From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id ECF8FCA600A for ; Thu, 8 Oct 2026 07:29:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:MIME-Version:Reply-To:List-Subscribe: List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id:Date:References: In-Reply-To:Cc:To:Subject:From:Message-ID:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=9zwe3gHeDZpy1uzH872vIdHYVfQTMT3fZZVo4hJgNEU=; b=KpH114LW+GgLYu x5LHEiuVML3y3Mvj0V5F8O/jlvWmSBe85+9bzjdX5V94qzsVo8677hATClLMPP5pmNhokGs5DEynC nI3No1l0xpqvsiIWF2Mm62Recewipv05H+2P397rwnTGoQLAWmqEG5EkNT0TS85swKMbeEWwwLxm1 X2+i7y4VfkYeUCBD5vOzfBBlEkilO1PHGWb8bf2pSXYFQ8SCk+2EoZZldsVtcGKE0549uuDE+Vghq 6uowURkkWaiVnzoFckep/sQiK3JS9wVUrxLJlr9gDGFzTWcQ7SXzoYw7C7hXBAmHqSq6Q6pG+H65g TbGUSHb4NmFcIXl7Ht5Q==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.99.1 #2 (Red Hat Linux)) id 1xEiZ7-00000003kJu-2kOB; Thu, 08 Oct 2026 07:29:21 +0000 Received: from sea.source.kernel.org ([2600:3c0a:e001:78e:0:1991:8:25]) by bombadil.infradead.org with esmtps (Exim 4.99.1 #2 (Red Hat Linux)) id 1xEiZ7-00000003kJc-03Tf for linux-phy@lists.infradead.org; Thu, 08 Oct 2026 07:29:21 +0000 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) by sea.source.kernel.org (Postfix) with ESMTP id 600F3429D0; Thu, 8 Oct 2026 07:29:20 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id DD1E31F000FF; Thu, 8 Oct 2026 07:29:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1791444560; bh=LoqUM2YEELUiIvwftTXbSKEJZLI4BN3PEcn0ofvkAG8=; h=From:Subject:Reply-To:To:Cc:In-Reply-To:References:Date; b=M/im5R9ziNMj+RNBML0MPGJUVLachc5d9EYt4aICKMKF3/1QrohcKViX2fddWQdUo /R5OVw1RiL7SLptGYe2F9Siz9CJr9ZkWVXTOKT7IztrihDEM3aUc+KFhs2s3BlrbNd 7c98pLk2dlXzHyCZdwbAi1DU8ZbzwFEtF9kDsmdRkzNtRnH/+67LjiTNn8/CZp7yNE FkNEOUtiKuXT/WR1Q24RO+BUE4d+dIdcH6V+Qg+okjRsUoOwf60RHIogjkI41UCsSk IjGB6Ov3H0CjZZJdK2q/2UWZ6VLaQ/tggmWhxK9QKnubTl3S3mpq6q/vZhHJna+4W0 id0bbLE+Chwdw== Message-ID: From: sashiko-bot@kernel.org Subject: Re: [PATCH v19 05/12] media: qcom: camss: Add Kaanapali compatible To: "Hangxiang Ma" Cc: devicetree@vger.kernel.org, conor+dt@kernel.org, media-ci@linuxtv.org, neil.armstrong@linaro.org, vkoul@kernel.org, olteanv@gmail.com, robh@kernel.org, linux-phy@lists.infradead.org In-Reply-To: <20261008-kaanapali-camss-v19-5-b2c583ef50e0@oss.qualcomm.com> References: <20261008-kaanapali-camss-v19-0-b2c583ef50e0@oss.qualcomm.com> <20261008-kaanapali-camss-v19-5-b2c583ef50e0@oss.qualcomm.com> Date: Thu, 08 Oct 2026 07:29:19 +0000 X-BeenThere: linux-phy@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Linux Phy Mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: sashiko-reviews@lists.linux.dev MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Sender: "linux-phy" Errors-To: linux-phy-bounces+linux-phy=archiver.kernel.org@lists.infradead.org VGhhbmsgeW91IGZvciB5b3VyIGNvbnRyaWJ1dGlvbiEgU2FzaGlrbyBBSSByZXZpZXcgZm91bmQg MSBwb3RlbnRpYWwgaXNzdWUocykgdG8gY29uc2lkZXI6Ci0gW0hpZ2hdIG1lZGlhOiBxY29tOiBj YW1zczogbWlzc2luZyBEVCBwb3J0IGJvdW5kcyBjaGVjayBpbiBjYW1zc19wYXJzZV9lbmRwb2lu dF9ub2RlKCkKLS0KCmNvbW1pdCA3ODFkN2NjMWQxYmUyYTBiNjRlZjA0OTgyYzM4YmQ4MmZjNmMx YTVkCkF1dGhvcjogSGFuZ3hpYW5nIE1hIDxoYW5neGlhbmcubWFAb3NzLnF1YWxjb21tLmNvbT4K CiAgICBtZWRpYTogcWNvbTogY2Ftc3M6IEFkZCBLYWFuYXBhbGkgY29tcGF0aWJsZQogICAgCiAg ICBBZGQgQ0FNU1NfS0FBTkFQQUxJIGVudW0sIEthYW5hcGFsaSBjb21wYXRpYmxlIGFuZCBLYWFu YXBhbGkgQ0FNU1MgZHJpdmVyCiAgICBwcml2YXRlIGRhdGEuIFRoZSBwcml2YXRlIGRhdGEgY3Vy cmVudGx5IGluY2x1ZGVzIG9ubHkgYmFzaWMgaW5mb3JtYXRpb24uCiAgICBMYXRlciBjaGFuZ2Vz IHdpbGwgYWRkIENTSVBIWSwgVFBHLCBDU0lEIGFuZCBWRkUgcmVzb3VyY2VzLgoKPiBkaWZmIC0t Z2l0IGEvZHJpdmVycy9tZWRpYS9wbGF0Zm9ybS9xY29tL2NhbXNzL2NhbXNzLmMgYi9kcml2ZXJz L21lZGlhL3BsYXRmb3JtL3Fjb20vY2Ftc3MvY2Ftc3MuYwo+IGluZGV4IGM1NDE4NWM5M2E4YTku LmZjYTNkZTIxNGE5MjIgMTAwNjQ0Cj4gLS0tIGEvZHJpdmVycy9tZWRpYS9wbGF0Zm9ybS9xY29t L2NhbXNzL2NhbXNzLmMKPiArKysgYi9kcml2ZXJzL21lZGlhL3BsYXRmb3JtL3Fjb20vY2Ftc3Mv Y2Ftc3MuYwoKWyAuLi4gXQoKPiBAQCAtNTU3Niw2ICs1NTkwLDEzIEBAIHN0YXRpYyB2b2lkIGNh bXNzX3JlbW92ZShzdHJ1Y3QgcGxhdGZvcm1fZGV2aWNlICpwZGV2KQo+ICAJY2Ftc3NfZ2VucGRf Y2xlYW51cChjYW1zcyk7Cj4gIH0KPiAgCj4gK3N0YXRpYyBjb25zdCBzdHJ1Y3QgY2Ftc3NfcmVz b3VyY2VzIGthYW5hcGFsaV9yZXNvdXJjZXMgPSB7Cj4gKwkudmVyc2lvbiA9IENBTVNTX0tBQU5B UEFMSSwKPiArCS5wZF9uYW1lID0gInRvcCIsCj4gKwkuaWNjX3JlcyA9IGljY19yZXNfa2FhbmFw YWxpLAo+ICsJLmljY19wYXRoX251bSA9IEFSUkFZX1NJWkUoaWNjX3Jlc19rYWFuYXBhbGkpLAo+ ICt9Owo+ICsKCltTZXZlcml0eTogSGlnaF0KRG9lcyB0aGlzIGNvZGUgYWxsb3cgYW4gb3V0LW9m LWJvdW5kcyBhcnJheSBhY2Nlc3MgaWYgYSBtYWxmb3JtZWQgZGV2aWNlIHRyZWUKcHJvdmlkZXMg YW4gZXhjZXNzaXZlbHkgbGFyZ2UgcG9ydCBudW1iZXI/CgpUaGUgZHJpdmVyIHBhcnNlcyB0aGUg cG9ydCBlbmRwb2ludCBmcm9tIHRoZSBkZXZpY2UgdHJlZSBpbgpjYW1zc19wYXJzZV9lbmRwb2lu dF9ub2RlKCkgYW5kIHN0b3JlcyBpdCB3aXRob3V0IGJvdW5kcyBjaGVja2luZzoKCmRyaXZlcnMv bWVkaWEvcGxhdGZvcm0vcWNvbS9jYW1zcy9jYW1zcy5jOmNhbXNzX3BhcnNlX2VuZHBvaW50X25v ZGUoKSB7CgkuLi4KCWNzZC0+aW50ZXJmYWNlLmNzaXBoeV9pZCA9IHZlcC5iYXNlLnBvcnQ7Cgku Li4KfQoKVGhlbiBpbiBjYW1zc19zdWJkZXZfbm90aWZpZXJfYm91bmQoKSwgdGhpcyB1bnZhbGlk YXRlZCBpZCBpcyB1c2VkIHRvIGluZGV4CmludG8gdGhlIGR5bmFtaWNhbGx5IGFsbG9jYXRlZCBj YW1zcy0+Y3NpcGh5IGFycmF5OgoKZHJpdmVycy9tZWRpYS9wbGF0Zm9ybS9xY29tL2NhbXNzL2Nh bXNzLmM6Y2Ftc3Nfc3ViZGV2X25vdGlmaWVyX2JvdW5kKCkgewoJLi4uCgl1OCBpZCA9IGNzZC0+ aW50ZXJmYWNlLmNzaXBoeV9pZDsKCXN0cnVjdCBjc2lwaHlfZGV2aWNlICpjc2lwaHkgPSAmY2Ft