linux-kernel - [bug report] media: synopsys: add driver for the designware mipi csi-2 receiver

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <aYXu9Sf4aEl8c3ym@stanley.mountain>
Date: Fri, 6 Feb 2026 16:39:01 +0300
From: Dan Carpenter <dan.carpenter@...aro.org>
To: Michael Riesch <michael.riesch@...labora.com>
Cc: linux-media@...r.kernel.org,
	linux-kernel <linux-kernel@...r.kernel.org>
Subject: [bug report] media: synopsys: add driver for the designware mipi
 csi-2 receiver

[ Smatch checking is paused while we raise funding.  #SadFace
  https://lore.kernel.org/all/aTaiGSbWZ9DJaGo7@stanley.mountain/ -dan ]

Hello Michael Riesch,

Commit 355a11004066 ("media: synopsys: add driver for the designware
mipi csi-2 receiver") from Jan 20, 2026 (linux-next), leads to the
following Smatch static checker warning:

	drivers/media/platform/synopsys/dw-mipi-csi2rx.c:307 dw_mipi_csi2rx_enum_mbus_code()
	warn: array off by one? 'csi2->formats[code->index]'

drivers/media/platform/synopsys/dw-mipi-csi2rx.c
    286 static int
    287 dw_mipi_csi2rx_enum_mbus_code(struct v4l2_subdev *sd,
    288                               struct v4l2_subdev_state *sd_state,
    289                               struct v4l2_subdev_mbus_code_enum *code)
    290 {
    291         struct dw_mipi_csi2rx_device *csi2 = to_csi2(sd);
    292 
    293         switch (code->pad) {
    294         case DW_MIPI_CSI2RX_PAD_SRC:
    295                 if (code->index)
    296                         return -EINVAL;
    297 
    298                 code->code =
    299                         v4l2_subdev_state_get_format(sd_state,
    300                                                      DW_MIPI_CSI2RX_PAD_SINK)->code;
    301 
    302                 return 0;
    303         case DW_MIPI_CSI2RX_PAD_SINK:
    304                 if (code->index > csi2->formats_num)

This should be >=.

    305                         return -EINVAL;
    306 
--> 307                 code->code = csi2->formats[code->index].code;
    308                 return 0;
    309         default:
    310                 return -EINVAL;
    311         }
    312 }

regards,
dan carpenter