[PATCH 1/5] staging: media: tegra-video: add NULL checks for of_device_get_match_data()

[PATCH 1/5] staging: media: tegra-video: add NULL checks for of_device_get_match_data()

[Alexandru Hossu]

tegra_csi_probe(), tegra_vi_probe(), and tegra_vip_probe() all call
of_device_get_match_data() to retrieve SoC-specific data from the device
tree match table, but none of them check the return value for NULL before
eventually dereferencing it.

In tegra_csi_probe(), the pointer is dereferenced on the very next
statement via csi->soc->num_clks. In tegra_vi_probe(), it is dereferenced
later via vi->soc->ops. In tegra_vip_probe(), vip->soc is stored and then
dereferenced at runtime via vip->soc->ops->vip_start_streaming(). A NULL
return would cause a kernel NULL pointer dereference in each case.

Add a NULL check returning -ENODEV in all three probe functions, consistent
with the defensive pattern already used in similar staging drivers such as
drivers/staging/media/sunxi/cedrus/cedrus_hw.c.

Signed-off-by: Alexandru Hossu <hossu.alexandru@gmail.com>
---
 drivers/staging/media/tegra-video/csi.c | 2 ++
 drivers/staging/media/tegra-video/vi.c  | 2 ++
 drivers/staging/media/tegra-video/vip.c | 2 ++
 3 files changed, 6 insertions(+)

diff --git a/drivers/staging/media/tegra-video/csi.c b/drivers/staging/media/tegra-video/csi.c
index 7842104ca933..33369a8c803a 100644
--- a/drivers/staging/media/tegra-video/csi.c
+++ b/drivers/staging/media/tegra-video/csi.c
@@ -781,6 +781,8 @@ static int tegra_csi_probe(struct platform_device *pdev)
 		return PTR_ERR(csi->iomem);
 
 	csi->soc = of_device_get_match_data(&pdev->dev);
+	if (!csi->soc)
+		return -ENODEV;
 
 	csi->clks = devm_kcalloc(&pdev->dev, csi->soc->num_clks,
 				 sizeof(*csi->clks), GFP_KERNEL);
diff --git a/drivers/staging/media/tegra-video/vi.c b/drivers/staging/media/tegra-video/vi.c
index d1d934e361f7..f3b749f059f8 100644
--- a/drivers/staging/media/tegra-video/vi.c
+++ b/drivers/staging/media/tegra-video/vi.c
@@ -1907,6 +1907,8 @@ static int tegra_vi_probe(struct platform_device *pdev)
 		return PTR_ERR(vi->iomem);
 
 	vi->soc = of_device_get_match_data(&pdev->dev);
+	if (!vi->soc)
+		return -ENODEV;
 
 	vi->clk = devm_clk_get(&pdev->dev, NULL);
 	if (IS_ERR(vi->clk)) {
diff --git a/drivers/staging/media/tegra-video/vip.c b/drivers/staging/media/tegra-video/vip.c
index 80cd3b113125..148c68ceb605 100644
--- a/drivers/staging/media/tegra-video/vip.c
+++ b/drivers/staging/media/tegra-video/vip.c
@@ -236,6 +236,8 @@ static int tegra_vip_probe(struct platform_device *pdev)
 		return -ENOMEM;
 
 	vip->soc = of_device_get_match_data(&pdev->dev);
+	if (!vip->soc)
+		return -ENODEV;
 
 	vip->dev = &pdev->dev;
 	platform_set_drvdata(pdev, vip);
-- 
2.53.0

Re: [PATCH 1/5] staging: media: tegra-video: add NULL checks for of_device_get_match_data()

[Mikko Perttunen]

