Skip to content

drivers/sensor/lsm6dsl: assertion/UB during interrupt handling #29721

@ygubin

Description

@ygubin

Describe the bug

Dereferencing dev parameter in

static void lsm6dsl_gpio_callback(const struct device *dev,
to dev->config and then to config->irq_pin is irrelevant, as dev points to GPIO port, not LSM6DSL device.

To Reproduce
Run any LSM6DSL data sampling code with trigger enabled and CONFIG_ASSERT=y (and be lucky).

Impact
Kernel panic / UB

Logs and console output

ASSERTION FAIL [(cfg->port_pin_mask & (gpio_port_pins_t)(1UL << (pin))) != 0U] @ WEST_TOPDIR/zephyr/include/drivers/gpio.h:510
        Unsupported pin
...
[00:03:10.552,246] <err> os: >>> ZEPHYR FATAL ERROR 4: Kernel panic on CPU 0
[00:03:10.552,246] <err> os: Fault during interrupt handling

Suggested Fix

In lsm6dsl_gpio_callback(), irq_pin should be obtained from drv_data, not dev parameter, so change

	const struct lsm6dsl_config *config = dev->config;
	struct lsm6dsl_data *drv_data =
		CONTAINER_OF(cb, struct lsm6dsl_data, gpio_cb);

to

	struct lsm6dsl_data *drv_data =
		CONTAINER_OF(cb, struct lsm6dsl_data, gpio_cb);
	const struct lsm6dsl_config *config = drv_data->dev->config;

Metadata

Metadata

Assignees

Labels

area: SensorsSensorsbugThe issue is a bug, or the PR is fixing a bugpriority: lowLow impact/importance bug

Type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions