media: imx-mipi-csis: Check csis_fmt validity before use
Commit Message
The find_csis_format() may return NULL in case supported format is not
found, check the return value of find_csis_format() before using the
result to avoid NULL pointer dereference.
Fixes: 11927d0fd0d0 ("media: imx-mipi-csis: Use V4L2 subdev active state")
Signed-off-by: Marek Vasut <marex@denx.de>
---
Cc: Fabio Estevam <festevam@gmail.com>
Cc: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Cc: Mauro Carvalho Chehab <mchehab@kernel.org>
Cc: NXP Linux Team <linux-imx@nxp.com>
Cc: Pengutronix Kernel Team <kernel@pengutronix.de>
Cc: Philipp Zabel <p.zabel@pengutronix.de>
Cc: Rui Miguel Silva <rmfrfs@gmail.com>
Cc: Sascha Hauer <s.hauer@pengutronix.de>
Cc: Shawn Guo <shawnguo@kernel.org>
Cc: linux-arm-kernel@lists.infradead.org
Cc: linux-media@vger.kernel.org
---
drivers/media/platform/nxp/imx-mipi-csis.c | 2 ++
1 file changed, 2 insertions(+)
Comments
Hi Marek,
Thank you for the patch.
On Tue, Feb 14, 2023 at 11:20:24PM +0100, Marek Vasut wrote:
> The find_csis_format() may return NULL in case supported format is not
> found, check the return value of find_csis_format() before using the
> result to avoid NULL pointer dereference.
>
> Fixes: 11927d0fd0d0 ("media: imx-mipi-csis: Use V4L2 subdev active state")
> Signed-off-by: Marek Vasut <marex@denx.de>
> ---
> Cc: Fabio Estevam <festevam@gmail.com>
> Cc: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
> Cc: Mauro Carvalho Chehab <mchehab@kernel.org>
> Cc: NXP Linux Team <linux-imx@nxp.com>
> Cc: Pengutronix Kernel Team <kernel@pengutronix.de>
> Cc: Philipp Zabel <p.zabel@pengutronix.de>
> Cc: Rui Miguel Silva <rmfrfs@gmail.com>
> Cc: Sascha Hauer <s.hauer@pengutronix.de>
> Cc: Shawn Guo <shawnguo@kernel.org>
> Cc: linux-arm-kernel@lists.infradead.org
> Cc: linux-media@vger.kernel.org
> ---
> drivers/media/platform/nxp/imx-mipi-csis.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/drivers/media/platform/nxp/imx-mipi-csis.c b/drivers/media/platform/nxp/imx-mipi-csis.c
> index e99633565463e..8e307ca0b5688 100644
> --- a/drivers/media/platform/nxp/imx-mipi-csis.c
> +++ b/drivers/media/platform/nxp/imx-mipi-csis.c
> @@ -1108,6 +1108,8 @@ static int mipi_csis_get_frame_desc(struct v4l2_subdev *sd, unsigned int pad,
> fmt = v4l2_subdev_get_pad_format(sd, state, CSIS_PAD_SOURCE);
> csis_fmt = find_csis_format(fmt->code);
> v4l2_subdev_unlock_state(state);
> + if (!csis_fmt)
> + return -EINVAL;
Oops.
I'd add a blank line before the check (I can handle this locally), apart
from that,
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
> fd->type = V4L2_MBUS_FRAME_DESC_TYPE_PARALLEL;
> fd->num_entries = 1;
@@ -1108,6 +1108,8 @@ static int mipi_csis_get_frame_desc(struct v4l2_subdev *sd, unsigned int pad,
fmt = v4l2_subdev_get_pad_format(sd, state, CSIS_PAD_SOURCE);
csis_fmt = find_csis_format(fmt->code);
v4l2_subdev_unlock_state(state);
+ if (!csis_fmt)
+ return -EINVAL;
fd->type = V4L2_MBUS_FRAME_DESC_TYPE_PARALLEL;
fd->num_entries = 1;