Re: [PATCH v4 2/2] memory: mtk-smi: Add MT8189 support

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Out-of-bounds array read in mtk_smi_larb_config_port_gen2_general() when accessing mtk_smi_larb_mt8189_ostd.
--

commit 799e65b6a88840741f8de7319f0b544e0e41e3de
Author: Zhengnan Chen <zhengnan.chen@mediatek.com>

memory: mtk-smi: Add MT8189 support
    
Add the MT8189 SMI common, sub-common and LARB platform data.
    
Enable the GALS clock for the MT8189 SMI sub-common.

> diff --git a/drivers/memory/mtk-smi.c b/drivers/memory/mtk-smi.c
> index aaeba8ab211e9..8c4606cbd73d9 100644
> --- a/drivers/memory/mtk-smi.c
> +++ b/drivers/memory/mtk-smi.c
> @@ -401,6 +401,30 @@ static const u8 mtk_smi_larb_mt8188_ostd[][SMI_LARB_PORT_NR_MAX] = {
>  	[25] = {0x01},
>  };
>  
> +static const u8 mtk_smi_larb_mt8189_ostd[][SMI_LARB_PORT_NR_MAX] = {
> +	[0] = {0x8, 0x20, 0x20, 0x20, 0x20, 0x20, 0x10,},
> +	[1] = {0x8, 0x20, 0x20, 0x20, 0x20, 0x20, 0x10,},
> +	[2] = {0x7, 0x7, 0x4, 0x4, 0x1, 0x1, 0x2, 0x2, 0x7, 0x7,},
> +	[4] = {0x2f, 0x1e, 0x9, 0x1, 0x1, 0x1, 0x1, 0x2, 0x2, 0x5, 0x1, 0x17,},
> +	[7] = {0x20, 0x2, 0x1, 0x1, 0x1, 0x4, 0x2, 0x1, 0x1, 0x2, 0x3, 0x2,
> +	       0xa, 0xf, 0x4, 0x6, 0x5, 0x1,},
> +	[9] = {0x6, 0x3, 0xc, 0x6, 0x1, 0x4, 0x3, 0x1, 0x2, 0x4, 0x5, 0x2,
> +	       0x4, 0x2, 0x3, 0xb, 0x1, 0x4, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1,
> +	       0x1, 0x1,},
> +	[11] = {0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1,
> +		0x1, 0x1, 0x1, 0xb, 0x1, 0x4, 0x6, 0x5, 0x6, 0x1, 0x5, 0x2,
> +		0x9, 0x5,},
> +	[13] = {0x2, 0x8, 0x8, 0x8, 0x4, 0x4, 0x4, 0x4, 0x4, 0xe, 0x4, 0x1,
> +		0x6, 0x6, 0x2,},
> +	[14] = {0x1, 0x1, 0x1, 0x20, 0xe, 0x4, 0x8, 0x8, 0x6, 0x4,},
> +	[16] = {0x1e, 0xc, 0x2, 0x8, 0xe, 0x2, 0x1e, 0x10, 0x4, 0x2, 0x2, 0x2,
> +		0x2, 0x2, 0x4, 0x2, 0x4,},
> +	[17] = {0x1e, 0xc, 0x2, 0x8, 0xe, 0x2, 0x1e, 0x10, 0x4, 0x2, 0x2, 0x2,
> +		0x2, 0x2, 0x4, 0x2, 0x4,},
> +	[19] = {0x2, 0x1, 0x3, 0x1,},
> +	[20] = {0x7, 0x7, 0x3, 0x3, 0x1, 0x1,},
> +};

[Severity: High]
This is a pre-existing issue, but could this array sizing lead to an
out-of-bounds read and hardware corruption?

Since the array is implicitly sized to 21 elements, what happens if an MT8189
device tree supplies a LARB ID greater than 20? 

The driver appears to bound-check larbid against MTK_LARB_NR_MAX (32)
during probe, which allows an ID up to 31. If larbid is between 21 and 31,
the pre-existing array access in mtk_smi_larb_config_port_gen2_general():

    const u8 *larbostd = larb->larb_gen->ostd ? larb->larb_gen->ostd[larb->larbid] : NULL;

would read out-of-bounds. This garbage pointer would then be dereferenced and
written to the hardware registers later in the same function:

    for (i = 0; i < SMI_LARB_PORT_NR_MAX && larbostd && !!larbostd[i]; i++)
        writel_relaxed(larbostd[i], larb->base + SMI_LARB_OSTDL_PORTx(i));

Does mtk_smi_larb_mt8189_ostd need an explicit size of [MTK_LARB_NR_MAX]
to prevent this?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260831-8189-smi-support-v4-0-8ae66dd3eeed@mediatek.com?part=2