On Sun Jun 28 16:40:36 2026 +0300, Sakari Ailus wrote:
> When the set_selection() pad operation is called from mt9m001_s_fmt(),
> it receives a NULL pointer for the state argument. As the function does
> not use the state this does not cause any issue in practice, but it
> could cause NULL pointer dereferences if the mt9m001_set_selection()
> implementation is modified. Avoid future issues by passing the subdev
> state.
>
> Suggested-by: Laurent Pinchart <[email protected]>
> Signed-off-by: Sakari Ailus <[email protected]>
> Reviewed-by: Laurent Pinchart <[email protected]>
Patch committed.
Thanks,
Sakari Ailus
drivers/media/i2c/mt9m001.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
---
diff --git a/drivers/media/i2c/mt9m001.c b/drivers/media/i2c/mt9m001.c
index 0ade967b357b..d8fffed0818a 100644
--- a/drivers/media/i2c/mt9m001.c
+++ b/drivers/media/i2c/mt9m001.c
@@ -343,6 +343,7 @@ static int mt9m001_get_fmt(struct v4l2_subdev *sd,
}
static int mt9m001_s_fmt(struct v4l2_subdev *sd,
+ struct v4l2_subdev_state *state,
const struct mt9m001_datafmt *fmt,
struct v4l2_mbus_framefmt *mf)
{
@@ -359,7 +360,7 @@ static int mt9m001_s_fmt(struct v4l2_subdev *sd,
int ret;
/* No support for scaling so far, just crop. TODO: use skipping */
- ret = mt9m001_set_selection(sd, NULL, &sel);
+ ret = mt9m001_set_selection(sd, state, &sel);
if (!ret) {
mf->width = mt9m001->rect.width;
mf->height = mt9m001->rect.height;
@@ -404,7 +405,7 @@ static int mt9m001_set_fmt(struct v4l2_subdev *sd,
mf->xfer_func = V4L2_XFER_FUNC_DEFAULT;
if (format->which == V4L2_SUBDEV_FORMAT_ACTIVE)
- return mt9m001_s_fmt(sd, fmt, mf);
+ return mt9m001_s_fmt(sd, sd_state, fmt, mf);
*v4l2_subdev_state_get_format(sd_state, 0) = *mf;
return 0;
}
_______________________________________________
linuxtv-commits mailing list -- [email protected]
To unsubscribe send an email to [email protected]
