[PATCH] media: tegra-video: Check CSI subdev before error recovery

[PATCH] media: tegra-video: Check CSI subdev before error recovery

[Alex Kazinsky]

tegra_channel_get_remote_csi_subdev() can return NULL when no remote
pad is found or the remote subdevice is not a Tegra CSI subdevice.
Passing NULL to tegra_csi_error_recover() would cause an invalid
memory access through to_csi_chan().

Check the lookup result before attempting CSI recovery. This keeps
the recovery path consistent with the helper's nullable return value
and allows VI recovery to complete without accessing an absent CSI
subdevice.

This defensive check addresses a potential invalid memory access
identified by source code analysis. No runtime failure has been
reproduced.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 1ebaeb09830f ("media: tegra-video: Add support for external sensor capture")
Cc: stable@vger.kernel.org
Signed-off-by: Alex Kazinsky <a.kazinsky@ideco.ru>
---
 drivers/staging/media/tegra-video/tegra210.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/staging/media/tegra-video/tegra210.c b/drivers/staging/media/tegra-video/tegra210.c
index a6606768fa03..82d054c9c34c 100644
--- a/drivers/staging/media/tegra-video/tegra210.c
+++ b/drivers/staging/media/tegra-video/tegra210.c
@@ -346,7 +346,8 @@ static void tegra_channel_capture_error_recover(struct tegra_vi_channel *chan,
 
 	/* recover CSI block */
 	subdev = tegra_channel_get_remote_csi_subdev(chan);
-	tegra_csi_error_recover(subdev);
+	if (subdev)
+		tegra_csi_error_recover(subdev);
 }
 
 static struct tegra_channel_buffer *
-- 
2.56.0