Re: [PATCH v2] phy: exynos5-usbdrd: Use dynamic phy_cfg size to prevent OOB access

[Selvarasu Ganesan]

On 10/12/2026 9:44 PM, Manivannan Sadhasivam wrote:
> On Fri, Sep 18, 2026 at 04:01:47PM +0530, Selvarasu Ganesan wrote:
>> The probe loop currently iterates using EXYNOS5_DRDPHYS_NUM (2),
>> creating both UTMI and PIPE3 PHY instances regardless of the SoC
>> capability. Several SoCs (Exynos2200, Exynos7870, Exynos850, Exynos990,
>> and ExynosAutoV920) provide phy_cfg arrays containing only a single
>> element.
>>
>> On these SoCs, when the loop reaches index 1, the driver reads past the
>> end of the rodata array, populating the second PHY instance with garbage
>> data. Since the configuration structure contains critical function
>> pointers (phy_isol, phy_init, set_refclk), any subsequent access to this
>> PHY instance via exynos5_usbdrd_phy_xlate could result in a kernel oops.
>>
>> Fix this by adding 'n_phy_cfg' to struct exynos5_usbdrd_phy_drvdata to
>> store the actual size of the phy_cfg array for each SoC. Update the
>> probe loop and the xlate function to bound their access against this
>> value instead of the hardcoded EXYNOS5_DRDPHYS_NUM.
>>
>> Assisted-by: LLM
>> Signed-off-by: Selvarasu Ganesan <selvarasu.g@xxxxxxxxxxx>
>> Tested-by: Łukasz Lebiedziński <kernel@xxxxxxxxx>
>> Reviewed-by: Alim Akhtar <alim.akhtar@xxxxxxxxxxx>
>> Reviewed-by: André Draszik <andre.draszik@xxxxxxxxxx>
>> Reviewed-by: Peter Griffin <peter.griffin@xxxxxxxxxx>
> Since this patch fixes an OOB issue, it should have a Fixes tag and the stable
> list should be CCed for backporting.

Hi Mani,

Thanks for your reviewing patch.

Sure, I will add fixes and stable tag in the next version.

Thanks,
Selva
>
> - Mani
>