linux-kernel - Re: [PATCH v2] pinctrl: canaan: k230: Fix NULL pointer dereference when parsing devicetree

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <aW8arOPzmpigRW+a@duge-virtual-machine>
Date: Tue, 20 Jan 2026 14:03:24 +0800
From: Jiayu Du <jiayu.riscv@...c.iscas.ac.cn>
To: linusw@...nel.org
Cc: pjw@...nel.org, palmer@...belt.com, aou@...s.berkeley.edu,
	alex@...ti.fr, linux-gpio@...r.kernel.org,
	linux-riscv@...ts.infradead.org, linux-kernel@...r.kernel.org,
	gaohan@...as.ac.cn, me@...ao.cc
Subject: Re: [PATCH v2] pinctrl: canaan: k230: Fix NULL pointer dereference
 when parsing devicetree

On Thu, Jan 15, 2026 at 02:38:14PM +0800, Jiayu Du wrote:
> On Sun, Dec 28, 2025 at 11:49:47PM +0800, Jiayu Du wrote:
> > When probing the k230 pinctrl driver, the kernel triggers a NULL pointer
> > dereference. The crash trace showed:
> > [    0.732084] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000068
> > [    0.740737] ...
> > [    0.776296] epc : k230_pinctrl_probe+0x1be/0x4fc
> > 
> > In k230_pinctrl_parse_functions(), we attempt to retrieve the device
> > pointer via info->pctl_dev->dev, but info->pctl_dev is only initialized
> > after k230_pinctrl_parse_dt() completes.
> > 
> > At the time of DT parsing, info->pctl_dev is still NULL, leading to
> > the invalid dereference of info->pctl_dev->dev.
> > 
> > Use the already available device pointer from platform_device
> > instead of accessing through uninitialized pctl_dev.
> > 
> > Fixes: d94a32ac688f ("pinctrl: canaan: k230: Fix order of DT parse and pinctrl register")
> > Signed-off-by: Jiayu Du <jiayu.riscv@...c.iscas.ac.cn>
> > ---
> >  drivers/pinctrl/pinctrl-k230.c | 7 +++++--
> >  1 file changed, 5 insertions(+), 2 deletions(-)
> > 
> > diff --git a/drivers/pinctrl/pinctrl-k230.c b/drivers/pinctrl/pinctrl-k230.c
> > index d716f23d837f..20f7c0f70eb7 100644
> > --- a/drivers/pinctrl/pinctrl-k230.c
> > +++ b/drivers/pinctrl/pinctrl-k230.c
> > @@ -65,6 +65,7 @@ struct k230_pmx_func {
> >  };
> >  
> >  struct k230_pinctrl {
> > +	struct device		*dev;
> >  	struct pinctrl_desc	pctl;
> >  	struct pinctrl_dev	*pctl_dev;
> >  	struct regmap		*regmap_base;
> > @@ -470,7 +471,7 @@ static int k230_pinctrl_parse_groups(struct device_node *np,
> >  				     struct k230_pinctrl *info,
> >  				     unsigned int index)
> >  {
> > -	struct device *dev = info->pctl_dev->dev;
> > +	struct device *dev = info->dev;
> >  	const __be32 *list;
> >  	int size, i, ret;
> >  
> > @@ -511,7 +512,7 @@ static int k230_pinctrl_parse_functions(struct device_node *np,
> >  					struct k230_pinctrl *info,
> >  					unsigned int index)
> >  {
> > -	struct device *dev = info->pctl_dev->dev;
> > +	struct device *dev = info->dev;
> >  	struct k230_pmx_func *func;
> >  	struct k230_pin_group *grp;
> >  	static unsigned int idx, i;
> > @@ -596,6 +597,8 @@ static int k230_pinctrl_probe(struct platform_device *pdev)
> >  	if (!info)
> >  		return -ENOMEM;
> >  
> > +	info->dev = dev;
> > +
> >  	pctl = &info->pctl;
> >  
> >  	pctl->name	= "k230-pinctrl";
> > -- 
> > 2.52.0
> > 
Hi Linus, sorry for bothering again. Could you please take a look at
this patch? Thanks for your time.

Regards,
Jiayu Du