on probe:
> 
>       Unable to handle kernel NULL pointer dereference at virtual address
> 0000000000000000
>       Hardware name: Raspberry Pi 5 Model B Rev 1.0 (DT)
>       pc : adis_init+0xc0/0x118
>       lr : adis_init+0x50/0x118
>       Call trace:
>        adis_init+0xc0/0x118
>        adis16480_probe+0xe0/0x670
>        spi_probe+0x8c/0xf8
>        really_probe+0xc4/0x2b0
> 
>   The bug was introduced in 7f15d7 ("iio: imu: adis: Add reset to custom ops")
>   which added the ops validation logic without a prior NULL check
>   on the pointer itself.
> 
>   The fix is a one-line addition of !adis->ops to the condition, so that
>   a NULL ops pointer is treated the same as an ops struct with all-NULL
>   function pointers, both falling through to the default ops assignment.
>   The validation path for partially-populated custom ops structs is
>   unchanged.
> 
>   Tested on Raspberry Pi 5 with adis16545-3 connected over SPI. Without
>   the fix the kernel crashes at adis_init+0xc0. With the fix the driver
>   probes successfully and the device is accessible via the IIO subsystem.
> ---
>  drivers/iio/imu/adis.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/iio/imu/adis.c b/drivers/iio/imu/adis.c
> index d160147cce0b..e68bc1c36ed1 100644
> --- a/drivers/iio/imu/adis.c
> +++ b/drivers/iio/imu/adis.c
> @@ -526,7 +526,7 @@ int adis_init(struct adis *adis, struct iio_dev
> *indio_dev,
> 
>  	adis->spi = spi;
>  	adis->data = data;
> -	if (!adis->ops->write && !adis->ops->read && !adis->ops->reset)
> +	if (!adis->ops || (!adis->ops->write && !adis->ops->read && !adis-
> >ops->reset))
>  		adis->ops = &adis_default_ops;
>  	else if (!adis->ops->write || !adis->ops->read || !adis->ops->reset)
>  		return -EINVAL;
> 
> ---
> base-commit: 8bf22c33e7a172fbc72464f4cc484d23a6b412ba
> change-id: 20260220-adis-fix-177ca0405d8a
> 
> Best regards,
> --
> Radu Sabau <radu.sabau@analog.com>
>