Re: [PATCH v1 05/10] media: tegra-video: vi: Use entity function to check subdev type

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [High] media: tegra-video: ERR_PTR deref in
  tegra_channel_get_remote_source_subdev()
--

commit a0a0dd1c4d66f50cccd70079714c29c0b22431b6
Author: Svyatoslav Ryhel <clamor95@gmail.com>

media: tegra-video: vi: Use entity function to check subdev type

This commit updates tegra_channel_get_remote_source_subdev() to stop
walking upstream subdevices when it reaches an entity with function
MEDIA_ENT_F_PROC_VIDEO_ISP or MEDIA_ENT_F_CAM_SENSOR instead of checking
pad flags.

> diff --git a/drivers/media/platform/nvidia/tegra-video/vi.c b/drivers/media/platform/nvidia/tegra-video/vi.c
> index a96ef26af89eb..139e3ff0faaed 100644
> --- a/drivers/media/platform/nvidia/tegra-video/vi.c
> +++ b/drivers/media/platform/nvidia/tegra-video/vi.c
> @@ -189,13 +189,12 @@ tegra_channel_get_remote_source_subdev(struct tegra_vi_channel *chan)
>  
>  	entity = &subdev->entity;
>  
> -	pad = &subdev->entity.pads[0];
> -	while (!(pad->flags & MEDIA_PAD_FL_SOURCE)) {
> +	while (entity->function != MEDIA_ENT_F_PROC_VIDEO_ISP &&
> +	       entity->function != MEDIA_ENT_F_CAM_SENSOR) {
>  		pad = media_entity_remote_source_pad_unique(entity);
>  		if (!pad || !is_media_entity_v4l2_subdev(pad->entity))
>  			break;

[Severity: High]
Can this dereference an error pointer at pad->entity when a pipeline
ends at a non-sensor, non-ISP source?

media_entity_remote_source_pad_unique() calls
media_entity_remote_pad_unique(), which returns ERR_PTR(-ENOLINK) rather
than NULL when an entity has no enabled upstream source link.  Previously,
the loop condition !(pad->flags & MEDIA_PAD_FL_SOURCE) exited before
calling media_entity_remote_source_pad_unique() on a single-pad source
subdev.  With the new condition, a terminal source whose function is
neither MEDIA_ENT_F_PROC_VIDEO_ISP nor MEDIA_ENT_F_CAM_SENSOR (such as the
CSI subdev in TPG mode or an HDMI/TV decoder with
MEDIA_ENT_F_VID_IF_BRIDGE, MEDIA_ENT_F_DV_DECODER, or
MEDIA_ENT_F_ATV_DECODER) enters the loop, receives ERR_PTR(-ENOLINK) in
pad, passes !pad, and crashes when is_media_entity_v4l2_subdev(pad->entity)
dereferences pad.

Checking IS_ERR(pad) instead of !pad would avoid the bad dereference.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261113161819.36847-1-clamor95@gmail.com?part=5