[PATCH v2] phy: exynos5-usbdrd: Use dynamic phy_cfg size to prevent OOB access

[Manivannan Sadhasivam]

On Fri, Sep 18, 2026 at 04:01:47PM +0530, Selvarasu Ganesan wrote:
> The probe loop currently iterates using EXYNOS5_DRDPHYS_NUM (2),
> creating both UTMI and PIPE3 PHY instances regardless of the SoC
> capability. Several SoCs (Exynos2200, Exynos7870, Exynos850, Exynos990,
> and ExynosAutoV920) provide phy_cfg arrays containing only a single
> element.
> 
> On these SoCs, when the loop reaches index 1, the driver reads past the
> end of the rodata array, populating the second PHY instance with garbage
> data. Since the configuration structure contains critical function
> pointers (phy_isol, phy_init, set_refclk), any subsequent access to this
> PHY instance via exynos5_usbdrd_phy_xlate could result in a kernel oops.
> 
> Fix this by adding 'n_phy_cfg' to struct exynos5_usbdrd_phy_drvdata to
> store the actual size of the phy_cfg array for each SoC. Update the
> probe loop and the xlate function to bound their access against this
> value instead of the hardcoded EXYNOS5_DRDPHYS_NUM.
> 
> Assisted-by: LLM
> Signed-off-by: Selvarasu Ganesan <selvarasu.g at samsung.com>
> Tested-by: Łukasz Lebiedziński <kernel at lvkasz.us>
> Reviewed-by: Alim Akhtar <alim.akhtar at samsung.com>
> Reviewed-by: André Draszik <andre.draszik at linaro.org>
> Reviewed-by: Peter Griffin <peter.griffin at linaro.org>

Since this patch fixes an OOB issue, it should have a Fixes tag and the stable
list should be CCed for backporting.

- Mani

-- 
மணிவண்ணன் சதாசிவம்