Re: [PATCH 3/9] watchdog: w83627hf_wdt: Use private driver data structure

Thank you for your contribution! Sashiko AI review found 1 potential issue(=
s) to consider:
- [High] Possible NULL pointer dereference of `id` in `wdt_probe` if device=
 is matched via `driver_override`.
--

--- Patch [3]: [PATCH 3/9] watchdog: w83627hf_wdt: Use private driver data =
structure ---
commit a08865ae24d92d72840774e0d257ddcdf06b2ed4
Author: Paul Louvel <[email protected]>

watchdog: w83627hf_wdt: Use private driver data structure
   =20
Allocating a per-device data structure is a common practice in the Linux
driver model. Add one that will be used to store chip-specific register
offsets, and configuration.

> diff --git a/drivers/watchdog/w83627hf_wdt.c b/drivers/watchdog/w83627hf_=
wdt.c
> index 993e65ce4447c..72e167f37885f 100644
> --- a/drivers/watchdog/w83627hf_wdt.c
> +++ b/drivers/watchdog/w83627hf_wdt.c
[ ... ]
> @@ -471,28 +464,44 @@ static int wdt_probe(struct platform_device *pdev)
>  {
>  	const struct platform_device_id *id =3D platform_get_device_id(pdev);
>  	enum chips chip =3D id->driver_data;
                          ^^^^^^^^^^^^^^^

[Severity: High]
Can platform_get_device_id() return NULL here?

If a user with root privileges writes the name of this driver ("w83627hf_wd=
t")
to the driver_override sysfs attribute of an arbitrary platform device and
forces it to bind, the device might not match any entry in the driver's
wdt_ids table.

In this case, platform_get_device_id() would return NULL, causing a NULL
pointer dereference when accessing id->driver_data.

Note that this issue appears to have been introduced when the driver was
converted to the platform driver model in patch 2 of this series.

[ ... ]
> +	data =3D devm_kzalloc(&pdev->dev, sizeof(*data), GFP_KERNEL);
> +	if (!data)
> +		return -ENOMEM;
> +
> +	data->info.options =3D WDIOF_SETTIMEOUT | WDIOF_KEEPALIVEPING | WDIOF_M=
AGICCLOSE;
> +	snprintf(data->info.identity, sizeof(data->info.identity),
> +		 "%s Watchdog", id->name);
                                ^^^^^^^^

[Severity: High]
Does this also cause a NULL pointer dereference if id is NULL under the same
driver_override condition?

[ ... ]

--=20
Sashiko AI review =C2=B7 https://sashiko.dev/#/patchset/20260725-w83627hf_w=
[email protected]?part=3D3