Re: [PATCH v6 4/8] media: qcom: camss: Initialize lanes after lane configuration is available

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] The patch introduces an unconditional read of uninitialized heap memory (`regs->lane_regs`) for Gen1 platforms in `csiphy_lanes_enable()`.
--

commit 55583036179e2bfc17906697e5da8e0e61d94891
Author: David Heidelberg <david@ixit.cz>

media: qcom: camss: Initialize lanes after lane configuration is available

This commit delays lane initialization until after the lane configuration
is available, as it depends on whether D-PHY or C-PHY mode is in use. It
moves the lane initialization switch statement into csiphy_lanes_enable().

> diff --git a/drivers/media/platform/qcom/camss/camss-csiphy-3ph-1-0.c b/drivers/media/platform/qcom/camss/camss-csiphy-3ph-1-0.c
> index 15876eb973718..938c365eb352f 100644
> --- a/drivers/media/platform/qcom/camss/camss-csiphy-3ph-1-0.c
> +++ b/drivers/media/platform/qcom/camss/camss-csiphy-3ph-1-0.c
> @@ -1168,6 +1168,98 @@ static void csiphy_lanes_enable(struct csiphy_device *csiphy,
[ ... ]
> +	case CAMSS_8300:
> +	case CAMSS_8775P:
> +		if (c->phy_cfg == V4L2_MBUS_CSI2_CPHY) {
> +			regs->lane_regs = NULL;
> +			regs->lane_array_size = 0;
> +		} else {
> +			regs->lane_regs = &lane_regs_sa8775p[0];
> +			regs->lane_array_size = ARRAY_SIZE(lane_regs_sa8775p);
> +		}
> +		break;
> +	default:
> +		break;
> +	}
> +
> +	if (!regs->lane_regs && c->phy_cfg == V4L2_MBUS_CSI2_CPHY)

[Severity: Medium]
Will this evaluate uninitialized heap memory for Gen1 platforms?

Looking at csiphy_init(), regs is allocated using devm_kmalloc(), which
does not zero-initialize memory:

drivers/media/platform/qcom/camss/camss-csiphy-3ph-1-0.c:csiphy_init() {
    ...
	regs = devm_kmalloc(dev, sizeof(*regs), GFP_KERNEL);
	if (!regs)
		return -ENOMEM;

	csiphy->regs = regs;
    ...
}

For platforms that fall through to the default case in the switch block
above, regs->lane_regs remains uninitialized when it is subsequently
evaluated here. Could this regression lead to undefined behavior and
potential false positives or negatives for the C-PHY warning?

> +		WARN_ONCE(1, "Missing lane_regs definition for C-PHY!\n");
> +
>  	settle_cnt = csiphy_settle_cnt_calc(link_freq, csiphy->timer_clk_rate);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260603-qcom-cphy-v6-0-e50de0b557a8@ixit.cz?part=4