From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 18B13C4451B for ; Mon, 20 Jul 2026 03:31:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender:List-Subscribe:List-Help :List-Post:List-Archive:List-Unsubscribe:List-Id:MIME-Version:Cc:To: In-Reply-To:References:Message-Id:Content-Transfer-Encoding:Content-Type: Subject:Date:From:Reply-To:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=EClAtv2h5kHEPJgSHYPfps/esVjFAZoWMporRerY9ls=; b=voJAZ6nO80uxl4mUW57cxxUREg ollBbJAnJYVit56PkhdSlcp5nVJDd4Lfui6K95OTxXGeFKu5JV8yq1E9TES9Y+xK7Z1M8Pm79rJuf AytBYF84KD8KsfG7hlo4Jyq6m2YJW20T3zQtVm/1iHYljBg6o6rylB4d+ecx7gSj0QqiXeyve+gbS hDDCwOaItTJvZ5hDmXVqcuoTDRULCqNMKnb3vNjQ0OFr1WJCFVdU85xKLgaMoLinvAFIyjsT7MZUa fgWSWgLMcKP8lVXQUdEvh+v+oBE2rU0+58919Dqw3fxrHFKl/jyr5ZrMDAbNED8tuoNSjynKSNvXB hBxZeObw==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.99.1 #2 (Red Hat Linux)) id 1wleiW-00000005lnU-2BIX; Mon, 20 Jul 2026 03:30:56 +0000 Received: from mail-northeuropeazlp170110003.outbound.protection.outlook.com ([2a01:111:f403:c200::3] helo=DU2PR03CU002.outbound.protection.outlook.com) by bombadil.infradead.org with esmtps (Exim 4.99.1 #2 (Red Hat Linux)) id 1wleiS-00000005lm3-1c86 for linux-arm-kernel@lists.infradead.org; Mon, 20 Jul 2026 03:30:53 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=HOvgAFeAIbqHgeG9e9MuHtrwqM7Iuo0zkBjXFsmQMxR9qb+c1jx4+ZsB6QP1OfCIyW2xsDkPoetleMFp8fXKyECB9k8lCL7ta+195aBtBZnM2rCTv59KLzoLCGm2lVG2FoCSt4dyCjxGoQwwNx4xPXdLoBS0FsPw3T3OQg09ica1sILVicrnPjDSox54h6D8hcZFGjXAQlOcpdROoiB8Z/HY7W1ZTxUSR4HE986np2vsMp2jRF2MUBGo5jpOBdMZy14FpbuMGykF3TCsWfhd7CrbQ3IbM32/hGIEXdHwzWuEhRNs1QhEzL7imrWrfLyJKaWhDWGRBoqQHkFca2qocg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=EClAtv2h5kHEPJgSHYPfps/esVjFAZoWMporRerY9ls=; b=gRwDJH0/6tsK/gOxmPPm16qPDYXEm1dJUXB4MpXEQsLhgWJeApAKfz0xdXO3RCBPvJyVYcZf6PeM7CNKL9jVTcyhyZSmv318VTDiSUuF+jDTRPSXaJl+SVR4Go9OoIxmgGrhZictrUY3uTznsTzLttfxghASEjdnuHzqRwuVJ0nCdbTaHKW/YHu0tzrwi2PiYHu7/XDDz/WFwBPI041LoWWEYjLlT9oCLGYxZqFi9/rSVzoDxHnlRxDx+rL5LYUO9wFVQFnfBOwinzJNYPHvZ6wcpm1Pfyj8M2w57mpc+fU9N8PpSWlaFNk2Lsu6yJ/VwDYcBVyznnyB+r+8UzH+kA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oss.nxp.com; dmarc=pass action=none header.from=oss.nxp.com; dkim=pass header.d=oss.nxp.