[PATCH] media: rzg2l-cru: Fix possible ERR_PTR deference

[PATCH] media: rzg2l-cru: Fix possible ERR_PTR deference

[Alper Ak]

The media_pad_remote_pad_unique() can return ERR_PTR() on failure
(-ENOTUNIQ or -ENOLINK), but the code was dereferencing the return
value without checking for errors. Add IS_ERR() check before
dereferencing the pointer.

Fixes: d7d72dae81d5 ("media: rzg2l-cru: Retrieve virtual channel information")
Signed-off-by: Alper Ak <alperyasinak1@gmail.com>
---
 drivers/media/platform/renesas/rzg2l-cru/rzg2l-video.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/media/platform/renesas/rzg2l-cru/rzg2l-video.c b/drivers/media/platform/renesas/rzg2l-cru/rzg2l-video.c
index 162e2ace6931..a34c2188df1a 100644
--- a/drivers/media/platform/renesas/rzg2l-cru/rzg2l-video.c
+++ b/drivers/media/platform/renesas/rzg2l-cru/rzg2l-video.c
@@ -411,6 +411,12 @@ static int rzg2l_cru_get_virtual_channel(struct rzg2l_cru_dev *cru)
 	int ret;
 
 	remote_pad = media_pad_remote_pad_unique(&cru->ip.pads[RZG2L_CRU_IP_SINK]);
+	if (IS_ERR(remote_pad)) {
+		ret = PTR_ERR(remote_pad);
+		dev_err(cru->dev, "Failed to get remote source pad: %d\n", ret);
+		return ret;
+	}
+
 	ret = v4l2_subdev_call(cru->ip.remote, pad, get_frame_desc, remote_pad->index, &fd);
 	if (ret < 0 && ret != -ENOIOCTLCMD) {
 		dev_err(cru->dev, "get_frame_desc failed on IP remote subdev\n");
-- 
2.43.0

Re: [PATCH] media: rzg2l-cru: Fix possible ERR_PTR deference

[Laurent Pinchart]

On Sat, Feb 07, 2026 at 12:48:39PM +0300, Alper Ak wrote:
> The media_pad_remote_pad_unique() can return ERR_PTR() on failure
> (-ENOTUNIQ or -ENOLINK), but the code was dereferencing the return
> value without checking for errors. Add IS_ERR() check before
> dereferencing the pointer.

Have you seen this happening ?

> Fixes: d7d72dae81d5 ("media: rzg2l-cru: Retrieve virtual channel information")
> Signed-off-by: Alper Ak <alperyasinak1@gmail.com>
> ---
>  drivers/media/platform/renesas/rzg2l-cru/rzg2l-video.c | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/drivers/media/platform/renesas/rzg2l-cru/rzg2l-video.c b/drivers/media/platform/renesas/rzg2l-cru/rzg2l-video.c
> index 162e2ace6931..a34c2188df1a 100644
> --- a/drivers/media/platform/renesas/rzg2l-cru/rzg2l-video.c
> +++ b/drivers/media/platform/renesas/rzg2l-cru/rzg2l-video.c
> @@ -411,6 +411,12 @@ static int rzg2l_cru_get_virtual_channel(struct rzg2l_cru_dev *cru)
>  	int ret;
>  
>  	remote_pad = media_pad_remote_pad_unique(&cru->ip.pads[RZG2L_CRU_IP_SINK]);
> +	if (IS_ERR(remote_pad)) {
> +		ret = PTR_ERR(remote_pad);
> +		dev_err(cru->dev, "Failed to get remote source pad: %d\n", ret);
> +		return ret;
> +	}
> +
>  	ret = v4l2_subdev_call(cru->ip.remote, pad, get_frame_desc, remote_pad->index, &fd);
>  	if (ret < 0 && ret != -ENOIOCTLCMD) {
>  		dev_err(cru->dev, "get_frame_desc failed on IP remote subdev\n");

-- 
Regards,

Laurent Pinchart

Re: [PATCH] media: rzg2l-cru: Fix possible ERR_PTR deference

[Alper Ak]

> Have you seen this happening ?

No, I haven't seen this happen in practice. This was reported by
static analysis tool. Since the function explicitly documents these
error cases, it seemed appropriate to add defensive error checking to
avoid potential ERR_PTR dereference.


