[PATCH] pwm: lp3943: fix NULL pointer dereference for an unconfigured channel

[PATCH] pwm: lp3943: fix NULL pointer dereference for an unconfigured channel

[Manush Prajwal]

lp3943_pwm_probe() unconditionally registers a pwmchip with
LP3943_NUM_PWMS(2) hwpwm channels, but lp3943_pwm_parse_dt() only
populates pdata->pwms[i] for the channels whose ti,pwm0/ti,pwm1
property is actually present in the devicetree (the binding
explicitly allows each PWM generator to drive zero or more outputs,
and lp3943_pwm_parse_dt() only fails outright with -ENODATA if
*neither* property is present). A devicetree that configures only one
of the two channels leaves pdata->pwms[] NULL for the other.

lp3943_pwm_request_map() dereferences pdata->pwms[hwpwm] with no NULL
check:

	pwm_map->output = pdata->pwms[hwpwm]->output;
	pwm_map->num_outputs = pdata->pwms[hwpwm]->num_outputs;

so requesting the unconfigured channel (e.g. exporting it from
sysfs) crashes with a NULL pointer dereference instead of failing
cleanly.

Return -ENODEV from lp3943_pwm_request_map() when the channel was
never configured, before the pointer is dereferenced. The caller,
lp3943_pwm_request(), already propagates an ERR_PTR return correctly
(it does so today for the existing -EBUSY case).

Reported-by: Sashiko AI review <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/6a9d4c6b.79b5ea6e.147aa1.5883@mx.google.com?part=1
Signed-off-by: Manush Prajwal <manushprajwal555@gmail.com>
---
 drivers/pwm/pwm-lp3943.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/pwm/pwm-lp3943.c b/drivers/pwm/pwm-lp3943.c
index e8bb8dbb9..956d22053 100644
--- a/drivers/pwm/pwm-lp3943.c
+++ b/drivers/pwm/pwm-lp3943.c
@@ -38,6 +38,9 @@ lp3943_pwm_request_map(struct lp3943_pwm *lp3943_pwm, int hwpwm)
 	struct lp3943_pwm_map *pwm_map = &lp3943_pwm->pwm_map[hwpwm];
 	int i, offset;
 
+	if (!pdata->pwms[hwpwm])
+		return ERR_PTR(-ENODEV);
+
 	pwm_map->output = pdata->pwms[hwpwm]->output;
 	pwm_map->num_outputs = pdata->pwms[hwpwm]->num_outputs;
 
-- 
2.46.2.windows.1

Re: [PATCH] pwm: lp3943: fix NULL pointer dereference for an unconfigured channel

[Uwe Kleine-König]

[-- Attachment #1: Type: text/plain, Size: 1736 bytes --]

On Sun, Sep 06, 2026 at 05:11:58PM +0530, Manush Prajwal wrote:
> lp3943_pwm_probe() unconditionally registers a pwmchip with
> LP3943_NUM_PWMS(2) hwpwm channels, but lp3943_pwm_parse_dt() only
> populates pdata->pwms[i] for the channels whose ti,pwm0/ti,pwm1
> property is actually present in the devicetree (the binding
> explicitly allows each PWM generator to drive zero or more outputs,
> and lp3943_pwm_parse_dt() only fails outright with -ENODATA if
> *neither* property is present). A devicetree that configures only one
> of the two channels leaves pdata->pwms[] NULL for the other.
> 
> lp3943_pwm_request_map() dereferences pdata->pwms[hwpwm] with no NULL
> check:
> 
> 	pwm_map->output = pdata->pwms[hwpwm]->output;
> 	pwm_map->num_outputs = pdata->pwms[hwpwm]->num_outputs;
> 
> so requesting the unconfigured channel (e.g. exporting it from
> sysfs) crashes with a NULL pointer dereference instead of failing
> cleanly.
> 
> Return -ENODEV from lp3943_pwm_request_map() when the channel was
> never configured, before the pointer is dereferenced. The caller,
> lp3943_pwm_request(), already propagates an ERR_PTR return correctly
> (it does so today for the existing -EBUSY case).
> 
> Reported-by: Sashiko AI review <sashiko-bot@kernel.org>
> Closes: https://sashiko.dev/#/patchset/6a9d4c6b.79b5ea6e.147aa1.5883@mx.google.com?part=1
> Signed-off-by: Manush Prajwal <manushprajwal555@gmail.com>

Applied to
https://git.kernel.org/pub/scm/linux/kernel/git/ukleinek/linux.git pwm/for-next

adding a Fixes trailer for af66b3c0934e ("pwm: Add LP3943 PWM driver").

I havn't made up my mind yet if I send a fixes PR before 7.3. If I do I
will likely include this patch.

Best regards
Uwe

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]