linux-kernel - Re: [PATCH v2] pinctrl: canaan: k230: Fix NULL pointer dereference when parsing devicetree

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <aWiLFFnk9aAiMMJI@duge-virtual-machine>
Date: Thu, 15 Jan 2026 14:38:14 +0800
From: Jiayu Du <jiayu.riscv@...c.iscas.ac.cn>
To: linusw@...nel.org
Cc: pjw@...nel.org, palmer@...belt.com, aou@...s.berkeley.edu,
	alex@...ti.fr, linux-gpio@...r.kernel.org,
	linux-riscv@...ts.infradead.org, linux-kernel@...r.kernel.org,
	gaohan@...as.ac.cn, me@...ao.cc
Subject: Re: [PATCH v2] pinctrl: canaan: k230: Fix NULL pointer dereference
 when parsing devicetree

On Sun, Dec 28, 2025 at 11:49:47PM +0800, Jiayu Du wrote:
> When probing the k230 pinctrl driver, the kernel triggers a NULL pointer
> dereference. The crash trace showed:
> [    0.732084] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000068
> [    0.740737] ...
> [    0.776296] epc : k230_pinctrl_probe+0x1be/0x4fc
> 
> In k230_pinctrl_parse_functions(), we attempt to retrieve the device
> pointer via info->pctl_dev->dev, but info->pctl_dev is only initialized
> after k230_pinctrl_parse_dt() completes.
> 
> At the time of DT parsing, info->pctl_dev is still NULL, leading to
> the invalid dereference of info->pctl_dev->dev.
> 
> Use the already available device pointer from platform_device
> instead of accessing through uninitialized pctl_dev.
> 
> Fixes: d94a32ac688f ("pinctrl: canaan: k230: Fix order of DT parse and pinctrl register")
> Signed-off-by: Jiayu Du <jiayu.riscv@...c.iscas.ac.cn>
> ---
>  drivers/pinctrl/pinctrl-k230.c | 7 +++++--
>  1 file changed, 5 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/pinctrl/pinctrl-k230.c b/drivers/pinctrl/pinctrl-k230.c
> index d716f23d837f..20f7c0f70eb7 100644
> --- a/drivers/pinctrl/pinctrl-k230.c
> +++ b/drivers/pinctrl/pinctrl-k230.c
> @@ -65,6 +65,7 @@ struct k230_pmx_func {
>  };
>  
>  struct k230_pinctrl {
> +	struct device		*dev;
>  	struct pinctrl_desc	pctl;
>  	struct pinctrl_dev	*pctl_dev;
>  	struct regmap		*regmap_base;
> @@ -470,7 +471,7 @@ static int k230_pinctrl_parse_groups(struct device_node *np,
>  				     struct k230_pinctrl *info,
>  				     unsigned int index)
>  {
> -	struct device *dev = info->pctl_dev->dev;
> +	struct device *dev = info->dev;
>  	const __be32 *list;
>  	int size, i, ret;
>  
> @@ -511,7 +512,7 @@ static int k230_pinctrl_parse_functions(struct device_node *np,
>  					struct k230_pinctrl *info,
>  					unsigned int index)
>  {
> -	struct device *dev = info->pctl_dev->dev;
> +	struct device *dev = info->dev;
>  	struct k230_pmx_func *func;
>  	struct k230_pin_group *grp;
>  	static unsigned int idx, i;
> @@ -596,6 +597,8 @@ static int k230_pinctrl_probe(struct platform_device *pdev)
>  	if (!info)
>  		return -ENOMEM;
>  
> +	info->dev = dev;
> +
>  	pctl = &info->pctl;
>  
>  	pctl->name	= "k230-pinctrl";
> -- 
> 2.52.0
> 

Hi Linus, could you please take a look at this patch? Thanks for
your time.

Regards,
Jiayu Du