From nobody Mon Feb 9 18:22:57 2026 Received: from cstnet.cn (smtp81.cstnet.cn [159.226.251.81]) (using TLSv1.2 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6181B2D0C68; Sun, 28 Dec 2025 15:53:05 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=159.226.251.81 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1766937191; cv=none; b=Y+1G1citIQI/iPML2ik9cqciaPw09o5uczKMojcuKA2W9fXDSD/PPKindLc8uTimRb6V6kGdU5Uhca66N3sLBR/a+8GApmSYKxo4NvatLNqJwp0KuXNai+coLQC+eI1XjKmprbCuaaEIN0dbK4YU+XqMDXD0R/Mw4unTph3qA5Q= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1766937191; c=relaxed/simple; bh=V1uqzkvwQQr4Ur9fEt2RPPfue/AQNMTE8dQQNC4QW50=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=iumvQ4Euy4h1mZJg6M3n+Q8AWTViWq3ot5IDXj2lY3cmUooFCSjpWF/U6wrekDuNZO0HwoetlznpK067i8O0LCr/QDVUWHY7dSEbn6q3UC7gnGzXJPbJfUQCSpAjY0dpkXDKrxIkj0F0JcdXP6WEbd1VB8d5y98PeGMv4W7viaE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=isrc.iscas.ac.cn; spf=pass smtp.mailfrom=isrc.iscas.ac.cn; arc=none smtp.client-ip=159.226.251.81 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=isrc.iscas.ac.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=isrc.iscas.ac.cn Received: from duge-virtual-machine (unknown [183.192.221.253]) by APP-03 (Coremail) with SMTP id rQCowACnv9ZWUlFp5XFXAg--.16949S2; Sun, 28 Dec 2025 23:52:55 +0800 (CST) From: Jiayu Du To: linusw@kernel.org Cc: pjw@kernel.org, palmer@dabbelt.com, aou@eecs.berkeley.edu, alex@ghiti.fr, linux-gpio@vger.kernel.org, linux-riscv@lists.infradead.org, linux-kernel@vger.kernel.org, gaohan@iscas.ac.cn, me@ziyao.cc, Jiayu Du Subject: [PATCH v2] pinctrl: canaan: k230: Fix NULL pointer dereference when parsing devicetree Date: Sun, 28 Dec 2025 23:49:47 +0800 Message-ID: <20251228154947.194684-1-jiayu.riscv@isrc.iscas.ac.cn> X-Mailer: git-send-email 2.52.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-CM-TRANSID: rQCowACnv9ZWUlFp5XFXAg--.16949S2 X-Coremail-Antispam: 1UD129KBjvJXoW7Zry8XrWUGFWruF4ruF1xKrg_yoW8uFy7pF 43Ga98Kr47Jr4kWw1rAayDZFyak3Z7A34fCw17t34Fgwn8tryDX3W5WFWUZws8CFZxCF15 tr4YyFyj9w1UJr7anT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUU9014x267AKxVW8JVW5JwAFc2x0x2IEx4CE42xK8VAvwI8IcIk0 rVWUuVWrJwAFIxvE14AKwVWUJVWUGwA2ocxC64kIII0Yj41l84x0c7CEw4AK67xGY2AK02 1l84ACjcxK6xIIjxv20xvE14v26r1j6r1xM28EF7xvwVC0I7IYx2IY6xkF7I0E14v26r4j 6F4UM28EF7xvwVC2z280aVAFwI0_Jr0_Gr1l84ACjcxK6I8E87Iv6xkF7I0E14v26r4j6r 4UJwAS0I0E0xvYzxvE52x082IY62kv0487Mc02F40EFcxC0VAKzVAqx4xG6I80ewAv7VC0 I7IYx2IY67AKxVWUJVWUGwAv7VC2z280aVAFwI0_Jr0_Gr1lOx8S6xCaFVCjc4AY6r1j6r 4UM4x0Y48IcxkI7VAKI48JM4x0x7Aq67IIx4CEVc8vx2IErcIFxwACI402YVCY1x02628v n2kIc2xKxwCY1x0262kKe7AKxVWUtVW8ZwCF04k20xvY0x0EwIxGrwCFx2IqxVCFs4IE7x kEbVWUJVW8JwC20s026c02F40E14v26r1j6r18MI8I3I0E7480Y4vE14v26r106r1rMI8E 67AF67kF1VAFwI0_Jw0_GFylIxkGc2Ij64vIr41lIxAIcVC0I7IYx2IY67AKxVWUJVWUCw CI42IY6xIIjxv20xvEc7CjxVAFwI0_Gr0_Cr1lIxAIcVCF04k26cxKx2IYs7xG6r1j6r1x MIIF0xvEx4A2jsIE14v26r1j6r4UMIIF0xvEx4A2jsIEc7CjxVAFwI0_Gr0_Gr1UYxBIda VFxhVjvjDU0xZFpf9x0JUd-B_UUUUU= X-CM-SenderInfo: 5mld534oul2uny6l223fol2u1dvotugofq/ Content-Type: text/plain; charset="utf-8" When probing the k230 pinctrl driver, the kernel triggers a NULL pointer dereference. The crash trace showed: [ 0.732084] Unable to handle kernel NULL pointer dereference at virtual = address 0000000000000068 [ 0.740737] ... [ 0.776296] epc : k230_pinctrl_probe+0x1be/0x4fc In k230_pinctrl_parse_functions(), we attempt to retrieve the device pointer via info->pctl_dev->dev, but info->pctl_dev is only initialized after k230_pinctrl_parse_dt() completes. At the time of DT parsing, info->pctl_dev is still NULL, leading to the invalid dereference of info->pctl_dev->dev. Use the already available device pointer from platform_device instead of accessing through uninitialized pctl_dev. Fixes: d94a32ac688f ("pinctrl: canaan: k230: Fix order of DT parse and pinc= trl register") Signed-off-by: Jiayu Du --- drivers/pinctrl/pinctrl-k230.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/pinctrl/pinctrl-k230.c b/drivers/pinctrl/pinctrl-k230.c index d716f23d837f..20f7c0f70eb7 100644 --- a/drivers/pinctrl/pinctrl-k230.c +++ b/drivers/pinctrl/pinctrl-k230.c @@ -65,6 +65,7 @@ struct k230_pmx_func { }; =20 struct k230_pinctrl { + struct device *dev; struct pinctrl_desc pctl; struct pinctrl_dev *pctl_dev; struct regmap *regmap_base; @@ -470,7 +471,7 @@ static int k230_pinctrl_parse_groups(struct device_node= *np, struct k230_pinctrl *info, unsigned int index) { - struct device *dev =3D info->pctl_dev->dev; + struct device *dev =3D info->dev; const __be32 *list; int size, i, ret; =20 @@ -511,7 +512,7 @@ static int k230_pinctrl_parse_functions(struct device_n= ode *np, struct k230_pinctrl *info, unsigned int index) { - struct device *dev =3D info->pctl_dev->dev; + struct device *dev =3D info->dev; struct k230_pmx_func *func; struct k230_pin_group *grp; static unsigned int idx, i; @@ -596,6 +597,8 @@ static int k230_pinctrl_probe(struct platform_device *p= dev) if (!info) return -ENOMEM; =20 + info->dev =3D dev; + pctl =3D &info->pctl; =20 pctl->name =3D "k230-pinctrl"; --=20 2.52.0