RE: [PATCH] phy: exynos5-usbdrd: Use dynamic phy_cfg size to prevent OOB access

Hi Selvarasu

-----Original Message-----
From: Selvarasu Ganesan <redacted>
Sent: Monday, August 31, 2026 12:33 PM
To: vkoul@kernel.org; neil.armstrong@linaro.org; krzk@kernel.org;
peter.griffin@linaro.org; alim.akhtar@samsung.com;
pritam.sutar@samsung.com; andre.draszik@linaro.org; kernel@lvkasz.us;
linux-phy@lists.infradead.org; linux-arm-kernel@lists.infradead.org; linux-
samsung-soc@vger.kernel.org; linux-kernel@vger.kernel.org
Cc: jh0801.jung@samsung.com; dh10.jung@samsung.com;
akash.m5@samsung.com; muhammed.ali@samsung.com;
thiagu.r@samsung.com; Selvarasu Ganesan [off-list ref]
Subject: [PATCH] phy: exynos5-usbdrd: Use dynamic phy_cfg size to prevent
OOB access

The probe loop currently iterates using EXYNOS5_DRDPHYS_NUM (2),
creating both UTMI and PIPE3 PHY instances regardless of the SoC capability.
Several SoCs (Exynos2200, Exynos7870, Exynos850, Exynos990, and
ExynosAutoV920) provide phy_cfg arrays containing only a single element.

On these SoCs, when the loop reaches index 1, the driver reads past the end
of the rodata array, populating the second PHY instance with garbage data.
Since the configuration structure contains critical function pointers (phy_isol,
phy_init, set_refclk), any subsequent access to this PHY instance via
exynos5_usbdrd_phy_xlate could result in a kernel oops.

Fix this by adding 'n_phy_cfg' to struct exynos5_usbdrd_phy_drvdata to
store the actual size of the phy_cfg array for each SoC. Update the probe
loop and the xlate function to bound their access against this value instead of
the hardcoded EXYNOS5_DRDPHYS_NUM.

Assisted-by: Claude:claude-sonnet-5
Signed-off-by: Selvarasu Ganesan <redacted>
---

Reviewed-by: Alim Akhtar <alim.akhtar@samsung.com>


-- 
linux-phy mailing list
linux-phy@lists.infradead.org
https://lists.infradead.org/mailman/listinfo/linux-phy