Re: [PATCH 01/10] pinctrl: sunxi: Fix out-of-bounds irq_bank index when first bank has no IRQs

[Lee Jones <lee@kernel.org>]

On Thu, 05 Nov 2026, Andre Przywara wrote:

> Hi Lee,
> 
> On 11/3/26 22:29, Lee Jones wrote:
> > In prepare_function_table(), irq_bank and last_bank are initialised to 0
> > and last_bank is updated on every bank regardless of whether it supports
> > interrupts.  On SoCs where bank 0 (PA) has no pins or does not support
> > interrupts (such as Allwinner A523 and A733), the first IRQ-capable bank
> > has bank > 0, which causes irq_bank to be incremented to 1 instead of
> > starting at 0.  As a result, the final IRQ bank receives irq_bank equal
> > to desc->irq_banks and writes out-of-bounds past pctl->irq_array during
> > sunxi_pinctrl_build_state().
> > 
> > Initialise irq_bank and last_bank to -1 and only update last_bank when
> > processing an IRQ-capable bank so that irq_bank always starts at 0 and
> > increments sequentially across IRQ-capable banks.
> 
> Can we please hold back this patch for now? There are more issues around the
> IRQ bank usage on recent Allwinner SoCs, patches for which [1] are on the
> list. They should solve the out-of-bounds access, I think, though we might
> want to add explicit checks, maybe.
> 
> But taking just this patch here would torpedo the efforts in fixing the
> correctness issues that we see.

Sure, no problem.

-- 
Lee Jones