Re: [PATCH v10 14/36] pinctrl: airoha: add missed get_direction() function for gpio_chip

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] NULL pointer dereference in `airoha_gpio_get_direction` due to uninitialized `gpio_chip` data.
--

--- Patch [14]: [PATCH v10 14/36] pinctrl: airoha: add missed get_direction() function for gpio_chip ---
commit a28e04a43e47b35e64952416f2914df3c7e0801d
Author: Mikhail Kshevetskiy <[email protected]>

pinctrl: airoha: add missed get_direction() function for gpio_chip
    
This patch adds missed get_direction() function for gpio_chip.
Also it reimplements pinconf's get_direction() function using
newly defined function.

> diff --git a/drivers/pinctrl/airoha/pinctrl-airoha.c b/drivers/pinctrl/airoha/pinctrl-airoha.c
> index a1044babb2823..df1694296046c 100644
> --- a/drivers/pinctrl/airoha/pinctrl-airoha.c
> +++ b/drivers/pinctrl/airoha/pinctrl-airoha.c
> @@ -2523,6 +2523,22 @@ static int airoha_gpio_get(struct gpio_chip *chip, unsigned int gpio)
>  	return err ? err : !!(val & BIT(pin));
>  }
>  
> +static int airoha_gpio_get_direction(struct gpio_chip *chip, unsigned int gpio)
> +{
> +	struct airoha_pinctrl *pinctrl = gpiochip_get_data(chip);

[Severity: High]
Can this cause a NULL pointer dereference during early probe?

The comments added in airoha_pinctrl_probe() explicitly mention that pinctrl
operations like get_direction() might run before the gpio chip abstraction is
completely initialized.

If airoha_pinconf_get_direction() is called during this window, it passes
the unregistered &pinctrl->gpiochip.chip into this function. However,
gpiochip_get_data() unconditionally dereferences chip->gpiodev:

drivers/gpio/gpiolib.c:gpiochip_get_data() {
        ...
        return gc->gpiodev->data;
}

Since gpiodev is allocated later during gpiochip registration, it will be
NULL here and crash. Could we use container_of() to derive the
airoha_pinctrl pointer directly from the embedded chip member to avoid this?

> +	u32 val, mask;
> +	u8 index;
> +	int err;
> +
> +	index = gpio / AIROHA_REG_GPIOCTRL_NUM_PIN;
> +	err = regmap_read(pinctrl->regmap, pinctrl->gpiochip.dir[index], &val);
> +	if (err)
> +		return err;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=14