From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wr1-f49.google.com (mail-wr1-f49.google.com [209.85.221.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4437B384258 for ; Wed, 4 Mar 2026 11:47:55 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.49 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772624876; cv=none; b=JssLcKvchZA1vEe8Ti/xnlUgSYFWLrkzrMAtG2jKL0qSjmYS4a3pIZUwVnwQEpzC+Btmju8Hp+cH2fAmLd3Alqwn3DgeQs/8Jx1G526pSLmw9GAlehUHiA4gRBlYSBRfazxufoOVQd0DqK3vH7ddY1uW5oMHmcKgaZ15Jl3rybc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772624876; c=relaxed/simple; bh=/R4eaBcrPWpSJC8OeQOy0GTZEIidjpvzldxcxjU2idw=; h=Message-ID:Subject:From:To:Date:In-Reply-To:References: Content-Type:MIME-Version; b=P0qB+CChqMXP1ugaiqYxZnCtvl79kTZQXCeO7UzHdiV9Vx6KE3x+BVA70sDEAGVvjiBEcsV66wiG0bOgTLxhfmbdOID/MUCwDqzb1HIc2lDAnDoRDlPLfOBbL2GS/tDL3+pKkLxlfwgTR4XWNPzJcQDcm7jrnxbf907+ZD7OWIQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=LNxxACgi; arc=none smtp.client-ip=209.85.221.49 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="LNxxACgi" Received: by mail-wr1-f49.google.com with SMTP id ffacd0b85a97d-439c4bde55cso787885f8f.1 for ; Wed, 04 Mar 2026 03:47:54 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1772624873; x=1773229673; darn=vger.kernel.org; h=mime-version:user-agent:content-transfer-encoding:references :in-reply-to:date:to:from:subject:message-id:from:to:cc:subject:date :message-id:reply-to; bh=CduAQzbmJX58L5AceBDqB7EH1l0pF29iMVDCaHBV8pk=; b=LNxxACgiNpyN1jEhDJkix3m9mJWIlpkr42EL1l+57EONc2GbzdOH084plUqRUOYjDQ t+L0oPWwamNC7/WykQr2kqiZit9A5Iavp2leYE0gFhcYf4iMD/1D1ReKlhDpQw4CnncO ZrhVKFAm9is/z6lcy9tDEXHUeCioWvTICo0qyyzzil3mUrmFiYt1wSYdNE0lBBWyRW1D Xcn6nHg/i7MVY5PxGHz91d2Y+yx+h9d9s85p1oA9B9XuzirSWWYHnKInGVC/NpwyFGqG Lh+WnihnkzDMi/B9W2//aivHRXwrlSo/kWe8aOPJ9usmJEmiFMvDfiqoLp61W8zkWtFL /DRg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1772624873; x=1773229673; h=mime-version:user-agent:content-transfer-encoding:references :in-reply-to:date:to:from:subject:message-id:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=CduAQzbmJX58L5AceBDqB7EH1l0pF29iMVDCaHBV8pk=; b=i8Mk/VP3LLepTfwE2N/oTGSesIx24DzQHf7iw4Eo5i7cB0My93nagk+WVTIyw005eT ZuoLcte9SpUdbmOF3eygQe3H26s9mt5ABPhiiJ/s9DxeKGuNlvtmEs/WQGAb6P9nrrUZ abdJT3EZ09C5zLutFpJLsGv6tpqRkOeqXntprjNiGVvDhWip3hymq0qaYS2lkVbnLvxj CPCO9s5m0VYBAe57o6VajvC9YMB4yHmYlUPA9zWKFtymJw2UCdI0ghq+bl48v8Grg6mw tjJbr5U7TxHblCRc9A0Bxm2F5gpkYTr4yXcsXiWRJbUv4l7B3T3obStAhCgRJU7W8OEY kRxQ== X-Forwarded-Encrypted: i=1; AJvYcCU8ebc9MED/4Lv/tSm8yasijUuufN4DqlAxXIomeuaO6SMoEVU6jNRO3/6VMcKe22hEC80CFOSgH/cZcv0=@vger.kernel.org X-Gm-Message-State: AOJu0Yy7q9XV7ndr3T8tkJ+HjwQJXF58Nk6DLw3e47qlmaH4JlSlxD2Z PKeyfRLyRGlo+CPc/fcH0LAQV9rubRqNQHfIHX1Rxu9wLFQfoNbhUARWZIfmKw== X-Gm-Gg: ATEYQzyeST0/XDyYZMBmHExPaPS/HOpux3bJuL2P1M7+ojcONnV3fe2Ps0loiwHqYS0 AlCiD2i5MO0umoj9rIn7z88Ei8zqgNg/Npb40h4fPDGsd0OP4NIx58ti0++yNqqBLWbrhTP1POO sWCf6Ky3/7vhHw6QzjNfsnf7q7Zhlhij9nfn7sIdF/E7F+jMN9TPutlkYHt5/yo7AVjo7kIOGpg untFcDOc6waJAI4i3X6EcEu1dGMgZ2z39jpVCGJGLpxT+EYBoPViOownfQ1twnjbt3JIqB0agIq JSJW5EOt4ovEaz0SP/D6mQ7mDW4BgdkqX/uG4DQp6TVUUZmuVT0b5BYuy1FGIohctr0gblsBgXc ZG4DJWPx9/++lLKv50opeiu8TasLzJJ1gV8v+rH+ROTZ3egsaEVqAS/N3ly5TnEMlmM4ST6F1V5 yUBEymdsH6A/fLswj0+NwcGrraYZ84Be0= X-Received: by 2002:a05:6000:2381:b0:439:b3c5:ea20 with SMTP id ffacd0b85a97d-439c7f64c41mr3158399f8f.5.1772624873314; Wed, 04 Mar 2026 03:47:53 -0800 (PST) Received: from [192.168.1.187] ([148.63.225.166]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-439ac9f3e5bsm33109011f8f.37.2026.03.04.03.47.52 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 04 Mar 2026 03:47:53 -0800 (PST) Message-ID: <40d38cac145215e525c0fdc19f48634e9315467f.camel@gmail.com> Subject: Re: [PATCH v3] iio: frequency: admv1013: fix NULL pointer dereference on str From: Nuno =?ISO-8859-1?Q?S=E1?= To: Antoniu Miclaus , Lars-Peter Clausen , Michael Hennerich , Jonathan Cameron , David Lechner , Nuno =?ISO-8859-1?Q?S=E1?= , Andy Shevchenko , linux-iio@vger.kernel.org, linux-kernel@vger.kernel.org Date: Wed, 04 Mar 2026 11:48:37 +0000 In-Reply-To: <20260304095818.5459-1-antoniu.miclaus@analog.com> References: <20260304095818.5459-1-antoniu.miclaus@analog.com> Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable User-Agent: Evolution 3.58.3 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 On Wed, 2026-03-04 at 11:58 +0200, Antoniu Miclaus wrote: > When device_property_read_string() fails, str is left uninitialized > but the code falls through to strcmp(str, ...), dereferencing a garbage > pointer. Replace manual read/strcmp with > device_property_match_property_string() which reads the property as a > single string value and matches it against an array of known valid > strings, handling the missing property case internally. >=20 > Fixes: da35a7b526d9 ("iio: frequency: admv1013: add support for ADMV1013"= ) > Signed-off-by: Antoniu Miclaus > --- One nit below but no need to re-spin just for that: Reviewed-by: Nuno S=C3=A1 > Changes in v3: > =C2=A0- add enum for quad SE mode indices to avoid magic numbers > =C2=A0- use designated initializers for string arrays > =C2=A0- replace switch with a lookup table for quad SE register values >=20 > =C2=A0drivers/iio/frequency/admv1013.c | 55 +++++++++++++++++++----------= --- > =C2=A01 file changed, 33 insertions(+), 22 deletions(-) >=20 > diff --git a/drivers/iio/frequency/admv1013.c b/drivers/iio/frequency/adm= v1013.c > index 9202443ef445..afdf06a0de43 100644 > --- a/drivers/iio/frequency/admv1013.c > +++ b/drivers/iio/frequency/admv1013.c > @@ -90,6 +90,12 @@ enum { > =C2=A0 ADMV1013_SE_MODE_DIFF =3D 12 > =C2=A0}; > =C2=A0 > +enum { > + ADMV1013_QUAD_SE_DIFF, > + ADMV1013_QUAD_SE_POS, > + ADMV1013_QUAD_SE_NEG, > +}; > + > =C2=A0struct admv1013_state { > =C2=A0 struct spi_device *spi; > =C2=A0 struct clk *clkin; > @@ -512,37 +518,42 @@ static void admv1013_powerdown(void *data) > =C2=A0 admv1013_spi_update_bits(data, ADMV1013_REG_ENABLE, enable_reg_msk= , enable_reg); > =C2=A0} > =C2=A0 > +static const char * const admv1013_input_modes[] =3D { > + [ADMV1013_IQ_MODE] =3D "iq", > + [ADMV1013_IF_MODE] =3D "if", > +}; > + > +static const char * const admv1013_quad_se_modes[] =3D { > + [ADMV1013_QUAD_SE_DIFF] =3D "diff", > + [ADMV1013_QUAD_SE_POS] =3D "se-pos", > + [ADMV1013_QUAD_SE_NEG] =3D "se-neg", > +}; > + > +static const unsigned int admv1013_quad_se_regvals[] =3D { > + [ADMV1013_QUAD_SE_DIFF] =3D ADMV1013_SE_MODE_DIFF, > + [ADMV1013_QUAD_SE_POS] =3D ADMV1013_SE_MODE_POS, > + [ADMV1013_QUAD_SE_NEG] =3D ADMV1013_SE_MODE_NEG, > +}; > + > =C2=A0static int admv1013_properties_parse(struct admv1013_state *st) > =C2=A0{ > =C2=A0 int ret; > - const char *str; > =C2=A0 struct device *dev =3D &st->spi->dev; > =C2=A0 > =C2=A0 st->det_en =3D device_property_read_bool(dev, "adi,detector-enable= "); > =C2=A0 > - ret =3D device_property_read_string(dev, "adi,input-mode", &str); > - if (ret) > - st->input_mode =3D ADMV1013_IQ_MODE; > + ret =3D device_property_match_property_string(dev, "adi,input-mode", > + =C2=A0=C2=A0=C2=A0 admv1013_input_modes, > + =C2=A0=C2=A0=C2=A0 ARRAY_SIZE(admv1013_input_modes)); > + st->input_mode =3D ret >=3D 0 ? ret : ADMV1013_IQ_MODE; > =C2=A0 > - if (!strcmp(str, "iq")) > - st->input_mode =3D ADMV1013_IQ_MODE; > - else if (!strcmp(str, "if")) > - st->input_mode =3D ADMV1013_IF_MODE; > - else > - return -EINVAL; > + ret =3D device_property_match_property_string(dev, "adi,quad-se-mode", > + =C2=A0=C2=A0=C2=A0 admv1013_quad_se_modes, > + =C2=A0=C2=A0=C2=A0 ARRAY_SIZE(admv1013_quad_se_modes)); > + if (ret < 0) > + ret =3D ADMV1013_QUAD_SE_DIFF; > =C2=A0 > - ret =3D device_property_read_string(dev, "adi,quad-se-mode", &str); > - if (ret) > - st->quad_se_mode =3D ADMV1013_SE_MODE_DIFF; > - > - if (!strcmp(str, "diff")) > - st->quad_se_mode =3D ADMV1013_SE_MODE_DIFF; > - else if (!strcmp(str, "se-pos")) > - st->quad_se_mode =3D ADMV1013_SE_MODE_POS; > - else if (!strcmp(str, "se-neg")) > - st->quad_se_mode =3D ADMV1013_SE_MODE_NEG; > - else > - return -EINVAL; > + st->quad_se_mode =3D admv1013_quad_se_regvals[ret]; You could have kept the same style: st->quad_se_mode =3D ret >=3D 0 ? admv1013_quad_se_regvals[ret] : ADMV1013_= SE_MODE_DIFF; yes, more that 80 col but maybe one of those justifiable cases :) - Nuno S=C3=A1