[PATCH 0/7] iio: validate SPI match data before use

[PATCH 0/7] iio: validate SPI match data before use

[Jiale Yao]

SPI driver_override can bind a device without a matching entry in the
driver's ID tables.  spi_get_device_match_data() then returns NULL.

These seven IIO drivers use that result without checking it, causing a
NULL pointer dereference during probe.  Add the missing checks before
the match data is used.

Jiale Yao (7):
  iio: amplifiers: ad8366: reject devices without match data
  iio: dac: ad5755: validate SPI match data
  iio: dac: mcp4821: reject devices without match data
  iio: frequency: adf4377: reject devices without match data
  iio: imu: adis16400: validate SPI match data
  iio: potentiometer: x9250: reject devices without match data
  iio: pressure: bmp280: validate SPI match data

 drivers/iio/amplifiers/ad8366.c   | 2 ++
 drivers/iio/dac/ad5755.c          | 3 +++
 drivers/iio/dac/mcp4821.c         | 7 +++++--
 drivers/iio/frequency/adf4377.c   | 3 +++
 drivers/iio/imu/adis16400.c       | 3 +++
 drivers/iio/potentiometer/x9250.c | 7 ++++++-
 drivers/iio/pressure/bmp280-spi.c | 2 ++
 7 files changed, 24 insertions(+), 3 deletions(-)

-- 
2.34.1

[PATCH 1/7] iio: amplifiers: ad8366: reject devices without match data

[Jiale Yao]

A device bound through driver_override need not match an entry in the
driver tables. In that case spi_get_device_match_data() returns NULL,
but ad8366_probe() later dereferences the result while setting up the
IIO device.

Reject devices without match data before using the chip information.

Fixes: d5e02d0d00b9 ("iio: amplifiers: ad8366: add device tree support")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/iio/amplifiers/ad8366.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/iio/amplifiers/ad8366.c b/drivers/iio/amplifiers/ad8366.c
index e12f8604f59f..9adff120de1a 100644
--- a/drivers/iio/amplifiers/ad8366.c
+++ b/drivers/iio/amplifiers/ad8366.c
@@ -326,6 +326,8 @@ static int ad8366_probe(struct spi_device *spi)
 
 	st->spi = spi;
 	st->info = spi_get_device_match_data(spi);
+	if (!st->info)
+		return -ENODATA;
 
 	enable_gpio = devm_gpiod_get_optional(dev, "enable", GPIOD_OUT_HIGH);
 	if (IS_ERR(enable_gpio))
-- 
2.34.1

[PATCH 2/7] iio: dac: ad5755: validate SPI match data

[Jiale Yao]

A device bound through driver_override need not match an entry in the
driver tables. In that case spi_get_device_match_data() returns NULL,
but ad5755_probe() stores and later dereferences the result.

Validate the match data before it is used.

Fixes: 62d3fb9dcc09 ("iio: dac: ad5755: make use of of_device_id table")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/iio/dac/ad5755.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/iio/dac/ad5755.c b/drivers/iio/dac/ad5755.c
index 0828b9909099..730289dd8ef6 100644
--- a/drivers/iio/dac/ad5755.c
+++ b/drivers/iio/dac/ad5755.c
@@ -819,6 +819,9 @@ static int ad5755_probe(struct spi_device *spi)
 	spi_set_drvdata(spi, indio_dev);
 
 	st->chip_info = spi_get_device_match_data(spi);
+	if (!st->chip_info)
+		return -ENODATA;
+
 	st->spi = spi;
 	st->pwr_down = 0xf;
 
-- 
2.34.1

[PATCH 3/7] iio: dac: mcp4821: reject devices without match data

[Jiale Yao]

A device bound through driver_override need not match an entry in the
driver tables. In that case spi_get_device_match_data() returns NULL,
but mcp4821_probe() dereferences the result while configuring the IIO
device.

Reject devices without match data before using the chip information.

