[PATCH 1/3] bus: imx-aipstz: reject devices without match data

[PATCH 1/3] bus: imx-aipstz: reject devices without match data

[Jiale Yao]

Platform driver_override can bind a device to this driver without a
matching OF entry. In that case, of_device_get_match_data() returns
NULL and imx_aipstz_apply_default() dereferences it.

Reject devices without match data before applying the default
configuration.

Fixes: 796cba2dd4d9 ("bus: add driver for IMX AIPSTZ bridge")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/bus/imx-aipstz.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/bus/imx-aipstz.c b/drivers/bus/imx-aipstz.c
index 83371e5b35a2..9f74cbcd47ff 100644
--- a/drivers/bus/imx-aipstz.c
+++ b/drivers/bus/imx-aipstz.c
@@ -61,6 +61,8 @@ static int imx_aipstz_probe(struct platform_device *pdev)
 				     "failed to get/ioremap AC memory\n");
 
 	data->default_cfg = of_device_get_match_data(&pdev->dev);
+	if (!data->default_cfg)
+		return -ENODATA;
 
 	imx_aipstz_apply_default(data);
 
-- 
2.34.1

Re: [PATCH 1/3] bus: imx-aipstz: reject devices without match data

[Frank Li]

On Tue, Oct 20, 2026 at 05:36:33PM +0800, Jiale Yao wrote:
> Platform driver_override can bind a device to this driver without a
> matching OF entry. In that case, of_device_get_match_data() returns
> NULL and imx_aipstz_apply_default() dereferences it.
>
> Reject devices without match data before applying the default
> configuration.

It should never happen. if run to here,  of_device_get_match_data() will
return validate driver data.

Frank

>
> Fixes: 796cba2dd4d9 ("bus: add driver for IMX AIPSTZ bridge")
> Cc: stable@vger.kernel.org
> Signed-off-by: Jiale Yao <yaojiale02@163.com>
> ---
>  drivers/bus/imx-aipstz.c | 2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/drivers/bus/imx-aipstz.c b/drivers/bus/imx-aipstz.c
> index 83371e5b35a2..9f74cbcd47ff 100644
> --- a/drivers/bus/imx-aipstz.c
> +++ b/drivers/bus/imx-aipstz.c
> @@ -61,6 +61,8 @@ static int imx_aipstz_probe(struct platform_device *pdev)
>  				     "failed to get/ioremap AC memory\n");
>
>  	data->default_cfg = of_device_get_match_data(&pdev->dev);
> +	if (!data->default_cfg)
> +		return -ENODATA;
>
>  	imx_aipstz_apply_default(data);
>
> --
> 2.34.1
>
>

[PATCH 2/3] bus: imx-weim: reject devices without match data

[Jiale Yao]

Platform driver_override can bind a device to this driver without a
matching OF entry. In that case, device_get_match_data() returns NULL
and weim_parse_dt() dereferences it while configuring the controller.

Reject devices without match data before parsing the device tree.

Fixes: 85bf6d4e4b10 ("drivers: bus: add a new driver for WEIM")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/bus/imx-weim.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/bus/imx-weim.c b/drivers/bus/imx-weim.c
index 87070155b057..3ecad0e453cc 100644
--- a/drivers/bus/imx-weim.c
+++ b/drivers/bus/imx-weim.c
@@ -205,13 +205,17 @@ static int weim_timing_setup(struct device *dev, struct device_node *np,
 
 static int weim_parse_dt(struct platform_device *pdev)
 {
-	const struct imx_weim_devtype *devtype = device_get_match_data(&pdev->dev);
+	const struct imx_weim_devtype *devtype;
 	int ret = 0, have_child = 0;
 	struct device_node *child;
 	struct weim_priv *priv;
 	void __iomem *base;
 	u32 reg;
 
+	devtype = device_get_match_data(&pdev->dev);
+	if (!devtype)
+		return -ENODATA;
+
 	if (devtype == &imx50_weim_devtype) {
 		ret = imx_weim_gpr_setup(pdev);
 		if (ret)
-- 
2.34.1

Re: [PATCH 2/3] bus: imx-weim: reject devices without match data

[Frank Li]

On Tue, Oct 20, 2026 at 05:36:34PM +0800, Jiale Yao wrote:
> Platform driver_override can bind a device to this driver without a
> matching OF entry. In that case, device_get_match_data() returns NULL
> and weim_parse_dt() dereferences it while configuring the controller.
>
> Reject devices without match data before parsing the device tree.

This should never happen, if run to here, driver data is always existed.

Frank
>
> Fixes: 85bf6d4e4b10 ("drivers: bus: add a new driver for WEIM")
> Cc: stable@vger.kernel.org
> Signed-off-by: Jiale Yao <yaojiale02@163.com>
> ---
>  drivers/bus/imx-weim.c | 6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/bus/imx-weim.c b/drivers/bus/imx-weim.c
> index 87070155b057..3ecad0e453cc 100644
> --- a/drivers/bus/imx-weim.c
> +++ b/drivers/bus/imx-weim.c
> @@ -205,13 +205,17 @@ static int weim_timing_setup(struct device *dev, struct device_node *np,
>
>  static int weim_parse_dt(struct platform_device *pdev)
>  {
> -	const struct imx_weim_devtype *devtype = device_get_match_data(&pdev->dev);
> +	const struct imx_weim_devtype *devtype;
>  	int ret = 0, have_child = 0;
>  	struct device_node *child;
>  	struct weim_priv *priv;
>  	void __iomem *base;
>  	u32 reg;
>
> +	devtype = device_get_match_data(&pdev->dev);
> +	if (!devtype)
> +		return -ENODATA;
> +
>  	if (devtype == &imx50_weim_devtype) {
>  		ret = imx_weim_gpr_setup(pdev);
>  		if (ret)
> --
> 2.34.1
>
>

[PATCH 3/3] bus: stm32-rifsc: reject debugfs setup without match data

[Jiale Yao]

Platform driver_override can bind a device to this driver without a
matching OF entry. With debugfs enabled, of_device_get_match_data()
then returns NULL and the configuration dump dereferences the resource
name table.

Reject debugfs registration without match data before exposing the
configuration file.

Fixes: 3bae4748c1cdd ("bus: rifsc: add debugfs entry to dump the firewall configuration")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/bus/stm32_rifsc.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/bus/stm32_rifsc.c b/drivers/bus/stm32_rifsc.c
index 19d10379dcef..dd008103b9c1 100644
--- a/drivers/bus/stm32_rifsc.c
+++ b/drivers/bus/stm32_rifsc.c
@@ -617,6 +617,8 @@ static int stm32_rifsc_register_debugfs(struct stm32_firewall_controller *rifsc_
 	rifsc_priv->nb_rimu = nb_rimu;
 	rifsc_priv->nb_risal = nb_risal;
 	rifsc_priv->res_names = of_device_get_match_data(rifsc_controller->dev);
+	if (!rifsc_priv->res_names)
+		return -ENODATA;
 
 	root = debugfs_lookup("stm32_firewall", NULL);
 	if (!root)
-- 
2.34.1