Re: [PATCH] media: i2c: vgxy61: reject out of range MIPI CSI-2 lane numbers

[Guo Zihao <guozh23@xiaopeng.com>]

Hi Benjamin,

Thanks for the review. The maintainers are in copy now.

On the lane checking: l_nb is the number of lanes, while clock_lane and
data_lanes[] are the lane indices. The check at line 1453 accepts
num_data_lanes being 1, 2 or 4, but an endpoint such as

        data-lanes = <1 2 3 99>;

has a valid count of 4 and an out of range index in the last entry. The
indices are stored as unsigned char in struct v4l2_mbus_config_mipi_csi2,
so an endpoint value of 99 arrives as 99, and anything from 5 up writes
past the five element phy2log array.

For clock_lane the write to phy2log[clock_lane] at line 1461 happens
before the log2phy[0] != 0 check at line 1480. vd55g1 and vd56g3, which
build the same kind of map from the same properties, check clock_lane
before the map is built rather than after.

v2 keeps both checks.

On the tooling question: yes, this was written with the help of an LLM,
and v2 carries the Assisted-by tag as the process documentation asks. I
went through the code and the reasoning myself before sending it.

Regards,
Guo