The function iio_get_current_scan_type() can return an error pointer,
the return value scan_type is not checked for this and immediately
dereferenced which can cause a kernel panic.

Add check for IS_ERR() and propagate the error back.

Fixes: ff085189cb17 ("iio: adc: ad7768-1: add support for ADAQ776x-1 ADC Family")
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <error27@gmail.com>
Closes: https://lore.kernel.org/r/202602051234.5gArzLyZ-lkp@intel.com/
Signed-off-by: Ethan Tidmore <ethantidmore06@gmail.com>
---
v3:
- Fix typo and added changelog.
v2:
- Add credit to bots and Dan Carpenter.
- Propgate the error back instead of just returning.

 drivers/iio/adc/ad7768-1.c | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/drivers/iio/adc/ad7768-1.c b/drivers/iio/adc/ad7768-1.c
index fcd8aea7152e..e16dede687d3 100644
--- a/drivers/iio/adc/ad7768-1.c
+++ b/drivers/iio/adc/ad7768-1.c
@@ -531,7 +531,7 @@ static int ad7768_reg_access(struct iio_dev *indio_dev,
 	return ret;
 }
 
-static void ad7768_fill_scale_tbl(struct iio_dev *dev)
+static int ad7768_fill_scale_tbl(struct iio_dev *dev)
 {
 	struct ad7768_state *st = iio_priv(dev);
 	const struct iio_scan_type *scan_type;
@@ -541,6 +541,11 @@ static void ad7768_fill_scale_tbl(struct iio_dev *dev)
 	u64 tmp2;
 
 	scan_type = iio_get_current_scan_type(dev, &dev->channels[0]);
+	if (IS_ERR(scan_type)) {
+		dev_err(&st->spi->dev, "Failed to get scan type.\n");
+		return PTR_ERR(scan_type);
+	}
+
 	if (scan_type->sign == 's')
 		val2 = scan_type->realbits - 1;
 	else
@@ -565,6 +570,8 @@ static void ad7768_fill_scale_tbl(struct iio_dev *dev)
 		st->scale_tbl[i][0] = tmp0; /* Integer part */
 		st->scale_tbl[i][1] = abs(tmp1); /* Fractional part */
 	}
+
+	return 0;
 }
 
 static int ad7768_set_sinc3_dec_rate(struct ad7768_state *st,
@@ -669,7 +676,9 @@ static int ad7768_configure_dig_fil(struct iio_dev *dev,
 	}
 
 	/* Update scale table: scale values vary according to the precision */
-	ad7768_fill_scale_tbl(dev);
+	ret = ad7768_fill_scale_tbl(dev);
+	if (ret)
+		return ret;
 
 	ad7768_fill_samp_freq_tbl(st);
 
-- 
2.53.0

On Sat, Feb 14, 2026 at 12:46:37PM -0600, Ethan Tidmore wrote:
> The function iio_get_current_scan_type() can return an error pointer,
> the return value scan_type is not checked for this and immediately
> dereferenced which can cause a kernel panic.
> 
> Add check for IS_ERR() and propagate the error back.

Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>

-- 
With Best Regards,
Andy Shevchenko

On Mon, 16 Feb 2026 09:35:05 +0200
Andy Shevchenko <andriy.shevchenko@intel.com> wrote:

> On Sat, Feb 14, 2026 at 12:46:37PM -0600, Ethan Tidmore wrote:
> > The function iio_get_current_scan_type() can return an error pointer,
> > the return value scan_type is not checked for this and immediately
> > dereferenced which can cause a kernel panic.
> > 
> > Add check for IS_ERR() and propagate the error back.  
> 
> Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
> 

Applied to the fixes-togreg branch of iio.git.

Thanks,

Jonathan