[PATCH v4 1/2] nfc: nfcmrvl: set drv_data before registering the nci device
flat view
COOLING5d
From: Shubham Antil <hidden>
Date: 2026-10-06 11:55:44
Also in:
lkml, oe-linux-nfc
Subsystem:
nfc subsystem, the rest · Maintainers:
David Heidelberg, Linus Torvalds
nfcmrvl_nci_uart_open() stores the per-ldisc back-pointer nu->drv_data
only after nfcmrvl_nci_register_dev() has returned. That function
registers the nci device, and a transmit started during registration
reaches the UART write path
nci_uart_write_work() -> nu->ops.tx_start()
== nfcmrvl_nci_uart_tx_start()
which dereferences nu->drv_data:
struct nfcmrvl_private *priv = (struct nfcmrvl_private *)nu->drv_data;
if (priv->ndev->nfc_dev->fw_download_in_progress)
At that point nu->drv_data is still NULL:
BUG: KASAN: null-ptr-deref in nfcmrvl_nci_uart_tx_start+0x2c/0xc0
Workqueue: events nci_uart_write_work
Call Trace:
nfcmrvl_nci_uart_tx_start
nci_uart_write_work
worker_thread
Publish nu->drv_data (and nu->ndev) for the UART phy before
nci_register_device() is called, and clear them again if registration
fails, so that a transmit triggered during registration finds a valid
pointer. The now-redundant assignment in nfcmrvl_nci_uart_open() is
removed.
Fixes: e097dc624f78 ("NFC: nfcmrvl: add UART driver")
Assisted-by: LLM Claude
Signed-off-by: Shubham Antil <redacted>
---
drivers/nfc/nfcmrvl/main.c | 17 +++++++++++++++++
drivers/nfc/nfcmrvl/uart.c | 3 ---
2 files changed, 17 insertions(+), 3 deletions(-)
diff --git a/drivers/nfc/nfcmrvl/main.c b/drivers/nfc/nfcmrvl/main.c
index 6efa83219..8186e86d7 100644
--- a/drivers/nfc/nfcmrvl/main.c
+++ b/drivers/nfc/nfcmrvl/main.c@@ -96,6 +96,7 @@ struct nfcmrvl_private *nfcmrvl_nci_register_dev(enum nfcmrvl_phy phy, const struct nfcmrvl_platform_data *pdata) { struct nfcmrvl_private *priv; + struct nci_uart *nu = NULL; int rc; int headroom; int tailroom;
@@ -110,6 +111,9 @@ struct nfcmrvl_private *nfcmrvl_nci_register_dev(enum nfcmrvl_phy phy, priv->dev = dev; priv->phy = phy; + if (phy == NFCMRVL_PHY_UART) + nu = drv_data; + memcpy(&priv->config, pdata, sizeof(*pdata)); if (!priv->config.reset_gpio) {
@@ -154,9 +158,22 @@ struct nfcmrvl_private *nfcmrvl_nci_register_dev(enum nfcmrvl_phy phy, nci_set_drvdata(priv->ndev, priv); + /* For the UART phy the transmit path reaches the driver through + * nu->drv_data; publish it before nci_register_device() so a transmit + * triggered during registration does not dereference a NULL pointer. + */ + if (nu) { + nu->drv_data = priv; + nu->ndev = priv->ndev; + } + rc = nci_register_device(priv->ndev); if (rc) { nfc_err(dev, "nci_register_device failed %d\n", rc); + if (nu) { + nu->drv_data = NULL; + nu->ndev = NULL; + } goto error_fw_dnld_deinit; }
diff --git a/drivers/nfc/nfcmrvl/uart.c b/drivers/nfc/nfcmrvl/uart.c
index 9aedd1687..421e6dc99 100644
--- a/drivers/nfc/nfcmrvl/uart.c
+++ b/drivers/nfc/nfcmrvl/uart.c@@ -138,9 +138,6 @@ static int nfcmrvl_nci_uart_open(struct nci_uart *nu) priv->support_fw_dnld = true; - nu->drv_data = priv; - nu->ndev = priv->ndev; - return 0; }
--
2.43.0