Re: [PATCH v2] leds: is31fl319x: modernize registration

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

New issues:
- [Low] Typo in error message string: 'corrunt' instead of 'current'.

Pre-existing issues:
- [High] Pre-existing NULL pointer dereference of `is31->cdef` when instantiating the driver via I2C sysfs (legacy matching).
--

commit c7085457e861bc7b7298902d300df66d0cbd367a
Author: Andreas Kemnade <andreas@kemnade.info>

leds: is31fl319x: modernize registration

This patch updates the driver to use the _ext version of LED registration
so properties can be parsed automatically and LEDs can be referenced via
phandle. It also defers LED registration until after iterating over the
nodes to determine the maximum current configuration.

> diff --git a/drivers/leds/leds-is31fl319x.c b/drivers/leds/leds-is31fl319x.c
> index 80f38dba0fba4..a912adf2c7d31 100644
> --- a/drivers/leds/leds-is31fl319x.c
> +++ b/drivers/leds/leds-is31fl319x.c
> @@ -363,31 +363,17 @@ static const struct of_device_id of_is31fl319x_match[] = {
[ ... ]
> -static int is31fl319x_parse_child_fw(const struct device *dev,
> -				     const struct fwnode_handle *child,
> -				     struct is31fl319x_led *led,
> -				     struct is31fl319x_chip *is31)
> +static void is31_free_fwnode(void *data)
>  {
> -	struct led_classdev *cdev = &led->cdev;
> -	int ret;
> -
> -	if (fwnode_property_read_string(child, "label", &cdev->name))
> -		cdev->name = fwnode_get_name(child);
> +	struct is31fl319x_chip *is31 = data;
> +	int i;
>  
> -	ret = fwnode_property_read_string(child, "linux,default-trigger", &cdev->default_trigger);
> -	if (ret < 0 && ret != -EINVAL) /* is optional */
> -		return ret;
> +	for (i = 0; i < is31->cdef->num_leds; i++) {

[Severity: High]
This isn't a bug introduced by this patch, but does this dereference of
is31->cdef in is31_free_fwnode() cause a kernel panic if the driver is
instantiated via I2C sysfs?

If the driver is bound manually via legacy I2C matching (for example, by
writing to /sys/bus/i2c/devices/i2c-0/new_device), device_get_match_data()
will return NULL because the driver's i2c_device_id array does not provide
.driver_data.

The driver already unconditionally dereferences is31->cdef later in
is31fl319x_parse_fw(), but this patch introduces an additional vector
where the new cleanup function runs and crashes on the same NULL pointer
dereference.

> +		if (is31->leds[i].fwnode)
> +			fwnode_handle_put(is31->leds[i].fwnode);
>  
> -	led->max_microamp = is31->cdef->current_default;
> -	ret = fwnode_property_read_u32(child, "led-max-microamp", &led->max_microamp);
> -	if (!ret) {
> -		if (led->max_microamp < is31->cdef->current_min)
> -			return -EINVAL;	/* not supported */
> -		led->max_microamp = min(led->max_microamp,
> -					is31->cdef->current_max);
> +		is31->leds[i].fwnode = NULL;
>  	}
> -
> -	return 0;
>  }
[ ... ]
> @@ -427,14 +417,20 @@ static int is31fl319x_parse_fw(struct device *dev, struct is31fl319x_chip *is31)
>  
>  		led = &is31->leds[reg - 1];
>  
> -		if (led->configured)
> +		if (led->fwnode)
>  			return dev_err_probe(dev, -EINVAL, "led %u is already configured\n", reg);
>  
> -		ret = is31fl319x_parse_child_fw(dev, child, led, is31);
> -		if (ret)
> -			return dev_err_probe(dev, ret, "led %u DT parsing failed\n", reg);
> +		led->max_microamp = is31->cdef->current_default;
> +		ret = fwnode_property_read_u32(child, "led-max-microamp", &led->max_microamp);
> +		if (!ret) {
> +			if (led->max_microamp < is31->cdef->current_min)
> +				return dev_err_probe(dev, -EINVAL, "invalid maximum corrunt\n");

[Severity: Low]
Is there a typo in this error message? It looks like "corrunt" should be
"current".

> +
> +			led->max_microamp = min(led->max_microamp,
> +						is31->cdef->current_max);
> +		}
>  
> -		led->configured = true;
> +		led->fwnode = fwnode_handle_get(child);
>  	}
>  
>  	is31->audio_gain_db = 0;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260703-led-modern-v2-1-d07dd0d6ec6f@kemnade.info?part=1