media: rcar-csi2: Add checking to rcsi2_start_receiver()

If rcsi2_code_to_fmt() return NULL, then null pointer dereference occurs
in the next cycle. That should not be possible now but adding checking
protects from future bugs.
The patch adds checking if format is NULL.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Nadezda Lutovinova <lutovinova@ispras.ru>
Reviewed-by: Jacopo Mondi <jacopo@jmondi.org>
Reviewed-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>

diff --git a/drivers/media/platform/rcar-vin/rcar-csi2.c b/drivers/media/platform/rcar-vin/rcar-csi2.c
index a4952711b7b19e239397ce8ed39a4e786191c418..d7f560e312d4451ac7e128826edf0321bcd50191 100644 (file)
--- a/drivers/media/platform/rcar-vin/rcar-csi2.c
+++ b/drivers/media/platform/rcar-vin/rcar-csi2.c
@@ -651,6 +651,8 @@ static int rcsi2_start_receiver(struct rcar_csi2 *priv)
 
        /* Code is validated in set_fmt. */
        format = rcsi2_code_to_fmt(priv->mf.code);
+       if (!format)
+               return -EINVAL;
 
        /*
         * Enable all supported CSI-2 channels with virtual channel and