[PATCH] media: malic55: Fix possible ERR_PTR deference in enable_streams

[PATCH] media: malic55: Fix possible ERR_PTR deference in enable_streams

[Alper Ak]

The media_pad_remote_pad_unique() function returns either a valid
pointer or an ERR_PTR() on failure (-ENOTUNIQ if multiple links are
enabled, -ENOLINK if no connected pad is found). The return value
was assigned directly to isp->remote_src and dereferenced in the
next line without checking for errors, which could lead to an
ERR_PTR dereference.

Add proper error checking with IS_ERR() before dereferencing the
pointer. Also set isp->remote_src to NULL on error to maintain
consistency with other error paths in the function.

Fixes: d5f281f3dd29 ("media: mali-c55: Add Mali-C55 ISP driver")
Signed-off-by: Alper Ak <alperyasinak1@gmail.com>
---
 drivers/media/platform/arm/mali-c55/mali-c55-isp.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/media/platform/arm/mali-c55/mali-c55-isp.c b/drivers/media/platform/arm/mali-c55/mali-c55-isp.c
index 497f25fbdd13..c7225e9c8df7 100644
--- a/drivers/media/platform/arm/mali-c55/mali-c55-isp.c
+++ b/drivers/media/platform/arm/mali-c55/mali-c55-isp.c
@@ -360,6 +360,13 @@ static int mali_c55_isp_enable_streams(struct v4l2_subdev *sd,
 
 	sink_pad = &isp->pads[MALI_C55_ISP_PAD_SINK_VIDEO];
 	isp->remote_src = media_pad_remote_pad_unique(sink_pad);
+	if (IS_ERR(isp->remote_src))  {
+		ret = PTR_ERR(isp->remote_src);
+		dev_err(mali_c55->dev, "Failed to get remote source pad: %d\n", ret);
+		isp->remote_src = NULL;
+		return ret;
+	}
+
 	src_sd = media_entity_to_v4l2_subdev(isp->remote_src->entity);
 
 	isp->frame_sequence = 0;
-- 
2.43.0

Re: [PATCH] media: malic55: Fix possible ERR_PTR deference in enable_streams

[Jacopo Mondi]

Hi Alper

On Sat, Feb 07, 2026 at 12:18:22PM +0300, Alper Ak wrote:
> The media_pad_remote_pad_unique() function returns either a valid
> pointer or an ERR_PTR() on failure (-ENOTUNIQ if multiple links are
> enabled, -ENOLINK if no connected pad is found). The return value
> was assigned directly to isp->remote_src and dereferenced in the
> next line without checking for errors, which could lead to an
> ERR_PTR dereference.
>
> Add proper error checking with IS_ERR() before dereferencing the
> pointer. Also set isp->remote_src to NULL on error to maintain
> consistency with other error paths in the function.
>
> Fixes: d5f281f3dd29 ("media: mali-c55: Add Mali-C55 ISP driver")
> Signed-off-by: Alper Ak <alperyasinak1@gmail.com>

As the media link on the ISP sink pad #0 can connect to either the TPG
entity or to the [CSI-2 RX | IVC] pair, it is created without an
IMMUTABLE flag and can be in facts disabled.

So I guess the check is correct in this case:
Acked-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>

As per the other patch for the CRU, it might be nice to attribute
credit to the static analysis tool you have used.

> ---
>  drivers/media/platform/arm/mali-c55/mali-c55-isp.c | 7 +++++++
>  1 file changed, 7 insertions(+)
>
> diff --git a/drivers/media/platform/arm/mali-c55/mali-c55-isp.c b/drivers/media/platform/arm/mali-c55/mali-c55-isp.c
> index 497f25fbdd13..c7225e9c8df7 100644
> --- a/drivers/media/platform/arm/mali-c55/mali-c55-isp.c
> +++ b/drivers/media/platform/arm/mali-c55/mali-c55-isp.c
> @@ -360,6 +360,13 @@ static int mali_c55_isp_enable_streams(struct v4l2_subdev *sd,
>
>  	sink_pad = &isp->pads[MALI_C55_ISP_PAD_SINK_VIDEO];
>  	isp->remote_src = media_pad_remote_pad_unique(sink_pad);
> +	if (IS_ERR(isp->remote_src))  {
> +		ret = PTR_ERR(isp->remote_src);
> +		dev_err(mali_c55->dev, "Failed to get remote source pad: %d\n", ret);
> +		isp->remote_src = NULL;
> +		return ret;
> +	}
> +
>  	src_sd = media_entity_to_v4l2_subdev(isp->remote_src->entity);
>
>  	isp->frame_sequence = 0;
> --
> 2.43.0
>

Re: [PATCH] media: malic55: Fix possible ERR_PTR deference in enable_streams

[Dan Scally]

