Re: [PATCH v8 5/9] media: Documentation: uapi: Add qcom-camss ISP params documentation

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] doc: userspace example crashes under _FORTIFY_SOURCE due to __counted_by
--

commit 051ac0c97fb5f4276626ca22d484402bd8d6a07a
Author: Loic Poulain <loic.poulain@oss.qualcomm.com>

media: Documentation: uapi: Add qcom-camss ISP params documentation

Add documentation for the Qualcomm CAMSS ISP parameters metadata format.
The patch defines parameter structures and includes a code example to
illustrate populating the buffer for the OPE processing pipeline.

> diff --git a/Documentation/userspace-api/media/v4l/metafmt-qcom-isp.rst b/Documentation/userspace-api/media/v4l/metafmt-qcom-isp.rst
> new file mode 100644
> index 0000000000000..5e1fd5814ff78
> --- /dev/null
> +++ b/Documentation/userspace-api/media/v4l/metafmt-qcom-isp.rst

[ ... ]

> +	struct v4l2_isp_params_buffer *params =
> +		(struct v4l2_isp_params_buffer *)buffer;
> +
> +	params->version = V4L2_ISP_PARAMS_VERSION_V1;
> +	params->data_size = 0;
> +
> +	void *data = (void *)params->data;
> +
> +	struct camss_params_wb_gain *wb =
> +		(struct camss_params_wb_gain *)data;
> +
> +	memset(wb, 0, sizeof(*wb));
> +	wb->header.type = CAMSS_PARAMS_WB_GAIN;
> +	wb->header.flags = V4L2_ISP_PARAMS_FL_BLOCK_ENABLE;
> +	wb->header.size = sizeof(struct camss_params_wb_gain);
> +
> +	/* Unity gain on all three channels (15uQ10, 1024 = 1.0) */
> +	wb->g_gain = 1024;
> +	wb->b_gain = 1024;
> +	wb->r_gain = 1024;
> +
> +	data += sizeof(struct camss_params_wb_gain);
> +	params->data_size += sizeof(struct camss_params_wb_gain);

[Severity: Medium]
Could this example code crash userspace applications compiled with modern
compiler protections like _FORTIFY_SOURCE=3?

The v4l2_isp_params_buffer struct uses the __counted_by(data_size) attribute
for its data flexible array. Setting data_size to 0 and then writing to the
array elements (via memset) before updating data_size will cause dynamic
object size tracking to see an allocation of size 0, leading to a runtime
bounds-checking abort.

Additionally, does this snippet rely on non-standard pointer arithmetic?

The data pointer is declared as a void *, and incrementing it directly
using data += sizeof(struct camss_params_wb_gain) is a GCC extension rather
than standard C.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260921-camss-isp-ope-v8-0-dd1c86a3c8a0@oss.qualcomm.com?part=5