Re: [PATCH] staging: media: ipu3: fix out-of-bounds access in imgu_map_node()

Sakari Ailus
2026-04-22T06:38:08Z

Hi Sajja,

On Wed, Apr 22, 2026 at 11:49:51AM +0530, Sajja Easwar Sai wrote:
> imgu_map_node() walks imgu_node_map[] looking for a CSS queue ID. When
> no match is found the loop exits with i == IMGU_NODE_NUM, which is one
> past the end of every array that is indexed by node id. The value is
> returned without any bounds check, so callers that use it immediately
> as an array subscript produce out-of-bounds reads.
>
> The most critical caller is the threaded IRQ handler
> imgu_isr_threaded(), where b->queue comes directly from firmware; a
> malformed or buggy firmware return could therefore trigger a kernel
> oops.

Have you seen this happen in practice?

--
Regards,

Sakari Ailus