c3MtPmNzaXBoeVtpZF07CgkuLi4KfQoKQ291bGQgdGhpcyBsZWFkIHRvIG1lbW9yeSBjb3JydXB0 aW9uIG9yIGEga2VybmVsIHBhbmljIGlmIHRoZSBwb3J0IG51bWJlcgpleGNlZWRzIGNhbXNzLT5y ZXMtPmNzaXBoeV9udW0/CgpXaGlsZSB0aGUgc3BlY2lmaWMgemVyby1zaXplIHBvaW50ZXIgaXNz dWUgZm9yIEthYW5hcGFsaSBpcyByZXNvbHZlZCBieQpmb2xsb3ctdXAgcGF0Y2hlcyBzZXR0aW5n IGNzaXBoeV9udW0sIHRoZSBtaXNzaW5nIGJvdW5kcyB2YWxpZGF0aW9uIGFwcGVhcnMgdG8KcmVt YWluIGEgdnVsbmVyYWJpbGl0eSBmb3IgYW55IGludmFsaWQgZGV2aWNlIHRyZWUuCgotLSAKU2Fz aGlrbyBBSSByZXZpZXcgwrcgaHR0cHM6Ly9zYXNoaWtvLmRldi8jL3BhdGNoc2V0LzIwMjYxMDA4 LWthYW5hcGFsaS1jYW1zcy12MTktMC1iMmM1ODNlZjUwZTBAb3NzLnF1YWxjb21tLmNvbT9wYXJ0 PTUKCi0tIApsaW51eC1waHkgbWFpbGluZyBsaXN0CmxpbnV4LXBoeUBsaXN0cy5pbmZyYWRlYWQu b3JnCmh0dHBzOi8vbGlzdHMuaW5mcmFkZWFkLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2xpbnV4LXBo eQo= From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8D7A93E49F7 for ; Thu, 8 Oct 2026 07:29:20 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791444563; cv=none; b=cEsTl25U+bDiLDobuZqfMn9mRiQqCWMymTpuHVSKGFrxiNglh2Mvn9L6zGu9W1lIRUW5Ct3kP/vikkvh1zohL1/VFWIw0BIQ+kTcfFzmmDjYgsMZTuyvna35NVCMZ2CRRshZLxlRbjTf0y4DNoMiT+I2CynX60DlQpTViWh2R0s= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791444563; c=relaxed/simple; bh=D6S8vUJ0cb95OQnRpxmXh4/hPp37KlroYFrYBnQADBs=; h=Message-ID:From:Subject:To:Cc:In-Reply-To:References:Content-Type: Date; b=iePZBi0lbRhIuLFR2Lv32qI7+IPA4rW/Totp9lSYUPCV1hCnlPVU7gDkmtZe+oUBisRTQmEXpU7EouIgSBWHMPXaDi8X8mHzHrqNq9FY5QtS1mgLyo79zBLzsx3KmytNsLC+hKKY+GFmDhEPrAYOQ74yW8NFnnm6+NL3GkvXt4M= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=M/im5R9z; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="M/im5R9z" Received: by smtp.kernel.org (Postfix) with ESMTPSA id DD1E31F000FF; Thu, 8 Oct 2026 07:29:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1791444560; bh=LoqUM2YEELUiIvwftTXbSKEJZLI4BN3PEcn0ofvkAG8=; h=From:Subject:Reply-To:To:Cc:In-Reply-To:References:Date; b=M/im5R9ziNMj+RNBML0MPGJUVLachc5d9EYt4aICKMKF3/1QrohcKViX2fddWQdUo /R5OVw1RiL7SLptGYe2F9Siz9CJr9ZkWVXTOKT7IztrihDEM3aUc+KFhs2s3BlrbNd 7c98pLk2dlXzHyCZdwbAi1DU8ZbzwFEtF9kDsmdRkzNtRnH/+67LjiTNn8/CZp7yNE FkNEOUtiKuXT/WR1Q24RO+BUE4d+dIdcH6V+Qg+okjRsUoOwf60RHIogjkI41UCsSk IjGB6Ov3H0CjZZJdK2q/2UWZ6VLaQ/tggmWhxK9QKnubTl3S3mpq6q/vZhHJna+4W0 id0bbLE+Chwdw== Message-ID: From: sashiko-bot@kernel.org Subject: Re: [PATCH v19 05/12] media: qcom: camss: Add Kaanapali compatible Reply-To: sashiko-reviews@lists.linux.dev To: "Hangxiang Ma" Cc: devicetree@vger.kernel.org, conor+dt@kernel.org, media-ci@linuxtv.org, neil.armstrong@linaro.org, vkoul@kernel.org, olteanv@gmail.com, robh@kernel.org, linux-phy@lists.infradead.org In-Reply-To: <20261008-kaanapali-camss-v19-5-b2c583ef50e0@oss.qualcomm.com> References: <20261008-kaanapali-camss-v19-0-b2c583ef50e0@oss.qualcomm.com> <20261008-kaanapali-camss-v19-5-b2c583ef50e0@oss.qualcomm.com> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Date: Thu, 08 Oct 2026 07:29:19 +0000 Precedence: bulk X-Mailing-List: devicetree@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Thank you for your contribution! Sashiko AI review found 1 potential issue(= s) to consider: - [High] media: qcom: camss: missing DT port bounds check in camss_parse_en= dpoint_node() -- commit 781d7cc1d1be2a0b64ef04982c38bd82fc6c1a5d Author: Hangxiang Ma media: qcom: camss: Add Kaanapali compatible =20 Add CAMSS_KAANAPALI enum, Kaanapali compatible and Kaanapali CAMSS driv= er private data. The private data currently includes only basic informatio= n. Later changes will add CSIPHY, TPG, CSID and VFE resources. > diff --git a/drivers/media/platform/qcom/camss/camss.c b/drivers/media/pl= atform/qcom/camss/camss.c > index c54185c93a8a9..fca3de214a922 100644 > --- a/drivers/media/platform/qcom/camss/camss.c > +++ b/drivers/media/platform/qcom/camss/camss.c [ ... ] > @@ -5576,6 +5590,13 @@ static void camss_remove(struct platform_device *p= dev) > camss_genpd_cleanup(camss); > } > =20 > +static const struct camss_resources kaanapali_resources =3D { > + .version =3D CAMSS_KAANAPALI, > + .pd_name =3D "top", > + .icc_res =3D icc_res_kaanapali, > + .icc_path_num =3D ARRAY_SIZE(icc_res_kaanapali), > +}; > + [Severity: High] Does this code allow an out-of-bounds array access if a malformed device tr= ee provides an excessively large port number? The driver parses the port endpoint from the device tree in camss_parse_endpoint_node() and stores it without bounds checking: drivers/media/platform/qcom/camss/camss.c:camss_parse_endpoint_node() { ... csd->interface.csiphy_id =3D vep.base.port; ... } Then in camss_subdev_notifier_bound(), this unvalidated id is used to index into the dynamically allocated camss->csiphy array: drivers/media/platform/qcom/camss/camss.c:camss_subdev_notifier_bound() { ... u8 id =3D csd->interface.csiphy_id; struct csiphy_device *csiphy =3D &camss->csiphy[id]; ... } Could this lead to memory corruption or a kernel panic if the port number exceeds camss->res->csiphy_num? While the specific zero-size pointer issue for Kaanapali is resolved by follow-up patches setting csiphy_num, the missing bounds validation appears= to remain a vulnerability for any invalid device tree. --=20 Sashiko AI review =C2=B7 https://sashiko.dev/#/patchset/20261008-kaanapali-= camss-v19-0-b2c583ef50e0@oss.qualcomm.com?part=3D5