The return value of mtk_vcp_mbox_xlate() is checked by IS_ERR(), so
return NULL is incorrect and could lead to a NULL pointer dereference.

Fixes: b562abd95672 ("mailbox: mediatek: Add mtk-vcp-mailbox driver")
Signed-off-by: Felix Gu <ustc.gu@gmail.com>
---
 drivers/mailbox/mtk-vcp-mailbox.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/mailbox/mtk-vcp-mailbox.c b/drivers/mailbox/mtk-vcp-mailbox.c
index cedad575528f..1b291b8ea15a 100644
--- a/drivers/mailbox/mtk-vcp-mailbox.c
+++ b/drivers/mailbox/mtk-vcp-mailbox.c
@@ -50,7 +50,7 @@ static struct mbox_chan *mtk_vcp_mbox_xlate(struct mbox_controller *mbox,
 					    const struct of_phandle_args *sp)
 {
 	if (sp->args_count)
-		return NULL;
+		return ERR_PTR(-EINVAL);
 
 	return &mbox->chans[0];
 }

---
base-commit: 3ef088b0c5772a6f75634e54aa34f5fc0a2c041c
change-id: 20260225-vcp-3a853447202e

Best regards,
-- 
Felix Gu <ustc.gu@gmail.com>

On Wed, Feb 25, 2026 at 10:33 AM Felix Gu <ustc.gu@gmail.com> wrote:
>
> The return value of mtk_vcp_mbox_xlate() is checked by IS_ERR(), so
> return NULL is incorrect and could lead to a NULL pointer dereference.
>
> Fixes: b562abd95672 ("mailbox: mediatek: Add mtk-vcp-mailbox driver")
> Signed-off-by: Felix Gu <ustc.gu@gmail.com>
> ---
>  drivers/mailbox/mtk-vcp-mailbox.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/mailbox/mtk-vcp-mailbox.c b/drivers/mailbox/mtk-vcp-mailbox.c
> index cedad575528f..1b291b8ea15a 100644
> --- a/drivers/mailbox/mtk-vcp-mailbox.c
> +++ b/drivers/mailbox/mtk-vcp-mailbox.c
> @@ -50,7 +50,7 @@ static struct mbox_chan *mtk_vcp_mbox_xlate(struct mbox_controller *mbox,
>                                             const struct of_phandle_args *sp)
>  {
>         if (sp->args_count)
> -               return NULL;
> +               return ERR_PTR(-EINVAL);
>
>         return &mbox->chans[0];
>  }
>
Applied to mailbox/for-next
Thanks
Jassi