On Monday, April 13, 2026 5:50 AM Alexandru Hossu wrote:
> tegra_csi_probe(), tegra_vi_probe(), and tegra_vip_probe() all call
> of_device_get_match_data() to retrieve SoC-specific data from the device
> tree match table, but none of them check the return value for NULL before
> eventually dereferencing it.
> 
> In tegra_csi_probe(), the pointer is dereferenced on the very next
> statement via csi->soc->num_clks. In tegra_vi_probe(), it is dereferenced
> later via vi->soc->ops. In tegra_vip_probe(), vip->soc is stored and then
> dereferenced at runtime via vip->soc->ops->vip_start_streaming(). A NULL
> return would cause a kernel NULL pointer dereference in each case.
> 
> Add a NULL check returning -ENODEV in all three probe functions, consistent
> with the defensive pattern already used in similar staging drivers such as
> drivers/staging/media/sunxi/cedrus/cedrus_hw.c.
> 
> Signed-off-by: Alexandru Hossu <hossu.alexandru@gmail.com>
> ---
>  drivers/staging/media/tegra-video/csi.c | 2 ++
>  drivers/staging/media/tegra-video/vi.c  | 2 ++
>  drivers/staging/media/tegra-video/vip.c | 2 ++
>  3 files changed, 6 insertions(+)
> 
> diff --git a/drivers/staging/media/tegra-video/csi.c b/drivers/staging/media/tegra-video/csi.c
> index 7842104ca933..33369a8c803a 100644
> --- a/drivers/staging/media/tegra-video/csi.c
> +++ b/drivers/staging/media/tegra-video/csi.c
> @@ -781,6 +781,8 @@ static int tegra_csi_probe(struct platform_device *pdev)
>  		return PTR_ERR(csi->iomem);
>  
>  	csi->soc = of_device_get_match_data(&pdev->dev);
> +	if (!csi->soc)
> +		return -ENODEV;
>  
>  	csi->clks = devm_kcalloc(&pdev->dev, csi->soc->num_clks,
>  				 sizeof(*csi->clks), GFP_KERNEL);
> diff --git a/drivers/staging/media/tegra-video/vi.c b/drivers/staging/media/tegra-video/vi.c
> index d1d934e361f7..f3b749f059f8 100644
> --- a/drivers/staging/media/tegra-video/vi.c
> +++ b/drivers/staging/media/tegra-video/vi.c
> @@ -1907,6 +1907,8 @@ static int tegra_vi_probe(struct platform_device *pdev)
>  		return PTR_ERR(vi->iomem);
>  
>  	vi->soc = of_device_get_match_data(&pdev->dev);
> +	if (!vi->soc)
> +		return -ENODEV;
>  
>  	vi->clk = devm_clk_get(&pdev->dev, NULL);
>  	if (IS_ERR(vi->clk)) {
> diff --git a/drivers/staging/media/tegra-video/vip.c b/drivers/staging/media/tegra-video/vip.c
> index 80cd3b113125..148c68ceb605 100644
> --- a/drivers/staging/media/tegra-video/vip.c
> +++ b/drivers/staging/media/tegra-video/vip.c
> @@ -236,6 +236,8 @@ static int tegra_vip_probe(struct platform_device *pdev)
>  		return -ENOMEM;
>  
>  	vip->soc = of_device_get_match_data(&pdev->dev);
> +	if (!vip->soc)
> +		return -ENODEV;
>  
>  	vip->dev = &pdev->dev;
>  	platform_set_drvdata(pdev, vip);
> -- 
> 2.53.0
> 
> 

These devices are only probed through device tree, so we know the 
returned pointer is always non-NULL. Typically we don't check in such 
cases.

Thanks
Mikko

Re: [PATCH 1/5] staging: media: tegra-video: add NULL checks for of_device_get_match_data()

[Alexandru Hossu]

On Mon, Apr 13, 2026 at 05:07 AM, Mikko Perttunen wrote:
> These devices are only probed through device tree, so we know the
> returned pointer is always non-NULL. Typically we don't check in such
> cases.

Thanks for the explanation, will drop this patch.

Alexandru