Re: [PATCH v1 04/10] media: tegra-video: vi: Switch to media_entity_remote_source_pad_unique() helper

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [High] media: tegra-video: ERR_PTR deref in
  tegra_channel_get_remote_source_subdev()
--

commit e0cde12330277b56d30a1de11e5da15a2551007a
Author: Svyatoslav Ryhel <clamor95@gmail.com>

media: tegra-video: vi: Switch to media_entity_remote_source_pad_unique() helper

This commit replaces media_pad_remote_pad_first() with
media_entity_remote_source_pad_unique() in
tegra_channel_get_remote_source_subdev() so multi-pad entities do not assume
pad 0 is the remote source pad.

> diff --git a/drivers/media/platform/nvidia/tegra-video/vi.c b/drivers/media/platform/nvidia/tegra-video/vi.c
> index 12eaa89304e84..a96ef26af89eb 100644
> --- a/drivers/media/platform/nvidia/tegra-video/vi.c
> +++ b/drivers/media/platform/nvidia/tegra-video/vi.c
> @@ -187,9 +187,11 @@ tegra_channel_get_remote_source_subdev(struct tegra_vi_channel *chan)
>  	if (!subdev)
>  		return NULL;
>  
> +	entity = &subdev->entity;
> +
>  	pad = &subdev->entity.pads[0];
>  	while (!(pad->flags & MEDIA_PAD_FL_SOURCE)) {
> -		pad = media_pad_remote_pad_first(pad);
> +		pad = media_entity_remote_source_pad_unique(entity);
>  		if (!pad || !is_media_entity_v4l2_subdev(pad->entity))
>  			break;
>  		entity = pad->entity;

[Severity: High]
Can this dereference an error pointer at pad->entity?

Unlike media_pad_remote_pad_first(), which returns NULL when no enabled
link is found, media_entity_remote_source_pad_unique() wraps
media_entity_remote_pad_unique() and returns ERR_PTR(-ENOLINK) or
ERR_PTR(-ENOTUNIQ) on failure.  If the upstream link is disabled or
missing, !pad is false and pad->entity faults.  Should the check use
IS_ERR(pad) instead of !pad?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261113161819.36847-1-clamor95@gmail.com?part=4