From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 602643815E3 for ; Tue, 18 Aug 2026 23:47:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787096871; cv=none; b=S61Z0HuNMDc9rLNLABA2A0AQPfPr4ACYpYmUIVuZ8CYsdgDhzOLtPc20a5MFPQbvbdadh24L8vqMZIcRbgzWfmtg5f3AlHLAWzcQQuYgRaNpDaco/Kq6yFDV655BtejRouw/6PF59WaE9nEWh0LtWqRIQHeIZXEQleK0Yxv4SLw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787096871; c=relaxed/simple; bh=bxgT8vPpvk56uPq+CqSBDplt0TnhEkFPlu11TRPx+lI=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=U1DOVH07PCacTutDz4Sst9gSzBpT/ZLtEYc7yoHO7mmEMA2yoH0p/3VJkh6gxXPLzcz9Pm2OG9XcpBewY+UbZoKfqz+3JkjrpbwC8PKr9KtdK3P+0fl46N21GH9fQxI1IcV+zfij4qEFMHYG4u5q/t/cCnr/AZwhN5x2BzZfRJM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=OtNqmMWM; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="OtNqmMWM" Received: by smtp.kernel.org (Postfix) with ESMTPSA id B68E31F000E9; Tue, 18 Aug 2026 23:47:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1787096870; bh=XGdv0RPOWe/xI6/BGdKprEdeW/PFOM5P0htoiHIhNCk=; h=From:To:Cc:Subject:Date; b=OtNqmMWMB8OOrCPC9pwgxmbJh22movI2zM5rX0dASUCE6tyXOTANnC445CfwnwqbT Rl5WjaAHhSIXs3YV3HsxA7dsQS/3w5Ky2oq+JXa7za6lZX88T5jIs/q6NRhJAiES+E tM7Kec1NZ5hzKFtNtfUIyc+RRxFyXTUjAV3osOEAmptvAHPPUtO43GJZRPag1jKGZw NJugVwtS0RCAQtUsGdHTqHBffbmoEzI4jStTEOAzPPy0LPzhVcS3AlyX/Xn+LrvnRc EyIDzJHuwHi+qnWK1/maxsvt8+AYDPJkPRrwflTa3BSr0y0iBNzT3D3wgavUq4Sw8L UjX4Mut8uVElg== From: "Rob Herring (Arm)" To: Andrzej Hajda , Neil Armstrong , Robert Foss , Laurent Pinchart , Jonas Karlman , Jernej Skrabec , Luca Ceresoli , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org Subject: [PATCH] drm/bridge: sii902x: Read "sil,i2s-data-lanes" as u32 Date: Tue, 18 Aug 2026 18:46:20 -0500 Message-ID: <20260818234621.1265415-1-robh@kernel.org> X-Mailer: git-send-email 2.53.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit The "sil,i2s-data-lanes" binding and in-tree DTS files use normal uint32 cells. Reading the array as u8 only works because the values are small, but it does not match the documented DT element size. Use the u32 array helper so the driver follows the binding. Changing to u32 increases a potential OOB access range due to using unchecked values, so add a check on the read values. Signed-off-by: Rob Herring (Arm) --- v2: - Add bounds check for property values as reported by sashiko --- drivers/gpu/drm/bridge/sii902x.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/drivers/gpu/drm/bridge/sii902x.c b/drivers/gpu/drm/bridge/sii902x.c index 9aac44ed5b67..241b472ab13e 100644 --- a/drivers/gpu/drm/bridge/sii902x.c +++ b/drivers/gpu/drm/bridge/sii902x.c @@ -862,7 +862,7 @@ static int sii902x_audio_codec_init(struct sii902x *sii902x, .max_i2s_channels = 0, .no_capture_mute = 1, }; - u8 lanes[4]; + u32 lanes[4]; int num_lanes, i; if (!of_property_present(dev->of_node, "#sound-dai-cells")) { @@ -871,10 +871,10 @@ static int sii902x_audio_codec_init(struct sii902x *sii902x, return 0; } - num_lanes = of_property_read_variable_u8_array(dev->of_node, - "sil,i2s-data-lanes", - lanes, 1, - ARRAY_SIZE(lanes)); + num_lanes = of_property_read_variable_u32_array(dev->of_node, + "sil,i2s-data-lanes", + lanes, 1, + ARRAY_SIZE(lanes)); if (num_lanes == -EINVAL) { dev_dbg(dev, @@ -890,9 +890,12 @@ static int sii902x_audio_codec_init(struct sii902x *sii902x, } codec_data.max_i2s_channels = 2 * num_lanes; - for (i = 0; i < num_lanes; i++) + for (i = 0; i < num_lanes; i++) { + if (WARN_ON(lanes[i] >= ARRAY_SIZE(i2s_lane_id))) + break; sii902x->audio.i2s_fifo_sequence[i] |= audio_fifo_id[i] | i2s_lane_id[lanes[i]] | SII902X_TPI_I2S_FIFO_ENABLE; + } sii902x->audio.mclk = devm_clk_get_optional(dev, "mclk"); if (IS_ERR(sii902x->audio.mclk)) { -- 2.53.0