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=NXP1.onmicrosoft.com; s=selector1-NXP1-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=EClAtv2h5kHEPJgSHYPfps/esVjFAZoWMporRerY9ls=; b=w9u0zXcmZ6aobE+/XD2k5DBPwd77BnGUAsUPZgNjp3b7CW6MiH26WZa6YkZUQuyJdJrNk6ta5why5Oa/uBnJq1AhfNi4uyu31nypQ+Z7AiUbbvPS9kSWIMMgcI7N85Q/+TkhTbmlh/VlxjQTqvf33Y8K/L0gwvvHQl36aurT+5j8YXI9coNgcXJjNPGycS6bgw2dTDwblU/bf9lJCrUATSCWhBJLB9fFBlO+v+mVORlrp9Lt1be/aDNS/Bj//wFx6cxqcr9QUltYjUcmKZuohQTxV4WAAWF4vZc/9shAbnLMqv+bld1+EoIittubv2dtFVaPwvNyS0lQNfpubTHfKw== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=oss.nxp.com; Received: from GV1PR04MB11513.eurprd04.prod.outlook.com (2603:10a6:150:284::9) by GV1PR04MB10534.eurprd04.prod.outlook.com (2603:10a6:150:205::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.223.16; Mon, 20 Jul 2026 03:30:48 +0000 Received: from GV1PR04MB11513.eurprd04.prod.outlook.com ([fe80::29e0:98a1:4577:2cc7]) by GV1PR04MB11513.eurprd04.prod.outlook.com ([fe80::29e0:98a1:4577:2cc7%3]) with mapi id 15.21.0223.012; Mon, 20 Jul 2026 03:30:48 +0000 From: Guoniu Zhou Date: Mon, 20 Jul 2026 11:34:03 +0800 Subject: [PATCH v2 1/6] media: nxp: imx8-isi: Fix stream ID validation bypass in crossbar routing Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-Id: <20260720-isi-v2-1-45845bc5d4fa@oss.nxp.com> References: <20260720-isi-v2-0-45845bc5d4fa@oss.nxp.com> In-Reply-To: <20260720-isi-v2-0-45845bc5d4fa@oss.nxp.com> To: Laurent Pinchart , Mauro Carvalho Chehab , Frank Li , Sascha Hauer , Pengutronix Kernel Team , Fabio Estevam , Christian Hemp , Stefan Riedmueller , Jacopo Mondi , Loic Poulain , Bryan O'Donoghue Cc: Dong Aisheng , Guoniu Zhou , linux-media@vger.kernel.org, imx@lists.linux.dev, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, Guoniu Zhou , stable@vger.kernel.org X-Mailer: b4 0.14.0 X-Developer-Signature: v=1; a=ed25519-sha256; t=1784518456; l=2001; i=guoniu.zhou@oss.nxp.com; s=20250815; h=from:subject:message-id; bh=7LdACj5/lGKsIoxWOTOdpGddV95ttSQd0PgfXBxA818=; b=ovwp1BlR323v7/rkvymxUUus71e/XsRFb0BlhVNwvpauQuc9dY0AhjggUYI2TK4B8MfXmShvh Fvxkggcb2bTAshh6PR58elKotnyXsyjXBXT2NeUE0OEb5qtYKu8uB6q X-Developer-Key: i=guoniu.zhou@oss.nxp.com; a=ed25519; pk=MM+/XICg5S78/gs+f9wtGP6yIvkyjTdZwfaxXeu5rlo= X-ClientProxiedBy: MA0PR01CA0096.INDPRD01.PROD.OUTLOOK.COM (2603:1096:a01:af::12) To GV1PR04MB11513.eurprd04.prod.outlook.com (2603:10a6:150:284::9) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: