Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

iio: core: Prevent invalid memory access when there is no parent

Commit 813665564b3d ("iio: core: Convert to use firmware node handle
instead of OF node") switched the kind of nodes to use for label
retrieval in device registration. Probably an unwanted change in that
commit was that if the device has no parent then NULL pointer is
accessed. This is what happens in the stock IIO dummy driver when a
new entry is created in configfs:

# mkdir /sys/kernel/config/iio/devices/dummy/foo
BUG: kernel NULL pointer dereference, address: ...
...
Call Trace:
__iio_device_register
iio_dummy_probe

Since there seems to be no reason to make a parent device of an IIO
dummy device mandatory, let’s prevent the invalid memory access in
__iio_device_register when the parent device is NULL. With this
change, the IIO dummy driver works fine with configfs.

Fixes: 813665564b3d ("iio: core: Convert to use firmware node handle instead of OF node")
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Milan Zamazal <mzamazal@redhat.com>
Link: https://lore.kernel.org/r/20230719083208.88149-1-mzamazal@redhat.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>

authored by

Milan Zamazal and committed by
Jonathan Cameron
b2a69969 507397d1

+3 -2
+3 -2
drivers/iio/industrialio-core.c
··· 1888 1888 int __iio_device_register(struct iio_dev *indio_dev, struct module *this_mod) 1889 1889 { 1890 1890 struct iio_dev_opaque *iio_dev_opaque = to_iio_dev_opaque(indio_dev); 1891 - struct fwnode_handle *fwnode; 1891 + struct fwnode_handle *fwnode = NULL; 1892 1892 int ret; 1893 1893 1894 1894 if (!indio_dev->info) ··· 1899 1899 /* If the calling driver did not initialize firmware node, do it here */ 1900 1900 if (dev_fwnode(&indio_dev->dev)) 1901 1901 fwnode = dev_fwnode(&indio_dev->dev); 1902 - else 1902 + /* The default dummy IIO device has no parent */ 1903 + else if (indio_dev->dev.parent) 1903 1904 fwnode = dev_fwnode(indio_dev->dev.parent); 1904 1905 device_set_node(&indio_dev->dev, fwnode); 1905 1906