From 17dbb6938d3ab444cd6be1c95506450595a8800d Mon Sep 17 00:00:00 2001 From: Manush Prajwal Date: Sun, 6 Sep 2026 17:11:58 +0530 Subject: [PATCH] pwm: lp3943: fix NULL pointer dereference for an unconfigured channel MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit lp3943_pwm_probe() unconditionally registers a pwmchip with LP3943_NUM_PWMS(2) hwpwm channels, but lp3943_pwm_parse_dt() only populates pdata->pwms[i] for the channels whose ti,pwm0/ti,pwm1 property is actually present in the devicetree (the binding explicitly allows each PWM generator to drive zero or more outputs, and lp3943_pwm_parse_dt() only fails outright with -ENODATA if *neither* property is present). A devicetree that configures only one of the two channels leaves pdata->pwms[] NULL for the other. lp3943_pwm_request_map() dereferences pdata->pwms[hwpwm] with no NULL check: pwm_map->output = pdata->pwms[hwpwm]->output; pwm_map->num_outputs = pdata->pwms[hwpwm]->num_outputs; so requesting the unconfigured channel (e.g. exporting it from sysfs) crashes with a NULL pointer dereference instead of failing cleanly. Return -ENODEV from lp3943_pwm_request_map() when the channel was never configured, before the pointer is dereferenced. The caller, lp3943_pwm_request(), already propagates an ERR_PTR return correctly (it does so today for the existing -EBUSY case). Reported-by: Sashiko AI review Closes: https://sashiko.dev/#/patchset/6a9d4c6b.79b5ea6e.147aa1.5883@mx.google.com?part=1 Signed-off-by: Manush Prajwal Link: https://patch.msgid.link/6a9d5187.d63de05c.175391.a17c@mx.google.com Fixes: af66b3c0934e ("pwm: Add LP3943 PWM driver") Signed-off-by: Uwe Kleine-König --- drivers/pwm/pwm-lp3943.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/pwm/pwm-lp3943.c b/drivers/pwm/pwm-lp3943.c index 10537e74be28..e42af9007546 100644 --- a/drivers/pwm/pwm-lp3943.c +++ b/drivers/pwm/pwm-lp3943.c @@ -38,6 +38,9 @@ lp3943_pwm_request_map(struct lp3943_pwm *lp3943_pwm, int hwpwm) struct lp3943_pwm_map *pwm_map = &lp3943_pwm->pwm_map[hwpwm]; int i, offset; + if (!pdata->pwms[hwpwm]) + return ERR_PTR(-ENODEV); + pwm_map->output = pdata->pwms[hwpwm]->output; pwm_map->num_outputs = pdata->pwms[hwpwm]->num_outputs;