github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

media: ipu6: Fix bus device use-after-free

Browse Source 
The ipu6_bus_del_devices() will uninitialize and free bus devices and
dereferencing isp->psys and isp->isys will lead to use-after-free.

While at it, remove unnecessary checks for isp->isys/psys.

Reported-by: Dan Carpenter <error27@gmail.com>
Fixes: 69ebb1bfc8 ("media: ipu6: Move isys fw mapping to pci_probe")
Signed-off-by: Antti Laakso <antti.laakso@linux.intel.com>
Closes: https://lore.kernel.org/linux-media/aqlXAXcXvMM3HWtJ@stanley.mountain/T/#u
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
This commit is contained in:
Antti Laakso 2026-09-24 15:06:34 +03:00 committed by Sakari Ailus
parent a91ee98d8d
commit 9a4dd8147c
1 changed files with 7 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
drivers/media/pci/intel/ipu6/ipu6.c
View File

@ -880,6 +880,8 @@ static int ipu6_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
static void ipu6_pci_remove(struct pci_dev *pdev)
{
struct ipu6_device *isp = pci_get_drvdata(pdev);
struct ipu6_mmu *isys_mmu = isp->isys->mmu;
struct ipu6_mmu *psys_mmu = isp->psys->mmu;
unsigned long dir;
devm_free_irq(&pdev->dev, pdev->irq, isp);
@ -888,11 +890,9 @@ static void ipu6_pci_remove(struct pci_dev *pdev)
ipu6_cpd_free_pkg_dir(isp->psys);
ipu6_unmap_fw_region(isp->psys, dir);
if (isp->isys) {
ipu6_cpd_free_pkg_dir(isp->isys);
if (isp->isys->fw_sgt.nents)
ipu6_unmap_fw_region(isp->isys, dir);
}
ipu6_cpd_free_pkg_dir(isp->isys);
if (isp->isys->fw_sgt.nents)
ipu6_unmap_fw_region(isp->isys, dir);
vfree(isp->fw_code_region);
isp->fw_code_region = NULL;
@ -906,10 +906,8 @@ static void ipu6_pci_remove(struct pci_dev *pdev)
release_firmware(isp->cpd_fw);
if (isp->psys)
ipu6_mmu_cleanup(isp->psys->mmu);
if (isp->isys)
ipu6_mmu_cleanup(isp->isys->mmu);
ipu6_mmu_cleanup(psys_mmu);
ipu6_mmu_cleanup(isys_mmu);
}
static void ipu6_pci_reset_prepare(struct pci_dev *pdev)