Laurent Pinchart <laurent.pinchart@ideasonboard.com>, 8 Şub 2026 Paz,
00:27 tarihinde şunu yazdı:
>
> On Sat, Feb 07, 2026 at 12:48:39PM +0300, Alper Ak wrote:
> > The media_pad_remote_pad_unique() can return ERR_PTR() on failure
> > (-ENOTUNIQ or -ENOLINK), but the code was dereferencing the return
> > value without checking for errors. Add IS_ERR() check before
> > dereferencing the pointer.
>
> Have you seen this happening ?
>
> > Fixes: d7d72dae81d5 ("media: rzg2l-cru: Retrieve virtual channel information")
> > Signed-off-by: Alper Ak <alperyasinak1@gmail.com>
> > ---
> >  drivers/media/platform/renesas/rzg2l-cru/rzg2l-video.c | 6 ++++++
> >  1 file changed, 6 insertions(+)
> >
> > diff --git a/drivers/media/platform/renesas/rzg2l-cru/rzg2l-video.c b/drivers/media/platform/renesas/rzg2l-cru/rzg2l-video.c
> > index 162e2ace6931..a34c2188df1a 100644
> > --- a/drivers/media/platform/renesas/rzg2l-cru/rzg2l-video.c
> > +++ b/drivers/media/platform/renesas/rzg2l-cru/rzg2l-video.c
> > @@ -411,6 +411,12 @@ static int rzg2l_cru_get_virtual_channel(struct rzg2l_cru_dev *cru)
> >       int ret;
> >
> >       remote_pad = media_pad_remote_pad_unique(&cru->ip.pads[RZG2L_CRU_IP_SINK]);
> > +     if (IS_ERR(remote_pad)) {
> > +             ret = PTR_ERR(remote_pad);
> > +             dev_err(cru->dev, "Failed to get remote source pad: %d\n", ret);
> > +             return ret;
> > +     }
> > +
> >       ret = v4l2_subdev_call(cru->ip.remote, pad, get_frame_desc, remote_pad->index, &fd);
> >       if (ret < 0 && ret != -ENOIOCTLCMD) {
> >               dev_err(cru->dev, "get_frame_desc failed on IP remote subdev\n");
>
> --
> Regards,
>
> Laurent Pinchart

Re: [PATCH] media: rzg2l-cru: Fix possible ERR_PTR deference

[Laurent Pinchart]

On Sun, Feb 08, 2026 at 02:07:48PM +0300, Alper Ak wrote:
> > Have you seen this happening ?
> 
> No, I haven't seen this happen in practice. This was reported by
> static analysis tool. Since the function explicitly documents these
> error cases, it seemed appropriate to add defensive error checking to
> avoid potential ERR_PTR dereference.

It's a false positive, this can't happen in practice due to the
MEDIA_PAD_FL_MUST_CONNECT flag being set on the RZG2L_CRU_IP_SINK pad.

In the future, please disclose usage of static analysis tools when you
submit patches.

> Laurent Pinchart, 8 Şub 2026 Paz, 00:27 tarihinde şunu yazdı:
> > On Sat, Feb 07, 2026 at 12:48:39PM +0300, Alper Ak wrote:
> > > The media_pad_remote_pad_unique() can return ERR_PTR() on failure
> > > (-ENOTUNIQ or -ENOLINK), but the code was dereferencing the return
> > > value without checking for errors. Add IS_ERR() check before
> > > dereferencing the pointer.
> >
> > Have you seen this happening ?
> >
> > > Fixes: d7d72dae81d5 ("media: rzg2l-cru: Retrieve virtual channel information")
> > > Signed-off-by: Alper Ak <alperyasinak1@gmail.com>
> > > ---
> > >  drivers/media/platform/renesas/rzg2l-cru/rzg2l-video.c | 6 ++++++
> > >  1 file changed, 6 insertions(+)
> > >
> > > diff --git a/drivers/media/platform/renesas/rzg2l-cru/rzg2l-video.c b/drivers/media/platform/renesas/rzg2l-cru/rzg2l-video.c
> > > index 162e2ace6931..a34c2188df1a 100644
> > > --- a/drivers/media/platform/renesas/rzg2l-cru/rzg2l-video.c
> > > +++ b/drivers/media/platform/renesas/rzg2l-cru/rzg2l-video.c
> > > @@ -411,6 +411,12 @@ static int rzg2l_cru_get_virtual_channel(struct rzg2l_cru_dev *cru)
> > >       int ret;
> > >
> > >       remote_pad = media_pad_remote_pad_unique(&cru->ip.pads[RZG2L_CRU_IP_SINK]);
> > > +     if (IS_ERR(remote_pad)) {
> > > +             ret = PTR_ERR(remote_pad);
> > > +             dev_err(cru->dev, "Failed to get remote source pad: %d\n", ret);
> > > +             return ret;
> > > +     }
> > > +
> > >       ret = v4l2_subdev_call(cru->ip.remote, pad, get_frame_desc, remote_pad->index, &fd);
> > >       if (ret < 0 && ret != -ENOIOCTLCMD) {
> > >               dev_err(cru->dev, "get_frame_desc failed on IP remote subdev\n");

-- 
Regards,

Laurent Pinchart

Re: [PATCH] media: rzg2l-cru: Fix possible ERR_PTR deference

[Markus Elfring]

> No, I haven't seen this happen in practice. This was reported by
> static analysis tool.

* Did this tool get a special name?

* Was any background information published for it?



>                       Since the function explicitly documents these
> error cases, it seemed appropriate to add defensive error checking to
> avoid potential ERR_PTR dereference.

How do you think about to improve change descriptions accordingly?

Regards,
Markus