From a35bf832d7047662761571b6f80861cb25477030 Mon Sep 17 00:00:00 2001 From: Artur Kowalski Date: Sun, 30 Mar 2025 21:11:54 +0200 Subject: [PATCH] pinctrl: tegra20: detect unknown/invalid pin/func configurations Tegra20 driver doesn't know about some pin configurations and even about some pins. In case when pin configuration is unknown the pin would be muxed to whatever is under function 0, in case when pin itself is unknown, it could cause out-of-bounds array access in pinmux_set_func and pinmux_set_pullupdown. Signed-off-by: Artur Kowalski Reviewed-by: Svyatoslav Ryhel Signed-off-by: Svyatoslav Ryhel --- drivers/pinctrl/tegra/pinctrl-tegra20.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/drivers/pinctrl/tegra/pinctrl-tegra20.c b/drivers/pinctrl/tegra/pinctrl-tegra20.c index d59b3ec7b5d..c32d590a7e0 100644 --- a/drivers/pinctrl/tegra/pinctrl-tegra20.c +++ b/drivers/pinctrl/tegra/pinctrl-tegra20.c @@ -37,6 +37,11 @@ static void tegra_pinctrl_set_pin(struct udevice *config) if (!strcmp(pins[i], tegra_pinctrl_to_pingrp[pin_id])) break; + if (pin_id == PMUX_PINGRP_COUNT) { + log_debug("%s: %s(%d) is not valid\n", __func__, pins[i], pin_id); + continue; + } + if (pull >= 0) pinmux_set_pullupdown(pin_id, pull); @@ -58,13 +63,16 @@ static void tegra_pinctrl_set_func(struct udevice *config) const char **pins; function = dev_read_string(config, "nvidia,function"); - if (function) + if (function) { for (i = 0; i < PMUX_FUNC_COUNT; i++) if (tegra_pinctrl_to_func[i]) if (!strcmp(function, tegra_pinctrl_to_func[i])) break; - func_id = i; + func_id = i; + } else { + func_id = PMUX_FUNC_COUNT; + } count = dev_read_string_list(config, "nvidia,pins", &pins); if (count < 0) { @@ -78,6 +86,12 @@ static void tegra_pinctrl_set_func(struct udevice *config) if (!strcmp(pins[i], tegra_pinctrl_to_pingrp[pin_id])) break; + if (func_id == PMUX_FUNC_COUNT || pin_id == PMUX_PINGRP_COUNT) { + log_debug("%s: pin %s(%d) or function %s(%d) is not valid\n", + __func__, pins[i], pin_id, function, func_id); + continue; + } + debug("%s(%d) muxed to %s(%d)\n", pins[i], pin_id, function, func_id); pinmux_set_func(pin_id, func_id); -- 2.39.5