Re: [PATCH v10 10/11] iio: adc: qcom-spmi-iadc: Migrate to devm_spmi_subdevice_alloc_and_add()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Blind cast of `dev->parent` to `struct spmi_device` bypassing bus type validation can lead to a type confusion vulnerability and kernel panic.
--

--- Patch [10]: [PATCH v10 10/11] iio: adc: qcom-spmi-iadc: Migrate to devm_spmi_subdevice_alloc_and_add() ---
commit e1eedb072014331c1e52822eb31e7a9aaeb3e848
Author: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>

iio: adc: qcom-spmi-iadc: Migrate to devm_spmi_subdevice_alloc_and_add()

This commit changes the driver to register a new SPMI sub-device and
initialize its own regmap rather than using the parent SPMI device's
regmap. This allows the regmap API to handle the base address directly.

> diff --git a/drivers/iio/adc/qcom-spmi-iadc.c b/drivers/iio/adc/qcom-spmi-iadc.c
> --- a/drivers/iio/adc/qcom-spmi-iadc.c
> +++ b/drivers/iio/adc/qcom-spmi-iadc.c
[ ... ]
> @@ -502,18 +511,21 @@ static int iadc_probe(struct platform_device *pdev)
>  	iadc = iio_priv(indio_dev);
>  	iadc->dev = dev;
>  
> -	iadc->regmap = dev_get_regmap(dev->parent, NULL);
> -	if (!iadc->regmap)
> -		return -ENODEV;
> +	sparent = to_spmi_device(dev->parent);
> +	sub_sdev = devm_spmi_subdevice_alloc_and_add(dev, sparent);

[Severity: High]
Could this blind cast to struct spmi_device cause a kernel panic if the
parent device isn't actually on the SPMI bus?

If a customized device tree or overlay instantiates this driver under a
non-SPMI parent node (for example, directly under simple-bus), dev->parent
will not be a valid spmi_device. When subdevice allocation accesses
sparent->ctrl, it will read memory overlapping with the parent's actual
structure, which can lead to an invalid pointer dereference.

The previous implementation safely handled this via dev_get_regmap(), but
this new cast bypasses bus type validation. Would it be better to use
spmi_find_device_by_of_node() here, similar to how it is used in other
drivers in this patch series, to ensure the device is safely retrieved?

> +	if (IS_ERR(sub_sdev))
> +		return PTR_ERR(sub_sdev);
>  
>  	init_completion(&iadc->complete);
>  	mutex_init(&iadc->lock);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260707083730.33977-1-angelogioacchino.delregno@collabora.com?part=10

-- 
linux-phy mailing list
linux-phy@lists.infradead.org
https://lists.infradead.org/mailman/listinfo/linux-phy