Linux Input/HID development
 help / color / mirror / Atom feed
From: sashiko-bot@kernel.org
To: "Hendrik Noack" <hendrik-noack@gmx.de>
Cc: dmitry.torokhov@gmail.com, linux-input@vger.kernel.org
Subject: Re: [PATCH v2 2/2] Input: atmel_mxt_ts: Allow per-board config via DT compatible
Date: Sat, 23 May 2026 16:18:40 +0000	[thread overview]
Message-ID: <20260523161841.06B051F000E9@smtp.kernel.org> (raw)
In-Reply-To: <20260523152332.86864-2-hendrik-noack@gmx.de>

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [Medium] The OF device node reference for the root node is leaked when falling back to the generic configuration loader.
- [Medium] Mismatch between the constructed firmware filename and the filename documented in the commit message.
--

commit e3439c3fb5cf6c8c740fae5a27659ea3cb9e7436
Author: Hendrik Noack <hendrik-noack@gmx.de>

Input: atmel_mxt_ts: Allow per-board config via DT compatible

This commit modifies the Atmel maXTouch driver to load a board-specific
configuration file based on the device tree compatible string. If the specific
configuration file is not found, it falls back to the original generic
configuration behavior.

> Extend the driver to support per-board config files keyed by the device
> tree compatible string. For DT-based systems, the driver now looks up the
> primary compatible of the board and searches for a config file named:
> 
>   atmel/maxtouch,<compatible>.cfg

[Severity: Medium]
The documentation in the commit message uses a comma before the compatible
string, but the code implementation constructs the filename using a dot.

Is it intended to use a dot here, and if so, could the commit message
be updated to match the code?

> diff --git a/drivers/input/touchscreen/atmel_mxt_ts.c b/drivers/input/touchscreen/atmel_mxt_ts.c
> index 07690c3bff06e..a9e9f151d0424 100644
> --- a/drivers/input/touchscreen/atmel_mxt_ts.c
> +++ b/drivers/input/touchscreen/atmel_mxt_ts.c

[ ... ]

> @@ -2233,6 +2235,64 @@ static void mxt_config_cb(const struct firmware *cfg, void *ctx)

[ ... ]

> +static int mxt_invoke_config_loader(struct mxt_data *data, bool device_specific)
> +{
> +	struct device_node *root;
> +	char *board_type = NULL;
> +	char *fw_name;
> +	void (*cb)(const struct firmware *fw, void *context);
> +	int error;
> +
> +	root = of_find_node_by_path("/");
> +	if (device_specific && root) {
> +		const char *tmp;
> +
> +		if (!of_property_read_string_index(root, "compatible", 0, &tmp))
> +			board_type = kstrdup(tmp, GFP_KERNEL);
> +
> +		of_node_put(root);
> +	}

[Severity: Medium]
Does this leak the root device node reference when device_specific is false?

The call to of_find_node_by_path() unconditionally acquires a reference,
but of_node_put() is only called inside the if block. The fallback
configuration path triggered from mxt_board_config_cb() passes false
for device_specific, which would bypass the release.

> +
> +	if (board_type) {
> +		/* get rid of '/' in the compatible string to be able to find the FW */
> +		strreplace(board_type, '/', '-');
> +
> +		fw_name = kasprintf(GFP_KERNEL, "%s/%s.%s%s", MXT_CFG_FOLDER, MXT_CFG_NAME,
> +				    board_type, MXT_CFG_EXTENSION);

[Severity: Medium]
Does this format string construct the filename with a dot instead of the comma
described in the commit message?

This format string expands to atmel/maxtouch.<compatible>.cfg which might lead
to unexpected firmware loading failures for users following the naming scheme
documented in the commit.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260523152332.86864-1-hendrik-noack@gmx.de?part=2

  reply	other threads:[~2026-05-23 16:18 UTC|newest]

Thread overview: 4+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-05-23 15:23 [PATCH v2 1/2] Input: atmel_mxt_ts: Fix async config use-after-free Hendrik Noack
2026-05-23 15:23 ` [PATCH v2 2/2] Input: atmel_mxt_ts: Allow per-board config via DT compatible Hendrik Noack
2026-05-23 16:18   ` sashiko-bot [this message]
2026-05-23 16:01 ` [PATCH v2 1/2] Input: atmel_mxt_ts: Fix async config use-after-free sashiko-bot

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260523161841.06B051F000E9@smtp.kernel.org \
    --to=sashiko-bot@kernel.org \
    --cc=dmitry.torokhov@gmail.com \
    --cc=hendrik-noack@gmx.de \
    --cc=linux-input@vger.kernel.org \
    --cc=sashiko-reviews@lists.linux.dev \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox