Re: [PATCH 15/16] media: sun6i-isp: Add support for MC-centric format enumeration

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Missing mbus_code validation in sun6i_isp_params_enum_fmt when V4L2_CAP_IO_MC is enabled.
--

commit 1a4894a83da0c694f7055ec896e27ceb3fb1ad43
Author: Paul Kocialkowski <paulk@sys-base.io>

media: sun6i-isp: Add support for MC-centric format enumeration

This commit adds MC-centric format enumeration support to the sun6i-isp
driver by setting the V4L2_CAP_IO_MC capability on the capture and params
video nodes. It also updates the capture format enumeration to validate
the provided mbus code.

> diff --git a/drivers/staging/media/sunxi/sun6i-isp/sun6i_isp_params.c b/drivers/staging/media/sunxi/sun6i-isp/sun6i_isp_params.c
> index 0cc48e2bc8c61..2622e5a078176 100644
> --- a/drivers/staging/media/sunxi/sun6i-isp/sun6i_isp_params.c
> +++ b/drivers/staging/media/sunxi/sun6i-isp/sun6i_isp_params.c
> @@ -531,7 +531,8 @@ int sun6i_isp_params_setup(struct sun6i_isp_device *isp_dev)
>  
>  	strscpy(video_dev->name, SUN6I_ISP_PARAMS_NAME,
>  		sizeof(video_dev->name));
> -	video_dev->device_caps = V4L2_CAP_META_OUTPUT | V4L2_CAP_STREAMING;
> +	video_dev->device_caps = V4L2_CAP_META_OUTPUT | V4L2_CAP_STREAMING |
> +				 V4L2_CAP_IO_MC;

The commit message mentions that the params video node does not care about
the mbus format, but with V4L2_CAP_IO_MC enabled here, does this allow
sun6i_isp_params_enum_fmt() to return success for invalid mbus codes?

According to the V4L2 specification for MC-centric devices, if the
mbus_code field in struct v4l2_fmtdesc is non-zero during the
VIDIOC_ENUM_FMT ioctl, the driver must restrict the enumerated formats
to those supported for the given media bus code, and return -EINVAL if
the code is unsupported.

By ignoring the mbus_code in the params node entirely, it appears userspace
could query completely arbitrary values and still receive a 0 (success)
return code. This incorrectly informs userspace that the format is
supported in combination with any given mbus_code.

Should sun6i_isp_params_enum_fmt() be updated to return -EINVAL if a
non-zero mbus_code is provided, similar to the check added in
sun6i_isp_capture_enum_fmt()?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260518102451.417971-1-paulk@sys-base.io?part=15