From: sashiko-bot@kernel.org
To: "Hendrik Noack" <hendrik-noack@gmx.de>
Cc: dmitry.torokhov@gmail.com, linux-input@vger.kernel.org
Subject: Re: [PATCH v2 2/2] Input: atmel_mxt_ts: Allow per-board config via DT compatible
Date: Sat, 23 May 2026 16:18:40 +0000 [thread overview]
Message-ID: <20260523161841.06B051F000E9@smtp.kernel.org> (raw)
In-Reply-To: <20260523152332.86864-2-hendrik-noack@gmx.de>
Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [Medium] The OF device node reference for the root node is leaked when falling back to the generic configuration loader.
- [Medium] Mismatch between the constructed firmware filename and the filename documented in the commit message.
--
commit e3439c3fb5cf6c8c740fae5a27659ea3cb9e7436
Author: Hendrik Noack <hendrik-noack@gmx.de>
Input: atmel_mxt_ts: Allow per-board config via DT compatible
This commit modifies the Atmel maXTouch driver to load a board-specific
configuration file based on the device tree compatible string. If the specific
configuration file is not found, it falls back to the original generic
configuration behavior.
> Extend the driver to support per-board config files keyed by the device
> tree compatible string. For DT-based systems, the driver now looks up the
> primary compatible of the board and searches for a config file named:
>
> atmel/maxtouch,<compatible>.cfg
[Severity: Medium]
The documentation in the commit message uses a comma before the compatible
string, but the code implementation constructs the filename using a dot.
Is it intended to use a dot here, and if so, could the commit message
be updated to match the code?
> diff --git a/drivers/input/touchscreen/atmel_mxt_ts.c b/drivers/input/touchscreen/atmel_mxt_ts.c
> index 07690c3bff06e..a9e9f151d0424 100644
> --- a/drivers/input/touchscreen/atmel_mxt_ts.c
> +++ b/drivers/input/touchscreen/atmel_mxt_ts.c
[ ... ]
> @@ -2233,6 +2235,64 @@ static void mxt_config_cb(const struct firmware *cfg, void *ctx)
[ ... ]
> +static int mxt_invoke_config_loader(struct mxt_data *data, bool device_specific)
> +{
> + struct device_node *root;
> + char *board_type = NULL;
> + char *fw_name;
> + void (*cb)(const struct firmware *fw, void *context);
> + int error;
> +
> + root = of_find_node_by_path("/");
> + if (device_specific && root) {
> + const char *tmp;
> +
> + if (!of_property_read_string_index(root, "compatible", 0, &tmp))
> + board_type = kstrdup(tmp, GFP_KERNEL);
> +
> + of_node_put(root);
> + }
[Severity: Medium]
Does this leak the root device node reference when device_specific is false?
The call to of_find_node_by_path() unconditionally acquires a reference,
but of_node_put() is only called inside the if block. The fallback
configuration path triggered from mxt_board_config_cb() passes false
for device_specific, which would bypass the release.
> +
> + if (board_type) {
> + /* get rid of '/' in the compatible string to be able to find the FW */
> + strreplace(board_type, '/', '-');
> +
> + fw_name = kasprintf(GFP_KERNEL, "%s/%s.%s%s", MXT_CFG_FOLDER, MXT_CFG_NAME,
> + board_type, MXT_CFG_EXTENSION);
[Severity: Medium]
Does this format string construct the filename with a dot instead of the comma
described in the commit message?
This format string expands to atmel/maxtouch.<compatible>.cfg which might lead
to unexpected firmware loading failures for users following the naming scheme
documented in the commit.
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260523152332.86864-1-hendrik-noack@gmx.de?part=2
next prev parent reply other threads:[~2026-05-23 16:18 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-05-23 15:23 [PATCH v2 1/2] Input: atmel_mxt_ts: Fix async config use-after-free Hendrik Noack
2026-05-23 15:23 ` [PATCH v2 2/2] Input: atmel_mxt_ts: Allow per-board config via DT compatible Hendrik Noack
2026-05-23 16:18 ` sashiko-bot [this message]
2026-05-23 16:01 ` [PATCH v2 1/2] Input: atmel_mxt_ts: Fix async config use-after-free sashiko-bot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260523161841.06B051F000E9@smtp.kernel.org \
--to=sashiko-bot@kernel.org \
--cc=dmitry.torokhov@gmail.com \
--cc=hendrik-noack@gmx.de \
--cc=linux-input@vger.kernel.org \
--cc=sashiko-reviews@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox