[PATCH 0/9] iio: adc: reject SPI devices without match data

[PATCH 0/9] iio: adc: reject SPI devices without match data

[Jiale Yao]

SPI driver_override can bind a device to a driver without a matching
firmware entry or SPI device ID. In that case,
spi_get_device_match_data() returns NULL.

These nine ADC probe paths assume that the returned chip information is
present and later dereference it. Reject devices without match data before
the pointer is used, following the handling added to the AD5686 bus
frontends by commit 572a00852635 ("iio: dac: ad5686: missing NULL check on
match data").

The ADC128S052 and ADS7950 probes also dereference spi_get_device_id() to
obtain the IIO device name. Use the always available SPI modalias instead,
so the override path does not depend on a matching SPI ID.

Each patch fixes one driver and can be applied independently.

Jiale Yao (9):
  iio: adc: ad7192: reject devices without match data
  iio: adc: ad7606: reject devices without match data
  iio: adc: ad7768-1: reject devices without match data
  iio: adc: max11205: reject devices without match data
  iio: adc: mcp3911: reject devices without match data
  iio: adc: ti-adc128s052: validate SPI match data
  iio: adc: ti-ads1018: reject devices without match data
  iio: adc: ti-ads131m02: reject devices without match data
  iio: adc: ti-ads7950: validate SPI match data

 drivers/iio/adc/ad7192.c        | 3 +++
 drivers/iio/adc/ad7606_spi.c    | 6 +++++-
 drivers/iio/adc/ad7768-1.c      | 3 +++
 drivers/iio/adc/max11205.c      | 2 ++
 drivers/iio/adc/mcp3911.c       | 2 ++
 drivers/iio/adc/ti-adc128s052.c | 8 +++++---
 drivers/iio/adc/ti-ads1018.c    | 3 +++
 drivers/iio/adc/ti-ads131m02.c  | 2 ++
 drivers/iio/adc/ti-ads7950.c    | 4 +++-
 9 files changed, 28 insertions(+), 5 deletions(-)

base-commit: 93f51579e7df248780214094418f205253383cc5
-- 
2.34.1

[PATCH 1/9] iio: adc: ad7192: reject devices without match data

[Jiale Yao]

SPI driver_override allows a device to bind to this driver without
matching either the OF or SPI device ID table. In that case,
spi_get_device_match_data() returns NULL.

ad7192_probe() immediately dereferences the returned chip information
to initialize the IIO device, causing a NULL pointer dereference.

Commit 572a00852635 ("iio: dac: ad5686: missing NULL check on match
data") fixed the same driver_override issue in another SPI driver.
Reject devices without match data before using the chip information.

Fixes: c3708c829a06 ("iio: adc: ad7192: Convert from of specific to fwnode property handling")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/iio/adc/ad7192.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/iio/adc/ad7192.c b/drivers/iio/adc/ad7192.c
index d8f5886fcf69..8bd810546311 100644
--- a/drivers/iio/adc/ad7192.c
+++ b/drivers/iio/adc/ad7192.c
@@ -1406,6 +1406,9 @@ static int ad7192_probe(struct spi_device *spi)
 	st->int_vref_mv = ret == -ENODEV ? avdd_mv : ret / MILLI;
 
 	st->chip_info = spi_get_device_match_data(spi);
+	if (!st->chip_info)
+		return -ENODATA;
+
 	indio_dev->name = st->chip_info->name;
 	indio_dev->modes = INDIO_DIRECT_MODE;
 	indio_dev->info = st->chip_info->info;
-- 
2.34.1

[PATCH 2/9] iio: adc: ad7606: reject devices without match data

[Jiale Yao]

SPI driver_override allows a device to bind to this driver without
matching either the OF or SPI device ID table. In that case,
spi_get_device_match_data() returns NULL.

ad7606_spi_probe() dereferences the returned bus information to pass
the chip information and bus operations to the core, causing a NULL
pointer dereference.

Commit 572a00852635 ("iio: dac: ad5686: missing NULL check on match
data") fixed the same driver_override issue in another SPI driver.
Reject devices without match data before entering the core.

Fixes: bc69e9fffde4 ("iio: adc: ad7606: Add compatibility to fw_nodes")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/iio/adc/ad7606_spi.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/iio/adc/ad7606_spi.c b/drivers/iio/adc/ad7606_spi.c
index 1ebdfb8580ab..8c479fa50a23 100644
--- a/drivers/iio/adc/ad7606_spi.c
+++ b/drivers/iio/adc/ad7606_spi.c
@@ -456,7 +456,11 @@ static const struct ad7606_bus_info ad7616_bus_info = {
 
 static int ad7606_spi_probe(struct spi_device *spi)
 {
-	const struct ad7606_bus_info *bus_info = spi_get_device_match_data(spi);
+	const struct ad7606_bus_info *bus_info;
+
+	bus_info = spi_get_device_match_data(spi);
+	if (!bus_info)
+		return -ENODATA;
 
 	return ad7606_probe(&spi->dev, spi->irq, NULL,
 			    bus_info->chip_info, bus_info->bops);
-- 
2.34.1

[PATCH 3/9] iio: adc: ad7768-1: reject devices without match data

[Jiale Yao]

SPI driver_override allows a device to bind to this driver without
matching either the OF or SPI device ID table. In that case,
spi_get_device_match_data() returns NULL.

ad7768_probe() later dereferences the returned chip information to
initialize the IIO channels and device name, causing a NULL pointer
dereference.

Commit 572a00852635 ("iio: dac: ad5686: missing NULL check on match
data") fixed the same driver_override issue in another SPI driver.
Reject devices without match data before continuing the probe.

Fixes: fa087f5babbc ("iio: adc: ad7768-1: introduce chip info for future multidevice support")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/iio/adc/ad7768-1.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/iio/adc/ad7768-1.c b/drivers/iio/adc/ad7768-1.c
index e9060c1bbe6f..3972821c295a 100644
--- a/drivers/iio/adc/ad7768-1.c
+++ b/drivers/iio/adc/ad7768-1.c
@@ -1829,6 +1829,9 @@ static int ad7768_probe(struct spi_device *spi)
 	}
 
 	st->chip = spi_get_device_match_data(spi);
+	if (!st->chip)
+		return -ENODATA;
+
 	st->spi = spi;
 
 	st->regmap = devm_regmap_init_spi(spi, &ad7768_regmap_config);
-- 
2.34.1

[PATCH 4/9] iio: adc: max11205: reject devices without match data

[Jiale Yao]

SPI driver_override allows a device to bind to this driver without
matching either the OF or SPI device ID table. In that case,
spi_get_device_match_data() returns NULL.

max11205_probe() immediately dereferences the returned chip information
to set the IIO device name, causing a NULL pointer dereference.

Commit 572a00852635 ("iio: dac: ad5686: missing NULL check on match
data") fixed the same driver_override issue in another SPI driver.
Reject devices without match data before using the chip information.

Fixes: bf3c855be801 ("iio: adc: max11205: simplify with spi_get_device_match_data()")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/iio/adc/max11205.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/iio/adc/max11205.c b/drivers/iio/adc/max11205.c
index 63b6561dcf47..53ac2f4f383e 100644
--- a/drivers/iio/adc/max11205.c
+++ b/drivers/iio/adc/max11205.c
@@ -117,6 +117,8 @@ static int max11205_probe(struct spi_device *spi)
 	ad_sd_init(&st->sd, indio_dev, spi, &max11205_sigma_delta_info);
 
 	st->chip_info = spi_get_device_match_data(spi);
+	if (!st->chip_info)
+		return -ENODATA;
 
 	indio_dev->name = st->chip_info->name;
 	indio_dev->modes = INDIO_DIRECT_MODE;
-- 
2.34.1

[PATCH 5/9] iio: adc: mcp3911: reject devices without match data

[Jiale Yao]

SPI driver_override allows a device to bind to this driver without
matching either the OF or SPI device ID table. In that case,
spi_get_device_match_data() returns NULL.

mcp3911_probe() stores the result and later calls through chip->config
and accesses other chip-specific fields, causing a NULL pointer
dereference.

Commit 572a00852635 ("iio: dac: ad5686: missing NULL check on match
data") fixed the same driver_override issue in another SPI driver.
Reject devices without match data before continuing the probe.

Fixes: 732ad34260d3 ("iio: adc: mcp3911: add support for the whole MCP39xx family")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/iio/adc/mcp3911.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/iio/adc/mcp3911.c b/drivers/iio/adc/mcp3911.c
index 797424f59f74..90167930f913 100644
--- a/drivers/iio/adc/mcp3911.c
+++ b/drivers/iio/adc/mcp3911.c
@@ -721,6 +721,8 @@ static int mcp3911_probe(struct spi_device *spi)
 	adc = iio_priv(indio_dev);
 	adc->spi = spi;
 	adc->chip = spi_get_device_match_data(spi);
+	if (!adc->chip)
+		return -ENODATA;
 
 	ret = devm_regulator_get_enable_read_voltage(dev, "vref");
 	if (ret < 0 && ret != -ENODEV)
-- 
2.34.1

[PATCH 6/9] iio: adc: ti-adc128s052: validate SPI match data

[Jiale Yao]

SPI driver_override allows a device to bind to this driver without
matching either the firmware tables or SPI device ID table. In that
case, spi_get_device_match_data() returns NULL.

adc128_probe() also obtains the IIO device name by dereferencing the
result of spi_get_device_id(), which is NULL on the same override path.
The probe can therefore crash before it reaches the match data access.

Commit 572a00852635 ("iio: dac: ad5686: missing NULL check on match
data") fixed the same driver_override issue in another SPI driver.
Reject devices without match data and use the always available SPI
modalias for the IIO device name.

Fixes: d5f0da0c6972 ("iio: adc: ti-adc128s052: Switch to use spi_get_device_match_data()")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/iio/adc/ti-adc128s052.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/drivers/iio/adc/ti-adc128s052.c b/drivers/iio/adc/ti-adc128s052.c
index 1899813c1aee..f9a995ff403e 100644
--- a/drivers/iio/adc/ti-adc128s052.c
+++ b/drivers/iio/adc/ti-adc128s052.c
@@ -195,12 +195,14 @@ static int adc128_probe(struct spi_device *spi)
 	adc = iio_priv(indio_dev);
 	adc->spi = spi;
 
-	indio_dev->name = spi_get_device_id(spi)->name;
+	config = spi_get_device_match_data(spi);
+	if (!config)
+		return -ENODATA;
+
+	indio_dev->name = spi->modalias;
 	indio_dev->modes = INDIO_DIRECT_MODE;
 	indio_dev->info = &adc128_info;
 
-	config = spi_get_device_match_data(spi);
-
 	indio_dev->channels = config->channels;
 	indio_dev->num_channels = config->num_channels;
 
-- 
2.34.1

Re: [PATCH 6/9] iio: adc: ti-adc128s052: validate SPI match data

[Jonathan Cameron]

On Fri, 25 Sep 2026 20:57:44 +0800
Jiale Yao <yaojiale02@163.com> wrote:

> SPI driver_override allows a device to bind to this driver without
> matching either the firmware tables or SPI device ID table. In that
> case, spi_get_device_match_data() returns NULL.
> 
> adc128_probe() also obtains the IIO device name by dereferencing the
> result of spi_get_device_id(), which is NULL on the same override path.
> The probe can therefore crash before it reaches the match data access.
> 
> Commit 572a00852635 ("iio: dac: ad5686: missing NULL check on match
> data") fixed the same driver_override issue in another SPI driver.
> Reject devices without match data and use the always available SPI
> modalias for the IIO device name.

Why this change?  The name is clearly encoded in a place that makes
it readily available and verifiably the right thing in a way that
spi->modalias does not.
There isn't any reason the IIO name would always match that even it
happens to do so here.


> 
> Fixes: d5f0da0c6972 ("iio: adc: ti-adc128s052: Switch to use spi_get_device_match_data()")
> Cc: stable@vger.kernel.org
> Signed-off-by: Jiale Yao <yaojiale02@163.com>
> ---
>  drivers/iio/adc/ti-adc128s052.c | 8 +++++---
>  1 file changed, 5 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/iio/adc/ti-adc128s052.c b/drivers/iio/adc/ti-adc128s052.c
> index 1899813c1aee..f9a995ff403e 100644
> --- a/drivers/iio/adc/ti-adc128s052.c
> +++ b/drivers/iio/adc/ti-adc128s052.c
> @@ -195,12 +195,14 @@ static int adc128_probe(struct spi_device *spi)
>  	adc = iio_priv(indio_dev);
>  	adc->spi = spi;
>  
> -	indio_dev->name = spi_get_device_id(spi)->name;
> +	config = spi_get_device_match_data(spi);
> +	if (!config)
> +		return -ENODATA;
> +
> +	indio_dev->name = spi->modalias;
>  	indio_dev->modes = INDIO_DIRECT_MODE;
>  	indio_dev->info = &adc128_info;
>  
> -	config = spi_get_device_match_data(spi);
> -
>  	indio_dev->channels = config->channels;
>  	indio_dev->num_channels = config->num_channels;
>  

Re: [PATCH 6/9] iio: adc: ti-adc128s052: validate SPI match data

[Jonathan Cameron]

On Sat, 26 Sep 2026 02:15:06 +0100
Jonathan Cameron <jic23@kernel.org> wrote:

> On Fri, 25 Sep 2026 20:57:44 +0800
> Jiale Yao <yaojiale02@163.com> wrote:
> 
> > SPI driver_override allows a device to bind to this driver without
> > matching either the firmware tables or SPI device ID table. In that
> > case, spi_get_device_match_data() returns NULL.
> > 
> > adc128_probe() also obtains the IIO device name by dereferencing the
> > result of spi_get_device_id(), which is NULL on the same override path.
> > The probe can therefore crash before it reaches the match data access.
> > 
> > Commit 572a00852635 ("iio: dac: ad5686: missing NULL check on match
> > data") fixed the same driver_override issue in another SPI driver.
> > Reject devices without match data and use the always available SPI
> > modalias for the IIO device name.  
> 
> Why this change?  The name is clearly encoded in a place that makes
> it readily available and verifiably the right thing in a way that
> spi->modalias does not.
> There isn't any reason the IIO name would always match that even it
> happens to do so here.

Actually - ignore that, I misread this and assumed the code
was different from what was actually there.

Drivers shouldn't be using spi_get_device_id(spi)->name but
I'm not sure modalias is any better.

I'm out of time for now, so will revisit this in a day or so.

> 
> 
> > 
> > Fixes: d5f0da0c6972 ("iio: adc: ti-adc128s052: Switch to use spi_get_device_match_data()")
> > Cc: stable@vger.kernel.org
> > Signed-off-by: Jiale Yao <yaojiale02@163.com>
> > ---
> >  drivers/iio/adc/ti-adc128s052.c | 8 +++++---
> >  1 file changed, 5 insertions(+), 3 deletions(-)
> > 
> > diff --git a/drivers/iio/adc/ti-adc128s052.c b/drivers/iio/adc/ti-adc128s052.c
> > index 1899813c1aee..f9a995ff403e 100644
> > --- a/drivers/iio/adc/ti-adc128s052.c
> > +++ b/drivers/iio/adc/ti-adc128s052.c
> > @@ -195,12 +195,14 @@ static int adc128_probe(struct spi_device *spi)
> >  	adc = iio_priv(indio_dev);
> >  	adc->spi = spi;
> >  
> > -	indio_dev->name = spi_get_device_id(spi)->name;
> > +	config = spi_get_device_match_data(spi);
> > +	if (!config)
> > +		return -ENODATA;
> > +
> > +	indio_dev->name = spi->modalias;
> >  	indio_dev->modes = INDIO_DIRECT_MODE;
> >  	indio_dev->info = &adc128_info;
> >  
> > -	config = spi_get_device_match_data(spi);
> > -
> >  	indio_dev->channels = config->channels;
> >  	indio_dev->num_channels = config->num_channels;
> >    
> 
> 

[PATCH 7/9] iio: adc: ti-ads1018: reject devices without match data

[Jiale Yao]

SPI driver_override allows a device to bind to this driver without
matching either the OF or SPI device ID table. In that case,
spi_get_device_match_data() returns NULL.

ads1018_spi_probe() immediately dereferences the returned chip
information to initialize the IIO device, causing a NULL pointer
dereference.

Commit 572a00852635 ("iio: dac: ad5686: missing NULL check on match
data") fixed the same driver_override issue in another SPI driver.
Reject devices without match data before allocating the IIO device.

Fixes: bf0bba486b5b ("iio: adc: Add ti-ads1018 driver")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/iio/adc/ti-ads1018.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/iio/adc/ti-ads1018.c b/drivers/iio/adc/ti-ads1018.c
index d9ec4a8d7ce5..8f2d03eee77b 100644
--- a/drivers/iio/adc/ti-ads1018.c
+++ b/drivers/iio/adc/ti-ads1018.c
@@ -624,12 +624,16 @@ static int ads1018_trigger_setup(struct iio_dev *indio_dev)
 
 static int ads1018_spi_probe(struct spi_device *spi)
 {
-	const struct ads1018_chip_info *info = spi_get_device_match_data(spi);
+	const struct ads1018_chip_info *info;
 	struct device *dev = &spi->dev;
 	struct iio_dev *indio_dev;
 	struct ads1018 *ads1018;
 	int ret;
 
+	info = spi_get_device_match_data(spi);
+	if (!info)
+		return -ENODATA;
+
 	indio_dev = devm_iio_device_alloc(dev, sizeof(*ads1018));
 	if (!indio_dev)
 		return -ENOMEM;
-- 
2.34.1

Re: [PATCH 7/9] iio: adc: ti-ads1018: reject devices without match data

[Kurt Borja]

On Fri Sep 25, 2026 at 9:57 AM -03, Jiale Yao wrote:
> SPI driver_override allows a device to bind to this driver without
> matching either the OF or SPI device ID table. In that case,
> spi_get_device_match_data() returns NULL.
>
> ads1018_spi_probe() immediately dereferences the returned chip
> information to initialize the IIO device, causing a NULL pointer
> dereference.
>
> Commit 572a00852635 ("iio: dac: ad5686: missing NULL check on match
> data") fixed the same driver_override issue in another SPI driver.
> Reject devices without match data before allocating the IIO device.
>
> Fixes: bf0bba486b5b ("iio: adc: Add ti-ads1018 driver")
> Cc: stable@vger.kernel.org
> Signed-off-by: Jiale Yao <yaojiale02@163.com>

Reviewed-by: Kurt Borja <kuurtb@gmail.com>

> ---
>  drivers/iio/adc/ti-ads1018.c | 6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/iio/adc/ti-ads1018.c b/drivers/iio/adc/ti-ads1018.c
> index d9ec4a8d7ce5..8f2d03eee77b 100644
> --- a/drivers/iio/adc/ti-ads1018.c
> +++ b/drivers/iio/adc/ti-ads1018.c
> @@ -624,12 +624,16 @@ static int ads1018_trigger_setup(struct iio_dev *indio_dev)
>  
>  static int ads1018_spi_probe(struct spi_device *spi)
>  {
> -	const struct ads1018_chip_info *info = spi_get_device_match_data(spi);
> +	const struct ads1018_chip_info *info;
>  	struct device *dev = &spi->dev;
>  	struct iio_dev *indio_dev;
>  	struct ads1018 *ads1018;
>  	int ret;
>  
> +	info = spi_get_device_match_data(spi);
> +	if (!info)
> +		return -ENODATA;
> +
>  	indio_dev = devm_iio_device_alloc(dev, sizeof(*ads1018));
>  	if (!indio_dev)
>  		return -ENOMEM;

-- 
Thanks,
 ~ Kurt

[PATCH 8/9] iio: adc: ti-ads131m02: reject devices without match data

[Jiale Yao]

SPI driver_override allows a device to bind to this driver without
matching either the OF or SPI device ID table. In that case,
spi_get_device_match_data() returns NULL.

ads131m_probe() immediately dereferences the returned configuration to
initialize the IIO device, causing a NULL pointer dereference.

Commit 572a00852635 ("iio: dac: ad5686: missing NULL check on match
data") fixed the same driver_override issue in another SPI driver.
Reject devices without match data before using the configuration.

Fixes: 4aa91223fd6c ("iio: adc: Add TI ADS131M0x ADC driver")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/iio/adc/ti-ads131m02.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/iio/adc/ti-ads131m02.c b/drivers/iio/adc/ti-ads131m02.c
index 2f8f75c8216b..7ecfb27fd7ef 100644
--- a/drivers/iio/adc/ti-ads131m02.c
+++ b/drivers/iio/adc/ti-ads131m02.c
@@ -897,6 +897,8 @@ static int ads131m_probe(struct spi_device *spi)
 	indio_dev->info = &ads131m_info;
 
 	config = spi_get_device_match_data(spi);
+	if (!config)
+		return -ENODATA;
 
 	priv->config = config;
 	indio_dev->name = config->name;
-- 
2.34.1

[PATCH 9/9] iio: adc: ti-ads7950: validate SPI match data

[Jiale Yao]

SPI driver_override allows a device to bind to this driver without
matching either the OF or SPI device ID table. In that case,
spi_get_device_match_data() returns NULL.

ti_ads7950_probe() also obtains the IIO device name by dereferencing the
result of spi_get_device_id(), which is NULL on the same override path.
The probe can therefore crash before dereferencing the chip information.

Commit 572a00852635 ("iio: dac: ad5686: missing NULL check on match
data") fixed the same driver_override issue in another SPI driver.
Reject devices without match data and use the always available SPI
modalias for the IIO device name.

Fixes: ff0843ceb1fb ("iio: adc: ti-ads7950: remove chip_info[]")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/iio/adc/ti-ads7950.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/iio/adc/ti-ads7950.c b/drivers/iio/adc/ti-ads7950.c
index d27c1f2885fd..0d5708e0b831 100644
--- a/drivers/iio/adc/ti-ads7950.c
+++ b/drivers/iio/adc/ti-ads7950.c
@@ -527,8 +527,10 @@ static int ti_ads7950_probe(struct spi_device *spi)
 	st->spi = spi;
 
 	info = spi_get_device_match_data(spi);
+	if (!info)
+		return -ENODATA;
 
-	indio_dev->name = spi_get_device_id(spi)->name;
+	indio_dev->name = spi->modalias;
 	indio_dev->modes = INDIO_DIRECT_MODE;
 	indio_dev->channels = info->channels;
 	indio_dev->num_channels = info->num_channels;
-- 
2.34.1