Re: [PATCH v2 06/20] media: imx355: Set register LINE_LENGTH_PCK programmatically

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] The arguments `len` and `val` are swapped in the call to `imx355_write_reg()` for `IMX355_REG_LLP`, causing streaming to fail unconditionally with `-EINVAL`.
--

--- Patch [6]: [PATCH v2 06/20] media: imx355: Set register LINE_LENGTH_PCK programmatically ---
commit 0e41a9d7ebe7908de03f784b605b040468271935
Author: Dave Stevenson <dave.stevenson@raspberrypi.com>

media: imx355: Set register LINE_LENGTH_PCK programmatically
    
This commit removes duplicated Line Length Pixel (LLP) values from the mode
register lists and sets the LLP register programmatically when starting
the stream.

> diff --git a/drivers/media/i2c/imx355.c b/drivers/media/i2c/imx355.c
> index 363b5667b6c9a..66e70650e666b 100644
> --- a/drivers/media/i2c/imx355.c
> +++ b/drivers/media/i2c/imx355.c

[ ... ]

> @@ -1058,6 +1033,13 @@ static int imx355_start_streaming(struct imx355 *imx355)
>  	if (ret)
>  		return ret;
>  
> +	/* set line length */
> +	ret = imx355_write_reg(imx355, IMX355_REG_LLP,
> +			       imx355->hblank->val + imx355->cur_mode->width,
> +			       2);

[Severity: High]
Are the len and val arguments swapped in this call to imx355_write_reg()?

If the line length value (which can exceed 3000) is passed as the len
argument, won't this unconditionally fail the bounds check in
imx355_write_reg():

drivers/media/i2c/imx355.c:imx355_write_reg() {
    ...
    if (len > 4)
        return -EINVAL;
    ...
}

and return -EINVAL, effectively preventing the camera from starting?

> +	if (ret)
> +		return ret;
> +
>  	/* Apply customized values from user */
>  	ret =  __v4l2_ctrl_handler_setup(imx355->sd.ctrl_handler);
>  	if (ret)

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260707-media-imx355-v2-0-1683ec07b897@raspberrypi.com?part=6