Fix potential out-of-bounds array access.

Found by smatch, reported by and ok jsg@

diff --git a/sys/dev/fdt/rkpinctrl.c b/sys/dev/fdt/rkpinctrl.c
index 159b8cc..50e7716 100644 (file)
--- a/sys/dev/fdt/rkpinctrl.c
+++ b/sys/dev/fdt/rkpinctrl.c
@@ -1,4 +1,4 @@
-/*     $OpenBSD: rkpinctrl.c,v 1.14 2023/09/22 01:10:44 jsg Exp $      */
+/*     $OpenBSD: rkpinctrl.c,v 1.15 2024/02/11 16:01:09 kettenis Exp $ */
 /*
  * Copyright (c) 2017, 2018 Mark Kettenis <kettenis@openbsd.org>
  *
@@ -260,12 +260,13 @@ rk3288_pinctrl(uint32_t phandle, void *cookie)
                bank = pins[i];
                idx = pins[i + 1];
                mux = pins[i + 2];
-               pull = rk3288_pull(bank, idx, pins[i + 3]);
-               strength = rk3288_strength(bank, idx, pins[i + 3]);
 
-               if (bank > 8 || idx > 32 || mux > 7)
+               if (bank > 8 || idx >= 32 || mux > 7)
                        continue;
 
+               pull = rk3288_pull(bank, idx, pins[i + 3]);
+               strength = rk3288_strength(bank, idx, pins[i + 3]);
+
                /* Bank 0 lives in the PMU. */
                if (bank < 1) {
                        rm = sc->sc_pmu;
@@ -401,12 +402,13 @@ rk3308_pinctrl(uint32_t phandle, void *cookie)
                bank = pins[i];
                idx = pins[i + 1];
                mux = pins[i + 2];
+
+               if (bank > 4 || idx >= 32 || mux > 7)
+                       continue;
+
                pull = rk3308_pull(bank, idx, pins[i + 3]);
                strength = rk3308_strength(bank, idx, pins[i + 3]);
  
-               if (bank > 4 || idx > 32 || mux > 7)
-                       continue;
-
                base = RK3308_GRF_GPIO0A_IOMUX;
 
                s = splhigh();
@@ -546,12 +548,13 @@ rk3328_pinctrl(uint32_t phandle, void *cookie)
                bank = pins[i];
                idx = pins[i + 1];
                mux = pins[i + 2];
-               pull = rk3328_pull(bank, idx, pins[i + 3]);
-               strength = rk3328_strength(bank, idx, pins[i + 3]);
 
-               if (bank > 3 || idx > 32 || mux > 3)
+               if (bank > 3 || idx >= 32 || mux > 3)
                        continue;
 
+               pull = rk3328_pull(bank, idx, pins[i + 3]);
+               strength = rk3328_strength(bank, idx, pins[i + 3]);
+
                base = RK3328_GRF_GPIO0A_IOMUX;
 
                s = splhigh();
@@ -738,12 +741,13 @@ rk3399_pinctrl(uint32_t phandle, void *cookie)
                bank = pins[i];
                idx = pins[i + 1];
                mux = pins[i + 2];
-               pull = rk3399_pull(bank, idx, pins[i + 3]);
-               strength = rk3399_strength(bank, idx, pins[i + 3]);
 
-               if (bank > 5 || idx > 32 || mux > 3)
+               if (bank > 4 || idx >= 32 || mux > 3)
                        continue;
 
+               pull = rk3399_pull(bank, idx, pins[i + 3]);
+               strength = rk3399_strength(bank, idx, pins[i + 3]);
+
                /* Bank 0 and 1 live in the PMU. */
                if (bank < 2) {
                        rm = sc->sc_pmu;
@@ -986,13 +990,14 @@ rk3568_pinctrl(uint32_t phandle, void *cookie)
                bank = pins[i];
                idx = pins[i + 1];
                mux = pins[i + 2];
+
+               if (bank > 5 || idx >= 32 || mux > 7)
+                       continue;
+
                pull = rk3568_pull(bank, idx, pins[i + 3]);
                strength = rk3568_strength(bank, idx, pins[i + 3]);
                schmitt = rk3568_schmitt(bank, idx, pins[i + 3]);
 
-               if (bank > 5 || idx > 32 || mux > 7)
-                       continue;
-
                /* Bank 0 lives in the PMU. */
                if (bank < 1) {
                        rm = sc->sc_pmu;
@@ -1170,13 +1175,14 @@ rk3588_pinctrl(uint32_t phandle, void *cookie)
                bank = pins[i];
                idx = pins[i + 1];
                mux = pins[i + 2];
+
+               if (bank > 5 || idx >= 32 || mux > 15)
+                       continue;
+
                pull = rk3588_pull(bank, idx, pins[i + 3]);
                strength = rk3588_strength(bank, idx, pins[i + 3]);
                schmitt = rk3588_schmitt(bank, idx, pins[i + 3]);
 
-               if (bank > 5 || idx > 32 || mux > 15)
-                       continue;
-
                if (bank == 0 && idx < 12) {
                        /* PMU1 */
                        iomux_base = RK3588_PMU1_IOC;