Fixes: cdf3ecb0d8d0 ("iio: dac: driver for MCP4821")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/iio/dac/mcp4821.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/iio/dac/mcp4821.c b/drivers/iio/dac/mcp4821.c
index 8d8c00cd60e9..59defb1b5e62 100644
--- a/drivers/iio/dac/mcp4821.c
+++ b/drivers/iio/dac/mcp4821.c
@@ -255,9 +255,13 @@ static const struct iio_info mcp4821_info = {
 
 static int mcp4821_probe(struct spi_device *spi)
 {
+	const struct mcp4821_chip_info *info;
 	struct iio_dev *indio_dev;
 	struct mcp4821_state *state;
-	const struct mcp4821_chip_info *info;
+
+	info = spi_get_device_match_data(spi);
+	if (!info)
+		return -ENODATA;
 
 	indio_dev = devm_iio_device_alloc(&spi->dev, sizeof(*state));
 	if (indio_dev == NULL)
@@ -268,7 +272,6 @@ static int mcp4821_probe(struct spi_device *spi)
 
 	/* default gain is 2x */
 	state->gain = 2;
-	info = spi_get_device_match_data(spi);
 	indio_dev->name = info->name;
 	indio_dev->info = &mcp4821_info;
 	indio_dev->modes = INDIO_DIRECT_MODE;
-- 
2.34.1

[PATCH 4/7] iio: frequency: adf4377: reject devices without match data

[Jiale Yao]

A device bound through driver_override need not match an entry in the
driver tables. In that case spi_get_device_match_data() returns NULL,
but the result is later dereferenced by the property parsing and
initialization paths.

Reject devices without match data before continuing probe.

Fixes: 6140a92cd086 ("iio: frequency: adf4377: add adf4378 support")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/iio/frequency/adf4377.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/iio/frequency/adf4377.c b/drivers/iio/frequency/adf4377.c
index 4dd19a9aa994..d1e5bb062474 100644
--- a/drivers/iio/frequency/adf4377.c
+++ b/drivers/iio/frequency/adf4377.c
@@ -1060,6 +1060,9 @@ static int adf4377_probe(struct spi_device *spi)
 	st->regmap = regmap;
 	st->spi = spi;
 	st->chip_info = spi_get_device_match_data(spi);
+	if (!st->chip_info)
+		return -ENODATA;
+
 	mutex_init(&st->lock);
 
 	ret = adf4377_properties_parse(st);
-- 
2.34.1

[PATCH 5/7] iio: imu: adis16400: validate SPI match data

[Jiale Yao]

A device bound through driver_override need not match an entry in the
driver tables. In that case spi_get_device_match_data() returns NULL,
but adis16400_probe() immediately dereferences the result.

Validate the match data before it is used.

Fixes: 2ef920e0e5c0 ("iio: imu: adis16400: Use separate structures rather than an array for chip info")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/iio/imu/adis16400.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/iio/imu/adis16400.c b/drivers/iio/imu/adis16400.c
index 4842346f9f0c..28ad2d62d984 100644
--- a/drivers/iio/imu/adis16400.c
+++ b/drivers/iio/imu/adis16400.c
@@ -1150,6 +1150,9 @@ static int adis16400_probe(struct spi_device *spi)
 
 	/* setup the industrialio driver allocated elements */
 	st->variant = spi_get_device_match_data(spi);
+	if (!st->variant)
+		return -ENODATA;
+
 	indio_dev->name = spi_get_device_id(spi)->name;
 	indio_dev->channels = st->variant->channels;
 	indio_dev->num_channels = st->variant->num_channels;
-- 
2.34.1

[PATCH 6/7] iio: potentiometer: x9250: reject devices without match data

[Jiale Yao]

A device bound through driver_override need not match an entry in the
driver tables. In that case spi_get_device_match_data() returns NULL,
but x9250_probe() later dereferences the result while naming the IIO
device.

Reject devices without match data before enabling the regulators.

