[PATCH v2] media: i2c: thp7312: bound the focus lookup against the table size

[PATCH v2] media: i2c: thp7312: bound the focus lookup against the table size

[Guo Zihao]

thp7312_set_focus() indexes thp7312_focus_values[] with the value of the
V4L2_CID_FOCUS_ABSOLUTE control:

        if (thp7312->focus_absolute->is_new) {
                unsigned int value;

                value = thp7312_focus_values[thp7312->focus_absolute->val];

The control is registered with the table size as its maximum:

        v4l2_ctrl_new_std(hdl, &thp7312_ctrl_ops,
                          V4L2_CID_FOCUS_ABSOLUTE,
                          0, ARRAY_SIZE(thp7312_focus_values),
                          1, 0);

The table has 19 entries, so the valid indices are 0 to 18, but the
maximum passed to the control is 19. The control framework does not
reject the bound itself for an integer control: std_validate_elem() only
rounds the value into [minimum, maximum] through ROUND_TO_RANGE() and
returns 0, whereas a menu control returns -ERANGE for a value outside the
range. So a value of 19 is accepted and the lookup reads one entry past
the end of the array. That value is then written to the sensor through
cci_write(THP7312_REG_MANUAL_FOCUS_POSITION).

Reject a value that is not a valid index before the lookup. The control
range is the safer place for the bound, but leaving the lookup guarded
keeps the table and its only user consistent with each other; narrowing
the control is a follow-up that does not affect this fix.

No Fixes tag. The table, its registration and the lookup all come from
the initial driver import, 7a52ab415b43 ("media: i2c: Add driver for
THine THP7312"), and have not been touched since.

Reviewed-by: Liu Weibin <liuwb@xiaopeng.com>
Assisted-by: LLM
Signed-off-by: Guo Zihao <guozh23@xiaopeng.com>
---
v2: add the THP7312 maintainers to the recipients, and say that the value
    read out of range is written to the sensor.

    The previous version said the read was of a value next to the table
    and left it at that. The read result goes into cci_write() for
    THP7312_REG_MANUAL_FOCUS_POSITION, so the description now follows the
    value to where it is used.

    Add the Assisted-by tag.
---
 drivers/media/i2c/thp7312.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/media/i2c/thp7312.c b/drivers/media/i2c/thp7312.c
index 775cfba18..20698b7a1 100644
--- a/drivers/media/i2c/thp7312.c
+++ b/drivers/media/i2c/thp7312.c
@@ -931,6 +931,11 @@ static int thp7312_set_focus(struct thp7312_device *thp7312)
 	if (thp7312->focus_absolute->is_new) {
 		unsigned int value;
 
+		if (thp7312->focus_absolute->val < 0 ||
+		    thp7312->focus_absolute->val >=
+		    ARRAY_SIZE(thp7312_focus_values))
+			return -EINVAL;
+
 		value = thp7312_focus_values[thp7312->focus_absolute->val];
 
 		ret = cci_write(thp7312->regmap,
-- 
2.50.1

Re: [PATCH v2] media: i2c: thp7312: bound the focus lookup against the table size

[Laurent Pinchart]

Hello,

This is an automated reply.

You have sent a patch that appears to have been generated by an LLM. The
commit message and/or code show little to no real understanding of the
changes being proposed.

Such patches require a large amount of work to review. They rely on the
maintainer to propose - and often even implement - a proper design. The
probability that the author will learn from the experience to improve
their future contributions is close to zero.

As a result, to make good use of maintainer time and keep the kernel
development process sustainable, your patch has been rejected.

If you believe the change you proposed is important, take time to study
the problem, learn, and develop a solution without AI assistance.
Answering this e-mail or generating a new version of the patch by
feeding this reply to an LLM will only result in your e-mails being
ignored.

Please note that if your patch attempted to address an important
problem, maintainers or other contributors can submit and merge a
similar or entirely different fix without crediting you.

Your contributions to the Linux kernel will be welcome if you genuinely
desire to invest your time and learn.

Thank you,

Laurent's mail bot

On Tue, 22 Sep 2026 15:52:46 +0800, Guo Zihao <guozh23@xiaopeng.com> wrote:
> thp7312_set_focus() indexes thp7312_focus_values[] with the value of the
> V4L2_CID_FOCUS_ABSOLUTE control:
> 
>         if (thp7312->focus_absolute->is_new) {
>                 unsigned int value;
> 
>                 value = thp7312_focus_values[thp7312->focus_absolute->val];
> 
> The control is registered with the table size as its maximum:
> 
>         v4l2_ctrl_new_std(hdl, &thp7312_ctrl_ops,
>                           V4L2_CID_FOCUS_ABSOLUTE,
>                           0, ARRAY_SIZE(thp7312_focus_values),
>                           1, 0);
> 
> The table has 19 entries, so the valid indices are 0 to 18, but the
> maximum passed to the control is 19. The control framework does not
> reject the bound itself for an integer control: std_validate_elem() only
> rounds the value into [minimum, maximum] through ROUND_TO_RANGE() and
> returns 0, whereas a menu control returns -ERANGE for a value outside the
> range. So a value of 19 is accepted and the lookup reads one entry past
> the end of the array. That value is then written to the sensor through
> cci_write(THP7312_REG_MANUAL_FOCUS_POSITION).
> 
> Reject a value that is not a valid index before the lookup. The control
> range is the safer place for the bound, but leaving the lookup guarded
> keeps the table and its only user consistent with each other; narrowing
> the control is a follow-up that does not affect this fix.
> 
> No Fixes tag. The table, its registration and the lookup all come from
> the initial driver import, 7a52ab415b43 ("media: i2c: Add driver for
> THine THP7312"), and have not been touched since.
> 
> Reviewed-by: Liu Weibin <liuwb@xiaopeng.com>
> Assisted-by: LLM
> Signed-off-by: Guo Zihao <guozh23@xiaopeng.com>
> ---
> v2: add the THP7312 maintainers to the recipients, and say that the value
>     read out of range is written to the sensor.
> 
>     The previous version said the read was of a value next to the table
>     and left it at that. The read result goes into cci_write() for
>     THP7312_REG_MANUAL_FOCUS_POSITION, so the description now follows the
>     value to where it is used.
> 
>     Add the Assisted-by tag.
> ---
>  drivers/media/i2c/thp7312.c | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/drivers/media/i2c/thp7312.c b/drivers/media/i2c/thp7312.c
> index 775cfba18..20698b7a1 100644
> --- a/drivers/media/i2c/thp7312.c
> +++ b/drivers/media/i2c/thp7312.c
> @@ -931,6 +931,11 @@ static int thp7312_set_focus(struct thp7312_device *thp7312)
>  	if (thp7312->focus_absolute->is_new) {
>  		unsigned int value;
>  
> +		if (thp7312->focus_absolute->val < 0 ||
> +		    thp7312->focus_absolute->val >=
> +		    ARRAY_SIZE(thp7312_focus_values))
> +			return -EINVAL;
> +
>  		value = thp7312_focus_values[thp7312->focus_absolute->val];
>  
>  		ret = cci_write(thp7312->regmap,