Morning Alper, thanks for the patch

On 07/02/2026 09:18, Alper Ak wrote:
> The media_pad_remote_pad_unique() function returns either a valid
> pointer or an ERR_PTR() on failure (-ENOTUNIQ if multiple links are
> enabled, -ENOLINK if no connected pad is found). The return value
> was assigned directly to isp->remote_src and dereferenced in the
> next line without checking for errors, which could lead to an
> ERR_PTR dereference.
> 
> Add proper error checking with IS_ERR() before dereferencing the
> pointer. Also set isp->remote_src to NULL on error to maintain
> consistency with other error paths in the function.
> 
> Fixes: d5f281f3dd29 ("media: mali-c55: Add Mali-C55 ISP driver")
> Signed-off-by: Alper Ak <alperyasinak1@gmail.com>
> ---
>   drivers/media/platform/arm/mali-c55/mali-c55-isp.c | 7 +++++++
>   1 file changed, 7 insertions(+)
> 
> diff --git a/drivers/media/platform/arm/mali-c55/mali-c55-isp.c b/drivers/media/platform/arm/mali-c55/mali-c55-isp.c
> index 497f25fbdd13..c7225e9c8df7 100644
> --- a/drivers/media/platform/arm/mali-c55/mali-c55-isp.c
> +++ b/drivers/media/platform/arm/mali-c55/mali-c55-isp.c
> @@ -360,6 +360,13 @@ static int mali_c55_isp_enable_streams(struct v4l2_subdev *sd,
>   
>   	sink_pad = &isp->pads[MALI_C55_ISP_PAD_SINK_VIDEO];
>   	isp->remote_src = media_pad_remote_pad_unique(sink_pad);
> +	if (IS_ERR(isp->remote_src))  {
> +		ret = PTR_ERR(isp->remote_src);
> +		dev_err(mali_c55->dev, "Failed to get remote source pad: %d\n", ret);
> +		isp->remote_src = NULL;
> +		return ret;
> +	}
> +


Reviewed-by: Daniel Scally <dan.scally@ideasonboard.com>

>   	src_sd = media_entity_to_v4l2_subdev(isp->remote_src->entity);
>   
>   	isp->frame_sequence = 0;

Re: [PATCH] media: malic55: Fix possible ERR_PTR deference in enable_streams

[Markus Elfring]

…
> pointer or an ERR_PTR() on failure …

                error pointer


> Add proper error checking with IS_ERR() before dereferencing the
> pointer. Also set isp->remote_src to NULL on error to maintain
> consistency with other error paths in the function.
…

* See also once more:
  https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/stable-kernel-rules.rst?h=v6.19#n34

* Were any source code analysis tools involved here?

* Would a summary phrase like “Prevent error pointer dereference
  in mali_c55_isp_enable_streams()” be more appropriate?


Regards,
Markus

Re: [PATCH] media: malic55: Fix possible ERR_PTR deference in enable_streams

[Alper Ak]

Hello everyone, look like this patch hasn't been applied. Did I miss
something I needed to do to get it applied? If there is anything I
need to do, please let me know.


Markus Elfring <Markus.Elfring@web.de>, 14 Şub 2026 Cmt, 17:37
tarihinde şunu yazdı:
>
> …
> > pointer or an ERR_PTR() on failure …
>
>                 error pointer
>
>
> > Add proper error checking with IS_ERR() before dereferencing the
> > pointer. Also set isp->remote_src to NULL on error to maintain
> > consistency with other error paths in the function.
> …
>
> * See also once more:
>   https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/stable-kernel-rules.rst?h=v6.19#n34
>
> * Were any source code analysis tools involved here?
>
> * Would a summary phrase like “Prevent error pointer dereference
>   in mali_c55_isp_enable_streams()” be more appropriate?
>
>
> Regards,
> Markus
>

Re: media: malic55: Fix possible ERR_PTR deference in enable_streams

[Markus Elfring]

> Hello everyone, look like this patch hasn't been applied. Did I miss
> something I needed to do to get it applied? If there is anything I
> need to do, please let me know.

Did anything hinder you to take also my patch review comments better
into account?

Regards,
Markus

Re: [PATCH] media: malic55: Fix possible ERR_PTR deference in enable_streams

[Jacopo Mondi]

Hi Alper,

On Fri, Mar 06, 2026 at 09:31:22AM +0300, Alper Ak wrote:
> Hello everyone, look like this patch hasn't been applied. Did I miss
> something I needed to do to get it applied? If there is anything I
> need to do, please let me know.

No, I think it's good.

The only think I see is my comment

As per the other patch for the CRU, it might be nice to attribute
credit to the static analysis tool you have used.

which makes me think there was a discussion on another patch about the
tool.

If you wish to resend to add credit, you're welcome to do so.

Otherwise, patches are collected in the media tree before the current
-rc6 (usually) so seat back and relax it might still take a while.

>
>
> Markus Elfring <Markus.Elfring@web.de>, 14 Şub 2026 Cmt, 17:37
> tarihinde şunu yazdı:
> >
> > …
> > > pointer or an ERR_PTR() on failure …
> >
> >                 error pointer
> >
> >
> > > Add proper error checking with IS_ERR() before dereferencing the
> > > pointer. Also set isp->remote_src to NULL on error to maintain
> > > consistency with other error paths in the function.
> > …
> >
> > * See also once more:
> >   https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/stable-kernel-rules.rst?h=v6.19#n34
> >
> > * Were any source code analysis tools involved here?
> >
> > * Would a summary phrase like “Prevent error pointer dereference
> >   in mali_c55_isp_enable_streams()” be more appropriate?
> >
> >
> > Regards,
> > Markus
> >

Re: media: malic55: Fix possible ERR_PTR deference in enable_streams

[Markus Elfring]

>> Hello everyone, look like this patch hasn't been applied. Did I miss
>> something I needed to do to get it applied? If there is anything I
>> need to do, please let me know.
> 
> No, I think it's good.

Does such feedback indicate that you would tolerate typos here?


> The only think I see is my comment
> 
> As per the other patch for the CRU, it might be nice to attribute
> credit to the static analysis tool you have used.
> 
> which makes me think there was a discussion on another patch about the tool.

Will such patch review concerns be reconsidered any more?

Regards,
Markus