[v3,04/11] pinctrl: sunxi: add Allwinner B288 pin controller driver
Commit Message
80 pins across ports B, C, D, F and G; the mux values come from the DT.
Port C has no external interrupts. PH0 is BSP FPGA-only and omitted.
Signed-off-by: Pablo Mazzini <pmazzini@gmail.com>
---
drivers/pinctrl/sunxi/Kconfig | 10 +++++
drivers/pinctrl/sunxi/Makefile | 1 +
drivers/pinctrl/sunxi/pinctrl-sun8i-b288.c | 49 ++++++++++++++++++++++
3 files changed, 60 insertions(+)
create mode 100644 drivers/pinctrl/sunxi/pinctrl-sun8i-b288.c
Comments
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] pinctrl: sunxi: NULL ptr deref on probe deferral due to npins accumulation
--
commit 23f0ad979270766cafcf25e2ddff2cd81bb51adc
Author: Pablo Mazzini <pmazzini@gmail.com>
pinctrl: sunxi: add Allwinner B288 pin controller driver
This commit introduces pin controller and GPIO support for the Allwinner
B288 SoC. It covers configuration for 80 pins across ports B, C, D, F, and
G, including external interrupts.
> diff --git a/drivers/pinctrl/sunxi/pinctrl-sun8i-b288.c b/drivers/pinctrl/sunxi/pinctrl-sun8i-b288.c
> new file mode 100644
> index 0000000000000..f973c2b3f2eba
> --- /dev/null
> +++ b/drivers/pinctrl/sunxi/pinctrl-sun8i-b288.c
[ ... ]
> +static struct sunxi_pinctrl_desc b288_pinctrl_data = {
> + .irq_banks = 4,
> +};
> +
> +static int b288_pinctrl_probe(struct platform_device *pdev)
> +{
> + return sunxi_pinctrl_dt_table_init(pdev, b288_nr_bank_pins,
> + b288_irq_bank_muxes,
> + &b288_pinctrl_data, 0);
> +}
[Severity: High]
If b288_pinctrl_probe() fails and defers, will b288_pinctrl_data.npins
accumulate indefinitely and cause a NULL pointer dereference?
Since b288_pinctrl_data is defined as a static global variable, its state
persists across multiple probe attempts. Looking at
sunxi_pinctrl_dt_table_init(), it forwards this struct to init_pins_table()
which modifies desc->npins:
init_pins_table() {
...
desc->npins += pins_per_bank[i];
...
}
If the probe fails and defers, or if the driver is unbound and rebound,
desc->npins is not reset to 0, so its value will double on the next probe
attempt.
This leads to the pins array being allocated for the doubled size, but only
the first 80 elements are actually initialized. The rest are zeroed out by
the allocation. Later, in prepare_function_table(), a loop iterates over
the doubled npins value and calls strcmp(pins[i].pin.name, name). For
indexes beyond the actual number of pins, pins[i].pin.name is NULL, which
triggers a crash.
Should npins be cleared to 0 before initialization, or should the static
struct be treated as read-only and copied to a local device structure?
@@ -56,6 +56,16 @@ config PINCTRL_SUN8I_A23_R
default MACH_SUN8I
select PINCTRL_SUNXI
+config PINCTRL_SUN8I_B288
+ bool "Support for the Allwinner B288 PIO"
+ default MACH_SUN8I
+ select PINCTRL_SUNXI
+ help
+ Say Y here to enable pin controller and GPIO support for the
+ Allwinner B288 (sun8iw10p1) SoC, as used in e-book readers such
+ as the PocketBook Verse. This covers ports B, C, D, F and G,
+ including the four banks of external interrupt capable pins.
+
config PINCTRL_SUN8I_H3
bool "Support for the Allwinner H3 PIO"
default MACH_SUN8I
@@ -18,6 +18,7 @@ obj-$(CONFIG_PINCTRL_SUN50I_A100) += pinctrl-sun50i-a100.o
obj-$(CONFIG_PINCTRL_SUN50I_A100_R) += pinctrl-sun50i-a100-r.o
obj-$(CONFIG_PINCTRL_SUN8I_A83T) += pinctrl-sun8i-a83t.o
obj-$(CONFIG_PINCTRL_SUN8I_A83T_R) += pinctrl-sun8i-a83t-r.o
+obj-$(CONFIG_PINCTRL_SUN8I_B288) += pinctrl-sun8i-b288.o
obj-$(CONFIG_PINCTRL_SUN8I_H3) += pinctrl-sun8i-h3.o
obj-$(CONFIG_PINCTRL_SUN8I_H3_R) += pinctrl-sun8i-h3-r.o
obj-$(CONFIG_PINCTRL_SUN8I_V3S) += pinctrl-sun8i-v3s.o
new file mode 100644
@@ -0,0 +1,49 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Allwinner B288 (sun8iw10p1) SoC pinctrl driver.
+ *
+ * Bank sizes and the interrupt mux derived from Allwinner's BSP driver
+ * pinctrl-sun8iw10p1.c, which is:
+ * Copyright (C) 2014 Jackie Hwang <huangshr@allwinnertech.com>
+ */
+
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/of.h>
+#include <linux/pinctrl/pinctrl.h>
+
+#include "pinctrl-sunxi.h"
+
+/* PH0 exists only on the BSP's FPGA platform and is omitted. */
+static const u8 b288_nr_bank_pins[SUNXI_PINCTRL_MAX_BANKS] =
+/* PA PB PC PD PE PF PG */
+ { 0, 17, 15, 29, 0, 7, 12 };
+
+static const u8 b288_irq_bank_muxes[SUNXI_PINCTRL_MAX_BANKS] =
+/* PA PB PC PD PE PF PG */
+ { 0, 6, 0, 6, 0, 6, 6 };
+
+static struct sunxi_pinctrl_desc b288_pinctrl_data = {
+ .irq_banks = 4,
+};
+
+static int b288_pinctrl_probe(struct platform_device *pdev)
+{
+ return sunxi_pinctrl_dt_table_init(pdev, b288_nr_bank_pins,
+ b288_irq_bank_muxes,
+ &b288_pinctrl_data, 0);
+}
+
+static const struct of_device_id b288_pinctrl_match[] = {
+ { .compatible = "allwinner,sun8i-b288-pinctrl", },
+ {}
+};
+
+static struct platform_driver b288_pinctrl_driver = {
+ .probe = b288_pinctrl_probe,
+ .driver = {
+ .name = "sun8i-b288-pinctrl",
+ .of_match_table = b288_pinctrl_match,
+ },
+};
+builtin_platform_driver(b288_pinctrl_driver);