Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [High] In `mtk_dsi_host_transfer()`, reading from DSI RX data registers incorrectly adds the byte offset `i` to the `reg_main` enum array index rather than the resolved register address, causing out-of-bounds array reads and invalid MMIO access. --
--- Patch [5]: [PATCH v3 05/10] drm/mediatek: mtk_dsi: Transfer register offsets to per-SoC const --- commit a32b9a7c67e660488b31bdcea6dd9055c83b92eb Author: AngeloGioacchino Del Regno <[email protected]> drm/mediatek: mtk_dsi: Transfer register offsets to per-SoC const This commit transfers DSI register offsets to two const arrays to support newer generation DSI IPs with different register offsets. It separates DSI IP version-specific registers from SoC-specific ones. > diff --git a/drivers/gpu/drm/mediatek/mtk_dsi.c > b/drivers/gpu/drm/mediatek/mtk_dsi.c > index bdb9ea2e7b6f6..4d5cb91c788f6 100644 > --- a/drivers/gpu/drm/mediatek/mtk_dsi.c > +++ b/drivers/gpu/drm/mediatek/mtk_dsi.c [ ... ] > @@ -1297,7 +1432,8 @@ static ssize_t mtk_dsi_host_transfer(struct > mipi_dsi_host *host, > } > > for (i = 0; i < 16; i++) > - *(read_data + i) = readb(dsi->regs + DSI_RX_DATA0 + i); > + *(read_data + i) = readb(dsi->regs + > + > dsi->driver_data->reg_main[DSI_RX_DATA0 + i]); [Severity: High] Does this code perform an out-of-bounds array read? Since DSI_RX_DATA0 is 17 and DSI_MAIN_REG_MAX is 28, the loop will read past the end of the reg_main array when i >= 11. Even for smaller values of i, this will fetch the base offsets of unrelated registers (like DSI_RX_DATA1, DSI_RACK, and DSI_PHY_LCCON) instead of consecutive bytes of the RX payload. Should the byte offset i be added outside the array subscript instead, like dsi->driver_data->reg_main[DSI_RX_DATA0] + i? > > recv_cnt = mtk_dsi_recv_cnt(read_data[0], read_data); -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=5
