github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

media: mt9m001: Pass sub-device state to set_selection() callback

Browse Source 
When the set_selection() pad operation is called from mt9m001_s_fmt(),
it receives a NULL pointer for the state argument. As the function does
not use the state this does not cause any issue in practice, but it
could cause NULL pointer dereferences if the mt9m001_set_selection()
implementation is modified. Avoid future issues by passing the subdev
state.

Suggested-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
This commit is contained in:
Sakari Ailus 2026-06-28 16:40:36 +03:00
parent 92e0c721f7
commit e33ce9db24
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
drivers/media/i2c/mt9m001.c
View File

@ -343,6 +343,7 @@ static int mt9m001_get_fmt(struct v4l2_subdev *sd,
}
static int mt9m001_s_fmt(struct v4l2_subdev *sd,
struct v4l2_subdev_state *state,
const struct mt9m001_datafmt *fmt,
struct v4l2_mbus_framefmt *mf)
{
@ -359,7 +360,7 @@ static int mt9m001_s_fmt(struct v4l2_subdev *sd,
int ret;
/* No support for scaling so far, just crop. TODO: use skipping */
ret = mt9m001_set_selection(sd, NULL, &sel);
ret = mt9m001_set_selection(sd, state, &sel);
if (!ret) {
mf->width = mt9m001->rect.width;
mf->height = mt9m001->rect.height;
@ -404,7 +405,7 @@ static int mt9m001_set_fmt(struct v4l2_subdev *sd,
mf->xfer_func = V4L2_XFER_FUNC_DEFAULT;
if (format->which == V4L2_SUBDEV_FORMAT_ACTIVE)
return mt9m001_s_fmt(sd, fmt, mf);
return mt9m001_s_fmt(sd, sd_state, fmt, mf);
*v4l2_subdev_state_get_format(sd_state, 0) = *mf;
return 0;
}