[PATCH v3] mfd: ls2kbmc: mfd: ls2kbmc: Fix iomem pointer handling in video mode parsing

[Binbin Zhou]

Use pointers annotated with the __iomem marker for all iomem map calls,
and creates a local copy of the mapped IO memory for future access in
the code. memcpy_fromio() and memcpy_toio() are used to read/write data
from/to mapped IO memory

Cc: stable@xxxxxxxxxxxxxxx # v6.18+
Fixes: 0d64f6d1ffe9 ("mfd: ls2kbmc: Introduce Loongson-2K BMC core driver")
Reported-by: kernel test robot <lkp@xxxxxxxxx>
Closes: https://lore.kernel.org/oe-kbuild-all/202603021730.Yy3QXYTw-lkp@xxxxxxxxx/
Closes: https://lore.kernel.org/oe-kbuild-all/202606120639.WG6eb8VU-lkp@xxxxxxxxx/
Reviewed-by: Huacai Chen <chenhuacai@xxxxxxxxxxx>
Signed-off-by: Binbin Zhou <zhoubinbin@xxxxxxxxxxx>
---
V3:
 - Reduce the range of `ioremap` from `SZ_16M` to `SZ_64`;
 - Define a new variable `pos` to iterate through the string;
 - Add failure handling for `strncmp()`.

Link to V2:
https://lore.kernel.org/all/20260624085550.1508771-1-zhoubinbin@xxxxxxxxxxx/

V2:
 - Add the missing memcpy_fromio();
 - Drop the unnecessary `buf` variable.

Link to V1:
https://lore.kernel.org/all/20260616115530.4012675-1-zhoubinbin@xxxxxxxxxxx/

 drivers/mfd/ls2k-bmc-core.c | 29 ++++++++++++++++++++++-------
 1 file changed, 22 insertions(+), 7 deletions(-)

diff --git a/drivers/mfd/ls2k-bmc-core.c b/drivers/mfd/ls2k-bmc-core.c
index 408056bfb2fe..a2aee2131529 100644
--- a/drivers/mfd/ls2k-bmc-core.c
+++ b/drivers/mfd/ls2k-bmc-core.c
@@ -66,6 +66,9 @@
 /* Maximum time to wait for U-Boot and DDR to be ready with ms. */
 #define LS2K_BMC_RESET_WAIT_TIME	10000
 
+/* The length of the LS2K BMC display resolution string stored in PCI BAR0 */
+#define LS2K_RESOLUTION_STR_LEN		SZ_64
+
 /* It's an experience value */
 #define LS7A_BAR0_CHECK_MAX_TIMES	2000
 
@@ -427,27 +430,39 @@ static int ls2k_bmc_init(struct ls2k_bmc_ddata *ddata)
  */
 static int ls2k_bmc_parse_mode(struct pci_dev *pdev, struct simplefb_platform_data *pd)
 {
-	char *mode;
+	char *mode __free(kfree) = NULL;
+	void __iomem *base;
+	char *pos = NULL;
 	int depth, ret;
 
 	/* The last 16M of PCI BAR0 is used to store the resolution string. */
-	mode = devm_ioremap(&pdev->dev, pci_resource_start(pdev, 0) + SZ_16M, SZ_16M);
+	base = devm_ioremap(&pdev->dev, pci_resource_start(pdev, 0) + SZ_16M,
+			    LS2K_RESOLUTION_STR_LEN);
+	if (!base)
+		return -ENOMEM;
+
+	mode = kmalloc(LS2K_RESOLUTION_STR_LEN, GFP_KERNEL);
 	if (!mode)
 		return -ENOMEM;
 
+	memcpy_fromio(mode, base, LS2K_RESOLUTION_STR_LEN);
+
 	/* The resolution field starts with the flag "video=". */
-	if (!strncmp(mode, "video=", 6))
-		mode = mode + 6;
+	if (strncmp(mode, "video=", 6)) {
+		dev_err(&pdev->dev, "Simpledrm resolution missing or corrupt!\n");
+		return -EINVAL;
+	}
 
-	ret = kstrtoint(strsep(&mode, "x"), 10, &pd->width);
+	pos = mode + 6;
+	ret = kstrtoint(strsep(&pos, "x"), 10, &pd->width);
 	if (ret)
 		return ret;
 
-	ret = kstrtoint(strsep(&mode, "-"), 10, &pd->height);
+	ret = kstrtoint(strsep(&pos, "-"), 10, &pd->height);
 	if (ret)
 		return ret;
 
-	ret = kstrtoint(strsep(&mode, "@"), 10, &depth);
+	ret = kstrtoint(strsep(&pos, "@"), 10, &depth);
 	if (ret)
 		return ret;
 

base-commit: d5d2d7a8d8be18681a0864f58e3875f1c639e11c
-- 
2.52.0