The sil,i2s-data-lanes property count is bounded, but each lane value indexes a four-entry lane table.
Reject lane values outside the supported table before building the FIFO sequence. Signed-off-by: Pengpeng Hou <[email protected]> --- drivers/gpu/drm/bridge/sii902x.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/bridge/sii902x.c b/drivers/gpu/drm/bridge/sii902x.c index ea543be..d68f0a5 100644 --- a/drivers/gpu/drm/bridge/sii902x.c +++ b/drivers/gpu/drm/bridge/sii902x.c @@ -890,9 +890,16 @@ static int sii902x_audio_codec_init(struct sii902x *sii902x, } codec_data.max_i2s_channels = 2 * num_lanes; - for (i = 0; i < num_lanes; i++) + for (i = 0; i < num_lanes; i++) { + if (lanes[i] >= ARRAY_SIZE(i2s_lane_id)) { + dev_err(dev, "%s: invalid i2s data lane %u\n", + __func__, lanes[i]); + return -EINVAL; + } + sii902x->audio.i2s_fifo_sequence[i] |= audio_fifo_id[i] | i2s_lane_id[lanes[i]] | SII902X_TPI_I2S_FIFO_ENABLE; + } sii902x->audio.mclk = devm_clk_get_optional(dev, "mclk"); if (IS_ERR(sii902x->audio.mclk)) {
