[media] s5p-fimc: Avoid null pointer dereference in fimc_capture_ctrls_create()

With presence of some faults, e.g. caused by wrong platform data or
the device tree structure the IDX_SENSOR entry in the array may be NULL,
so make sure it is not dereferenced then.

Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

diff --git a/drivers/media/platform/s5p-fimc/fimc-capture.c b/drivers/media/platform/s5p-fimc/fimc-capture.c
index df6fc6c7eecd0fdb27968efd830fee9d0631a8ab..5ec2f48f7db5e9065246d0e81397cd7f5d2c5da5 100644 (file)
--- a/drivers/media/platform/s5p-fimc/fimc-capture.c
+++ b/drivers/media/platform/s5p-fimc/fimc-capture.c
@@ -486,6 +486,7 @@ static struct vb2_ops fimc_capture_qops = {
 int fimc_capture_ctrls_create(struct fimc_dev *fimc)
 {
        struct fimc_vid_cap *vid_cap = &fimc->vid_cap;
+       struct v4l2_subdev *sensor = fimc->pipeline.subdevs[IDX_SENSOR];
        int ret;
 
        if (WARN_ON(vid_cap->ctx == NULL))
@@ -494,11 +495,13 @@ int fimc_capture_ctrls_create(struct fimc_dev *fimc)
                return 0;
 
        ret = fimc_ctrls_create(vid_cap->ctx);
-       if (ret || vid_cap->user_subdev_api || !vid_cap->ctx->ctrls.ready)
+
+       if (ret || vid_cap->user_subdev_api || !sensor ||
+           !vid_cap->ctx->ctrls.ready)
                return ret;
 
        return v4l2_ctrl_add_handler(&vid_cap->ctx->ctrls.handler,
-                   fimc->pipeline.subdevs[IDX_SENSOR]->ctrl_handler, NULL);
+                                    sensor->ctrl_handler, NULL);
 }
 
 static int fimc_capture_set_default_format(struct fimc_dev *fimc);