Hi,

On Thu, Jan 10, 2019 at 04:26:32PM +0800, Chen-Yu Tsai wrote:
> On the A80, the pin banks go up to PN, which translates to the 14th
> entry in the regulator array. The array is only 12 entries long, which
> causes the sunxi_pmx_{request,free} functions to access beyond the
> array on the A80 and the A31 (which has pin bank PM). While the
> accessed data is still valid allocated data within the same driver
> data structure, it is likely not a pointer.
> 
> Increase the size of the regulator array from 12 to 14. This is a simple
> fix. While we could have the code take into account the fact that R_PIO
> pin banks start from PL, or maybe even dynamically allocate the array
> based on the last pin of the pin controller, the size reduction probably
> isn't worth the additional code complexity.
> 
> Fixes: 9a2a566adb00 ("pinctrl: sunxi: Deal with per-bank regulators")
> Signed-off-by: Chen-Yu Tsai <wens@csie.org>

I definitely overlooked the R_PIO case, sorry. I guess the proper fix
would be the first alternative one you suggested, and we should take
the pin_base into account. There's no need to store twice such a large
array for this case.

Maxime

-- 
Maxime Ripard, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com