From: William Breathitt Gray <wbg@kernel.org>
To: Babanpreet Singh <bbnpreetsingh@gmail.com>
Cc: William Breathitt Gray <wbg@kernel.org>,
Kamel Bouhara <kamel.bouhara@bootlin.com>,
linux-iio@vger.kernel.org, linux-arm-kernel@lists.infradead.org,
linux-kernel@vger.kernel.org, Jonathan Cameron <jic23@kernel.org>
Subject: Re: [PATCH] counter: microchip-tcb-capture: Fix DT channel validation
Date: Sun, 2 Aug 2026 21:44:40 +0900 [thread overview]
Message-ID: <178567458124.1423913.11797126534465463278.b4-ty@kernel.org> (raw)
In-Reply-To: <20260714042910.7-1-bbnpreetsingh@gmail.com>
On Tue, 14 Jul 2026 04:29:10 +0000, Babanpreet Singh wrote:
> mchp_tc_probe() reads the devicetree "reg" cell - a u32, per the API
> contract of of_property_read_u32_index() - into a signed int, so the
> bounds check "channel > 2" fails to reject cell values at or above
> 0x80000000: reinterpreted as a negative int, they compare below 2 and
> pass validation.
>
> A malformed devicetree can therefore drive a negative channel into the
> ATMEL_TC_REG() offset arithmetic, making the driver access syscon
> regmap offsets outside the TC block's register window, and into the
> "t%d_clk" clock-name formatting, where it truncates clk_name (sized
> for "t0_clk".."t2_clk").
>
> [...]
Applied, thanks!
[1/1] counter: microchip-tcb-capture: Fix DT channel validation
commit: f1a3a9946aab611dd2200c01ff122f64b033dad2
Best regards,
--
William Breathitt Gray <wbg@kernel.org>
prev parent reply other threads:[~2026-08-02 12:44 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-14 4:29 Babanpreet Singh
2026-07-29 5:41 ` Babanpreet Singh
2026-07-29 16:12 ` William Breathitt Gray
2026-07-29 7:34 ` Joshua Crofts
2026-08-02 12:44 ` William Breathitt Gray [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=178567458124.1423913.11797126534465463278.b4-ty@kernel.org \
--to=wbg@kernel.org \
--cc=bbnpreetsingh@gmail.com \
--cc=jic23@kernel.org \
--cc=kamel.bouhara@bootlin.com \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-iio@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®