Re: [PATCH v2] input: misc: Convert to DEFINE_SIMPLE_DEV_PM_OPS()

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Out-of-bounds memory access in `pm80x_dev_suspend` and `pm80x_dev_resume` due to using a virtual IRQ number as a bit index.
--

--- Patch [1]: [PATCH v2] input: misc: Convert to DEFINE_SIMPLE_DEV_PM_OPS() ---
commit 34551f878a1e83fc07284971e8c372f8a5be3f46
Author: Triet Hoang <[email protected]>

input: misc: Convert to DEFINE_SIMPLE_DEV_PM_OPS()

This commit converts the deprecated SIMPLE_DEV_PM_OPS to
DEFINE_SIMPLE_DEV_PM_OPS and uses pm_ptr/pm_sleep_ptr(). This allows
dropping the __maybe_unused annotations from the resume callbacks and
reduces kernel size when PM options are disabled.

[ ... ]
> diff --git a/include/linux/mfd/88pm80x.h b/include/linux/mfd/88pm80x.h
> index 551ef1c367d65..be1b0d961e01a 100644
> --- a/include/linux/mfd/88pm80x.h
> +++ b/include/linux/mfd/88pm80x.h
> @@ -339,7 +339,6 @@ static inline void pm80x_free_irq(struct pm80x_chip *pm80x, int irq, void *data)
>  	free_irq(regmap_irq_get_virq(pm80x->irq_data, irq), data);
>  }
>  
> -#ifdef CONFIG_PM
>  static inline int pm80x_dev_suspend(struct device *dev)
>  {
>  	struct platform_device *pdev = to_platform_device(dev);

[Severity: High]
This is a pre-existing issue, but does using the virtual IRQ as a bit
index here lead to out-of-bounds memory accesses?

Looking at the body of pm80x_dev_suspend():

    int irq = platform_get_irq(pdev, 0);

    if (device_may_wakeup(dev))
        set_bit(irq, &chip->wu_flag);

Since platform_get_irq() returns a virtual IRQ number dynamically assigned
by the kernel, can this value exceed the capacity of the unsigned long
wu_flag?

Also, if platform_get_irq() returns a negative error code such as -ENXIO,
would passing it as an unsigned bit index to set_bit() cause a massive
out-of-bounds memory write and corrupt memory?

The same pattern exists in pm80x_dev_resume() with clear_bit().

> @@ -363,7 +362,6 @@ static inline int pm80x_dev_resume(struct device *dev)
>  
>  	return 0;
>  }
> -#endif

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=1