Re: [PATCH 2/2] pinctrl: mediatek: Add support for MT6895 pinctrl

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Medium] pinctrl: mediatek: mt6895: out-of-bounds read of
  mt6895_pull_type[]
--

commit 60c606b2dae303929573f6abbd4f0ebf7a610aff
Author: Alexander Letuchiy <asalde.le1@gmail.com>

pinctrl: mediatek: Add support for MT6895 pinctrl

This commit adds a Paris-based pinctrl and EINT driver for the MediaTek
MT6895 SoC, defining 227 physical GPIOs and 20 virtual EINT lines.

> diff --git a/drivers/pinctrl/mediatek/pinctrl-mt6895.c b/drivers/pinctrl/mediatek/pinctrl-mt6895.c
> new file mode 100644
> index 0000000000000..1eb8792912301
> --- /dev/null
> +++ b/drivers/pinctrl/mediatek/pinctrl-mt6895.c

[ ... ]

> +static const unsigned int mt6895_pull_type[] = {
> +	MTK_PULL_PU_PD_TYPE, /* 0 */
> +	MTK_PULL_PU_PD_TYPE, /* 1 */

[ ... ]

> +	MTK_PULL_PU_PD_RSEL_TYPE, /* 225 */
> +	MTK_PULL_PU_PD_RSEL_TYPE, /* 226 */
> +};
> +
> +static const char *const mt6895_pinctrl_register_base_names[] = {
> +	"base", "rm", "rt", "rmm", "bl", "bm", "br",
> +	"brr", "lb", "lm", "rtt", "tr", "tl", "lt",
> +};
> +
> +static const struct mtk_eint_hw mt6895_eint_hw = {
> +	.port_mask = 0xf,
> +	.ports     = 3,
> +	.ap_num    = 247,
> +	.db_cnt    = 32,
> +	.db_time   = debounce_time_mt6878,
> +};
> +
> +static const struct mtk_pin_reg_calc mt6895_reg_cals[PINCTRL_PIN_REG_MAX] = {
> +	[PINCTRL_PIN_REG_MODE] = MTK_RANGE(mt6895_pin_mode_range),
> +	[PINCTRL_PIN_REG_DIR] = MTK_RANGE(mt6895_pin_dir_range),
> +	[PINCTRL_PIN_REG_DI] = MTK_RANGE(mt6895_pin_di_range),
> +	[PINCTRL_PIN_REG_DO] = MTK_RANGE(mt6895_pin_do_range),
> +	[PINCTRL_PIN_REG_SMT] = MTK_RANGE(mt6895_pin_smt_range),
> +	[PINCTRL_PIN_REG_IES] = MTK_RANGE(mt6895_pin_ies_range),
> +	[PINCTRL_PIN_REG_PU] = MTK_RANGE(mt6895_pin_pu_range),
> +	[PINCTRL_PIN_REG_PD] = MTK_RANGE(mt6895_pin_pd_range),
> +	[PINCTRL_PIN_REG_DRV] = MTK_RANGE(mt6895_pin_drv_range),
> +	[PINCTRL_PIN_REG_PUPD] = MTK_RANGE(mt6895_pin_pupd_range),
> +	[PINCTRL_PIN_REG_R0] = MTK_RANGE(mt6895_pin_r0_range),
> +	[PINCTRL_PIN_REG_R1] = MTK_RANGE(mt6895_pin_r1_range),
> +	[PINCTRL_PIN_REG_DRV_ADV] = MTK_RANGE(mt6895_pin_adv_range),
> +	[PINCTRL_PIN_REG_RSEL] = MTK_RANGE(mt6895_pin_rsel_range),
> +};
> +
> +static const struct mtk_pin_soc mt6895_data = {
> +	.reg_cal = mt6895_reg_cals,
> +	.pins = mtk_pins_mt6895,
> +	.npins = ARRAY_SIZE(mtk_pins_mt6895),
> +	.ngrps = ARRAY_SIZE(mtk_pins_mt6895),
> +	.eint_hw = &mt6895_eint_hw,
> +	.eint_pin = eint_pins_mt6895,
> +	.nfuncs = 8,
> +	.gpio_m = 0,
> +	.base_names = mt6895_pinctrl_register_base_names,
> +	.nbase_names = ARRAY_SIZE(mt6895_pinctrl_register_base_names),
> +	.pull_type = mt6895_pull_type,
> +	.bias_set_combo = mtk_pinconf_bias_set_combo,
> +	.bias_get_combo = mtk_pinconf_bias_get_combo,

[Severity: Medium]
Can mtk_pinconf_bias_get_combo() and mtk_pinconf_bias_set_combo() read
past the end of mt6895_pull_type[]?

mtk_pins_mt6895[] has 247 entries including virtual EINT pins 227..246,
while mt6895_pull_type[] only has 227 entries for pins 0..226.  Reading
debugfs pinconf-pins (which queries all 0..npins-1 pins) calls
mtk_pinconf_get() -> mtk_pinconf_bias_get_combo(), indexing
hw->soc->pull_type[desc->number] out of bounds for pins 227..246.

Adding 20 trailing zero entries to mt6895_pull_type[] for the virtual EINT
pins (as done in mt6735_pull_type[]) would avoid the out-of-bounds read.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261108-pinctrl-mt6895-v1-0-f704c443b31a@gmail.com?part=2