Re: [PATCH] io: adc: stm32-adc: fix potential NULL pointer dereference in stm32_adc_probe()

[Zhang Shurong]

在 2023年7月17日星期一 CST 上午12:08:21，Jonathan Cameron 写道：
> On Sat, 15 Jul 2023 23:55:50 +0800
> 
> Zhang Shurong <zhang_shurong@xxxxxxxxxxx> wrote:
> > of_match_device() may fail and returns a NULL pointer.
> > 
> > Fix this by checking the return value of of_match_device().
> > 
> > Fixes: 64ad7f6438f3 ("iio: adc: stm32: introduce compatible data cfg")
> > Signed-off-by: Zhang Shurong <zhang_shurong@xxxxxxxxxxx>
> 
> Hi Zhang,
> 
> I'm not sure we can actually make this bug happen. Do you have
> a way of triggering it?  The driver is only probed on devices where
> that match will work.
> 
> Also, assuming the match table is the same one associated with this probe
> function, then us priv->cfg = of_device_get_match_data() and check the
> output of that which is what we really care about.
> 
> Jonathan
> 
> > ---
> > 
> >  drivers/iio/adc/stm32-adc-core.c | 9 +++++++--
> >  1 file changed, 7 insertions(+), 2 deletions(-)
> > 
> > diff --git a/drivers/iio/adc/stm32-adc-core.c
> > b/drivers/iio/adc/stm32-adc-core.c index 48f02dcc81c1..70011fdbf5f6
> > 100644
> > --- a/drivers/iio/adc/stm32-adc-core.c
> > +++ b/drivers/iio/adc/stm32-adc-core.c
> > @@ -706,6 +706,8 @@ static int stm32_adc_probe(struct platform_device
> > *pdev)> 
> >  	struct stm32_adc_priv *priv;
> >  	struct device *dev = &pdev->dev;
> >  	struct device_node *np = pdev->dev.of_node;
> > 
> > +	const struct of_device_id *of_id;
> > +
> > 
> >  	struct resource *res;
> >  	u32 max_rate;
> >  	int ret;
> > 
> > @@ -718,8 +720,11 @@ static int stm32_adc_probe(struct platform_device
> > *pdev)> 
> >  		return -ENOMEM;
> >  	
> >  	platform_set_drvdata(pdev, &priv->common);
> > 
> > -	priv->cfg = (const struct stm32_adc_priv_cfg *)
> > -		of_match_device(dev->driver->of_match_table, dev)->data;
> > +	of_id = of_match_device(dev->driver->of_match_table, dev);
> > +	if (!of_id)
> > +		return -ENODEV;
> > +
> > +	priv->cfg = (const struct stm32_adc_priv_cfg *)of_id->data;
> > 
> >  	priv->nb_adc_max = priv->cfg->num_adcs;
> >  	spin_lock_init(&priv->common.lock);
Hello Jonathan,

I think we can make it happen by designing the platform device in a way that 
its name aligns with that of the driver. In such a scenario, when the driver 
is probed, the of_match_device function will return null. You can verify this 
functionality by reviewing the following function:

static int platform_match(struct device *dev, struct device_driver *drv)

Best regards,
Shurong