[PATCH v3 1/2] mfd: wcd934x: Fix NULL pointer dereference on IRQ probe deferral

[David Heidelberg via B4 Relay]

From: David Heidelberg <david@xxxxxxx>

ddata->dev is only assigned at the end of wcd934x_slim_probe(), but the
of_irq_get() error path has passed it to the error print since the
driver was added, while it is still NULL.

This used to be harmless with dev_err(), which copes with a NULL device
and was skipped on -EPROBE_DEFER. Since the switch to dev_err_probe(), a
deferred IRQ reaches device_set_deferred_probe_reason() ->
dev_driver_string(), which dereferences the NULL pointer and crashes
during probe. Use dev, which is already valid at this point.

Cc: stable@xxxxxxxxxxxxxxx
Fixes: 0f1b1b899521 ("mfd: wcd934x: Simplify with dev_err_probe()")
Reported-by: Sashiko <sashiko-bot@xxxxxxxxxx>
Link: https://lore.kernel.org/mfd/20260903145651.AC1311F00ACA@xxxxxxxxxxxxxxx/
Signed-off-by: David Heidelberg <david@xxxxxxx>
---
 drivers/mfd/wcd934x.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/mfd/wcd934x.c b/drivers/mfd/wcd934x.c
index 3c3080e8c8cf7..3a939e7ad3da5 100644
--- a/drivers/mfd/wcd934x.c
+++ b/drivers/mfd/wcd934x.c
@@ -218,17 +218,17 @@ static int wcd934x_slim_probe(struct slim_device *sdev)
 	int ret;
 
 	ddata = devm_kzalloc(dev, sizeof(*ddata), GFP_KERNEL);
 	if (!ddata)
 		return	-ENOMEM;
 
 	ddata->irq = of_irq_get(np, 0);
 	if (ddata->irq < 0)
-		return dev_err_probe(ddata->dev, ddata->irq,
+		return dev_err_probe(dev, ddata->irq,
 				     "Failed to get IRQ\n");
 
 	ddata->extclk = devm_clk_get(dev, "extclk");
 	if (IS_ERR(ddata->extclk))
 		return dev_err_probe(dev, PTR_ERR(ddata->extclk),
 				     "Failed to get extclk");
 
 	ddata->supplies[0].supply = "vdd-buck";

-- 
2.55.0