[PATCH] input: mtk-pmic-keys: Fix potential NULL pointer dereference in probe()

[PATCH] input: mtk-pmic-keys: Fix potential NULL pointer dereference in probe()

[Haotian Zhang]

of_match_device() may return NULL when the device node
does not match any entry in the driver's match table.
The current code dereferences of_id->data unconditionally,
which can lead to a NULL pointer dereference.

Add a NULL check for the return value of of_match_device()
and return -ENODEV upon failure.

Fixes: 3e9f0b3e2b27 ("input: Add MediaTek PMIC keys support")
Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
---
 drivers/input/keyboard/mtk-pmic-keys.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/input/keyboard/mtk-pmic-keys.c b/drivers/input/keyboard/mtk-pmic-keys.c
index c78d9f6d97c4..474ef36605dc 100644
--- a/drivers/input/keyboard/mtk-pmic-keys.c
+++ b/drivers/input/keyboard/mtk-pmic-keys.c
@@ -335,6 +335,8 @@ static int mtk_pmic_keys_probe(struct platform_device *pdev)
 	struct input_dev *input_dev;
 	const struct of_device_id *of_id =
 		of_match_device(of_mtk_pmic_keys_match_tbl, &pdev->dev);
+	if (!of_id)
+		return -ENODEV;
 
 	keys = devm_kzalloc(&pdev->dev, sizeof(*keys), GFP_KERNEL);
 	if (!keys)
-- 
2.50.1.windows.1

Re: [PATCH] input: mtk-pmic-keys: Fix potential NULL pointer dereference in probe()

[Dmitry Torokhov]

Hi Haotian,

On Wed, Dec 10, 2025 at 11:00:13AM +0800, Haotian Zhang wrote:
> of_match_device() may return NULL when the device node
> does not match any entry in the driver's match table.
> The current code dereferences of_id->data unconditionally,
> which can lead to a NULL pointer dereference.

How are we getting into probe() without matching compatible?

We already had a discussion about this in [1] and patched the MFD
portion to not use generic driver name when instantiating the keypad
sub-device.

[1] http://lore.kernel.org/r/20250630-mtk-pmic-keys-fix-crash-v1-1-e47351fa9d1f@collabora.com

Thanks.

-- 
Dmitry

Re: [PATCH] input: mtk-pmic-keys: Fix potential NULL pointer dereference in probe()

[Markus Elfring]

> of_match_device() may return NULL when the device node
> does not match any entry in the driver's match table.
> The current code dereferences of_id->data unconditionally,
> which can lead to a NULL pointer dereference.
…

Under which circumstances would you get into the mood to take more desirable
word wrap preferences better into account?
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/submitting-patches.rst?h=v6.18#n658

Regards,
Markus