GV1PR04MB11513:EE_|GV1PR04MB10534:EE_ X-MS-Office365-Filtering-Correlation-Id: abf1778f-2d25-4759-5a9f-08dee60f4a28 X-LD-Processed: 686ea1d3-bc2b-4c6f-a92c-d99c5c301635,ExtAddr X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|19092799006|376014|7416014|366016|23010399003|1800799024|921020|22082099003|18002099003|3023799007|6133799003|5023799004|56012099006|11063799006|10067099003; X-Microsoft-Antispam-Message-Info: zn35QKF70ET4Bjnp8+7jvx4b5/ituUE7JhPDpey+O4JC4e8Z9GP4GXdttJfRE28eImr8xig6Pfmxxj6JVmSvre+G0hlKa3h5PebzWLHZlpBFVT5VFWyin+yER5AOW83gTPCBr28y3UrmSkjfpA4i5WzETzCRE3afGz70Feo93c6qVBrBSmQmkYnZKD8vjwAXfy0T6laiTiF3mXTKc3R3Nl58Dm7pl35OjdqzJ/EqxXbPQUE4fjbumg6sxQFAPPDdbXXPUrttgIzh+dt3IVxOOEvIUGVF3DdeiRrfZlehQ7Zz5UuU53iG/p7+LVGiiSCqydO+RVj3W9Q9cASUmkrLc2w2acRnuoduPpR2QPUeQDhI9GwedR+eaI4uW5dIdgGID87tEzL0VbJJAEcSC5aR/6Xmp5xMrSxqtuW48Dt0pN3NryD11sYhfdHbbY1wZSb+aull6GdYP6eBawbAr6n5GzP3pX1nIJMkQ+muY2In3ZzK/fF9GFYbu5DcsuLrcngte8ekJsee3FqecrlKt7laxC0LdUUjdSv6wtS5+DG9FDHp+CpsXAu9ypfU7WO9FC9r4kkg/8xVTNnMr76/bm6Z0IhWm9RYbFcQJbwbYwKwR6ul6dpZJEeBCCH3V07svJoFSesXzJ1LNJXkRW8lftvgq4ruiCgZpbaeZc6nEU5aRLEZggKa0YO/4hpoR3LhWQc1LxpjBDqrklCQOmuCIRq/KA== X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:GV1PR04MB11513.eurprd04.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(19092799006)(376014)(7416014)(366016)(23010399003)(1800799024)(921020)(22082099003)(18002099003)(3023799007)(6133799003)(5023799004)(56012099006)(11063799006)(10067099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?eDcxYk5JUUlLaGJkaVZUL1Y0RG1tWTlUMDUvMGdIRU9qUnhkTmJDNzg5S2xY?= =?utf-8?B?bnl4ZDd4QVRWb1ZkeE5LeSt5cSt6cW1rd2kzVnRlT2prKzlwVWVrdDlhMFEr?= =?utf-8?B?T0N1UThGVWNqeVFPTnNXQlRkVzVrcmczRlR5alNTWkRqbStRYTZ5TmFMQmE3?= =?utf-8?B?Vll6VjF2ZmxiNkJvZzhGc3Yrbi9oUlJucXl2dFNveTBWUHhJVFNZTTd3T1JQ?= =?utf-8?B?d3lQRWE1Y2pZMitiVm5LQVdydkVpWGhJeXJKNzJiRE9FdlVSNGlLUmNMZDZz?= =?utf-8?B?OUhBek5JQXc1L0lIK2ZLMXJkRDV3ajF3WVRobVpQbmdSdEhDeHYxRThCV1lZ?= =?utf-8?B?SmRHcjhoMzNpamEyVVFjSzluTUpLRm9uR0pOWXJTeUpKa3R2b0g3d2VSeDZo?= =?utf-8?B?TnNOMk44L2FKMUtEdjFVRnZsODlzdEFqc2FqRDg3QWFhYkY3YmhpUlpEdkJv?= =?utf-8?B?Z1p6dThRSDZHVGZYU3VmT2p0TWFnREpWbDZxVnJIdk1TUk1ESjBNYnB2K0ZK?= =?utf-8?B?MWlaRDdZT3BSSDgxcmVhMWQrVW1tNVVaUzdtcU5zMEFFQnVPR3NDdXBjWC9w?= =?utf-8?B?NGVYQmx3ektYSTRRRFVGUHgvVHViSFpRKzlaOHBEck5pUVZGTlBVeUFaNHJ5?= =?utf-8?B?OTN1dXA1Y3ZtbmNrQ3k1bXhGdkNjTzhGaC9lVzZLWE8zemJMMlkrNDk2bTd6?