[PATCH v2 0/4] pinctrl: bcm: Two bounds fixes and a dt_free_map cleanup

[Xiaolei Wang <wangxiaolei01@kaihong.com>]

This series fixes two out-of-bounds accesses in the BCM pin controllers
and drops two hand-written dt_free_map callbacks that duplicate
pinctrl_utils_free_map().

1/4 indexes funcs[] with the raw FSEL field, which is 1-based: 0 means
GPIO, 1..n_funcs map to funcs[0..n_funcs - 1]. Every debugfs readback is
therefore shifted by one slot, and n_funcs indexes past the array. Index
with fsel - 1 and map 0 and out-of-range values back to GPIO.

2/4 and 3/4 replace the per-driver dt_free_map with
pinconf_generic_dt_free_map(). Both drivers already select
GENERIC_PINCONF, and brcmstb already uses the generic dt_node_to_map, so
this is a mechanical cleanup with no behaviour change.

4/4 adds the missing AON SGPIO entries. The controller describes six
SGPIO pins at pin 32..37, but the function tables stop at pin 16 (C0)
and pin 14 (D0), so dumping the pin list indexes past the end. The
function data comes from the downstream rpi-6.12.y driver; C0 and D0
differ on the HDMI1 and PMIC I2C signals.

Testing: 1/4 was run on a Raspberry Pi 5 with KASAN; the "alt8" readback
no longer splats and field 0 reports GPIO. 4/4's out-of-bounds read was
reproduced on the same board. Its D0 entries are not runtime tested,
because the board loads the C0 table.

Changes in v2:
- 1/4: the commit message describes the bug in prose instead of pasting
  the fix, as Andrea suggested.
- 4/4 is new, for the SGPIO out-of-bounds read he reported.

Link to v1:
- https://patchwork.kernel.org/project/linux-arm-kernel/cover/20261106070628.1428691-1-wangxiaolei01@kaihong.com/


Xiaolei Wang (4):
  pinctrl: bcm: Fix off-by-one and out-of-bounds access in fsel_get()
  pinctrl: bcm: Use pinconf_generic_dt_free_map in bcm2835
  pinctrl: bcm: Use pinconf_generic_dt_free_map in brcmstb
  pinctrl: bcm: Add missing SGPIO entries to the BCM2712 AON tables

 drivers/pinctrl/bcm/pinctrl-bcm2835.c         | 16 ++----------
 drivers/pinctrl/bcm/pinctrl-brcmstb-bcm2712.c | 12 +++++++++
 drivers/pinctrl/bcm/pinctrl-brcmstb.c         | 26 ++++++++-----------
 3 files changed, 25 insertions(+), 29 deletions(-)

-- 
2.34.1