Re: [PATCH 6/7] pinctrl: sunxi: a523-r: add a733-r compatible string

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] This problem wasn't introduced by this patch, but the static `desc->npins` counter accumulates on probe deferral, causing out-of-bounds array reads with negative indices.
--

commit 0f0363ee56222ed4bd5f82e32e391a15a8e11f99
Author: Andre Przywara <andre.przywara@arm.com>

pinctrl: sunxi: a523-r: add a733-r compatible string

Adds the allwinner,sun60i-a733-r-pinctrl compatible string to the A523-r
pinctrl driver. The driver is reused for the A733-r IP since it shares a
similar two-bank layout, with specific pinmux values provided by the DT.

> diff --git a/drivers/pinctrl/sunxi/pinctrl-sun55i-a523-r.c b/drivers/pinctrl/sunxi/pinctrl-sun55i-a523-r.c
> index 9e07fbb5be7cb..dfdcfa740ecc9 100644
> --- a/drivers/pinctrl/sunxi/pinctrl-sun55i-a523-r.c
> +++ b/drivers/pinctrl/sunxi/pinctrl-sun55i-a523-r.c
> @@ -40,6 +40,7 @@ static int a523_r_pinctrl_probe(struct platform_device *pdev)
>  
>  static const struct of_device_id a523_r_pinctrl_match[] = {
>  	{ .compatible = "allwinner,sun55i-a523-r-pinctrl", },
> +	{ .compatible = "allwinner,sun60i-a733-r-pinctrl", },

[Severity: High]
This isn't a bug introduced by this patch, but does the static desc->npins
counter accumulate on probe deferral, causing out-of-bounds array reads with
negative indices?

When the driver is probed, it passes the statically allocated
a523_r_pinctrl_data to sunxi_pinctrl_dt_table_init().

In drivers/pinctrl/sunxi/pinctrl-sunxi-dt.c:init_pins_table():

	for (i = 0; i < SUNXI_PINCTRL_MAX_BANKS; i++) {
		desc->npins += pins_per_bank[i];

If the probe fails later (e.g., -EPROBE_DEFER), desc->npins is not reset.
On the next probe, it increments again, allocating a larger array but only
initializing the first valid elements.

Then prepare_function_table() iterates up to the accumulated desc->npins:

	for (i = 0; i < npins; i++) {
		struct sunxi_desc_pin *pin = &pins[i];
		int bank = (pin->pin.number - pin_base) / PINS_PER_BANK;

		if (irq_bank_muxes[bank]) {

For uninitialized pins, pin->pin.number is 0. With a pin_base like 352
(PL_BASE), the bank index becomes (0 - 352) / 32 = -11. This results
in an out-of-bounds access irq_bank_muxes[-11].

Furthermore, searching for a non-existent DT pin name will scan into the
uninitialized elements, calling strcmp(NULL, name) and potentially panicking
the kernel.

>  	{}
>  };

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260910133519.459011-1-andre.przywara@arm.com?part=6