media_pad_remote_pad_unique() can return an error pointer if the link is
missing or ambiguous. The current code dereferences the returned pointer
without checking for errors, which leads to a kernel crash.

Fix this by adding an IS_ERR() check and returning the error via
dev_err_probe().

Fixes: d5f281f3dd29 ("media: mali-c55: Add Mali-C55 ISP driver")
Signed-off-by: Chen Ni <nichen@iscas.ac.cn>
---
 drivers/media/platform/arm/mali-c55/mali-c55-isp.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/media/platform/arm/mali-c55/mali-c55-isp.c b/drivers/media/platform/arm/mali-c55/mali-c55-isp.c
index 497f25fbdd13..7c58da3ee331 100644
--- a/drivers/media/platform/arm/mali-c55/mali-c55-isp.c
+++ b/drivers/media/platform/arm/mali-c55/mali-c55-isp.c
@@ -360,6 +360,10 @@ static int mali_c55_isp_enable_streams(struct v4l2_subdev *sd,
 
 	sink_pad = &isp->pads[MALI_C55_ISP_PAD_SINK_VIDEO];
 	isp->remote_src = media_pad_remote_pad_unique(sink_pad);
+	if (IS_ERR(isp->remote_src))
+		return dev_err_probe(mali_c55->dev, PTR_ERR(isp->remote_src),
+				     "Failed to get unique remote pad\n");
+
 	src_sd = media_entity_to_v4l2_subdev(isp->remote_src->entity);
 
 	isp->frame_sequence = 0;
-- 
2.25.1

Hi Chen - thanks for the patch

On 05/03/2026 05:20, Chen Ni wrote:
> media_pad_remote_pad_unique() can return an error pointer if the link is
> missing or ambiguous. The current code dereferences the returned pointer
> without checking for errors, which leads to a kernel crash.
> 
> Fix this by adding an IS_ERR() check and returning the error via
> dev_err_probe().
> 
> Fixes: d5f281f3dd29 ("media: mali-c55: Add Mali-C55 ISP driver")
> Signed-off-by: Chen Ni <nichen@iscas.ac.cn>
> ---

A similar patch was already submitted to fix this issue:

https://lore.kernel.org/linux-media/20260207091822.601255-1-alperyasinak1@gmail.com/

Thanks
Dan

>   drivers/media/platform/arm/mali-c55/mali-c55-isp.c | 4 ++++
>   1 file changed, 4 insertions(+)
> 
> diff --git a/drivers/media/platform/arm/mali-c55/mali-c55-isp.c b/drivers/media/platform/arm/mali-c55/mali-c55-isp.c
> index 497f25fbdd13..7c58da3ee331 100644
> --- a/drivers/media/platform/arm/mali-c55/mali-c55-isp.c
> +++ b/drivers/media/platform/arm/mali-c55/mali-c55-isp.c
> @@ -360,6 +360,10 @@ static int mali_c55_isp_enable_streams(struct v4l2_subdev *sd,
>   
>   	sink_pad = &isp->pads[MALI_C55_ISP_PAD_SINK_VIDEO];
>   	isp->remote_src = media_pad_remote_pad_unique(sink_pad);
> +	if (IS_ERR(isp->remote_src))
> +		return dev_err_probe(mali_c55->dev, PTR_ERR(isp->remote_src),
> +				     "Failed to get unique remote pad\n");
> +
>   	src_sd = media_entity_to_v4l2_subdev(isp->remote_src->entity);
>   
>   	isp->frame_sequence = 0;