[PATCH] phy: exynos5-usbdrd: Use dynamic phy_cfg size to prevent OOB access

[Selvarasu Ganesan]

On 9/2/2026 5:34 AM, Łukasz Lebiedziński wrote:
> I tested this on my Samsung Galaxy A6 (Exynos7870) with this patch applied
> on top of mainline. I wanted to verify the OOB read first before trusting
> this fix, so I forced the device tree to request PHY index 1
> (phys = <&usbdrd_phy 1>;) - this index does not exist for this SoC,
> because the phy_cfg_exynos7870[] array contains only one entry. I added
> a temporary pr_info() call after assigning phy_cfg in the probe loop to
> display the phy_isol/phy_init values using %pS:
>
>    i=0 phy_isol=exynos7870_usbdrd_phy_isol+0x0/0x60
>        phy_init=exynos7870_usbdrd_utmi_init+0x0/0x260
>    i=1 phy_isol=exynos5_usbdrd_phy_isol+0x0/0x50
>        phy_init=exynos5_usbdrd_utmi_init+0x0/0xc8
>
> For i=1, both function pointers resolve to the exynos5_* variants
> instead of the exynos7870 ones - the OOB read lands right on
> the adjacent phy_cfg_exynos5[] array in .rodata. No crash occurs, since
> these garbage pointers happen to point to valid (though unrelated)
> kernel functions rather than something invalid.
>
> With the patch applied, the same debug print shows the loop correctly
> stopping at n_phy_cfg=1; i=1 is never reached. Boot and USB both work
> fine on the actual PHY index (0).
>
> Tested-by: Łukasz Lebiedziński <kernel at lvkasz.us>

Thanks for your testing and update.

Thanks,
Selva
>