From e33ce9db24af0f1b646a5fade47a388ba9a06a2e Mon Sep 17 00:00:00 2001 From: Sakari Ailus Date: Sun, 28 Jun 2026 16:40:36 +0300 Subject: [PATCH] media: mt9m001: Pass sub-device state to set_selection() callback When the set_selection() pad operation is called from mt9m001_s_fmt(), it receives a NULL pointer for the state argument. As the function does not use the state this does not cause any issue in practice, but it could cause NULL pointer dereferences if the mt9m001_set_selection() implementation is modified. Avoid future issues by passing the subdev state. Suggested-by: Laurent Pinchart Signed-off-by: Sakari Ailus Reviewed-by: Laurent Pinchart --- drivers/media/i2c/mt9m001.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/media/i2c/mt9m001.c b/drivers/media/i2c/mt9m001.c index 0ade967b357b..d8fffed0818a 100644 --- a/drivers/media/i2c/mt9m001.c +++ b/drivers/media/i2c/mt9m001.c @@ -343,6 +343,7 @@ static int mt9m001_get_fmt(struct v4l2_subdev *sd, } static int mt9m001_s_fmt(struct v4l2_subdev *sd, + struct v4l2_subdev_state *state, const struct mt9m001_datafmt *fmt, struct v4l2_mbus_framefmt *mf) { @@ -359,7 +360,7 @@ static int mt9m001_s_fmt(struct v4l2_subdev *sd, int ret; /* No support for scaling so far, just crop. TODO: use skipping */ - ret = mt9m001_set_selection(sd, NULL, &sel); + ret = mt9m001_set_selection(sd, state, &sel); if (!ret) { mf->width = mt9m001->rect.width; mf->height = mt9m001->rect.height; @@ -404,7 +405,7 @@ static int mt9m001_set_fmt(struct v4l2_subdev *sd, mf->xfer_func = V4L2_XFER_FUNC_DEFAULT; if (format->which == V4L2_SUBDEV_FORMAT_ACTIVE) - return mt9m001_s_fmt(sd, fmt, mf); + return mt9m001_s_fmt(sd, sd_state, fmt, mf); *v4l2_subdev_state_get_format(sd_state, 0) = *mf; return 0; }