From b272a1780e8515617fed2564edccb8da8431d707 Mon Sep 17 00:00:00 2001 From: David Carlier Date: Tue, 28 Jul 2026 10:24:30 +0100 Subject: [PATCH] media: i2c: imx471: Fix uninitialized error value in imx471_set_ctrl() The exposure and vertical blanking writes pass the address of the local ret variable to cci_write() as its error pointer, but there is no earlier error to propagate: each case is a single standalone write, like the other controls in the same switch that already pass NULL. In the exposure case ret is still uninitialized, so a non-zero stack value makes cci_write() return early without programming the register, and the control write reports a bogus status. The vertical blanking case is benign today because ret is zero there, but the construct is equally wrong. Pass NULL as the error pointer in both cases. Fixes: be1589e567ae ("media: i2c: imx471: Add Sony IMX471 image sensor driver") Suggested-by: Kate Hsuan Signed-off-by: David Carlier Reviewed-by: Kate Hsuan Reviewed-by: Tarang Raval Signed-off-by: Sakari Ailus --- drivers/media/i2c/imx471.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/media/i2c/imx471.c b/drivers/media/i2c/imx471.c index 6d358b11e96d..4053aed84340 100644 --- a/drivers/media/i2c/imx471.c +++ b/drivers/media/i2c/imx471.c @@ -334,12 +334,12 @@ static int imx471_set_ctrl(struct v4l2_ctrl *ctrl) break; case V4L2_CID_EXPOSURE: ret = cci_write(sensor->regmap, IMX471_REG_EXPOSURE, - ctrl->val, &ret); + ctrl->val, NULL); break; case V4L2_CID_VBLANK: /* Update FLL that meets expected vertical blanking */ ret = cci_write(sensor->regmap, IMX471_REG_FLL, - format->height + ctrl->val, &ret); + format->height + ctrl->val, NULL); break; case V4L2_CID_TEST_PATTERN: ret = cci_write(sensor->regmap, IMX471_REG_TEST_PATTERN,