Re: [PATCH v2 2/2] media: i2c: Add Samsung S5K3T2 image sensor driver

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] media: i2c: s5k3t2: V4L2 controls are silently ignored when CONFIG_PM=n
- [Medium] media: i2c: s5k3t2: unchecked dereference of v4l2_subdev_state_get_format()
--

commit 0ff25daea454ea586f399f585c1432a8ce3f431a
Author: Armandas Kvietkus <armandas.kvietkus@proton.me>

media: i2c: Add Samsung S5K3T2 image sensor driver

This commit adds a V4L2 driver for the Samsung S5K3T2 20 Mpixel CMOS
image sensor, supporting three modes up to 5184x3880.

> diff --git a/drivers/media/i2c/s5k3t2.c b/drivers/media/i2c/s5k3t2.c
> new file mode 100644
> index 0000000000000..de24a6b9dacae
> --- /dev/null
> +++ b/drivers/media/i2c/s5k3t2.c
[ ... ]
> +static int s5k3t2_set_ctrl(struct v4l2_ctrl *ctrl)
> +{
> +	struct s5k3t2 *s5k3t2 = container_of(ctrl->handler, struct s5k3t2,
> +					     ctrl_handler);
[ ... ]
> +	}
> +
> +	if (pm_runtime_get_if_active(s5k3t2->dev) <= 0)
> +		return 0;

[Severity: High]
When the kernel is built with CONFIG_PM disabled, pm_runtime_get_if_active()
returns -EINVAL. Could this condition evaluate to true for that -EINVAL
return, incorrectly treating it as a suspended state?

If so, this would cause the function to return 0 without writing any values
to the hardware registers, silently ignoring all V4L2 control updates like
exposure and gain permanently.

> +
> +	switch (ctrl->id) {
> +	case V4L2_CID_ANALOGUE_GAIN:
[ ... ]
> +static int s5k3t2_set_pad_format(struct v4l2_subdev *sd,
> +				 struct v4l2_subdev_state *state,
> +				 struct v4l2_subdev_format *fmt)
> +{
[ ... ]
> +	if (s5k3t2->sd.ctrl_handler->error)
> +		return s5k3t2->sd.ctrl_handler->error;
> +
> +set_format:
> +	*v4l2_subdev_state_get_format(state, 0) = fmt->format;

[Severity: Medium]
Can v4l2_subdev_state_get_format() return NULL here and lead to an unchecked
pointer dereference?

While the check_format() guard normally executes for standard ioctls,
s5k3t2_init_state() acts as a direct caller that bypasses the check_state()
core validation wrapper. Additionally, this performs a mismatched lookup by
hardcoding pad 0 instead of matching the fmt->pad parameter.

> +
> +	return 0;
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260923-upstream-s5k3t2-v2-0-04ffda3350c1@proton.me?part=2