Re: [PATCH v2 2/3] media: i2c: Add driver for OmniVision OV32C4

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Potential NULL pointer dereference in ov32c4_set_format() when sd_state is NULL.
--

commit 1f7b42ee8c447c7e85f922c97bb8dbc3b6847261
Author: Robert Bozik <robertbozik@gmail.com>

media: i2c: Add driver for OmniVision OV32C4

This commit adds a Video4Linux2 I2C sensor driver for the OmniVision
OV32C4 camera. The driver supports basic streaming functionality,
analogue and digital gain, and flip controls.

> diff --git a/drivers/media/i2c/ov32c4.c b/drivers/media/i2c/ov32c4.c
> new file mode 100644
> index 0000000000000..8d11e1b00d73c
> --- /dev/null
> +++ b/drivers/media/i2c/ov32c4.c
[ ... ]
> +static int ov32c4_set_format(struct v4l2_subdev *sd,
> +			     struct v4l2_subdev_state *sd_state,
> +			     struct v4l2_subdev_format *fmt)
> +{
> +	const struct ov32c4_mode *mode = &supported_modes[0];
> +	struct ov32c4 *ov32c4 = to_ov32c4(sd);
> +	s32 vblank_def, h_blank;
> +
> +	ov32c4_update_pad_format(mode, &fmt->format);
> +	*v4l2_subdev_state_get_format(sd_state, fmt->pad) = fmt->format;

[Severity: High]
Can this code cause a NULL pointer dereference?

If the driver is compiled without CONFIG_MEDIA_CONTROLLER, the V4L2 core
does not allocate a fallback active state. A legacy bridge driver invoking
v4l2_subdev_call(sd, pad, set_fmt, NULL, &fmt) can pass sd_state == NULL
to ov32c4_set_format().

Because the core check_format() guard permits state == NULL when
which == V4L2_SUBDEV_FORMAT_ACTIVE, this function will still execute.

When v4l2_subdev_state_get_format() is passed a NULL state, it returns NULL.
The subsequent structure assignment then unconditionally dereferences it,
which would lead to a kernel panic.

> +
> +	if (fmt->which == V4L2_SUBDEV_FORMAT_TRY)
> +		return 0;
> +
> +	vblank_def = mode->vts_min - mode->height;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260828132104.21473-1-robertbozik@gmail.com?part=2