RE: [PATCH] iio: imu: adis: Fix NULL pointer dereference in adis_init

[Miclaus, Antoniu]

> -----Original Message-----
> From: Radu Sabau via B4 Relay <devnull+radu.sabau.analog.com@xxxxxxxxxx>
> Sent: Friday, February 20, 2026 3:36 PM
> To: Lars-Peter Clausen <lars@xxxxxxxxxx>; Hennerich, Michael
> <Michael.Hennerich@xxxxxxxxxx>; Sa, Nuno <Nuno.Sa@xxxxxxxxxx>;
> Jonathan Cameron <jic23@xxxxxxxxxx>; David Lechner
> <dlechner@xxxxxxxxxxxx>; Andy Shevchenko <andy@xxxxxxxxxx>; Budai,
> Robert <Robert.Budai@xxxxxxxxxx>; Miclaus, Antoniu
> <Antoniu.Miclaus@xxxxxxxxxx>; Gradinariu, Ramona
> <Ramona.Gradinariu@xxxxxxxxxx>
> Cc: Jonathan Cameron <Jonathan.Cameron@xxxxxxxxxx>; linux-
> iio@xxxxxxxxxxxxxxx; linux-kernel@xxxxxxxxxxxxxxx; Sabau, Radu bogdan
> <Radu.Sabau@xxxxxxxxxx>
> Subject: [PATCH] iio: imu: adis: Fix NULL pointer dereference in adis_init
> 
> [External]
> 
> From: Radu Sabau <radu.sabau@xxxxxxxxxx>
> 
> The adis_init() function dereferences adis->ops to check if the
> individual function pointers (write, read, reset) are NULL, but does
> not first check if adis->ops itself is NULL.
> 
> Drivers like adis16480, adis16490, adis16545 and others do not set
> custom ops and rely on adis_init() assigning the defaults. Since struct
> adis is zero-initialized by devm_iio_device_alloc(), adis->ops is NULL
> when adis_init() is called, causing a NULL pointer dereference:
> 
>     Unable to handle kernel NULL pointer dereference at virtual
>     address 0000000000000000
>     pc : adis_init+0xc0/0x118
>     Call trace:
>      adis_init+0xc0/0x118
>      adis16480_probe+0xe0/0x670
> 
> Fix this by checking if adis->ops is NULL before dereferencing it,
> falling through to assign the default ops in that case.
> 
> Fixes: 7f15d7a7d12d ("iio: imu: adis: Add reset to custom ops")

I think you want to fix 3b29bcee8f6f ("iio: imu: adis: Add custom ops struct")
where it was first introduced. With this change and Andy's suggestions addressed:

Reviewed-by: Antoniu Miclaus <antoniu.miclaus@xxxxxxxxxx>

> Signed-off-by: Radu Sabau <radu.sabau@xxxxxxxxxx>
> ---
> adis_init() dereferences adis->ops to validate its function pointers
>   before checking whether adis->ops itself is NULL. Drivers that rely on
>   the default ops (adis16480, adis16490, adis16545, among others) never
>   set adis->ops prior to calling adis_init(), so the field is NULL due to
>   zero-initialisation by devm_iio_device_alloc(). The result is a kernel
>   crash on probe:
> 
>       Unable to handle kernel NULL pointer dereference at virtual address
> 0000000000000000
>       Hardware name: Raspberry Pi 5 Model B Rev 1.0 (DT)
>       pc : adis_init+0xc0/0x118
>       lr : adis_init+0x50/0x118
>       Call trace:
>        adis_init+0xc0/0x118
>        adis16480_probe+0xe0/0x670
>        spi_probe+0x8c/0xf8
>        really_probe+0xc4/0x2b0
> 
>   The bug was introduced in 7f15d7 ("iio: imu: adis: Add reset to custom ops")
>   which added the ops validation logic without a prior NULL check
>   on the pointer itself.
> 
>   The fix is a one-line addition of !adis->ops to the condition, so that
>   a NULL ops pointer is treated the same as an ops struct with all-NULL
>   function pointers, both falling through to the default ops assignment.
>   The validation path for partially-populated custom ops structs is
>   unchanged.
> 
>   Tested on Raspberry Pi 5 with adis16545-3 connected over SPI. Without
>   the fix the kernel crashes at adis_init+0xc0. With the fix the driver
>   probes successfully and the device is accessible via the IIO subsystem.
> ---
>  drivers/iio/imu/adis.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/iio/imu/adis.c b/drivers/iio/imu/adis.c
> index d160147cce0b..e68bc1c36ed1 100644
> --- a/drivers/iio/imu/adis.c
> +++ b/drivers/iio/imu/adis.c
> @@ -526,7 +526,7 @@ int adis_init(struct adis *adis, struct iio_dev
> *indio_dev,
> 
>  	adis->spi = spi;
>  	adis->data = data;
> -	if (!adis->ops->write && !adis->ops->read && !adis->ops->reset)
> +	if (!adis->ops || (!adis->ops->write && !adis->ops->read && !adis-
> >ops->reset))
>  		adis->ops = &adis_default_ops;
>  	else if (!adis->ops->write || !adis->ops->read || !adis->ops->reset)
>  		return -EINVAL;
> 
> ---
> base-commit: 8bf22c33e7a172fbc72464f4cc484d23a6b412ba
> change-id: 20260220-adis-fix-177ca0405d8a
> 
> Best regards,
> --
> Radu Sabau <radu.sabau@xxxxxxxxxx>
>