Re: [PATCH v2 0/2] ata: reject invalid DT port numbers in AHCI drivers

[Niklas Cassel <cassel@kernel.org>]

On Tue, 10 Nov 2026 23:03:27 +0800, shao.mingyin@zte.com.cn wrote:
> Both the shared AHCI platform support and the DWC glue use the "reg"
> property of their port child nodes as a port number without checking
> that it addresses one of the controller's ports.
> 
> Patch 1 is in the shared platform code.  ahci_platform_get_firmware()
> uses "reg" as an index into hpriv->saved_port_cap[] while filling the
> firmware-specific port capabilities, so a "reg" value at or above
> hpriv->nports writes past that array.  Patch 2 is in the DWC glue.
> ahci_dwc_init_dmacr() walks the same child nodes a second time and uses
> "reg" both as an index into dpriv->dmacr[] and to compute the port MMIO
> base, with the same out-of-range consequence.
> 
> [...]

Applied to libata/linux.git (for-7.5), thanks!

[1/2] ata: libahci_platform: reject invalid port numbers
      https://git.kernel.org/libata/linux/c/b10c7a1c
[2/2] ata: ahci_dwc: reject invalid DT port numbers
      https://git.kernel.org/libata/linux/c/0f7d0044

Kind regards,
Niklas