Re: [PATCH v6 3/3] arm: dts: altera: add Draeger M48 CPU Module

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] arm: dts: out-of-bounds I/O access due to dw-apb-gpio size mismatch
--

commit 3b5d14b4fd8ed90306ed124677b8ae6312b78a2f
Author: Petko Manolov <petko.manolov@konsulko.com>

arm: dts: altera: add Draeger M48 CPU Module

This commit adds a new device tree for the Draeger M48 CPU Module. The module
is built around the Altera SoCFPGA Cyclone V.

> diff --git a/arch/arm/boot/dts/intel/socfpga/socfpga_cyclone5_draeger_m48.dts b/arch/arm/boot/dts/intel/socfpga/socfpga_cyclone5_draeger_m48.dts
> new file mode 100644
> index 0000000000000..dae809c02adb8
> --- /dev/null
> +++ b/arch/arm/boot/dts/intel/socfpga/socfpga_cyclone5_draeger_m48.dts

[ ... ]

> +	soc {
> +		gpio3: gpio@ff202000 {
> +			#address-cells = <1>;
> +			#size-cells = <0>;
> +			compatible = "snps,dw-apb-gpio";
> +			reg = <0xff202000 0x20>;

[Severity: High]
Does this compatible string cause an out-of-bounds I/O read regression during
probe?

The gpio3 node specifies a register window of 0x20 bytes. However, the
snps,dw-apb-gpio driver unconditionally accesses the GPIO_EXT_PORTA register
at offset 0x50 during initialization in dwapb_gpio_add_port() and during
system suspend in dwapb_gpio_suspend().

Accessing offset 0x50 from the 0xff202000 base address falls outside this
allocated 0x20 byte window. On an FPGA memory-mapped bus, accessing unmapped
or unpopulated physical memory can cause a synchronous external abort, leading
to a kernel panic at probe time.

Should this node use a different compatible string, such as altr,pio-1.0,
which fits the exactly 0x20 byte register window?

> +
> +			portd: gpio-controller@0 {
> +				compatible = "snps,dw-apb-gpio-port";
> +				gpio-controller;
> +				#gpio-cells = <2>;
> +				snps,nr-gpios = <2>;
> +				reg = <0>;
> +			};
> +		};
> +
> +		gpio4: gpio@ff202020 {
> +			#address-cells = <1>;
> +			#size-cells = <0>;
> +			compatible = "snps,dw-apb-gpio";
> +			reg = <0xff202020 0x20>;

[Severity: High]
Similarly, does this compatible string cause an out-of-bounds I/O access here?

Because gpio4 is placed immediately after gpio3 and also specifies a 0x20
byte window, the 0x50 offset accessed by the snps,dw-apb-gpio driver falls
outside the bounds of the gpio4 window as well.

> +
> +			porte: gpio-controller@0 {
> +				compatible = "snps,dw-apb-gpio-port";
> +				gpio-controller;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260917163157.1380860-1-petko.manolov@konsulko.com?part=3