Re: [PATCH v18 07/11] media: qcom: camss: vfe: Add support for VFE 1080

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] camss: out-of-bounds DMA due to AUP_UPDATE mismatch
--

commit cd020a472f6ce917268a88da4eeb7a4d0642ace1
Author: Hangxiang Ma <hangxiang.ma@oss.qualcomm.com>

media: qcom: camss: vfe: Add support for VFE 1080

This commit adds support for the Video Front End (VFE) 1080 module found on
the Kaanapali SoC.

> diff --git a/drivers/media/platform/qcom/camss/camss-vfe.c b/drivers/media/platform/qcom/camss/camss-vfe.c
> index 2680a9914765f..3acef6ba97dc9 100644
> --- a/drivers/media/platform/qcom/camss/camss-vfe.c
> +++ b/drivers/media/platform/qcom/camss/camss-vfe.c
[ ... ]
> @@ -552,7 +554,9 @@ int vfe_enable_output_v2(struct vfe_line *line)
>  		output->gen2.active_num++;
>  		ops->vfe_wm_update(vfe, output->wm_idx[0],
>  				   output->buf[i]->addr[0], line);
> -		ops->reg_update(vfe, line->id);
> +
> +		if (!vfe->res->reg_update_after_csid_config)
> +			ops->reg_update(vfe, line->id);
>  	}

[Severity: High]
Does this code handle the case where userspace queues fewer than 2 buffers?

If fewer than 2 buffers are queued, the loop above breaks early when 
vfe_buf_get_pending() returns NULL, leaving active_num < 2 without returning 
an error.

The commit message notes that "the number of AUP_UPDATE requests must match 
the number of buffers queued to the write master while it is being enabled."

However, if we proceed with active_num < 2, the pipeline start continues, and 
csid_configure_stream() in camss-csid-1080.c will unconditionally issue 
CAMSS_INIT_BUF_COUNT (2) AUP updates:

drivers/media/platform/qcom/camss/camss-csid-1080.c:csid_configure_stream() {
	...
	for (k = 0; k < CAMSS_INIT_BUF_COUNT; k++)
		__csid_aup_update(csid, i);
	...
}

Could this mismatch between AUP updates and actually queued buffers lead to 
the VFE write master hardware attempting out-of-bounds DMA to uninitialized 
addresses and causing memory corruption?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261003-kaanapali-camss-v18-0-87ba4ebe0db1@oss.qualcomm.com?part=7