[PATCH] counter: microchip-tcb-capture: Fix DT channel validation

[PATCH] counter: microchip-tcb-capture: Fix DT channel validation

[Babanpreet Singh]

mchp_tc_probe() reads the devicetree "reg" cell - a u32, per the API
contract of of_property_read_u32_index() - into a signed int, so the
bounds check "channel > 2" fails to reject cell values at or above
0x80000000: reinterpreted as a negative int, they compare below 2 and
pass validation.

A malformed devicetree can therefore drive a negative channel into the
ATMEL_TC_REG() offset arithmetic, making the driver access syscon
regmap offsets outside the TC block's register window, and into the
"t%d_clk" clock-name formatting, where it truncates clk_name (sized
for "t0_clk".."t2_clk").

Declare channel as u32, matching the API contract; the unsigned
comparison then rejects everything except channels 0..2. Adjust the
format specifier to %u accordingly, which also resolves the W=1
warning that exposed the gap:

  microchip-tcb-capture.c:520:56: warning: '%d' directive output may
    be truncated writing between 1 and 11 bytes into a region of size
    6 [-Wformat-truncation=]
  note: directive argument in the range [-2147483648, 2]

No behavior change for well-formed devicetrees: channels 0..2 take
identical paths before and after.

Fixes: 106b104137fd ("counter: Add microchip TCB capture counter")
Assisted-by: Claude:claude-fable-5 [gcc W=1]
Signed-off-by: Babanpreet Singh <bbnpreetsingh@gmail.com>
---
Note: struct mchp_tc_data's channel[2] member stays int — after this
fix it can only ever hold 0..2, so converting it (and the QDEC-mode
comparisons reading it) would be churn beyond the minimal fix. Happy
to do that conversion as a follow-up if preferred.

 drivers/counter/microchip-tcb-capture.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/counter/microchip-tcb-capture.c b/drivers/counter/microchip-tcb-capture.c
index 19d457ae4c3b..e53a8390756b 100644
--- a/drivers/counter/microchip-tcb-capture.c
+++ b/drivers/counter/microchip-tcb-capture.c
@@ -483,7 +483,7 @@ static int mchp_tc_probe(struct platform_device *pdev)
 	char clk_name[7];
 	struct regmap *regmap;
 	struct clk *clk[3];
-	int channel;
+	u32 channel;
 	int ret, i;
 
 	counter = devm_counter_alloc(&pdev->dev, sizeof(*priv));
@@ -517,7 +517,7 @@ static int mchp_tc_probe(struct platform_device *pdev)
 
 		priv->channel[i] = channel;
 
-		snprintf(clk_name, sizeof(clk_name), "t%d_clk", channel);
+		snprintf(clk_name, sizeof(clk_name), "t%u_clk", channel);
 
 		clk[i] = of_clk_get_by_name(np->parent, clk_name);
 		if (IS_ERR(clk[i])) {

base-commit: 3b029c035b34bbc693405ddf759f0e9b920c27f1
-- 
2.43.0

Re: [PATCH] counter: microchip-tcb-capture: Fix DT channel validation

[Babanpreet Singh]

Hi William,

A gentle ping on this one - it has been a couple of weeks without any
comments, and I could not find a competing fix on the list or in
linux-next.

No urgency from my side; I mainly want to check the patch has not simply
been missed. Happy to respin if you would prefer a different shape, or to
drop it if you would rather leave the validation as it is.

For convenience:
https://lore.kernel.org/all/20260714042910.7-1-bbnpreetsingh@gmail.com/

Thanks,
Baban

Re: [PATCH] counter: microchip-tcb-capture: Fix DT channel validation

[Joshua Crofts]

On Tue, 14 Jul 2026 04:29:10 +0000
Babanpreet Singh <bbnpreetsingh@gmail.com> wrote:

> mchp_tc_probe() reads the devicetree "reg" cell - a u32, per the API
> contract of of_property_read_u32_index() - into a signed int, so the
> bounds check "channel > 2" fails to reject cell values at or above
> 0x80000000: reinterpreted as a negative int, they compare below 2 and
> pass validation.
> 
> A malformed devicetree can therefore drive a negative channel into the
> ATMEL_TC_REG() offset arithmetic, making the driver access syscon
> regmap offsets outside the TC block's register window, and into the
> "t%d_clk" clock-name formatting, where it truncates clk_name (sized
> for "t0_clk".."t2_clk").
> 
> Declare channel as u32, matching the API contract; the unsigned
> comparison then rejects everything except channels 0..2. Adjust the
> format specifier to %u accordingly, which also resolves the W=1
> warning that exposed the gap:
> 
>   microchip-tcb-capture.c:520:56: warning: '%d' directive output may
>     be truncated writing between 1 and 11 bytes into a region of size
>     6 [-Wformat-truncation=]
>   note: directive argument in the range [-2147483648, 2]
> 
> No behavior change for well-formed devicetrees: channels 0..2 take
> identical paths before and after.
> 
> Fixes: 106b104137fd ("counter: Add microchip TCB capture counter")
> Assisted-by: Claude:claude-fable-5 [gcc W=1]
> Signed-off-by: Babanpreet Singh <bbnpreetsingh@gmail.com>
> ---
> Note: struct mchp_tc_data's channel[2] member stays int — after this
> fix it can only ever hold 0..2, so converting it (and the QDEC-mode
> comparisons reading it) would be churn beyond the minimal fix. Happy
> to do that conversion as a follow-up if preferred.
> 
>  drivers/counter/microchip-tcb-capture.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/counter/microchip-tcb-capture.c b/drivers/counter/microchip-tcb-capture.c
> index 19d457ae4c3b..e53a8390756b 100644
> --- a/drivers/counter/microchip-tcb-capture.c
> +++ b/drivers/counter/microchip-tcb-capture.c
> @@ -483,7 +483,7 @@ static int mchp_tc_probe(struct platform_device *pdev)
>  	char clk_name[7];
>  	struct regmap *regmap;
>  	struct clk *clk[3];
> -	int channel;
> +	u32 channel;
>  	int ret, i;
>  
>  	counter = devm_counter_alloc(&pdev->dev, sizeof(*priv));
> @@ -517,7 +517,7 @@ static int mchp_tc_probe(struct platform_device *pdev)
>  
>  		priv->channel[i] = channel;
>  
> -		snprintf(clk_name, sizeof(clk_name), "t%d_clk", channel);
> +		snprintf(clk_name, sizeof(clk_name), "t%u_clk", channel);
>  
>  		clk[i] = of_clk_get_by_name(np->parent, clk_name);
>  		if (IS_ERR(clk[i])) {
> 
> base-commit: 3b029c035b34bbc693405ddf759f0e9b920c27f1

Makes sense.

Reviewed-by: Joshua Crofts <joshua.crofts1@gmail.com>

-- 
Kind regards,
Joshua Crofts