The function ioremap() in gamecube_rtc_read_offset_from_sram() can fail
and return NULL, which is dereferenced without checking, leading to a
NULL pointer dereference.

Add a check for the return value of ioremap() and return -ENOMEM on
failure.

Fixes: 86559400b3ef ("rtc: gamecube: Add a RTC driver for the GameCube, Wii and Wii U")
Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
---
 drivers/rtc/rtc-gamecube.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/rtc/rtc-gamecube.c b/drivers/rtc/rtc-gamecube.c
index c828bc8e05b9..cd7714437107 100644
--- a/drivers/rtc/rtc-gamecube.c
+++ b/drivers/rtc/rtc-gamecube.c
@@ -242,6 +242,10 @@ static int gamecube_rtc_read_offset_from_sram(struct priv *d)
 	}
 
 	hw_srnprot = ioremap(res.start, resource_size(&res));
+	if (!hw_srnprot) {
+		pr_err("Failed to ioremap hw_srnprot\n");
+		return -ENOMEM;
+	}
 	old = ioread32be(hw_srnprot);
 
 	/* TODO: figure out why we use this magic constant.  I obtained it by
-- 
2.50.1.windows.1

Good catch!

On Wed, Nov 26, 2025 at 09:20:19AM +0800, Haotian Zhang wrote:
> The function ioremap() in gamecube_rtc_read_offset_from_sram() can fail
> and return NULL, which is dereferenced without checking, leading to a
> NULL pointer dereference.
> 
> Add a check for the return value of ioremap() and return -ENOMEM on
> failure.
> 
> Fixes: 86559400b3ef ("rtc: gamecube: Add a RTC driver for the GameCube, Wii and Wii U")
> Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
> ---
>  drivers/rtc/rtc-gamecube.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/drivers/rtc/rtc-gamecube.c b/drivers/rtc/rtc-gamecube.c
> index c828bc8e05b9..cd7714437107 100644
> --- a/drivers/rtc/rtc-gamecube.c
> +++ b/drivers/rtc/rtc-gamecube.c
> @@ -242,6 +242,10 @@ static int gamecube_rtc_read_offset_from_sram(struct priv *d)
>  	}
>  
>  	hw_srnprot = ioremap(res.start, resource_size(&res));
> +	if (!hw_srnprot) {
> +		pr_err("Failed to ioremap hw_srnprot\n");

The error messages on lines 240 and 276 start with a lowercase letter,
please use the same case for this message.  From a quick grep through
the kernel, it seems we use either lowercase or uppercase, but I’d
prefer to keep the case consistent in this driver at least.

> +		return -ENOMEM;
> +	}
>  	old = ioread32be(hw_srnprot);
>  
>  	/* TODO: figure out why we use this magic constant.  I obtained it by
> -- 
> 2.50.1.windows.1
> 

With that change:
Reviewed-by: Link Mauve <kernel@linkmauve.fr>

-- 
Link Mauve

The function ioremap() in gamecube_rtc_read_offset_from_sram() can fail
and return NULL, which is dereferenced without checking, leading to a
NULL pointer dereference.

Add a check for the return value of ioremap() and return -ENOMEM on
failure.

Fixes: 86559400b3ef ("rtc: gamecube: Add a RTC driver for the GameCube, Wii and Wii U")
Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
---
Changes in v2:
  -Use lowercase for error message to match existing style.
---
 drivers/rtc/rtc-gamecube.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/rtc/rtc-gamecube.c b/drivers/rtc/rtc-gamecube.c
index c828bc8e05b9..045d5d45ab4b 100644
--- a/drivers/rtc/rtc-gamecube.c
+++ b/drivers/rtc/rtc-gamecube.c
@@ -242,6 +242,10 @@ static int gamecube_rtc_read_offset_from_sram(struct priv *d)
 	}
 
 	hw_srnprot = ioremap(res.start, resource_size(&res));
+	if (!hw_srnprot) {
+		pr_err("failed to ioremap hw_srnprot\n");
+		return -ENOMEM;
+	}
 	old = ioread32be(hw_srnprot);
 
 	/* TODO: figure out why we use this magic constant.  I obtained it by
-- 
2.50.1.windows.1

Hi,

On Wed, Nov 26, 2025 at 04:06:25PM +0800, Haotian Zhang wrote:
> The function ioremap() in gamecube_rtc_read_offset_from_sram() can fail
> and return NULL, which is dereferenced without checking, leading to a
> NULL pointer dereference.
> 
> Add a check for the return value of ioremap() and return -ENOMEM on
> failure.
> 
> Fixes: 86559400b3ef ("rtc: gamecube: Add a RTC driver for the GameCube, Wii and Wii U")
> Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>

You forgot to carry my R-b, but here it is again:
Reviewed-by: Link Mauve <kernel@linkmauve.fr>

> ---
> Changes in v2:
>   -Use lowercase for error message to match existing style.
> ---
>  drivers/rtc/rtc-gamecube.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/drivers/rtc/rtc-gamecube.c b/drivers/rtc/rtc-gamecube.c
> index c828bc8e05b9..045d5d45ab4b 100644
> --- a/drivers/rtc/rtc-gamecube.c
> +++ b/drivers/rtc/rtc-gamecube.c
> @@ -242,6 +242,10 @@ static int gamecube_rtc_read_offset_from_sram(struct priv *d)
>  	}
>  
>  	hw_srnprot = ioremap(res.start, resource_size(&res));
> +	if (!hw_srnprot) {
> +		pr_err("failed to ioremap hw_srnprot\n");
> +		return -ENOMEM;
> +	}
>  	old = ioread32be(hw_srnprot);
>  
>  	/* TODO: figure out why we use this magic constant.  I obtained it by
> -- 
> 2.50.1.windows.1
> 

-- 
Link Mauve