pinctrl: canaan: k230: Fix NULL pointer dereference when parsing devicetree

[PATCH v2] pinctrl: canaan: k230: Fix NULL pointer dereference when parsing devicetree

Posted by Jiayu Du 1 month, 1 week ago

When probing the k230 pinctrl driver, the kernel triggers a NULL pointer
dereference. The crash trace showed:
[    0.732084] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000068
[    0.740737] ...
[    0.776296] epc : k230_pinctrl_probe+0x1be/0x4fc

In k230_pinctrl_parse_functions(), we attempt to retrieve the device
pointer via info->pctl_dev->dev, but info->pctl_dev is only initialized
after k230_pinctrl_parse_dt() completes.

At the time of DT parsing, info->pctl_dev is still NULL, leading to
the invalid dereference of info->pctl_dev->dev.

Use the already available device pointer from platform_device
instead of accessing through uninitialized pctl_dev.

Fixes: d94a32ac688f ("pinctrl: canaan: k230: Fix order of DT parse and pinctrl register")
Signed-off-by: Jiayu Du <jiayu.riscv@isrc.iscas.ac.cn>
---
 drivers/pinctrl/pinctrl-k230.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/pinctrl/pinctrl-k230.c b/drivers/pinctrl/pinctrl-k230.c
index d716f23d837f..20f7c0f70eb7 100644
--- a/drivers/pinctrl/pinctrl-k230.c
+++ b/drivers/pinctrl/pinctrl-k230.c
@@ -65,6 +65,7 @@ struct k230_pmx_func {
 };
 
 struct k230_pinctrl {
+	struct device		*dev;
 	struct pinctrl_desc	pctl;
 	struct pinctrl_dev	*pctl_dev;
 	struct regmap		*regmap_base;
@@ -470,7 +471,7 @@ static int k230_pinctrl_parse_groups(struct device_node *np,
 				     struct k230_pinctrl *info,
 				     unsigned int index)
 {
-	struct device *dev = info->pctl_dev->dev;
+	struct device *dev = info->dev;
 	const __be32 *list;
 	int size, i, ret;
 
@@ -511,7 +512,7 @@ static int k230_pinctrl_parse_functions(struct device_node *np,
 					struct k230_pinctrl *info,
 					unsigned int index)
 {
-	struct device *dev = info->pctl_dev->dev;
+	struct device *dev = info->dev;
 	struct k230_pmx_func *func;
 	struct k230_pin_group *grp;
 	static unsigned int idx, i;
@@ -596,6 +597,8 @@ static int k230_pinctrl_probe(struct platform_device *pdev)
 	if (!info)
 		return -ENOMEM;
 
+	info->dev = dev;
+
 	pctl = &info->pctl;
 
 	pctl->name	= "k230-pinctrl";
-- 
2.52.0

Re: [PATCH v2] pinctrl: canaan: k230: Fix NULL pointer dereference when parsing devicetree

Posted by Linus Walleij 6 days, 8 hours ago

On Sun, Dec 28, 2025 at 4:53 PM Jiayu Du <jiayu.riscv@isrc.iscas.ac.cn> wrote:

> When probing the k230 pinctrl driver, the kernel triggers a NULL pointer
> dereference. The crash trace showed:
> [    0.732084] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000068
> [    0.740737] ...
> [    0.776296] epc : k230_pinctrl_probe+0x1be/0x4fc
>
> In k230_pinctrl_parse_functions(), we attempt to retrieve the device
> pointer via info->pctl_dev->dev, but info->pctl_dev is only initialized
> after k230_pinctrl_parse_dt() completes.
>
> At the time of DT parsing, info->pctl_dev is still NULL, leading to
> the invalid dereference of info->pctl_dev->dev.
>
> Use the already available device pointer from platform_device
> instead of accessing through uninitialized pctl_dev.
>
> Fixes: d94a32ac688f ("pinctrl: canaan: k230: Fix order of DT parse and pinctrl register")
> Signed-off-by: Jiayu Du <jiayu.riscv@isrc.iscas.ac.cn>

Patch applied!

Sorry for missing this, I was waiting for maintainer feedback
but it never arrived.

