Re: [PATCH v2 4/5] ARM: dts: rockchip: Add RV1126 I2C5

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Adding I2C5 triggers an out-of-bounds bit shift and register field overflow in the `i2c-rk3x.c` driver, causing invalid GRF writes and potential memory/register corruption.
--

commit c9c38fbbccd8ad672b3147ed331a45ba6a025c0c
Author: Yanan He <grumpycat921013@gmail.com>

ARM: dts: rockchip: Add RV1126 I2C5

This commit adds the device tree node for the I2C5 controller on the
Rockchip RV1126 SoC, including its pinctrl definitions and aliases.
The controller can be used for external peripherals.

> diff --git a/arch/arm/boot/dts/rockchip/rv1126.dtsi b/arch/arm/boot/dts/rockchip/rv1126.dtsi
> index d6e8b63daa420..d0cdc5f742120 100644
> --- a/arch/arm/boot/dts/rockchip/rv1126.dtsi
> +++ b/arch/arm/boot/dts/rockchip/rv1126.dtsi
> @@ -23,6 +23,7 @@ aliases {
>  		i2c0 = &i2c0;
>  		i2c2 = &i2c2;
>  		i2c3 = &i2c3;
> +		i2c5 = &i2c5;

[Severity: High]
This is a pre-existing issue, but adding this I2C5 alias causes a regression
by exposing an out-of-bounds bit shift in the i2c-rk3x.c driver during boot.

When the system boots and probes the i2c5 device, the new i2c5 alias
forces bus_nr to 5. This causes the driver to calculate an invalid GRF
value in drivers/i2c/busses/i2c-rk3x.c:rk3x_i2c_probe():

    value = BIT(27 + bus_nr) | BIT(11 + bus_nr);

For bus_nr = 5, this evaluates to BIT(32) | BIT(16). Since the RV1126
is a 32-bit ARM Cortex-A7 platform, BIT(32) results in undefined behavior.

Furthermore, BIT(16) acts as the write mask for bit 0 of the 32-bit PMUGRF
register, which means this will spuriously overwrite bit 0 instead of
setting the correct configuration for I2C5, potentially corrupting an
unrelated SoC hardware state.

Should the i2c-rk3x.c driver be fixed to handle bus_nr = 5 before exposing
this I2C5 node in the device tree?

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260706-rv1126-alientek-dlrv1126-v2-0-ff3176ca362b@gmail.com?part=4