Re: [PATCH v2] input: misc: Convert to DEFINE_SIMPLE_DEV_PM_OPS()
flat view
From: sashiko-bot@kernel.org
Date: 2026-08-21 04:25:49
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: Pre-existing issues: - [High] Out-of-bounds memory access in `pm80x_dev_suspend` and `pm80x_dev_resume` due to using a virtual IRQ number as a bit index. --
--- Patch [1]: [PATCH v2] input: misc: Convert to DEFINE_SIMPLE_DEV_PM_OPS() ---commit 34551f878a1e83fc07284971e8c372f8a5be3f46 Author: Triet Hoang [off-list ref] input: misc: Convert to DEFINE_SIMPLE_DEV_PM_OPS() This commit converts the deprecated SIMPLE_DEV_PM_OPS to DEFINE_SIMPLE_DEV_PM_OPS and uses pm_ptr/pm_sleep_ptr(). This allows dropping the __maybe_unused annotations from the resume callbacks and reduces kernel size when PM options are disabled. [ ... ]
quoted hunk ↗ jump to hunk
diff --git a/include/linux/mfd/88pm80x.h b/include/linux/mfd/88pm80x.h index 551ef1c367d65..be1b0d961e01a 100644 --- a/include/linux/mfd/88pm80x.h +++ b/include/linux/mfd/88pm80x.h@@ -339,7 +339,6 @@ static inline void pm80x_free_irq(struct pm80x_chip *pm80x, int irq, void *data) free_irq(regmap_irq_get_virq(pm80x->irq_data, irq), data); } -#ifdef CONFIG_PM static inline int pm80x_dev_suspend(struct device *dev) { struct platform_device *pdev = to_platform_device(dev);
[Severity: High]
This is a pre-existing issue, but does using the virtual IRQ as a bit
index here lead to out-of-bounds memory accesses?
Looking at the body of pm80x_dev_suspend():
int irq = platform_get_irq(pdev, 0);
if (device_may_wakeup(dev))
set_bit(irq, &chip->wu_flag);
Since platform_get_irq() returns a virtual IRQ number dynamically assigned
by the kernel, can this value exceed the capacity of the unsigned long
wu_flag?
Also, if platform_get_irq() returns a negative error code such as -ENXIO,
would passing it as an unsigned bit index to set_bit() cause a massive
out-of-bounds memory write and corrupt memory?
The same pattern exists in pm80x_dev_resume() with clear_bit().
quoted hunk ↗ jump to hunk
@@ -363,7 +362,6 @@ static inline int pm80x_dev_resume(struct device *dev) return 0; } -#endif
-- Sashiko AI review · https://sashiko.dev/#/patchset/20260821041546.110119-1-triet.hoang.dev@gmail.com?part=1