Re: [PATCH v3 7/8] iio: adc: rzg2l_adc: Add RZ/G3L ADC support for TSU

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] iio: adc: rzg2l_adc: missing channel validation for RZ/G3L ADC1 causes state leaks and potential crashes
--

commit 6a30a731629fb5bab54f976d5c01c9fd5c2d8432
Author: Biju Das <biju.das.jz@bp.renesas.com>

iio: adc: rzg2l_adc: Add RZ/G3L ADC support for TSU

Add renesas,r9a08g046-adc1 compatible string and its hardware
parameters for the ADC1 IP on RZ/G3L, which is dedicated to
the on-chip TSU (thermal sensor unit).

> diff --git a/drivers/iio/adc/rzg2l_adc.c b/drivers/iio/adc/rzg2l_adc.c
> index aaf7e2ceff8ab..c892e355b7398 100644
> --- a/drivers/iio/adc/rzg2l_adc.c
> +++ b/drivers/iio/adc/rzg2l_adc.c
> @@ -500,8 +500,17 @@ static const struct rzg2l_adc_hw_params rzg3s_hw_params = {
>  	.adint_inten_mask = GENMASK(11, 0),
>  };
>  
> +static const struct rzg2l_adc_hw_params rzg3l_adc1_hw_params = {
> +	.max_channels = 9,
> +	.default_adcmp = 0x1d,
> +	.default_adsmp = { 0x7f, 0xff },
> +	.adsmp_mask = GENMASK(7, 0),
> +	.adint_inten_mask = BIT(8),

[Severity: High]
Does this mask inadvertently leak the interrupt enable state for channels 0-7 if
they are incorrectly configured in the device tree?

With max_channels set to 9, rzg2l_adc_probe() accepts channels 0 through 8 from
the device tree. If an unsupported channel (e.g., 0) is probed and accessed via
sysfs, rzg2l_adc_conversion_setup() sets BIT(0) in the interrupt enable
register.

However, because adint_inten_mask is restricted to BIT(8), the driver's timeout
and cleanup paths will fail to clear BIT(0):

drivers/iio/adc/rzg2l_adc.c:rzg2l_adc_conversion() {
    ...
		rzg2l_adc_writel(adc, RZG2L_ADINT,
				 rzg2l_adc_readl(adc, RZG2L_ADINT) & ~hw_params->adint_inten_mask);
    ...
}

Additionally, reading an unsupported channel data register in the ISR could
cause a synchronous external abort:

drivers/iio/adc/rzg2l_adc.c:rzg2l_adc_isr() {
    ...
	for_each_set_bit(ch, &intst, hw_params->max_channels)
		adc->last_val[ch] = rzg2l_adc_readl(adc, RZG2L_ADCR(ch)) & RZG2L_ADCR_AD_MASK;
    ...
}

> +};
> +
>  static const struct of_device_id rzg2l_adc_match[] = {
>  	{ .compatible = "renesas,r9a08g045-adc", .data = &rzg3s_hw_params },
> +	{ .compatible = "renesas,r9a08g046-adc1", .data = &rzg3l_adc1_hw_params },
>  	{ .compatible = "renesas,rzg2l-adc", .data = &rzg2l_hw_params },
>  	{ }
>  };

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260922042707.116378-1-biju.das.jz@bp.renesas.com?part=7