Re: [PATCH v7 4/8] media: qcom: camss: Initialize lanes after lane configuration is available

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Uninitialized memory read in csiphy_lanes_enable() for Gen 1 SoCs
--

commit 29ea95d7cd0cd620b740a193084b2b2f90d4327e
Author: David Heidelberg <david@ixit.cz>

media: qcom: camss: Initialize lanes after lane configuration is available

The lanes must not be initialized before the driver has access to
the lane configuration, as it depends on whether D-PHY or C-PHY mode
is in use. Move the lane initialization to csiphy_lanes_enable which is
called when the configuration structures are available.

> diff --git a/drivers/media/platform/qcom/camss/camss-csiphy-3ph-1-0.c b/drivers/media/platform/qcom/camss/camss-csiphy-3ph-1-0.c
> index fa24fc9706748..c76b9c352ea02 100644
> --- a/drivers/media/platform/qcom/camss/camss-csiphy-3ph-1-0.c
> +++ b/drivers/media/platform/qcom/camss/camss-csiphy-3ph-1-0.c
> @@ -1168,6 +1168,98 @@ static void csiphy_lanes_enable(struct csiphy_device *csiphy,
>  	u8 val;
>  	int i;
>  
> +	switch (csiphy->camss->res->version) {
[ ... ]
> +	case CAMSS_8300:
> +	case CAMSS_8775P:
> +		if (c->phy_cfg == V4L2_MBUS_CSI2_CPHY) {
> +			regs->lane_regs = NULL;
> +			regs->lane_array_size = 0;
> +		} else {
> +			regs->lane_regs = &lane_regs_sa8775p[0];
> +			regs->lane_array_size = ARRAY_SIZE(lane_regs_sa8775p);
> +		}
> +		break;
> +	default:
> +		break;
> +	}
> +
> +	if (!regs->lane_regs && c->phy_cfg == V4L2_MBUS_CSI2_CPHY)

[Severity: Medium]
Since regs is allocated with devm_kmalloc() in csiphy_init() and is not
zero-initialized, could regs->lane_regs contain garbage for Gen 1 platforms
that fall through to the default case above?

Because && evaluates left-to-right, this condition evaluates !regs->lane_regs
first, resulting in a read of uninitialized heap memory.

> +		WARN_ONCE(1, "Missing lane_regs definition for C-PHY!\n");

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260605-qcom-cphy-v7-0-426c37e9008f@ixit.cz?part=4