[PATCH] media: subdev: Fix error pointer dereference

[PATCH] media: subdev: Fix error pointer dereference

[Ethan Tidmore]

The function media_pad_remote_pad_unique() returns an error pointer upon
failure, not null.

Add check for error pointer and extract the error code with PTR_ERR().

Fixes: a564839e630c1 ("media: subdev: Add v4l2_subdev_get_frame_desc_passthrough helper")
Signed-off-by: Ethan Tidmore <ethantidmore06@gmail.com>
---
 drivers/media/v4l2-core/v4l2-subdev.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/media/v4l2-core/v4l2-subdev.c b/drivers/media/v4l2-core/v4l2-subdev.c
index 9efd14d4026f..7cb17e0a5617 100644
--- a/drivers/media/v4l2-core/v4l2-subdev.c
+++ b/drivers/media/v4l2-core/v4l2-subdev.c
@@ -2585,10 +2585,10 @@ int v4l2_subdev_get_frame_desc_passthrough(struct v4l2_subdev *sd,
 
 			if (!have_source_fd) {
 				remote_source_pad = media_pad_remote_pad_unique(local_sink_pad);
-				if (!remote_source_pad) {
+				if (IS_ERR(remote_source_pad)) {
 					dev_dbg(dev, "Failed to find remote pad for sink pad %u\n",
 						local_sink_pad->index);
-					ret = -EINVAL;
+					ret = PTR_ERR(remote_source_pad);
 					goto out_unlock;
 				}
 
-- 
2.53.0

Re: [PATCH] media: subdev: Fix error pointer dereference

[Ethan Tidmore]

On Fri Mar 13, 2026 at 10:02 PM CDT, Ethan Tidmore wrote:
> The function media_pad_remote_pad_unique() returns an error pointer upon
> failure, not null.
>
> Add check for error pointer and extract the error code with PTR_ERR().

Detected by Smatch:
drivers/media/v4l2-core/v4l2-subdev.c:2588 v4l2_subdev_get_frame_desc_passthrough() warn:
'remote_source_pad' is an error pointer or valid

drivers/media/v4l2-core/v4l2-subdev.c:2595 v4l2_subdev_get_frame_desc_passthrough() error:
'remote_source_pad' dereferencing possible ERR_PTR()

>
> Fixes: a564839e630c1 ("media: subdev: Add v4l2_subdev_get_frame_desc_passthrough helper")
> Signed-off-by: Ethan Tidmore <ethantidmore06@gmail.com>
> ---

Forgot to add the Smatch warnings, if this version is good please add
this to the commit message.

Thanks,

ET

Re: [PATCH] media: subdev: Fix error pointer dereference

[Jacopo Mondi]

Hi Ethan

On Fri, Mar 13, 2026 at 10:06:43PM -0500, Ethan Tidmore wrote:
> On Fri Mar 13, 2026 at 10:02 PM CDT, Ethan Tidmore wrote:
> > The function media_pad_remote_pad_unique() returns an error pointer upon
> > failure, not null.
> >

A patch has already been submitted to fix this issue
https://patchwork.linuxtv.org/project/linux-media/patch/20260313063946.3220962-1-nichen@iscas.ac.cn/

> > Add check for error pointer and extract the error code with PTR_ERR().
>
> Detected by Smatch:
> drivers/media/v4l2-core/v4l2-subdev.c:2588 v4l2_subdev_get_frame_desc_passthrough() warn:
> 'remote_source_pad' is an error pointer or valid
>
> drivers/media/v4l2-core/v4l2-subdev.c:2595 v4l2_subdev_get_frame_desc_passthrough() error:
> 'remote_source_pad' dereferencing possible ERR_PTR()
>

Chen Ni: have you used Smatch as well ? Should you add the above lines
to attribute the bug report to it ?

Thanks
  j

> >
> > Fixes: a564839e630c1 ("media: subdev: Add v4l2_subdev_get_frame_desc_passthrough helper")
> > Signed-off-by: Ethan Tidmore <ethantidmore06@gmail.com>
> > ---
>
> Forgot to add the Smatch warnings, if this version is good please add
> this to the commit message.
>
> Thanks,
>
> ET