Add check for the return value of media_pad_remote_pad_first() and
return the error if it fails in order to avoid NULL pointer dereference.

Fixes: b2e44430b634 ("media: mc-entity: Rename media_entity_remote_pad() to media_pad_remote_pad_first()")
Signed-off-by: Chen Ni <nichen@iscas.ac.cn>
---
 drivers/staging/media/omap4iss/iss_csi2.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/staging/media/omap4iss/iss_csi2.c b/drivers/staging/media/omap4iss/iss_csi2.c
index 0e6c5bd81930..43851bbd0cc3 100644
--- a/drivers/staging/media/omap4iss/iss_csi2.c
+++ b/drivers/staging/media/omap4iss/iss_csi2.c
@@ -539,6 +539,9 @@ static int csi2_configure(struct iss_csi2_device *csi2)
 		return -EBUSY;
 
 	pad = media_pad_remote_pad_first(&csi2->pads[CSI2_PAD_SINK]);
+	if (!pad)
+		return -EPIPE;
+
 	sensor = media_entity_to_v4l2_subdev(pad->entity);
 	pdata = sensor->host_priv;
 
-- 
2.25.1

On Fri, Jul 26, 2024 at 03:28:14PM +0800, Chen Ni wrote:
> Add check for the return value of media_pad_remote_pad_first() and
> return the error if it fails in order to avoid NULL pointer dereference.
> 
> Fixes: b2e44430b634 ("media: mc-entity: Rename media_entity_remote_pad() to media_pad_remote_pad_first()")

That Fixes tag isn't correct.  The patch just renamed the function.

When I look at that patch, the isp_pipeline_is_last() function doesn't
check for NULL either.  Why is that one different?

regards,
dan carpenter

On Fri, Jul 26, 2024 at 03:28:14PM +0800, Chen Ni wrote:
> Add check for the return value of media_pad_remote_pad_first() and
> return the error if it fails in order to avoid NULL pointer dereference.
> 
> Fixes: b2e44430b634 ("media: mc-entity: Rename media_entity_remote_pad() to media_pad_remote_pad_first()")
> Signed-off-by: Chen Ni <nichen@iscas.ac.cn>
> ---
>  drivers/staging/media/omap4iss/iss_csi2.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/drivers/staging/media/omap4iss/iss_csi2.c b/drivers/staging/media/omap4iss/iss_csi2.c
> index 0e6c5bd81930..43851bbd0cc3 100644
> --- a/drivers/staging/media/omap4iss/iss_csi2.c
> +++ b/drivers/staging/media/omap4iss/iss_csi2.c
> @@ -539,6 +539,9 @@ static int csi2_configure(struct iss_csi2_device *csi2)
>  		return -EBUSY;
>  
>  	pad = media_pad_remote_pad_first(&csi2->pads[CSI2_PAD_SINK]);
> +	if (!pad)
> +		return -EPIPE;

How was this found and tested?

thanks,

greg k-h