Re: [PATCH v4 1/3] dt-bindings: hwmon: Document SMSC EMC1402/1403/1404/1428

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Schema Constraint Bypass via incorrect `items` nesting for `reg` property bounds
--

--- Patch [1]: [PATCH v4 1/3] dt-bindings: hwmon: Document SMSC EMC1402/1403/1404/1428 ---
commit 370ec6fbb759eebe7152f9544892c617f0745163
Author: Svyatoslav Ryhel <clamor95@gmail.com>

dt-bindings: hwmon: Document SMSC EMC1402/1403/1404/1428

This commit documents the basic hardware layout of SMSC (now Microchip)
EMC1402/1403/1404/1428 thermal sensors and introduces a new YAML device tree
binding schema.

> diff --git a/Documentation/devicetree/bindings/hwmon/smsc,emc1403.yaml b/Documentation/devicetree/bindings/hwmon/smsc,emc1403.yaml
> new file mode 100644
> index 0000000000000..d7873a37c3295
> --- /dev/null
> +++ b/Documentation/devicetree/bindings/hwmon/smsc,emc1403.yaml
> @@ -0,0 +1,203 @@

[ ... ]

> +patternProperties:
> +  "^channel@([0-7])$":
> +    type: object
> +    description: Represents channels of the device and their specific configuration.
> +
> +    properties:
> +      reg:
> +        description: The channel number. 0 is local channel, 1-7 are remote channels.
> +        items:
> +          minimum: 0
> +          maximum: 7

[Severity: Medium]
Does nesting the minimum/maximum bounds inside items for the reg property bypass
dt-schema validation?

Since dt-schema decodes reg into an array of regions, numeric bounds placed
under items like this apply to the array element itself and are ignored.
Could these bounds be specified differently so they are correctly enforced
during make dtbs_check?

[ ... ]

> +allOf:
> +  - if:
> +      properties:
> +        compatible:
> +          contains:
> +            enum:
> +              - smsc,emc1402
> +    then:
> +      patternProperties:
> +        "^channel@([0-7])$":
> +          properties:
> +            reg:
> +              items:
> +                maximum: 1

[Severity: Medium]
Will this stricter bound also be ignored during schema validation due to the
items nesting? 

This could allow an invalid device tree, such as one defining channel@5 for
smsc,emc1402, to silently pass validation checks.

[ ... ]

> +  - if:
> +      properties:
> +        compatible:
> +          contains:
> +            enum:
> +              - smsc,emc1403
> +    then:
> +      patternProperties:
> +        "^channel@([0-7])$":
> +          properties:
> +            reg:
> +              items:
> +                maximum: 2

[Severity: Medium]
Does this maximum bound for smsc,emc1403 suffer from the same nesting issue?

[ ... ]

> +  - if:
> +      properties:
> +        compatible:
> +          contains:
> +            enum:
> +              - smsc,emc1404
> +    then:
> +      patternProperties:
> +        "^channel@([0-7])$":
> +          properties:
> +            reg:
> +              items:
> +                maximum: 3

[Severity: Medium]
Does the maximum bound for smsc,emc1404 also need to be adjusted to avoid
being ignored by dt-schema?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260731113007.145322-1-clamor95@gmail.com?part=1