Re: [PATCH v3 07/11] mfd: lm3533: Set DMA mask

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Out-of-bounds write in `lm3533_device_init` when processing child nodes with multiple compatible strings.
--

commit d3029bf43673fb0132c36c4614c542e46d64f393
Author: Svyatoslav Ryhel <clamor95@gmail.com>

mfd: lm3533: Set DMA mask

This commit sets the coherent_dma_mask and dma_mask to 0 during the i2c
probe. This resolves a warning about missing DMA mask assignments, as
neither the core nor child devices use DMA.

> diff --git a/drivers/mfd/lm3533-core.c b/drivers/mfd/lm3533-core.c
> index 4dca5641b7744..b597d338d6f78 100644
> --- a/drivers/mfd/lm3533-core.c
> +++ b/drivers/mfd/lm3533-core.c

[ ... ]

> @@ -491,6 +491,10 @@ static int lm3533_i2c_probe(struct i2c_client *i2c)
>  				   LM3533_BOOST_FREQ_MAX);
>  	lm3533->boost_freq = lm3533->boost_freq / (500 * KILO) - 1;
>  
> +	/* LM3533 and child devices do not use DMA */
> +	i2c->dev.coherent_dma_mask = 0;
> +	i2c->dev.dma_mask = &i2c->dev.coherent_dma_mask;
> +
>  	return lm3533_device_init(lm3533);

[Severity: High]
This is a pre-existing issue, but can the child node iteration in
lm3533_device_init() overflow the lm3533_devices array?

The lm3533_devices array is allocated based on nchilds. Inside the
iteration loop, independent if statements check the compatible strings:

drivers/mfd/lm3533-core.c:lm3533_device_init() {
    ...
    if (fwnode_device_is_compatible(child, "ti,lm3533-als")) {
        lm3533_devices[count].name = "lm3533-als";
        ...
        count++;
    }

    if (fwnode_device_is_compatible(child, "ti,lm3533-backlight")) {
        ...
        lm3533_devices[count].name = "lm3533-backlight";
        ...
        count++;
    }
    ...
}

Since the bounds check if (count >= nchilds) is only performed once at
the beginning of the loop, a single child node containing multiple matching
compatible strings (e.g., "ti,lm3533-als" and "ti,lm3533-backlight") would
increment count multiple times per iteration.

Could this bypass the bounds check and cause an out-of-bounds write?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260601151831.76350-1-clamor95@gmail.com?part=7