[PATCH v3] drm/bridge: sii902x: Read "sil,i2s-data-lanes" as u32

[PATCH v3] drm/bridge: sii902x: Read "sil,i2s-data-lanes" as u32

[Rob Herring (Arm)]

The "sil,i2s-data-lanes" binding and in-tree DTS files use normal
uint32 cells. Reading the array as u8 only works because the values are
small, but it does not match the documented DT element size.

Use the u32 array helper so the driver follows the binding. Changing to
u32 increases a potential OOB access range due to using unchecked
values, so add a check on the read values.

Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
---
v3:
 - Drop the WARN_ON.
 - Combine checking the values with any other error parsing the DT
   property. The exact DT error isn't important.

v2:
 - Add bounds check for property values as reported by sashiko
---
 drivers/gpu/drm/bridge/sii902x.c | 20 ++++++++++++++------
 1 file changed, 14 insertions(+), 6 deletions(-)

diff --git a/drivers/gpu/drm/bridge/sii902x.c b/drivers/gpu/drm/bridge/sii902x.c
index 9aac44ed5b67..b70818eab34d 100644
--- a/drivers/gpu/drm/bridge/sii902x.c
+++ b/drivers/gpu/drm/bridge/sii902x.c
@@ -862,7 +862,7 @@ static int sii902x_audio_codec_init(struct sii902x *sii902x,
 		.max_i2s_channels = 0,
 		.no_capture_mute = 1,
 	};
-	u8 lanes[4];
+	u32 lanes[4];
 	int num_lanes, i;
 
 	if (!of_property_present(dev->of_node, "#sound-dai-cells")) {
@@ -871,10 +871,10 @@ static int sii902x_audio_codec_init(struct sii902x *sii902x,
 		return 0;
 	}
 
-	num_lanes = of_property_read_variable_u8_array(dev->of_node,
-						       "sil,i2s-data-lanes",
-						       lanes, 1,
-						       ARRAY_SIZE(lanes));
+	num_lanes = of_property_read_variable_u32_array(dev->of_node,
+							"sil,i2s-data-lanes",
+							lanes, 1,
+							ARRAY_SIZE(lanes));
 
 	if (num_lanes == -EINVAL) {
 		dev_dbg(dev,
@@ -882,7 +882,15 @@ static int sii902x_audio_codec_init(struct sii902x *sii902x,
 			__func__);
 		num_lanes = 1;
 		lanes[0] = 0;
-	} else if (num_lanes < 0) {
+	} else {
+		for (i = 0; i < num_lanes; i++) {
+			if (lanes[i] >= ARRAY_SIZE(i2s_lane_id)) {
+				num_lanes = -EINVAL;
+				break;
+			}
+		}
+	}
+	if (num_lanes < 0) {
 		dev_err(dev,
 			"%s: Error getting \"sil,i2s-data-lanes\": %d\n",
 			__func__, num_lanes);
-- 
2.53.0

Re: [PATCH v3] drm/bridge: sii902x: Read "sil,i2s-data-lanes" as u32

[Rob Herring]

On Mon, Aug 31, 2026 at 3:32 PM Rob Herring (Arm) <robh@kernel.org> wrote:
>
> The "sil,i2s-data-lanes" binding and in-tree DTS files use normal
> uint32 cells. Reading the array as u8 only works because the values are
> small, but it does not match the documented DT element size.
>
> Use the u32 array helper so the driver follows the binding. Changing to
> u32 increases a potential OOB access range due to using unchecked
> values, so add a check on the read values.
>
> Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
> ---
> v3:
>  - Drop the WARN_ON.
>  - Combine checking the values with any other error parsing the DT
>    property. The exact DT error isn't important.
>
> v2:
>  - Add bounds check for property values as reported by sashiko
> ---
>  drivers/gpu/drm/bridge/sii902x.c | 20 ++++++++++++++------
>  1 file changed, 14 insertions(+), 6 deletions(-)

Ping. Can I get an ack on this to apply it.

Rob

Re: [PATCH v3] drm/bridge: sii902x: Read "sil,i2s-data-lanes" as u32

[Maxime Ripard]

[-- Attachment #1: Type: text/plain, Size: 1167 bytes --]

On Mon, Oct 26, 2026 at 10:25:13AM -0500, Rob Herring wrote:
> On Mon, Aug 31, 2026 at 3:32 PM Rob Herring (Arm) <robh@kernel.org> wrote:
> >
> > The "sil,i2s-data-lanes" binding and in-tree DTS files use normal
> > uint32 cells. Reading the array as u8 only works because the values are
> > small, but it does not match the documented DT element size.
> >
> > Use the u32 array helper so the driver follows the binding. Changing to
> > u32 increases a potential OOB access range due to using unchecked
> > values, so add a check on the read values.
> >
> > Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
> > ---
> > v3:
> >  - Drop the WARN_ON.
> >  - Combine checking the values with any other error parsing the DT
> >    property. The exact DT error isn't important.
> >
> > v2:
> >  - Add bounds check for property values as reported by sashiko
> > ---
> >  drivers/gpu/drm/bridge/sii902x.c | 20 ++++++++++++++------
> >  1 file changed, 14 insertions(+), 6 deletions(-)
> 
> Ping. Can I get an ack on this to apply it.

Acked-by: Maxime Ripard <mripard@kernel.org>

Alternatively, I can apply it to the drm-misc tree

Maxime

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 273 bytes --]