= =?utf-8?B?WGdFQzNsWnpWSmxmcElvUGdEdkkwRERmZkN4cVNocnJkak85UVJTMFhTQ0NT?= =?utf-8?B?TnQzMmJobnpSMGZabFNMaWtCdWhETUVpWWdXeVBncjlRQ3UrbmZjNDRDekVX?= =?utf-8?B?RGdtekNsWENTKzU2WU1NeTVXd215eFJwVHdvQVgvTVpTZk9HSnErZUdhTXBG?= =?utf-8?B?ZFNKbVBleHdEOVZBbVBhcW5YSTUyUzdqbmpPdGhZSEhsQmdXZmY2a3VFOUNz?= =?utf-8?B?NVVUSUxHOVVkYXZiSlowaXlHeVRqOG0zdlhlakdYbE5GWC9rUFRnUmhvVFZh?= =?utf-8?B?ZlNVNzd3RUJWN29keXUycHNxSUtaT1hIcmlUdUR5ZGl6elo3VVBFNkpCK01J?= =?utf-8?B?eTNqc21nL3pteDFhZmRxdHFyb0NoSzJqSVpiSWVjSHJiYy9JWjV2RGNQa0Vo?= =?utf-8?B?SDJoWGc0cnUvOUlsZ3Iwcm9Wbk9WTkZVdEdJbXNjcGtnR1VoQklWSGlEMjVu?= =?utf-8?B?OTRnSjZZUVhZZExBNXE4YXJvTERra1dJMW0rSkNJOEZvOFhiTUVhaW42am5x?= =?utf-8?B?WmNycFlIS1M4QkM0TXRwRTBIaEwzci9LYllzVHlNelkxOWZwUVlXTUlWQjhi?= =?utf-8?B?WGtKZ2xBZ2pKSENmMEdWb1FEU1NheW1WU1BMVWtyNEdQcFlSME10U1NxaTFx?= =?utf-8?B?RHNnRjRqQ09pSHhVc1RSaEVKdFkxeVZjbU9CZEZDOXNOeEYzM2NrWDNNR3M2?= =?utf-8?B?alozSm15ODFqS1lsM3c2T3Z3UzZuN1JaODJmeEhtcnFzTTN6UlpNT1NLNlFk?= =?utf-8?B?c3prWld3Vkg0WDZIb3FHQUxJSzYvZGdhU0NPM0lzVU5Da0k1TTZEUUpsRnBq?= =?utf-8?B?SDlaMGRMM20wbW5VUVVLNmwvbHUxNld6Zk1CWWV1ajJ0Z0ZEWFZEaTJTN3dM?= =?utf-8?B?NTQ1OURPaW9jK3dpa3RtejhFUFhSYkpNR2lzMFhtTUg0ZTVXSWlnTjgvUHpm?= =?utf-8?B?QlJUcnhsT0ZrQlVLTlNLWTIwOVVHaWV3bWJ6TktMeTJwRmFNVXBzbGk1YUMw?= =?utf-8?B?UDlveVhnZ2NZRWxDY01OaklLN0dYeXNkMzlsUkU5ZUErMFgvQ3JEQ3BEWkxF?= =?utf-8?B?d2N1Y0xVRlc2dFQ3Mkp4eWdjNHFpdUVHQi83Y2tmeDZET3BJa09ZTDZuU2tx?= =?utf-8?B?RTF0MTFWbHA0R05TcE0yYkc1Zkk0MVdqN0FoMzlPUnV0eG9Oa3hCek9Pajk4?= =?utf-8?B?R2J2WXFJcjNZQ3dUR3VyYzJCNnZUK25jYjAwWWd1VlJlTDlqZDhqY1pUOTMr?= =?utf-8?B?U1NOZEFHR0Rydy9EMlhwbTlmck5WZDZDd0tTRzVwL2ozM3JyTzFEMFEyWm9y?= =?utf-8?B?elBpTDg3SkJ3SjE5NldjdVB4cjR3NndJYVZySUw4ZXRMeWJkbWNtQVhxUFlQ?= =?utf-8?B?d2JXUGY4czBoUkFzdkxHc21mUmMzSHFPcmZQWkZvT3RwZktDSFNnNW5DYXlK?= =?utf-8?B?YzJMSlQ5ZmdkNlltMjVXT3c3MldJT1M3RDJTU0NxK0U1UmlGTSt1cjJWYWM1?= =?utf-8?B?QTc0L1dOUEFjWnpjZzVwa0ZNUFZZc0J1T3MzYWJTYTJtdS9sVjhFNEhhdEVK?= =?utf-8?B?clc3SmY1b1NTTktTNFROL0d0UloyTzcvdVEzS0txMjJHeUxRL2ppbFFyYzRr?= =?utf-8?Q?PLh44u002IcmIIJGCxqmH3N4eWl97gnT8PvNf?= X-OriginatorOrg: oss.nxp.com X-MS-Exchange-CrossTenant-Network-Message-Id: abf1778f-2d25-4759-5a9f-08dee60f4a28 X-MS-Exchange-CrossTenant-AuthSource: GV1PR04MB11513.eurprd04.