From dcf0e640b553d33512fbcaedb909c32ba9636a64 Mon Sep 17 00:00:00 2001 From: David Heidelberg Date: Thu, 3 Sep 2026 17:21:42 +0200 Subject: [PATCH] mfd: wcd934x: Fix NULL pointer dereference on IRQ probe deferral ddata->dev is only assigned at the end of wcd934x_slim_probe(), but the of_irq_get() error path has passed it to the error print since the driver was added, while it is still NULL. This used to be harmless with dev_err(), which copes with a NULL device and was skipped on -EPROBE_DEFER. Since the switch to dev_err_probe(), a deferred IRQ reaches device_set_deferred_probe_reason() -> dev_driver_string(), which dereferences the NULL pointer and crashes during probe. Use dev, which is already valid at this point. Cc: stable@vger.kernel.org Fixes: 0f1b1b899521 ("mfd: wcd934x: Simplify with dev_err_probe()") Reported-by: Sashiko Link: https://lore.kernel.org/mfd/20260903145651.AC1311F00ACA@smtp.kernel.org/ Signed-off-by: David Heidelberg Link: https://patch.msgid.link/20260903-wcd-dma-v3-1-d3920c6563c4@ixit.cz Signed-off-by: Lee Jones --- drivers/mfd/wcd934x.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/mfd/wcd934x.c b/drivers/mfd/wcd934x.c index 7bea64fc0956..d57796933d87 100644 --- a/drivers/mfd/wcd934x.c +++ b/drivers/mfd/wcd934x.c @@ -229,7 +229,7 @@ static int wcd934x_slim_probe(struct slim_device *sdev) ddata->irq = of_irq_get(np, 0); if (ddata->irq < 0) - return dev_err_probe(ddata->dev, ddata->irq, + return dev_err_probe(dev, ddata->irq, "Failed to get IRQ\n"); ddata->extclk = devm_clk_get(dev, "extclk");