Re: [PATCH RFC 1/2] of: property: fw_devlink: Follow GPIO nexus maps

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Medium] Infinite loop in `of_parse_phandle_with_args_map` due to lack of cycle detection when parsing `*-map` properties.
--

commit 97ac59dad65377a6557c6606a4f1c695b9fd0847
Author: Ernest Van Hoecke <ernest.vanhoecke@toradex.com>

of: property: fw_devlink: Follow GPIO nexus maps

This commit updates fw_devlink to parse GPIO properties using the map-aware
parser of_parse_phandle_with_args_map() instead of treating them as direct
phandle references. This ensures fw_devlink identifies the correct GPIO
provider rather than a translation nexus, and adds corresponding unittest
coverage.

Link: https://lore.kernel.org/all/juuc4af7ndbajcl7gzf4tg5qz2q2j5tt3rvql4jbauradujrre@gc5nbdhhixaf/

> diff --git a/drivers/of/property.c b/drivers/of/property.c
> index 72cf12907de03..380df0861ab97 100644
> --- a/drivers/of/property.c
> +++ b/drivers/of/property.c
[ ... ]
> @@ -1311,6 +1311,19 @@ static struct device_node *parse_prop_cells(struct device_node *np,
>  	return sup_args.np;
>  }
>  
> +static struct device_node *parse_nexus_prop(struct device_node *np,
> +					    const char *prop_name, int index,
> +					    const char *stem_name)
> +{
> +	struct of_phandle_args sup_args;
> +
> +	if (of_parse_phandle_with_args_map(np, prop_name, stem_name, index,
> +					   &sup_args))

[Severity: Medium]
This is a pre-existing issue, but does of_parse_phandle_with_args_map() lack
cycle detection when parsing *-map properties?

Looking at of_parse_phandle_with_args_map() in drivers/of/base.c, the loop
that follows mapping indirection lacks a cycle breaker:

drivers/of/base.c:of_parse_phandle_with_args_map() {
    ...
	while (cur) {
		/* Get the <list>-map property */
		map = of_get_property(cur, map_name, &map_len);
    ...
		out_args->np = new;
		of_node_put(cur);
		cur = new;
		new = NULL;
	}
    ...
}

If a cyclic device tree overlay introduces a cycle in the *-map properties,
could this while (cur) loop indefinitely follow the mapping indirection
and cause a denial of service? The function seems to jump directly to
reassigning cur = new and restarting the traversal without any cycle-breaking
or visited-node verification.

> +		return NULL;
> +
> +	return sup_args.np;
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260902-fw-devlink-nexus-ready-v1-0-68fe1996e78a@toradex.com?part=1