@@ -804,6 +804,9 @@ static int cal_get_external_info(struct cal_ctx *ctx)
{
struct v4l2_ctrl *ctrl;
+ if (!ctx->sensor)
+ return -ENODEV;
+
ctrl = v4l2_ctrl_find(ctx->sensor->ctrl_handler, V4L2_CID_PIXEL_RATE);
if (!ctrl) {
ctx_err(ctx, "no pixel rate control in subdev: %s\n",
@@ -950,9 +953,6 @@ static int __subdev_get_format(struct cal_ctx *ctx,
struct v4l2_mbus_framefmt *mbus_fmt = &sd_fmt.format;
int ret;
- if (!ctx->sensor)
- return -EINVAL;
-
sd_fmt.which = V4L2_SUBDEV_FORMAT_ACTIVE;
sd_fmt.pad = 0;
@@ -975,9 +975,6 @@ static int __subdev_set_format(struct cal_ctx *ctx,
struct v4l2_mbus_framefmt *mbus_fmt = &sd_fmt.format;
int ret;
- if (!ctx->sensor)
- return -EINVAL;
-
sd_fmt.which = V4L2_SUBDEV_FORMAT_ACTIVE;
sd_fmt.pad = 0;
*mbus_fmt = *fmt;
@@ -1152,7 +1149,7 @@ static int cal_enum_framesizes(struct file *file, void *fh,
ret = v4l2_subdev_call(ctx->sensor, pad, enum_frame_size, NULL, &fse);
if (ret)
- return -EINVAL;
+ return ret;
ctx_dbg(1, ctx, "%s: index: %d code: %x W:[%d,%d] H:[%d,%d]\n",
__func__, fse.index, fse.code, fse.min_width, fse.max_width,
@@ -1331,13 +1328,11 @@ static int cal_start_streaming(struct vb2_queue *vq, unsigned int count)
cal_wr_dma_addr(ctx, addr);
csi2_ppi_enable(ctx);
- if (ctx->sensor) {
- if (v4l2_subdev_call(ctx->sensor, video, s_stream, 1)) {
- ctx_err(ctx, "stream on failed in subdev\n");
- cal_runtime_put(ctx->dev);
- ret = -EINVAL;
- goto err;
- }
+ ret = v4l2_subdev_call(ctx->sensor, video, s_stream, 1);
+ if (ret) {
+ ctx_err(ctx, "stream on failed in subdev\n");
+ cal_runtime_put(ctx->dev);
+ goto err;
}
if (debug >= 4)
@@ -1360,10 +1355,8 @@ static void cal_stop_streaming(struct vb2_queue *vq)
struct cal_buffer *buf, *tmp;
unsigned long flags;
- if (ctx->sensor) {
- if (v4l2_subdev_call(ctx->sensor, video, s_stream, 0))
- ctx_err(ctx, "stream off failed in subdev\n");
- }
+ if (v4l2_subdev_call(ctx->sensor, video, s_stream, 0))
+ ctx_err(ctx, "stream off failed in subdev\n");
csi2_ppi_disable(ctx);
disable_irqs(ctx);
As reported ctx->sensor is being dereferenced before being checked in cal_get_external_info(). That being the case it was also checked twice in multiple other location where v4l2_subdev_call is already checking it so no need to explicitly check it again. Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Benoit Parrot <bparrot@ti.com> --- drivers/media/platform/ti-vpe/cal.c | 29 +++++++++++------------------ 1 file changed, 11 insertions(+), 18 deletions(-)