Re: [PATCH 3/6] media: qcom: camss: Add Glymur compatible

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Missing bounds check for device tree endpoint port number against `camss->res->csiphy_num` leads to out-of-bounds array access and memory corruption.
--

commit f84037afd7728553fdb93e0bd472a151b8696e13
Author: Prashant Shrotriya <pshrotri@qti.qualcomm.com>
    
media: qcom: camss: Add Glymur compatible
    
This commit adds the CAMSS_GLYMUR enum, the Glymur compatible string, and
the initial private data structure for the Glymur camss driver. The
resources will be populated in subsequent commits.
    
> diff --git a/drivers/media/platform/qcom/camss/camss.c b/drivers/media/platform/qcom/camss/camss.c
> --- a/drivers/media/platform/qcom/camss/camss.c
> +++ b/drivers/media/platform/qcom/camss/camss.c
> @@ -5507,6 +5507,11 @@ static void camss_remove(struct platform_device *pdev)
>  	camss_genpd_cleanup(camss);
>  }
>  
> +static const struct camss_resources glymur_resources = {
> +	.version = CAMSS_GLYMUR,
> +	.pd_name = "top",
> +};

[Severity: High]
This isn't a bug introduced by this patch, but is a pre-existing issue
affecting all supported SoCs.

In camss_parse_endpoint_node(), the device tree endpoint port number
(vep.base.port) is assigned to csd->interface.csiphy_id without verifying
if it is strictly less than camss->res->csiphy_num.

Later, when the external subdevice is bound, camss_subdev_notifier_bound()
uses this unchecked id to directly index the dynamically allocated
camss->csiphy array:

camss_subdev_notifier_bound() {
    ...
    struct camss_csiphy_device *csiphy = &camss->csiphy[id];
    ...
    csiphy->cfg.csi2 = &csd->interface.csi2;
    ...
}

If a device tree (including runtime DT overlays) defines an endpoint with an
abnormally high port number, could this unconditionally result in an
out-of-bounds write past the allocated block, leading to memory corruption?

While the specific 0-resource crash for the newly added Glymur driver in
this intermediate commit is resolved later in the patch series, the
underlying lack of bounds checking remains unfixed.

> +
>  static const struct camss_resources msm8916_resources = {
>  	.version = CAMSS_8x16,

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260529-glymur_camss-v1-0-bee535396d22@oss.qualcomm.com?part=3