From 9a4dd8147c7a45e8579e58c101c25604e51117b0 Mon Sep 17 00:00:00 2001 From: Antti Laakso Date: Thu, 24 Sep 2026 15:06:34 +0300 Subject: [PATCH] media: ipu6: Fix bus device use-after-free The ipu6_bus_del_devices() will uninitialize and free bus devices and dereferencing isp->psys and isp->isys will lead to use-after-free. While at it, remove unnecessary checks for isp->isys/psys. Reported-by: Dan Carpenter Fixes: 69ebb1bfc865 ("media: ipu6: Move isys fw mapping to pci_probe") Signed-off-by: Antti Laakso Closes: https://lore.kernel.org/linux-media/aqlXAXcXvMM3HWtJ@stanley.mountain/T/#u Signed-off-by: Sakari Ailus --- drivers/media/pci/intel/ipu6/ipu6.c | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-) diff --git a/drivers/media/pci/intel/ipu6/ipu6.c b/drivers/media/pci/intel/ipu6/ipu6.c index 1fc7a6aedd61..cdf812c02960 100644 --- a/drivers/media/pci/intel/ipu6/ipu6.c +++ b/drivers/media/pci/intel/ipu6/ipu6.c @@ -880,6 +880,8 @@ static int ipu6_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) static void ipu6_pci_remove(struct pci_dev *pdev) { struct ipu6_device *isp = pci_get_drvdata(pdev); + struct ipu6_mmu *isys_mmu = isp->isys->mmu; + struct ipu6_mmu *psys_mmu = isp->psys->mmu; unsigned long dir; devm_free_irq(&pdev->dev, pdev->irq, isp); @@ -888,11 +890,9 @@ static void ipu6_pci_remove(struct pci_dev *pdev) ipu6_cpd_free_pkg_dir(isp->psys); ipu6_unmap_fw_region(isp->psys, dir); - if (isp->isys) { - ipu6_cpd_free_pkg_dir(isp->isys); - if (isp->isys->fw_sgt.nents) - ipu6_unmap_fw_region(isp->isys, dir); - } + ipu6_cpd_free_pkg_dir(isp->isys); + if (isp->isys->fw_sgt.nents) + ipu6_unmap_fw_region(isp->isys, dir); vfree(isp->fw_code_region); isp->fw_code_region = NULL; @@ -906,10 +906,8 @@ static void ipu6_pci_remove(struct pci_dev *pdev) release_firmware(isp->cpd_fw); - if (isp->psys) - ipu6_mmu_cleanup(isp->psys->mmu); - if (isp->isys) - ipu6_mmu_cleanup(isp->isys->mmu); + ipu6_mmu_cleanup(psys_mmu); + ipu6_mmu_cleanup(isys_mmu); } static void ipu6_pci_reset_prepare(struct pci_dev *pdev)