From: kettenis <kettenis@openbsd.org>
Date: Sun, 11 Feb 2024 16:01:09 +0000 (+0000)
Subject: Fix potential out-of-bounds array access.
X-Git-Url: http://artulab.com/gitweb/?a=commitdiff_plain;h=8cff70dd7f9ae4b7290bc90cf5505ae9a5b6479a;p=openbsd

Fix potential out-of-bounds array access.

Found by smatch, reported by and ok jsg@
---

diff --git a/sys/dev/fdt/rkpinctrl.c b/sys/dev/fdt/rkpinctrl.c
index 159b8cc4980..50e771689ac 100644
--- a/sys/dev/fdt/rkpinctrl.c
+++ b/sys/dev/fdt/rkpinctrl.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: rkpinctrl.c,v 1.14 2023/09/22 01:10:44 jsg Exp $	*/
+/*	$OpenBSD: rkpinctrl.c,v 1.15 2024/02/11 16:01:09 kettenis Exp $	*/
 /*
  * Copyright (c) 2017, 2018 Mark Kettenis <kettenis@openbsd.org>
  *
@@ -260,12 +260,13 @@ rk3288_pinctrl(uint32_t phandle, void *cookie)
 		bank = pins[i];
 		idx = pins[i + 1];
 		mux = pins[i + 2];
-		pull = rk3288_pull(bank, idx, pins[i + 3]);
-		strength = rk3288_strength(bank, idx, pins[i + 3]);
 
-		if (bank > 8 || idx > 32 || mux > 7)
+		if (bank > 8 || idx >= 32 || mux > 7)
 			continue;
 
+		pull = rk3288_pull(bank, idx, pins[i + 3]);
+		strength = rk3288_strength(bank, idx, pins[i + 3]);
+
 		/* Bank 0 lives in the PMU. */
 		if (bank < 1) {
 			rm = sc->sc_pmu;
@@ -401,12 +402,13 @@ rk3308_pinctrl(uint32_t phandle, void *cookie)
 		bank = pins[i];
 		idx = pins[i + 1];
 		mux = pins[i + 2];
+
+		if (bank > 4 || idx >= 32 || mux > 7)
+			continue;
+
 		pull = rk3308_pull(bank, idx, pins[i + 3]);
 		strength = rk3308_strength(bank, idx, pins[i + 3]);
  
-		if (bank > 4 || idx > 32 || mux > 7)
-			continue;
-
 		base = RK3308_GRF_GPIO0A_IOMUX;
 
 		s = splhigh();
@@ -546,12 +548,13 @@ rk3328_pinctrl(uint32_t phandle, void *cookie)
 		bank = pins[i];
 		idx = pins[i + 1];
 		mux = pins[i + 2];
-		pull = rk3328_pull(bank, idx, pins[i + 3]);
-		strength = rk3328_strength(bank, idx, pins[i + 3]);
 
-		if (bank > 3 || idx > 32 || mux > 3)
+		if (bank > 3 || idx >= 32 || mux > 3)
 			continue;
 
+		pull = rk3328_pull(bank, idx, pins[i + 3]);
+		strength = rk3328_strength(bank, idx, pins[i + 3]);
+
 		base = RK3328_GRF_GPIO0A_IOMUX;
 
 		s = splhigh();
@@ -738,12 +741,13 @@ rk3399_pinctrl(uint32_t phandle, void *cookie)
 		bank = pins[i];
 		idx = pins[i + 1];
 		mux = pins[i + 2];
-		pull = rk3399_pull(bank, idx, pins[i + 3]);
-		strength = rk3399_strength(bank, idx, pins[i + 3]);
 
-		if (bank > 5 || idx > 32 || mux > 3)
+		if (bank > 4 || idx >= 32 || mux > 3)
 			continue;
 
+		pull = rk3399_pull(bank, idx, pins[i + 3]);
+		strength = rk3399_strength(bank, idx, pins[i + 3]);
+
 		/* Bank 0 and 1 live in the PMU. */
 		if (bank < 2) {
 			rm = sc->sc_pmu;
@@ -986,13 +990,14 @@ rk3568_pinctrl(uint32_t phandle, void *cookie)
 		bank = pins[i];
 		idx = pins[i + 1];
 		mux = pins[i + 2];
+
+		if (bank > 5 || idx >= 32 || mux > 7)
+			continue;
+
 		pull = rk3568_pull(bank, idx, pins[i + 3]);
 		strength = rk3568_strength(bank, idx, pins[i + 3]);
 		schmitt = rk3568_schmitt(bank, idx, pins[i + 3]);
 
-		if (bank > 5 || idx > 32 || mux > 7)
-			continue;
-
 		/* Bank 0 lives in the PMU. */
 		if (bank < 1) {
 			rm = sc->sc_pmu;
@@ -1170,13 +1175,14 @@ rk3588_pinctrl(uint32_t phandle, void *cookie)
 		bank = pins[i];
 		idx = pins[i + 1];
 		mux = pins[i + 2];
+
+		if (bank > 5 || idx >= 32 || mux > 15)
+			continue;
+
 		pull = rk3588_pull(bank, idx, pins[i + 3]);
 		strength = rk3588_strength(bank, idx, pins[i + 3]);
 		schmitt = rk3588_schmitt(bank, idx, pins[i + 3]);
 
-		if (bank > 5 || idx > 32 || mux > 15)
-			continue;
-
 		if (bank == 0 && idx < 12) {
 			/* PMU1 */
 			iomux_base = RK3588_PMU1_IOC;