Fixes: 66bfc528a6fd ("iio: potentiometer: Add support for the Renesas X9250 potentiometers")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/iio/potentiometer/x9250.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/iio/potentiometer/x9250.c b/drivers/iio/potentiometer/x9250.c
index 974e4447fc2c..675b78677baa 100644
--- a/drivers/iio/potentiometer/x9250.c
+++ b/drivers/iio/potentiometer/x9250.c
@@ -155,10 +155,15 @@ static const char *const x9250_regulator_names[] = {
 
 static int x9250_probe(struct spi_device *spi)
 {
+	const struct x9250_cfg *cfg;
 	struct iio_dev *indio_dev;
 	struct x9250 *x9250;
 	int ret;
 
+	cfg = spi_get_device_match_data(spi);
+	if (!cfg)
+		return -ENODATA;
+
 	ret = devm_regulator_bulk_get_enable(&spi->dev, ARRAY_SIZE(x9250_regulator_names),
 					     x9250_regulator_names);
 	if (ret)
@@ -176,7 +181,7 @@ static int x9250_probe(struct spi_device *spi)
 
 	x9250 = iio_priv(indio_dev);
 	x9250->spi = spi;
-	x9250->cfg = spi_get_device_match_data(spi);
+	x9250->cfg = cfg;
 	x9250->wp_gpio = devm_gpiod_get_optional(&spi->dev, "wp", GPIOD_OUT_LOW);
 	if (IS_ERR(x9250->wp_gpio))
 		return dev_err_probe(&spi->dev, PTR_ERR(x9250->wp_gpio),
-- 
2.34.1

[PATCH 7/7] iio: pressure: bmp280: validate SPI match data

[Jiale Yao]

A device bound through driver_override need not match an entry in the
driver tables. In that case spi_get_device_match_data() returns NULL,
but bmp280_spi_probe() immediately dereferences the result.

Validate the match data before selecting the regmap bus.

Fixes: faac4dda9a91 ("iio: pressure: bmp280: Use spi_get_device_match_data()")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/iio/pressure/bmp280-spi.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/iio/pressure/bmp280-spi.c b/drivers/iio/pressure/bmp280-spi.c
index a02a621b8015..95d9635f4711 100644
--- a/drivers/iio/pressure/bmp280-spi.c
+++ b/drivers/iio/pressure/bmp280-spi.c
@@ -83,6 +83,8 @@ static int bmp280_spi_probe(struct spi_device *spi)
 	struct regmap *regmap;
 
 	chip_info = spi_get_device_match_data(spi);
+	if (!chip_info)
+		return -ENODATA;
 
 	if (chip_info->spi_read_extra_byte)
 		bmp_regmap_bus = &bmp380_regmap_bus;
-- 
2.34.1

Re: [PATCH 0/7] iio: validate SPI match data before use

[Jonathan Cameron]

On Fri, 25 Sep 2026 21:17:29 +0800
Jiale Yao <yaojiale02@163.com> wrote:

> SPI driver_override can bind a device without a matching entry in the
> driver's ID tables.  spi_get_device_match_data() then returns NULL.
> 
> These seven IIO drivers use that result without checking it, causing a
> NULL pointer dereference during probe.  Add the missing checks before
> the match data is used.

I was hoping we'd close this finally by adding a flag to the
drivers to say they should fail a match if driver_override is set.
Given I thought maybe that would happen when Andy looked into this
a while back I've been sitting on this problem for a while.


Unfortunately seems we have to carry on papering over it in the
drivers for now :(

Ah well. Series is fine, so applied and marked for stable.
I'm not going to rush these in though so they can wait for the
next merge window.

Thanks

Jonathan


> 
> Jiale Yao (7):
>   iio: amplifiers: ad8366: reject devices without match data
>   iio: dac: ad5755: validate SPI match data
>   iio: dac: mcp4821: reject devices without match data
>   iio: frequency: adf4377: reject devices without match data
>   iio: imu: adis16400: validate SPI match data
>   iio: potentiometer: x9250: reject devices without match data
>   iio: pressure: bmp280: validate SPI match data
> 
>  drivers/iio/amplifiers/ad8366.c   | 2 ++
>  drivers/iio/dac/ad5755.c          | 3 +++
>  drivers/iio/dac/mcp4821.c         | 7 +++++--
>  drivers/iio/frequency/adf4377.c   | 3 +++
>  drivers/iio/imu/adis16400.c       | 3 +++
>  drivers/iio/potentiometer/x9250.c | 7 ++++++-
>  drivers/iio/pressure/bmp280-spi.c | 2 ++
>  7 files changed, 24 insertions(+), 3 deletions(-)
> 

Re: [PATCH 0/7] iio: validate SPI match data before use

[Uwe Kleine-König (The Capable Hub)]

