Re: [PATCH v2] mfd: da903x: cancel IRQ work during teardown

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

New issues:
- [Low] The commit message description starts with a lowercase letter, violating MFD subsystem guidelines.

Pre-existing issues:
- [High] Missing NULL check for platform data (`pdata`) leads to a kernel oops if the device is instantiated without it.
--

--- Patch [1]: [PATCH v2] mfd: da903x: cancel IRQ work during teardown ---
commit 2a17d672041aff8f9dbc3cb91964d70e165a4c40
Author: Hongyan Xu <[email protected]>

mfd: da903x: cancel IRQ work during teardown

This commit adds a devm action to disable the IRQ and cancel the scheduled
IRQ work during teardown. It also ensures the action is properly released
if child device creation fails during probe.

> mfd: da903x: cancel IRQ work during teardown

[Severity: Low]
This isn't a bug, but MFD subsystem guidelines require the description
after the subsystem prefix to be capitalized. Should "cancel" be capitalized
here?

> diff --git a/drivers/mfd/da903x.c b/drivers/mfd/da903x.c
> index e86b39de3303a..f3e983bd21b0d 100644
> --- a/drivers/mfd/da903x.c
> +++ b/drivers/mfd/da903x.c

[ ... ]

> @@ -529,6 +538,11 @@ static int da903x_probe(struct i2c_client *client)
>  		return ret;
>  	}
>  
> +	ret = devm_add_action_or_reset(&client->dev, da903x_cancel_irq_work,
> +				       chip);
> +	if (ret)
> +		return ret;
> +
>  	return da903x_add_subdevs(chip, pdata);

[Severity: High]
This is a pre-existing issue, but can passing pdata here cause a NULL 
pointer dereference if the device is instantiated without platform data?

If the driver is instantiated via the i2c sysfs interface without platform
data, dev_get_platdata() returns NULL. This is then passed directly into
da903x_add_subdevs(), which blindly dereferences it:

da903x_probe()->da903x_add_subdevs()
    for (i = 0; i < pdata->num_subdevs; i++) {
        subdev = &pdata->subdevs[i];

Could we add a NULL check for pdata in da903x_probe() to prevent a kernel
oops?

>  }
>  
> @@ -536,6 +550,7 @@ static void da903x_remove(struct i2c_client *client)

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=1