From d92eae0f73132dd8694e01bfa2b63d347dd5947a Mon Sep 17 00:00:00 2001 From: wormuz <3341798+wormuz@users.noreply.github.com> Date: Sat, 15 Aug 2026 18:27:44 +0300 Subject: [PATCH] input: joystick: adc-joystick: guard against NULL active_scan_mask adc_joystick_get_chan_offsets() dereferences indio_dev->active_scan_mask without checking it. The mask is only allocated once the IIO buffer is enabled; when the joystick probes against a driver whose buffer setup has not run yet (or was torn down), the pointer is NULL and test_bit() faults. Observed as a probe-time oops on JZ4770 (RG350P handheld) with the ingenic-adc driver, where adc-joystick can bind before the IIO buffer exists. Treat a NULL mask the same as a channel without a valid scan index: mark the offset as -1 and fall back to per-channel reads. Signed-off-by: wormuz <3341798+wormuz@users.noreply.github.com> --- drivers/input/joystick/adc-joystick.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/input/joystick/adc-joystick.c b/drivers/input/joystick/adc-joystick.c index b6b46631ec27af..af7d17eb86ae85 100644 --- a/drivers/input/joystick/adc-joystick.c +++ b/drivers/input/joystick/adc-joystick.c @@ -146,7 +146,8 @@ static int *adc_joystick_get_chan_offsets(struct iio_channel *chans, int count) ch = chans[idx].channel; si = ch->scan_index; - if (si < 0 || !test_bit(si, indio_dev->active_scan_mask)) { + if (si < 0 || !indio_dev->active_scan_mask || + !test_bit(si, indio_dev->active_scan_mask)) { offsets[idx] = -1; continue; }