Re: [PATCH] dt-bindings: mfd: Convert TPS61050 to DT schema

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The MFD core driver dynamically mutates static `mfd_cell` structures to pass custom parent data via `platform_data`, violating MFD guidelines and introducing a race condition.
--

--- Patch [1]: [PATCH] dt-bindings: mfd: Convert TPS61050 to DT schema ---
commit c3b0af0c4f22b90e8d39db54cb33489eff5b078e
Author: Eduard Bostina <[email protected]>

dt-bindings: mfd: Convert TPS61050 to DT schema
    
Convert the Texas Instruments TPS61050/TPS61052 boost converters bindings
to DT schema.

> diff --git a/Documentation/devicetree/bindings/mfd/ti,tps61050.yaml b/Documentation/devicetree/bindings/mfd/ti,tps61050.yaml
> new file mode 100644
> index 0000000000000..974ef78d6e26e
> --- /dev/null
> +++ b/Documentation/devicetree/bindings/mfd/ti,tps61050.yaml
> @@ -0,0 +1,92 @@
> +# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
> +%YAML 1.2
> +---
> +$id: http://devicetree.org/schemas/mfd/ti,tps61050.yaml#
> +$schema: http://devicetree.org/meta-schemas/core.yaml#
> +
> +title: Texas Instruments TPS61050/TPS61052 Boost Converter

[Severity: High]
This isn't a bug introduced by this patch, but the core driver for these
devices dynamically mutates static mfd_cell structures.

Looking at tps6105x_add_device() in drivers/mfd/tps6105x.c, the function
modifies the shared static mfd_cell's platform_data field with a pointer to
the newly allocated parent data:

drivers/mfd/tps6105x.c:tps6105x_add_device() {
    ...
	cell->platform_data = tps6105x;
	cell->pdata_size = sizeof(*tps6105x);
    ...
}

Because the cell is declared as static but not const:

drivers/mfd/tps6105x.c:
static struct mfd_cell tps6105x_gpio_cell = {
	.name = "tps6105x-gpio",
};

Could this create a data race if multiple I2C adapter initialization threads
concurrently call tps6105x_probe()?

Additionally, the child driver incorrectly reads the duplicated platform_data
instead of using dev_get_drvdata() on the parent device as mandated by MFD
rules:

drivers/leds/leds-tps6105x.c:tps6105x_led_probe() {
    ...
	struct tps6105x *tps6105x = dev_get_platdata(&pdev->dev);
    ...
}

Because platform_device_add_data() makes a kmemdup copy of the struct passed
via platform_data, if device B unbinds, device A's child may hold a copy of
pointers that were freed, leading to a Use-After-Free.

Could the child driver be updated to retrieve parent data via
dev_get_drvdata(pdev->dev.parent), allowing the mfd_cell arrays to be static
const?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=1