Yours,
Linus Walleij

Re: [PATCH v2] pinctrl: canaan: k230: Fix NULL pointer dereference when parsing devicetree

Posted by Ze Huang 5 days, 19 hours ago

On Tue Feb 3, 2026 at 8:32 AM CST, Linus Walleij wrote:
> On Sun, Dec 28, 2025 at 4:53 PM Jiayu Du <jiayu.riscv@isrc.iscas.ac.cn> wrote:
>
>> When probing the k230 pinctrl driver, the kernel triggers a NULL pointer
>> dereference. The crash trace showed:
>> [    0.732084] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000068
>> [    0.740737] ...
>> [    0.776296] epc : k230_pinctrl_probe+0x1be/0x4fc
>>
>> In k230_pinctrl_parse_functions(), we attempt to retrieve the device
>> pointer via info->pctl_dev->dev, but info->pctl_dev is only initialized
>> after k230_pinctrl_parse_dt() completes.
>>
>> At the time of DT parsing, info->pctl_dev is still NULL, leading to
>> the invalid dereference of info->pctl_dev->dev.
>>
>> Use the already available device pointer from platform_device
>> instead of accessing through uninitialized pctl_dev.
>>
>> Fixes: d94a32ac688f ("pinctrl: canaan: k230: Fix order of DT parse and pinctrl register")
>> Signed-off-by: Jiayu Du <jiayu.riscv@isrc.iscas.ac.cn>
>
> Patch applied!
>
> Sorry for missing this, I was waiting for maintainer feedback
> but it never arrived.
>
> Yours,
> Linus Walleij

Hi Linus, Jiayu,

Apologies for the delay.

I tested this on k230; it fixes the NULL pointer dereference during pinctrl
probing. The approach is correct.

Thanks to you both!

Best regards, Ze Huang

Re: [PATCH v2] pinctrl: canaan: k230: Fix NULL pointer dereference when parsing devicetree

Posted by Jiayu Du 3 weeks, 4 days ago

On Sun, Dec 28, 2025 at 11:49:47PM +0800, Jiayu Du wrote:
> When probing the k230 pinctrl driver, the kernel triggers a NULL pointer
> dereference. The crash trace showed:
> [    0.732084] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000068
> [    0.740737] ...
> [    0.776296] epc : k230_pinctrl_probe+0x1be/0x4fc
> 
> In k230_pinctrl_parse_functions(), we attempt to retrieve the device
> pointer via info->pctl_dev->dev, but info->pctl_dev is only initialized
> after k230_pinctrl_parse_dt() completes.
> 
> At the time of DT parsing, info->pctl_dev is still NULL, leading to
> the invalid dereference of info->pctl_dev->dev.
> 
> Use the already available device pointer from platform_device
> instead of accessing through uninitialized pctl_dev.
> 
> Fixes: d94a32ac688f ("pinctrl: canaan: k230: Fix order of DT parse and pinctrl register")
> Signed-off-by: Jiayu Du <jiayu.riscv@isrc.iscas.ac.cn>
> ---
>  drivers/pinctrl/pinctrl-k230.c | 7 +++++--
>  1 file changed, 5 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/pinctrl/pinctrl-k230.c b/drivers/pinctrl/pinctrl-k230.c
> index d716f23d837f..20f7c0f70eb7 100644
> --- a/drivers/pinctrl/pinctrl-k230.c
> +++ b/drivers/pinctrl/pinctrl-k230.c
> @@ -65,6 +65,7 @@ struct k230_pmx_func {
>  };
>  
>  struct k230_pinctrl {
> +	struct device		*dev;
>  	struct pinctrl_desc	pctl;
>  	struct pinctrl_dev	*pctl_dev;
>  	struct regmap		*regmap_base;
> @@ -470,7 +471,7 @@ static int k230_pinctrl_parse_groups(struct device_node *np,
>  				     struct k230_pinctrl *info,
>  				     unsigned int index)
>  {
> -	struct device *dev = info->pctl_dev->dev;
> +	struct device *dev = info->dev;
>  	const __be32 *list;
>  	int size, i, ret;
>  
> @@ -511,7 +512,7 @@ static int k230_pinctrl_parse_functions(struct device_node *np,
>  					struct k230_pinctrl *info,
>  					unsigned int index)
>  {
> -	struct device *dev = info->pctl_dev->dev;
> +	struct device *dev = info->dev;
>  	struct k230_pmx_func *func;
>  	struct k230_pin_group *grp;
>  	static unsigned int idx, i;
> @@ -596,6 +597,8 @@ static int k230_pinctrl_probe(struct platform_device *pdev)
>  	if (!info)
>  		return -ENOMEM;
>  
> +	info->dev = dev;
> +
>  	pctl = &info->pctl;
>  
>  	pctl->name	= "k230-pinctrl";
> -- 
> 2.52.0
> 

