Re: [PATCH v19 05/12] media: qcom: camss: Add Kaanapali compatible

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] media: qcom: camss: missing DT port bounds check in camss_parse_endpoint_node()
--

commit 781d7cc1d1be2a0b64ef04982c38bd82fc6c1a5d
Author: Hangxiang Ma <hangxiang.ma@oss.qualcomm.com>

    media: qcom: camss: Add Kaanapali compatible
    
    Add CAMSS_KAANAPALI enum, Kaanapali compatible and Kaanapali CAMSS driver
    private data. The private data currently includes only basic information.
    Later changes will add CSIPHY, TPG, CSID and VFE resources.

> diff --git a/drivers/media/platform/qcom/camss/camss.c b/drivers/media/platform/qcom/camss/camss.c
> index c54185c93a8a9..fca3de214a922 100644
> --- a/drivers/media/platform/qcom/camss/camss.c
> +++ b/drivers/media/platform/qcom/camss/camss.c

[ ... ]

> @@ -5576,6 +5590,13 @@ static void camss_remove(struct platform_device *pdev)
>  	camss_genpd_cleanup(camss);
>  }
>  
> +static const struct camss_resources kaanapali_resources = {
> +	.version = CAMSS_KAANAPALI,
> +	.pd_name = "top",
> +	.icc_res = icc_res_kaanapali,
> +	.icc_path_num = ARRAY_SIZE(icc_res_kaanapali),
> +};
> +

[Severity: High]
Does this code allow an out-of-bounds array access if a malformed device tree
provides an excessively large port number?

The driver parses the port endpoint from the device tree in
camss_parse_endpoint_node() and stores it without bounds checking:

drivers/media/platform/qcom/camss/camss.c:camss_parse_endpoint_node() {
	...
	csd->interface.csiphy_id = vep.base.port;
	...
}

Then in camss_subdev_notifier_bound(), this unvalidated id is used to index
into the dynamically allocated camss->csiphy array:

drivers/media/platform/qcom/camss/camss.c:camss_subdev_notifier_bound() {
	...
	u8 id = csd->interface.csiphy_id;
	struct csiphy_device *csiphy = &camss->csiphy[id];
	...
}

Could this lead to memory corruption or a kernel panic if the port number
exceeds camss->res->csiphy_num?

While the specific zero-size pointer issue for Kaanapali is resolved by
follow-up patches setting csiphy_num, the missing bounds validation appears to
remain a vulnerability for any invalid device tree.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261008-kaanapali-camss-v19-0-b2c583ef50e0@oss.qualcomm.com?part=5

-- 
linux-phy mailing list
linux-phy@lists.infradead.org
https://lists.infradead.org/mailman/listinfo/linux-phy