Re: [PATCH 16/26] sh: maple: remove unused driver field from struct maple_device
From: sashiko-bot@kernel.org
Date: 2026-07-04 06:09:17
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: Pre-existing issues: - [High] vmu_can_unload() crashes on hot-unplug if the driver fails to probe or is unbound. -- commit 03c570da1dc6a7b4d15fe87da8cdddba6169830d Author: Dmitry Torokhov [off-list ref] sh: maple: remove unused driver field from struct maple_device The commit removes the unused driver field from struct maple_device since all readers and writers of this field have been eliminated from the maple bus code.
quoted hunk ↗ jump to hunk
diff --git a/include/linux/maple.h b/include/linux/maple.h index 22f2930251edc..90c26c86e3ede 100644 --- a/include/linux/maple.h +++ b/include/linux/maple.h@@ -64,7 +64,6 @@ struct maple_devinfo { }; struct maple_device { - struct maple_driver *driver; struct mapleq *mq; void (*callback) (struct mapleq * mq); void (*fileerr_handler)(struct maple_device *mdev, void *recvbuf);
[Severity: High]
This is a pre-existing issue, but while reviewing changes to struct
maple_device, I noticed a potential null pointer dereference in the vmu-flash
driver.
In drivers/mtd/maps/vmu-flash.c:probe_maple_vmu(), the can_unload callback is
set:
probe_maple_vmu() {
...
mdev->can_unload = vmu_can_unload;
...
}
If probe fails during device connection or if the driver is unbound via sysfs,
the driver core clears the device's driver data to NULL. However,
mdev->can_unload remains pointing to vmu_can_unload.
If the device is subsequently hot-unplugged, the maple bus core calls
maple_response_none() -> mdev->can_unload(mdev), which dereferences the
driver data without checking if it is NULL:
vmu_can_unload() {
...
card = maple_get_drvdata(mdev);
for (x = 0; x < card->partitions; x++) {
...
}
Could this cause a system crash on hot-unplug? Should mdev->can_unload be
cleared on the probe error path and during unbind?
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260703-b4-maple-cleanup-v1-0-41e424964da5@gmail.com?part=16