Hi Linus, could you please take a look at this patch? Thanks for
your time.

Regards,
Jiayu Du

Re: [PATCH v2] pinctrl: canaan: k230: Fix NULL pointer dereference when parsing devicetree

Posted by Jiayu Du 2 weeks, 6 days ago

On Thu, Jan 15, 2026 at 02:38:14PM +0800, Jiayu Du wrote:
> On Sun, Dec 28, 2025 at 11:49:47PM +0800, Jiayu Du wrote:
> > When probing the k230 pinctrl driver, the kernel triggers a NULL pointer
> > dereference. The crash trace showed:
> > [    0.732084] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000068
> > [    0.740737] ...
> > [    0.776296] epc : k230_pinctrl_probe+0x1be/0x4fc
> > 
> > In k230_pinctrl_parse_functions(), we attempt to retrieve the device
> > pointer via info->pctl_dev->dev, but info->pctl_dev is only initialized
> > after k230_pinctrl_parse_dt() completes.
> > 
> > At the time of DT parsing, info->pctl_dev is still NULL, leading to
> > the invalid dereference of info->pctl_dev->dev.
> > 
> > Use the already available device pointer from platform_device
> > instead of accessing through uninitialized pctl_dev.
> > 
> > Fixes: d94a32ac688f ("pinctrl: canaan: k230: Fix order of DT parse and pinctrl register")
> > Signed-off-by: Jiayu Du <jiayu.riscv@isrc.iscas.ac.cn>
> > ---
> >  drivers/pinctrl/pinctrl-k230.c | 7 +++++--
> >  1 file changed, 5 insertions(+), 2 deletions(-)
> > 
> > diff --git a/drivers/pinctrl/pinctrl-k230.c b/drivers/pinctrl/pinctrl-k230.c
> > index d716f23d837f..20f7c0f70eb7 100644
> > --- a/drivers/pinctrl/pinctrl-k230.c
> > +++ b/drivers/pinctrl/pinctrl-k230.c
> > @@ -65,6 +65,7 @@ struct k230_pmx_func {
> >  };
> >  
> >  struct k230_pinctrl {
> > +	struct device		*dev;
> >  	struct pinctrl_desc	pctl;
> >  	struct pinctrl_dev	*pctl_dev;
> >  	struct regmap		*regmap_base;
> > @@ -470,7 +471,7 @@ static int k230_pinctrl_parse_groups(struct device_node *np,
> >  				     struct k230_pinctrl *info,
> >  				     unsigned int index)
> >  {
> > -	struct device *dev = info->pctl_dev->dev;
> > +	struct device *dev = info->dev;
> >  	const __be32 *list;
> >  	int size, i, ret;
> >  
> > @@ -511,7 +512,7 @@ static int k230_pinctrl_parse_functions(struct device_node *np,
> >  					struct k230_pinctrl *info,
> >  					unsigned int index)
> >  {
> > -	struct device *dev = info->pctl_dev->dev;
> > +	struct device *dev = info->dev;
> >  	struct k230_pmx_func *func;
> >  	struct k230_pin_group *grp;
> >  	static unsigned int idx, i;
> > @@ -596,6 +597,8 @@ static int k230_pinctrl_probe(struct platform_device *pdev)
> >  	if (!info)
> >  		return -ENOMEM;
> >  
> > +	info->dev = dev;
> > +
> >  	pctl = &info->pctl;
> >  
> >  	pctl->name	= "k230-pinctrl";
> > -- 
> > 2.52.0
> > 
Hi Linus, sorry for bothering again. Could you please take a look at
this patch? Thanks for your time.

Regards,
Jiayu Du