[PATCH] media: mali-c55: Fix possible ERR_PTR dereference in mali_c55_isp_enable_streams()
From: Alper Ak
Date: Sat Dec 27 2025 - 06:52:20 EST
media_pad_remote_pad_unique() can return ERR_PTR(-ENOTUNIQ) or
ERR_PTR(-ENOLINK) on error situation.
The current code dereferences isp->remote_src without checking
for these error cases, which could lead to invalid memory access.
Add IS_ERR() check before dereferencing the pointer.
Fixes: d5f281f3dd29 ("media: mali-c55: Add Mali-C55 ISP driver")
Signed-off-by: Alper Ak <alperyasinak1@xxxxxxxxx>
---
drivers/media/platform/arm/mali-c55/mali-c55-isp.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/media/platform/arm/mali-c55/mali-c55-isp.c b/drivers/media/platform/arm/mali-c55/mali-c55-isp.c
index 497f25fbdd13..ca1f0bde6f13 100644
--- a/drivers/media/platform/arm/mali-c55/mali-c55-isp.c
+++ b/drivers/media/platform/arm/mali-c55/mali-c55-isp.c
@@ -359,7 +359,11 @@ static int mali_c55_isp_enable_streams(struct v4l2_subdev *sd,
*/
sink_pad = &isp->pads[MALI_C55_ISP_PAD_SINK_VIDEO];
+
isp->remote_src = media_pad_remote_pad_unique(sink_pad);
+ if (IS_ERR(isp->remote_src))
+ return PTR_ERR(isp->remote_src);
+
src_sd = media_entity_to_v4l2_subdev(isp->remote_src->entity);
isp->frame_sequence = 0;
--
2.43.0