Re: [PATCH] phy: exynos5-usbdrd: Use dynamic phy_cfg size to prevent OOB access

[Selvarasu Ganesan <selvarasu.g@samsung.com>]

On 9/18/2026 2:04 PM, André Draszik wrote:
> On Mon, 2026-08-31 at 12:33 +0530, Selvarasu Ganesan wrote:
>> The probe loop currently iterates using EXYNOS5_DRDPHYS_NUM (2),
>> creating both UTMI and PIPE3 PHY instances regardless of the SoC
>> capability. Several SoCs (Exynos2200, Exynos7870, Exynos850, Exynos990,
>> and ExynosAutoV920) provide phy_cfg arrays containing only a single
>> element.
>>
>> On these SoCs, when the loop reaches index 1, the driver reads past the
>> end of the rodata array, populating the second PHY instance with garbage
>> data. Since the configuration structure contains critical function
>> pointers (phy_isol, phy_init, set_refclk), any subsequent access to this
>> PHY instance via exynos5_usbdrd_phy_xlate could result in a kernel oops.
>>
>> Fix this by adding 'n_phy_cfg' to struct exynos5_usbdrd_phy_drvdata to
>> store the actual size of the phy_cfg array for each SoC. Update the
>> probe loop and the xlate function to bound their access against this
>> value instead of the hardcoded EXYNOS5_DRDPHYS_NUM.
>>
>> Assisted-by: Claude:claude-sonnet-5
> Shouldn't this be 'Assisted-by: LLM'?
You are correct. I will update the tag to 'Assisted-by: LLM' as per the 
kernel documentation in the next version.

Thank you for pointing this out.

Thanks,
Selva
>
>> Signed-off-by: Selvarasu Ganesan <selvarasu.g@samsung.com>
>> ---
>>   drivers/phy/samsung/phy-exynos5-usbdrd.c | 17 +++++++++++++++--
>>   1 file changed, 15 insertions(+), 2 deletions(-)
> Other than that:
>
> Reviewed-by: André Draszik <andre.draszik@linaro.org>

-- 
linux-phy mailing list
linux-phy@lists.infradead.org
https://lists.infradead.org/mailman/listinfo/linux-phy