[-- Attachment #1: Type: text/plain, Size: 1018 bytes --]

Hello Jonathan,

On Sat, Sep 26, 2026 at 02:11:43AM +0100, Jonathan Cameron wrote:
> On Fri, 25 Sep 2026 21:17:29 +0800
> Jiale Yao <yaojiale02@163.com> wrote:
> 
> > SPI driver_override can bind a device without a matching entry in the
> > driver's ID tables.  spi_get_device_match_data() then returns NULL.
> > 
> > These seven IIO drivers use that result without checking it, causing a
> > NULL pointer dereference during probe.  Add the missing checks before
> > the match data is used.
> 
> I was hoping we'd close this finally by adding a flag to the
> drivers to say they should fail a match if driver_override is set.
> Given I thought maybe that would happen when Andy looked into this
> a while back I've been sitting on this problem for a while.
> 
> 
> Unfortunately seems we have to carry on papering over it in the
> drivers for now :(

Note there is another effort:
https://lore.kernel.org/lkml/20260922-driver-override-opt-out-v1-0-58c35ded3b83@nvidia.com/

Best regards
Uwe

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: [PATCH 0/7] iio: validate SPI match data before use

[Jonathan Cameron]

On Sat, 26 Sep 2026 08:13:13 +0200
Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com> wrote:

> Hello Jonathan,
> 
> On Sat, Sep 26, 2026 at 02:11:43AM +0100, Jonathan Cameron wrote:
> > On Fri, 25 Sep 2026 21:17:29 +0800
> > Jiale Yao <yaojiale02@163.com> wrote:
> >   
> > > SPI driver_override can bind a device without a matching entry in the
> > > driver's ID tables.  spi_get_device_match_data() then returns NULL.
> > > 
> > > These seven IIO drivers use that result without checking it, causing a
> > > NULL pointer dereference during probe.  Add the missing checks before
> > > the match data is used.  
> > 
> > I was hoping we'd close this finally by adding a flag to the
> > drivers to say they should fail a match if driver_override is set.
> > Given I thought maybe that would happen when Andy looked into this
> > a while back I've been sitting on this problem for a while.
> > 
> > 
> > Unfortunately seems we have to carry on papering over it in the
> > drivers for now :(  
> 
> Note there is another effort:
> https://lore.kernel.org/lkml/20260922-driver-override-opt-out-v1-0-58c35ded3b83@nvidia.com/

Nice. I look forward to ripping all these checks out again
if that lands. Obviously we won't backport doing that given the checks
will remain harmless.

Jonathan

> 
> Best regards
> Uwe

Re: [PATCH 0/7] iio: validate SPI match data before use

[Andy Shevchenko]

On Sun, Sep 27, 2026 at 06:20:01PM +0100, Jonathan Cameron wrote:
> On Sat, 26 Sep 2026 08:13:13 +0200
> Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com> wrote:
> > On Sat, Sep 26, 2026 at 02:11:43AM +0100, Jonathan Cameron wrote:
> > > On Fri, 25 Sep 2026 21:17:29 +0800
> > > Jiale Yao <yaojiale02@163.com> wrote:
> > >   
> > > > SPI driver_override can bind a device without a matching entry in the
> > > > driver's ID tables.  spi_get_device_match_data() then returns NULL.
> > > > 
> > > > These seven IIO drivers use that result without checking it, causing a
> > > > NULL pointer dereference during probe.  Add the missing checks before
> > > > the match data is used.  
> > > 
> > > I was hoping we'd close this finally by adding a flag to the
> > > drivers to say they should fail a match if driver_override is set.
> > > Given I thought maybe that would happen when Andy looked into this
> > > a while back I've been sitting on this problem for a while.

Sorry, I have had no time to continue...

> > > 
> > > Unfortunately seems we have to carry on papering over it in the
> > > drivers for now :(  
> > 
> > Note there is another effort:
> > https://lore.kernel.org/lkml/20260922-driver-override-opt-out-v1-0-58c35ded3b83@nvidia.com/

...but I like this effort, it looks great!

> Nice. I look forward to ripping all these checks out again
> if that lands. Obviously we won't backport doing that given the checks
> will remain harmless.

-- 
With Best Regards,
Andy Shevchenko