From 5280f3f697641a3c5001d3fe814f1cea3a2b9ff9 Mon Sep 17 00:00:00 2001 From: Yuefu Su Date: Wed, 22 Oct 2025 17:24:15 +0800 Subject: [PATCH 1/3] phy: rockchip: csi2-dphy: initialize sensor format request Set pad and which before forwarding get_fmt to the terminal sensor. This prevents stale caller values from selecting an invalid pad or format state. Signed-off-by: Yuefu Su Signed-off-by: Conghao Hu --- drivers/phy/rockchip/phy-rockchip-csi2-dphy.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/phy/rockchip/phy-rockchip-csi2-dphy.c b/drivers/phy/rockchip/phy-rockchip-csi2-dphy.c index e83672d665494..609a547068dcb 100644 --- a/drivers/phy/rockchip/phy-rockchip-csi2-dphy.c +++ b/drivers/phy/rockchip/phy-rockchip-csi2-dphy.c @@ -749,6 +749,8 @@ static int csi2_dphy_get_set_fmt(struct v4l2_subdev *sd, sensor = sd_to_sensor(dphy, sensor_sd); if (!sensor) return -ENODEV; + fmt->pad = 0; + fmt->which = V4L2_SUBDEV_FORMAT_ACTIVE; ret = v4l2_subdev_call(sensor_sd, pad, get_fmt, NULL, fmt); if (!ret && fmt->pad == 0 && fmt->which == V4L2_SUBDEV_FORMAT_ACTIVE) sensor->format = fmt->format; From 3a3f987abd17ddfd730ce9583a5a091c0a50821b Mon Sep 17 00:00:00 2001 From: Conghao Hu Date: Thu, 20 Aug 2026 13:16:42 +0800 Subject: [PATCH 2/3] media: rockchip: cif: zero-initialize subdev format Linux 6.6 added the stream field to struct v4l2_subdev_format. Leaving the request uninitialized can pass a random stream ID to get_fmt and make the terminal sensor format lookup fail. Zero-initialize the request so unspecified fields, including stream, use their default value. Signed-off-by: Conghao Hu --- drivers/media/platform/rockchip/cif/capture.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/media/platform/rockchip/cif/capture.c b/drivers/media/platform/rockchip/cif/capture.c index 635b5ce79b33a..85dd8da0cb9c5 100644 --- a/drivers/media/platform/rockchip/cif/capture.c +++ b/drivers/media/platform/rockchip/cif/capture.c @@ -982,7 +982,7 @@ const struct cif_input_fmt *rkcif_get_input_fmt(struct rkcif_device *dev, struct v4l2_rect *rect, u32 pad_id, struct csi_channel_info *csi_info) { - struct v4l2_subdev_format fmt; + struct v4l2_subdev_format fmt = {0}; struct v4l2_subdev *sd = dev->terminal_sensor.sd; struct rkmodule_channel_info ch_info = {0}; struct rkmodule_capture_info capture_info; From 94ed40a5748c9f1bfe0fc62b922d276fdd96b5bb Mon Sep 17 00:00:00 2001 From: Conghao Hu Date: Thu, 20 Aug 2026 09:21:06 +0800 Subject: [PATCH 3/3] media: rockchip: cif: guard against NULL input formats rkcif_get_input_fmt() can return NULL when the terminal sensor format lookup fails. Reject the error before storing or dereferencing the format, and keep the output format check defensive for its other callers. Signed-off-by: Conghao Hu --- drivers/media/platform/rockchip/cif/capture.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/drivers/media/platform/rockchip/cif/capture.c b/drivers/media/platform/rockchip/cif/capture.c index 85dd8da0cb9c5..d632a4121460f 100644 --- a/drivers/media/platform/rockchip/cif/capture.c +++ b/drivers/media/platform/rockchip/cif/capture.c @@ -638,6 +638,11 @@ static int rkcif_output_fmt_check(struct rkcif_stream *stream, int ret = -EINVAL; stream->rounding_bit = 0; + if (!input_fmt) { + v4l2_err(&stream->cifdev->v4l2_dev, "Input fmt is NULL\n"); + return -EINVAL; + } + switch (input_fmt->mbus_code) { case MEDIA_BUS_FMT_YUYV8_2X8: case MEDIA_BUS_FMT_YVYU8_2X8: @@ -8805,6 +8810,11 @@ int rkcif_set_fmt(struct rkcif_stream *stream, cif_fmt_in = rkcif_get_input_fmt(dev, &input_rect, stream->id, channel_info); + if (!cif_fmt_in) { + v4l2_err(&stream->cifdev->v4l2_dev, + "terminal sensor fmt invalid\n"); + return -EINVAL; + } stream->cif_fmt_in = cif_fmt_in; } else { v4l2_err(&stream->cifdev->v4l2_dev,