[PATCH v1 1/2] media: atomisp: fix potential NULL pointer dereference in configure_isp_from_args()

Jose A. Perez de Azpillaga
2026-03-28T19:27:43Z

The function configure_isp_from_args() incorrectly dereferences
args->delay_frames[0] to configure cropping without checking if the
pointer is valid. However, as noted in a FIXME comment later in the
same function, delay_frames can be NULL in certain pipeline
configurations.

Add defensive checks for both delay_frames and tnr_frames before passing
them to their respective configuration functions. This ensures that
optional frames are only processed if they were actually allocated,
preventing a kernel NULL pointer dereference.

Fixes: a49d25364dfb ("staging/atomisp: Add support for the Intel IPU v2")
Signed-off-by: Jose A. Perez de Azpillaga <azpijr@gmail.com>
---
drivers/staging/media/atomisp/pci/sh_css_sp.c | 44 ++++++++++++-------
1 file changed, 27 insertions(+), 17 deletions(-)

diff --git a/drivers/staging/media/atomisp/pci/sh_css_sp.c b/drivers/staging/media/atomisp/pci/sh_css_sp.c
index 6da151e7a873..2904455b35f7 100644
--- a/drivers/staging/media/atomisp/pci/sh_css_sp.c
+++ b/drivers/staging/media/atomisp/pci/sh_css_sp.c
@@ -775,9 +775,17 @@ static int configure_isp_from_args(const struct sh_css_sp_pipeline *pipeline,
ret = ia_css_fpn_configure(binary, &binary->in_frame_info);
if (ret)
return ret;
- ret = ia_css_crop_configure(binary, ia_css_frame_get_info(args->delay_frames[0]));
- if (ret)
- return ret;
+
+ /*
+ * Only configure crop if delay_frames are present. Accessing
+ * delay_frames[0] without this check would result in a NULL deference.
+ */
+ if (args->delay_frames[0]) {
+ ret = ia_css_crop_configure(binary, ia_css_frame_get_info(args->delay_frames[0]));
+ if (ret)
+ return ret;
+ }
+
ret = ia_css_qplane_configure(pipeline, binary, &binary->in_frame_info);
if (ret)
return ret;
@@ -808,21 +816,23 @@ static int configure_isp_from_args(const struct sh_css_sp_pipeline *pipeline,
return ret;

/*
- * FIXME: args->delay_frames can be NULL here
- *
- * Somehow, the driver at the Intel Atom Yocto tree doesn't seem to
- * suffer from the same issue.
- *
- * Anyway, the function below should now handle a NULL delay_frames
- * without crashing, but the pipeline should likely be built without
- * adding it at the first place (or there are a hidden bug somewhere)
+ * Safely handle pipelines built without delay_frames
*/
- ret = ia_css_ref_configure(binary, args->delay_frames, pipeline->dvs_frame_delay);
- if (ret)
- return ret;
- ret = ia_css_tnr_configure(binary, args->tnr_frames);
- if (ret)
- return ret;
+ if (args->delay_frames[0]) {
+ ret = ia_css_ref_configure(binary, args->delay_frames, pipeline->dvs_frame_delay);
+ if (ret)
+ return ret;
+ }
+
+ /*
+ * Safely handle TNR frames as well
+ */
+ if (args->tnr_frames[0]) {
+ ret = ia_css_tnr_configure(binary, args->tnr_frames);
+ if (ret)
+ return ret;
+ }
+
return ia_css_bayer_io_config(binary, args);
}

--
2.53.0