Re: [PATCH 1/2] gpio: davinci: use controller-specific MMIO for BINTEN

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found no new issues
in this patch, but noticed 1 related pre-existing issue it does not
introduce:
- [Critical] gpio: davinci: out-of-bounds array access in
  davinci_gpio_probe() [1]
--

commit 28eb7330290061761743897d388da288ba076340
Author: Sahaj Chaudhari <sahaj123.sc@gmail.com>

gpio: davinci: use controller-specific MMIO for BINTEN

This commit makes gpio_base local to davinci_gpio_probe() and derives the
BINTEN register address from the controller's mapped bank rather than a
file-global variable.

> diff --git a/drivers/gpio/gpio-davinci.c b/drivers/gpio/gpio-davinci.c
> index f7c3b644e0e39..caeecfc3df204 100644
> --- a/drivers/gpio/gpio-davinci.c
> +++ b/drivers/gpio/gpio-davinci.c

[ ... ]

> @@ -168,6 +167,7 @@ static int davinci_gpio_probe(struct platform_device *pdev)
>  	unsigned int ngpio, nbank, nirq, gpio_unbanked;
>  	struct davinci_gpio_controller *chips;
>  	struct device *dev = &pdev->dev;
> +	void __iomem *gpio_base;
>  
>  	/*
>  	 * The gpio banks conceptually expose a segmented bitmap,

[Severity: Critical]
This problem wasn't introduced by this patch, but can a large ti,ngpio
value overflow offset_array[] and chips->regs[] [1]?

When ti,davinci-gpio-unbanked is set, nirq is taken from gpio_unbanked
rather than DIV_ROUND_UP(ngpio, 16), so the nirq > MAX_INT_PER_BANK check
never bounds ngpio:

drivers/gpio/gpio-davinci.c:davinci_gpio_probe() {
	...
	if (gpio_unbanked)
		nirq = gpio_unbanked;
	else
		nirq = DIV_ROUND_UP(ngpio, 16);

	if (nirq > MAX_INT_PER_BANK) {
		dev_err(dev, "Too many IRQs!\n");
		return -EINVAL;
	}
	...
	nbank = DIV_ROUND_UP(ngpio, 32);
	for (bank = 0; bank < nbank; bank++)
		chips->regs[bank] = gpio_base + offset_array[bank];
	...
}

If ngpio exceeds 160, nbank exceeds 5 (MAX_REGS_BANKS), and the loop reads
past the end of offset_array[] and writes out-of-bounds into chips->regs[],
corrupting memory in struct davinci_gpio_controller.

[1] https://sashiko.dev/#/bug/linux-59cf1b6f-2241-467c-a82a-93a3d1bf5d16

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261109194910.2282454-1-sahaj123.sc@gmail.com?part=1