Re: [PATCH] io: adc: stm32-adc: fix potential NULL pointer dereference in stm32_adc_probe()

[Jonathan Cameron]

On Sat, 15 Jul 2023 23:55:50 +0800
Zhang Shurong <zhang_shurong@xxxxxxxxxxx> wrote:

> of_match_device() may fail and returns a NULL pointer.
> 
> Fix this by checking the return value of of_match_device().
> 
> Fixes: 64ad7f6438f3 ("iio: adc: stm32: introduce compatible data cfg")
> Signed-off-by: Zhang Shurong <zhang_shurong@xxxxxxxxxxx>
Hi Zhang,

I'm not sure we can actually make this bug happen. Do you have
a way of triggering it?  The driver is only probed on devices where
that match will work.

Also, assuming the match table is the same one associated with this probe
function, then us priv->cfg = of_device_get_match_data() and check the output
of that which is what we really care about.

Jonathan

> ---
>  drivers/iio/adc/stm32-adc-core.c | 9 +++++++--
>  1 file changed, 7 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/iio/adc/stm32-adc-core.c b/drivers/iio/adc/stm32-adc-core.c
> index 48f02dcc81c1..70011fdbf5f6 100644
> --- a/drivers/iio/adc/stm32-adc-core.c
> +++ b/drivers/iio/adc/stm32-adc-core.c
> @@ -706,6 +706,8 @@ static int stm32_adc_probe(struct platform_device *pdev)
>  	struct stm32_adc_priv *priv;
>  	struct device *dev = &pdev->dev;
>  	struct device_node *np = pdev->dev.of_node;
> +	const struct of_device_id *of_id;
> +
>  	struct resource *res;
>  	u32 max_rate;
>  	int ret;
> @@ -718,8 +720,11 @@ static int stm32_adc_probe(struct platform_device *pdev)
>  		return -ENOMEM;
>  	platform_set_drvdata(pdev, &priv->common);
>  
> -	priv->cfg = (const struct stm32_adc_priv_cfg *)
> -		of_match_device(dev->driver->of_match_table, dev)->data;
> +	of_id = of_match_device(dev->driver->of_match_table, dev);
> +	if (!of_id)
> +		return -ENODEV;
> +
> +	priv->cfg = (const struct stm32_adc_priv_cfg *)of_id->data;
>  	priv->nb_adc_max = priv->cfg->num_adcs;
>  	spin_lock_init(&priv->common.lock);
>