Re: [PATCH v7 10/18] ASoC: rsnd: ssiu: Add RZ/G3E BUSIF support

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Out-of-bounds array access and undefined bit shifts due to unvalidated device tree node count.
--

commit cd52ab06a4f096e9c70d4a69a4f934f03c3b0b19
Author: John Madieu <john.madieu.xa@bp.renesas.com>

ASoC: rsnd: ssiu: Add RZ/G3E BUSIF support

This commit adds support for the SSIU on the Renesas RZ/G3E SoC, which has a
different BUSIF layout compared to earlier generations. It also introduces
a capability flag to parametrize the BUSIF error-status loops, as the
RZ/G3E only has two pairs of error-status registers.

> diff --git a/sound/soc/renesas/rcar/ssiu.c b/sound/soc/renesas/rcar/ssiu.c
> index 2b922ead62d09..8d4ce9d35e9e7 100644
> --- a/sound/soc/renesas/rcar/ssiu.c
> +++ b/sound/soc/renesas/rcar/ssiu.c
[ ... ]
> @@ -559,6 +575,9 @@ int rsnd_ssiu_probe(struct rsnd_priv *priv)
>  		} else if (rsnd_is_gen4(priv)) {
>  			list	= gen4_id;
>  			nr	= ARRAY_SIZE(gen4_id);
> +		} else if (rsnd_is_rzg3e(priv)) {
> +			list	= rzg3e_id;
> +			nr	= ARRAY_SIZE(rzg3e_id);
>  		} else {
>  			dev_err(dev, "unknown SSIU\n");
>  			return -ENODEV;

[Severity: High]
This is a pre-existing issue, but can an excessive number of SSIU nodes
from the Device Tree cause out-of-bounds array accesses and undefined
bit shifts?

In rsnd_ssiu_probe(), priv->ssiu_nr is initialized to the total number of
SSIU nodes from the DT without validating against the maximum supported bus
interface index.

During initialization, ssiu->id_sub is computed as i - list[ssiu->id].
If the DT provides too many SSIU nodes (e.g., >= 33 for RZ/G3E), id_sub
will become 8 or greater.

This out-of-bounds id_sub value is later used in rsnd_ssiu_get_status() to
return &ssiu->busif_status[busif], which can lead to kernel memory corruption
when the caller dereferences and modifies it.

Additionally, rsnd_ssiu_start_gen2() uses busif as a shift amount via
1 << (busif * 4), which can result in undefined behavior when shifting a
32-bit integer by 32 or more.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260525110230.4014435-1-john.madieu.xa@bp.renesas.com?part=10