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 20 Jul 2026 03:30:47.9177 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 686ea1d3-bc2b-4c6f-a92c-d99c5c301635 X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: ZqJrFXYe2Vy2V3VDZqyr9yQlp1oPwMwOZzUbRuzqVGWzk1Yb49YVu11OIVDs1Rpt0o/3sQMgy9GOOocisd5n0VN+jpAoveXlbBXUx9b8rBaMKMd6GoUIi9sqFRZW9Yj1 X-MS-Exchange-Transport-CrossTenantHeadersStamped: GV1PR04MB10534 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.9.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20260719_203052_436533_37109D38 X-CRM114-Status: GOOD ( 14.97 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org The crossbar routing validation has a critical bug where it validates the wrong routing table, allowing userspace to bypass validation entirely. The __mxc_isi_crossbar_set_routing() function is called to validate and apply a new routing table from userspace. However, the validation loop iterates over state->routing (the currently active routing table) instead of the routing parameter (the new table being validated): for_each_active_route(&state->routing, route) { This means userspace can submit any invalid routing configuration and it will pass validation as long as the currently active routing is valid. This is a security issue as it allows userspace to configure routes that violate hardware constraints, potentially causing undefined hardware behavior. Fix by validating the routing table that will actually be applied. Fixes: cf21f328fcaf ("media: nxp: Add i.MX8 ISI driver") Cc: stable@vger.kernel.org Signed-off-by: Guoniu Zhou --- Changes in v2: - Split v1 patch 1/5 into two patches: this patch fixes the core for_each_active_route() bug, next patch adds additional stream validation (Frank Li) --- drivers/media/platform/nxp/imx8-isi/imx8-isi-crossbar.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/media/platform/nxp/imx8-isi/imx8-isi-crossbar.c b/drivers/media/platform/nxp/imx8-isi/imx8-isi-crossbar.c index c580c831972e..84871bceb31d 100644 --- a/drivers/media/platform/nxp/imx8-isi/imx8-isi-crossbar.c +++ b/drivers/media/platform/nxp/imx8-isi/imx8-isi-crossbar.c @@ -107,7 +107,7 @@ static int __mxc_isi_crossbar_set_routing(struct v4l2_subdev *sd, return ret; /* The memory input can be routed to the first pipeline only. */ - for_each_active_route(&state->routing, route) { + for_each_active_route(routing, route) { if (route->sink_pad == xbar->num_sinks - 1 && route->source_pad != xbar->num_sinks) { dev_dbg(xbar->isi->dev, -- 2.34.1