diff mbox series

[6/7] pinctrl: sunxi: a523-r: add a733-r compatible string

Message ID 20260910133519.459011-7-andre.przywara@arm.com (mailing list archive)
State New
Headers
Series pinctrl: sunxi: Add Allwinner A733 support |

Commit Message

Andre Przywara Sept. 10, 2026, 1:35 p.m. UTC 
The secondary Allwinner A733 pincontroller ("-r") is interestingly not
using the same new MMIO frame layout as the main controller, but is in
fact very similar to the A523-r one: it has two banks, with 14 and 6 pins
each. From the driver's perspective, this is all we care about, so we can
re-use the a523-r pinctrl driver for the a733-r, too.

The individual pinmux settings are different, so we must not use the
a523-r compatible string as a fallback, but we can surely let the same
driver care for both the a523-r and a733-r IP, as the pinmux values will
be provided by the DT.

Add the a733-r compatible string to the match list, without further
distinguishing between the two. Should differences be discovered later,
we can easily split this up then.

Signed-off-by: Andre Przywara <andre.przywara@arm.com>
---
 drivers/pinctrl/sunxi/pinctrl-sun55i-a523-r.c | 1 +
 1 file changed, 1 insertion(+)

Comments

sashiko-bot@kernel.org Sept. 10, 2026, 2:15 p.m. UTC | #1 
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] This problem wasn't introduced by this patch, but the static `desc->npins` counter accumulates on probe deferral, causing out-of-bounds array reads with negative indices.
--

commit 0f0363ee56222ed4bd5f82e32e391a15a8e11f99
Author: Andre Przywara <andre.przywara@arm.com>

pinctrl: sunxi: a523-r: add a733-r compatible string

Adds the allwinner,sun60i-a733-r-pinctrl compatible string to the A523-r
pinctrl driver. The driver is reused for the A733-r IP since it shares a
similar two-bank layout, with specific pinmux values provided by the DT.

> diff --git a/drivers/pinctrl/sunxi/pinctrl-sun55i-a523-r.c b/drivers/pinctrl/sunxi/pinctrl-sun55i-a523-r.c
> index 9e07fbb5be7cb..dfdcfa740ecc9 100644
> --- a/drivers/pinctrl/sunxi/pinctrl-sun55i-a523-r.c
> +++ b/drivers/pinctrl/sunxi/pinctrl-sun55i-a523-r.c
> @@ -40,6 +40,7 @@ static int a523_r_pinctrl_probe(struct platform_device *pdev)
>  
>  static const struct of_device_id a523_r_pinctrl_match[] = {
>  	{ .compatible = "allwinner,sun55i-a523-r-pinctrl", },
> +	{ .compatible = "allwinner,sun60i-a733-r-pinctrl", },

[Severity: High]
This isn't a bug introduced by this patch, but does the static desc->npins
counter accumulate on probe deferral, causing out-of-bounds array reads with
negative indices?

When the driver is probed, it passes the statically allocated
a523_r_pinctrl_data to sunxi_pinctrl_dt_table_init().

In drivers/pinctrl/sunxi/pinctrl-sunxi-dt.c:init_pins_table():

	for (i = 0; i < SUNXI_PINCTRL_MAX_BANKS; i++) {
		desc->npins += pins_per_bank[i];

If the probe fails later (e.g., -EPROBE_DEFER), desc->npins is not reset.
On the next probe, it increments again, allocating a larger array but only
initializing the first valid elements.

Then prepare_function_table() iterates up to the accumulated desc->npins:

	for (i = 0; i < npins; i++) {
		struct sunxi_desc_pin *pin = &pins[i];
		int bank = (pin->pin.number - pin_base) / PINS_PER_BANK;

		if (irq_bank_muxes[bank]) {

For uninitialized pins, pin->pin.number is 0. With a pin_base like 352
(PL_BASE), the bank index becomes (0 - 352) / 32 = -11. This results
in an out-of-bounds access irq_bank_muxes[-11].

Furthermore, searching for a non-existent DT pin name will scan into the
uninitialized elements, calling strcmp(NULL, name) and potentially panicking
the kernel.

>  	{}
>  };
diff mbox series

Patch

diff --git a/drivers/pinctrl/sunxi/pinctrl-sun55i-a523-r.c b/drivers/pinctrl/sunxi/pinctrl-sun55i-a523-r.c
index 9e07fbb5be7cb..dfdcfa740ecc9 100644
--- a/drivers/pinctrl/sunxi/pinctrl-sun55i-a523-r.c
+++ b/drivers/pinctrl/sunxi/pinctrl-sun55i-a523-r.c
@@ -40,6 +40,7 @@  static int a523_r_pinctrl_probe(struct platform_device *pdev)
 
 static const struct of_device_id a523_r_pinctrl_match[] = {
 	{ .compatible = "allwinner,sun55i-a523-r-pinctrl", },
+	{ .compatible = "allwinner,sun60i-a733-r-pinctrl", },
 	{}
 };