From: ChiYuan Huang <cy_huang@xxxxxxxxxxx>
In v4l2_async_create_ancillary_links(), if v4l2 async notifier is
created from v4l2 device, the v4l2 flash subdev async binding will enter
the logic to create media link. Due to the subdev of notifier is NULL,
this will cause NULL pointer to access the subdev entity. Therefore, add
the check to bypass it.
Fixes: aa4faf6eb271 ("media: v4l2-async: Create links during v4l2_async_match_notify()")
Signed-off-by: ChiYuan Huang <cy_huang@xxxxxxxxxxx>
---
Hi,
I'm trying to bind the v4l2 subdev for flashlight testing. It seems
some logic in v4l2 asynd binding is incorrect.
>From the change, I modified vim2m as the test driver to bind mt6370 flashlight.
Here's the backtrace log.
vim2m soc:vim2m: bound [white:flash-2]
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000058
......skipping
Call trace:
media_create_ancillary_link+0x48/0xd8 [mc]
v4l2_async_match_notify+0x17c/0x208 [v4l2_async]
v4l2_async_register_subdev+0xb8/0x1d0 [v4l2_async]
__v4l2_flash_init.part.0+0x3b4/0x4b0 [v4l2_flash_led_class]
v4l2_flash_init+0x28/0x48 [v4l2_flash_led_class]
mt6370_led_probe+0x348/0x690 [leds_mt6370_flash]
After tracing the code, it will let the subdev labeled as F_LENS or
F_FLASH function to create media link. To prevent the NULL pointer
issue, the simplest way is add a check when 'n->sd' is NULL and bypass
the later media link creataion.
---
drivers/media/v4l2-core/v4l2-async.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/media/v4l2-core/v4l2-async.c b/drivers/media/v4l2-core/v4l2-async.c
index 3ec323bd528b..9d3161c51954 100644
--- a/drivers/media/v4l2-core/v4l2-async.c
+++ b/drivers/media/v4l2-core/v4l2-async.c
@@ -324,6 +324,9 @@ static int v4l2_async_create_ancillary_links(struct v4l2_async_notifier *n,
sd->entity.function != MEDIA_ENT_F_FLASH)
return 0;
+ if (!n->sd)
+ return 0;
+
link = media_create_ancillary_link(&n->sd->entity, &sd->entity);
#endif
--
2.34.1
