[PATCH] media: nxp: isi: Check whether pad is non-NULL before access

[Marek Vasut]

On 1/13/24 01:03, Laurent Pinchart wrote:
> On Thu, Jan 11, 2024 at 07:52:33PM +0200, Laurent Pinchart wrote:
>> On Thu, Jan 11, 2024 at 05:49:41PM +0000, Kieran Bingham wrote:
>>> Quoting Laurent Pinchart (2023-12-03 16:59:59)
>>>> Hi Marek,
>>>>
>>>> Thank you for the patch.
>>>>
>>>> On Fri, Dec 01, 2023 at 04:06:04PM +0100, Marek Vasut wrote:
>>>>> The pad can be NULL if media controller routing is not set up correctly.
>>>>> Check whether the pad is NULL before using it, otherwise it is possible
>>>>> to achieve NULL pointer dereference.
>>>>
>>>> Could you share more information about how to misconfigure the routing ?
>>>
>>> You simply do 'nothing'.
>>
>> The default configuration should be working one. I think that should
>> then be fixed too (in a separate patch).
> 
> I managed to reproduce the issue (I had to heavily hack libcamera, by
> default it would reject incorrect configurations before triggering the
> kernel bug). The default configuration of the crossbar switch is fine,
> this patch is the right fix.
> 
> I'd like to expand the commit message with a clearer description of the
> erronous configuration. Marek, are you fine with the following commit
> message ?
> 
> --------
> When translating source to sink streams in the crossbar subdev, the
> driver tries to locate the remote subdev connected to the sink pad. The
> remote pad may be NULL, if userspace tries to enable a stream that ends
> at an unconnected crossbar sink. When that occurs, the driver
> dereferences the NULL pad, leading to a crash.
> 
> Prevent the crash by checking if the pad is NULL before using it, and
> return an error if it is.
> --------
> 
> If so I'll update it locally, no need for a new version.
> 
> Reviewed-by: Laurent Pinchart <laurent.pinchart at ideasonboard.com>

Sure, go for it.