On Thu, May 21, 2026 at 08:16:27PM +0800, Yingchao Deng wrote:

[...]

@@ -231,6 +254,8 @@ struct cti_trig_con *cti_allocate_trig_con(struct device *dev, int in_sigs, { struct cti_trig_con *tc = NULL; struct cti_trig_grp *in = NULL, *out = NULL;

• struct cti_drvdata *drvdata = dev_get_drvdata(dev);
• int n_trigs = drvdata->config.nr_trig_max;

I don't mind it allocates bitmask with nr_trig_max, but AI review suggests that when in_sigs / out_sigs bigger than nr_trig_max, it might access memory out-of-boundary (see cti_plat_read_trig_group()).

It is good to add a check:

if (in_sigs > n_trigs || out_sigs > n_trigs) { dev_err(dev, "trigger signal is out of range: in=%d out=%d nr_max=%d\n", in_sigs, out_sigs, n_trigs\n"); return NULL; }

With this:

Reviewed-by: Leo Yan leo.yan@arm.com

BTW, I have given my review tag on v8, please remember to update patches with review / ack tags.