Re: [PATCH] media: iris: Fix out-of-bounds read in timestamp metadata fallback

[Bryan O'Donoghue <bod@kernel.org>]

On 17/10/2026 04:25, Vishnu Reddy wrote:
> inst->tss[] has VIDEO_MAX_FRAME (32) entries, so valid indexes are 0
> through 31. iris_set_ts_metadata() writes at metadata_idx and then
> increments it. After the 32nd input buffer, metadata_idx is 32 until
> the next input buffer is queued.
> 
> If iris_get_ts_metadata() finds no matching timestamp in that window,
> its fallback reads inst->tss[32], one entry past the end of the array.
> UBSAN (Undefined Behavior Sanity Checker) reports this as an
> array-index-out-of-bounds error.
> 
> Use the last written entry, metadata_idx - 1, in the fallback instead.
> Fall back to slot 0 if nothing has been written yet. Even if stream off
> and stream on happen multiple times on the same session, the fallback
> always uses the latest metadata received.
> 
> Fixes: 17f2a485ca67 ("media: iris: implement vb2 ops for buf_queue and firmware response")
> Cc:stable@vger.kernel.org
> Signed-off-by: Vishnu Reddy<busanna.reddy@oss.qualcomm.com>
> ---
>   drivers/media/platform/qcom/iris/iris_buffer.c | 6 ++++--
>   1 file changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/media/platform/qcom/iris/iris_buffer.c b/drivers/media/platform/qcom/iris/iris_buffer.c
> index eb8de60c1177f..31cba99a665c1 100644
> --- a/drivers/media/platform/qcom/iris/iris_buffer.c
> +++ b/drivers/media/platform/qcom/iris/iris_buffer.c
> @@ -865,9 +865,11 @@ static void iris_get_ts_metadata(struct iris_inst *inst, u64 timestamp_ns,
>   		return;
>   	}
> 
> +	i = inst->metadata_idx ? inst->metadata_idx - 1 : 0;
> +
>   	vbuf->flags &= ~mask;
> -	vbuf->flags |= inst->tss[inst->metadata_idx].flags;
> -	vbuf->timecode = inst->tss[inst->metadata_idx].tc;
> +	vbuf->flags |= inst->tss[i].flags;
> +	vbuf->timecode = inst->tss[i].tc;
>   }
> 
>   int iris_vb2_buffer_done(struct iris_inst *inst, struct iris_buffer *buf)
> 
> ---
> base-commit: 2efb7a11f1aa4d2dc285fe2680cca22cb9f72f64
> change-id: 20261013-fix-oob-tss-7d317d612cf0
> 
> Best regards,
> --
> Vishnu Reddy<busanna.reddy@oss.qualcomm.com>

Just control the variable where it is owned/assigned - the index should 
never run outside of bounds - dealing with that out-of-bounds is a fixup 
that shouldn't have to be done.

Don't let the index overrun at all. That way the next function that 
reads the index, doesn't have to know or care that the index might run.

[0] % git diff
diff --git a/drivers/media/platform/qcom/iris/iris_common.c 
b/drivers/media/platform/qcom/iris/iris_common.c
index 25836561bcf3e..b2b9349c38ea9 100644
--- a/drivers/media/platform/qcom/iris/iris_common.c
+++ b/drivers/media/platform/qcom/iris/iris_common.c
@@ -33,9 +33,6 @@ void iris_set_ts_metadata(struct iris_inst *inst, 
struct vb2_v4l2_buffer *vbuf)
         struct vb2_buffer *vb = &vbuf->vb2_buf;
         u64 ts_us = vb->timestamp;

-       if (inst->metadata_idx >= ARRAY_SIZE(inst->tss))
-               inst->metadata_idx = 0;
-
         do_div(ts_us, NSEC_PER_USEC);

         inst->tss[inst->metadata_idx].flags = vbuf->flags & mask;
@@ -43,7 +40,10 @@ void iris_set_ts_metadata(struct iris_inst *inst, 
struct vb2_v4l2_buffer *vbuf)
         inst->tss[inst->metadata_idx].ts_us = ts_us;
         inst->tss[inst->metadata_idx].ts_ns = vb->timestamp;

-       inst->metadata_idx++;
+       if (inst->metadata_idx + 1 >= ARRAY_SIZE(inst->tss))
+               inst->metadata_idx = 0;
+       else
+               inst->metadata_idx++;
  }

  int iris_process_streamon_input(struct iris_inst *inst)

There should exist no window in time where the index is invalid.

---
bod