From: Artur Kowalski <arturkow2000@gmail.com>
Date: Sun, 30 Mar 2025 19:11:54 +0000 (+0200)
Subject: pinctrl: tegra20: detect unknown/invalid pin/func configurations
X-Git-Tag: v2025.07-rc1~69^2~8
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=a35bf832d70;p=thirdparty%2Fu-boot.git

pinctrl: tegra20: detect unknown/invalid pin/func configurations

Tegra20 driver doesn't know about some pin configurations and even about
some pins. In case when pin configuration is unknown the pin would be
muxed to whatever is under function 0, in case when pin itself is
unknown, it could cause out-of-bounds array access in pinmux_set_func
and pinmux_set_pullupdown.

Signed-off-by: Artur Kowalski <arturkow2000@gmail.com>
Reviewed-by: Svyatoslav Ryhel <clamor95@gmail.com>
Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com>
---

diff --git a/drivers/pinctrl/tegra/pinctrl-tegra20.c b/drivers/pinctrl/tegra/pinctrl-tegra20.c
index d59b3ec7b5d..c32d590a7e0 100644
--- a/drivers/pinctrl/tegra/pinctrl-tegra20.c
+++ b/drivers/pinctrl/tegra/pinctrl-tegra20.c
@@ -37,6 +37,11 @@ static void tegra_pinctrl_set_pin(struct udevice *config)
 				if (!strcmp(pins[i], tegra_pinctrl_to_pingrp[pin_id]))
 					break;
 
+		if (pin_id == PMUX_PINGRP_COUNT) {
+			log_debug("%s: %s(%d) is not valid\n", __func__, pins[i], pin_id);
+			continue;
+		}
+
 		if (pull >= 0)
 			pinmux_set_pullupdown(pin_id, pull);
 
@@ -58,13 +63,16 @@ static void tegra_pinctrl_set_func(struct udevice *config)
 	const char **pins;
 
 	function = dev_read_string(config, "nvidia,function");
-	if (function)
+	if (function) {
 		for (i = 0; i < PMUX_FUNC_COUNT; i++)
 			if (tegra_pinctrl_to_func[i])
 				if (!strcmp(function, tegra_pinctrl_to_func[i]))
 					break;
 
-	func_id = i;
+		func_id = i;
+	} else {
+		func_id = PMUX_FUNC_COUNT;
+	}
 
 	count = dev_read_string_list(config, "nvidia,pins", &pins);
 	if (count < 0) {
@@ -78,6 +86,12 @@ static void tegra_pinctrl_set_func(struct udevice *config)
 				if (!strcmp(pins[i], tegra_pinctrl_to_pingrp[pin_id]))
 					break;
 
+		if (func_id == PMUX_FUNC_COUNT || pin_id == PMUX_PINGRP_COUNT) {
+			log_debug("%s: pin %s(%d) or function %s(%d) is not valid\n",
+				  __func__, pins[i], pin_id, function, func_id);
+			continue;
+		}
+
 		debug("%s(%d) muxed to %s(%d)\n", pins[i], pin_id, function, func_id);
 
 		pinmux_set_func(pin_id, func_id);