Thank you for your contribution! Sashiko AI review found 3 potential issue(s) to consider: - [High] regulator: UAF and memory leak due to shared static array in of_regulator_match - [Medium] video: backlight: functional regression when led-max-microamp is missing - [Low] video: backlight: incompatible pointer type in device_property_read_u32 --
commit 084e352aa2d7fee86a0e56df75d5d10cdd400379 Author: Svyatoslav Ryhel <[email protected]> Subject: mfd: aat2870: Convert to use OF bindings This patch converts the AAT2870 driver to use OF bindings, replacing the MFD registration API with of_platform_populate() and adding dedicated compatible strings for its sub-devices. It also updates the regulator and backlight child drivers to parse properties directly from the device tree and removes redundant platform data. In drivers/regulator/aat2870-regulator.c around line 133, there is a static array defined for aat2870_regulator_matches. Later in aat2870_regulator_probe() around line 171, this shared static array is passed directly to of_regulator_match(). [Severity: High] Could passing this shared static array to of_regulator_match() cause a use-after-free or memory leak if multiple AAT2870 devices are probed? of_regulator_match() actively mutates the passed array to store device nodes and binds its lifetime to the device via devres. If a second device probes, it would overwrite the array, leaking the first device's nodes. Upon unbind, devres would drop references to whatever nodes are currently in the array, potentially causing a double-free or use-after-free for the remaining references. In drivers/video/backlight/aat2870_bl.c around line 141 in aat2870_bl_probe(), the code calls device_property_read_u32() to read led-max-microamp into aat2870_bl->max_current. [Severity: Low] Does this trigger an incompatible pointer types compiler warning? aat2870_bl->max_current is declared as an int, but device_property_read_u32() expects a u32 pointer. Also in drivers/video/backlight/aat2870_bl.c around line 141, the max_current value is read via device_property_read_u32() without prior initialization. [Severity: Medium] Will the backlight permanently disable itself if the led-max-microamp property is omitted from the device tree? If the property is missing, max_current remains 0. Passing 0 into clamp(0, 450, 27900) returns 450. When 450 is divided by AAT2870_CURRENT_STEP (which is 900), the result evaluates to 0. Since the brightness calculation multiplies by max_current, this appears to leave the backlight permanently disabled under these conditions. -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=2
