Re: [PATCH v3 2/2] memory: mtk-smi: Add mt8189 support

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] Implicitly sized array mtk_smi_larb_mt8189_ostd may be accessed out of bounds for LARB IDs >= 21.
- [High] Explicit 0x0 values in mtk_smi_larb_mt8189_ostd cause premature loop termination.
--

commit 34a5ce3e55a813425dbbd1c5607a1ed17951862b
Author: Zhengnan Chen <zhengnan.chen@mediatek.com>

memory: mtk-smi: Add mt8189 support
    
Add the necessary platform data and ostdl setting to enable support
for mt8189 smi.

> diff --git a/drivers/memory/mtk-smi.c b/drivers/memory/mtk-smi.c
> index aaeba8ab211e9..f2d5462af6817 100644
> --- a/drivers/memory/mtk-smi.c
> +++ b/drivers/memory/mtk-smi.c
> @@ -401,6 +401,30 @@ static const u8 mtk_smi_larb_mt8188_ostd[][SMI_LARB_PORT_NR_MAX] = {
>  	[25] = {0x01},
>  };
>  
> +static const u8 mtk_smi_larb_mt8189_ostd[][SMI_LARB_PORT_NR_MAX] = {
> +	[0] = {0x8, 0x20, 0x20, 0x20, 0x20, 0x20, 0x10, 0x0,},
> +	[1] = {0x8, 0x20, 0x20, 0x20, 0x20, 0x20, 0x10, 0x0,},
> +	[2] = {0x7, 0x7, 0x4, 0x4, 0x0, 0x0, 0x2, 0x2, 0x7, 0x7, 0x0,},

[Severity: High]
Does the inclusion of 0x0 values in this array cause valid hardware ports
to be left uninitialized?

The initialization loop in mtk_smi_larb_config_port_gen2_general() treats
a 0 value as the end of the array:

    for (i = 0; i < SMI_LARB_PORT_NR_MAX && larbostd && !!larbostd[i]; i++)
        writel_relaxed(larbostd[i], larb->base + SMI_LARB_OSTDL_PORTx(i));

When it encounters the 0x0 at the fifth element of LARB 2, the loop will
terminate immediately, ignoring the remaining configurations like 0x2 and 0x7.

[ ... ]

> +	[19] = {0x2, 0x1, 0x3, 0x1,},
> +	[20] = {0x7, 0x7, 0x3, 0x3, 0x1, 0x1,},
> +};

[Severity: High]
Will this implicitly sized array lead to an out-of-bounds read if the
device tree probes a LARB with an ID of 21 or 22?

Because the largest index provided is 20, the array has exactly 21 elements.
However, mtk_smi_larb_config_port_gen2_general() blindly accesses the array
using the LARB ID:

    const u8 *larbostd = larb->larb_gen->ostd ?
                         larb->larb_gen->ostd[larb->larbid] : NULL;

If MT8189 defines LARB IDs up to at least 22, accessing index 21 or 22 will
read past the end of the array and could write garbage data from read-only
memory into hardware limit registers.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260701074533.175803-1-Congcong.Yao@mediatek.com?part=2