Re: [PATCH 1/5] media: nxp: imx8-isi: Fix stream ID validation bypass in crossbar routing

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] The validation incorrectly restricts the crossbar sink stream ID (`route->sink_stream`) using the number of downstream ISI pipelines (`xbar->num_sources`), which breaks valid MIPI CSI-2 Virtual Channel routing and exposes unsupported hardware states.
--

commit 53e2d411183facaf6d43d260ebd9674b6c727a89
Author: Guoniu Zhou <guoniu.zhou@oss.nxp.com>

media: nxp: imx8-isi: Fix stream ID validation bypass in crossbar routing

This commit fixes a bug where the crossbar routing validation checked the
currently active routing table instead of the new one provided by userspace.
It also adds hardware constraint validation for source and sink streams.

> diff --git a/drivers/media/platform/nxp/imx8-isi/imx8-isi-crossbar.c b/drivers/media/platform/nxp/imx8-isi/imx8-isi-crossbar.c
> --- a/drivers/media/platform/nxp/imx8-isi/imx8-isi-crossbar.c
> +++ b/drivers/media/platform/nxp/imx8-isi/imx8-isi-crossbar.c

[ ... ]

> @@ -106,8 +106,28 @@ static int __mxc_isi_crossbar_set_routing(struct v4l2_subdev *sd,
>  	if (ret)
>  		return ret;
>  
> -	/* The memory input can be routed to the first pipeline only. */
> -	for_each_active_route(&state->routing, route) {
> +	/*
> +	 * Validate routes against hardware constraints:
> +	 * - SOURCE stream must be 0 (pipes are hardcoded to stream 0)
> +	 * - SINK stream must be < ISI channel count
> +	 * - Memory input can only route to the first pipeline
> +	 */
> +	for_each_active_route(routing, route) {
> +		if (route->source_stream != 0) {
> +			dev_dbg(xbar->isi->dev,
> +				"route to pipe %u must use source_stream=0, got %u\n",
> +				route->source_pad - xbar->num_sinks,
> +				route->source_stream);
> +			return -ENXIO;
> +		}
> +
> +		if (route->sink_stream >= xbar->num_sources) {

[Severity: High]
Does this incorrectly restrict the sink stream ID using the number of
downstream pipelines (xbar->num_sources) instead of the actual MIPI CSI-2
Virtual Channel limit?

This appears to break valid V4L2 routing configurations for MIPI CSI-2
Virtual Channels 1-3 on SoC variants with a single processing pipeline
(e.g., i.MX8MN) where num_sources is 1.

Conversely, for SoCs with multiple pipelines, this might enable invalid
routes (stream IDs up to 7, exceeding the hardware's 2-bit limit) that
will silently fail since the capture logic remains hardcoded to Virtual
Channel 0.

> +			dev_dbg(xbar->isi->dev,
> +				"sink_stream %u exceeds hardware limit %u\n",
> +				route->sink_stream, xbar->num_sources - 1);
> +			return -ENXIO;
> +		}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260629-isi-v1-0-deebfdb1b07b@oss.nxp.com?part=1