On Wed Jul 8 22:33:43 2026 +0800, Ruoyu Wang wrote:
> ipu6_bus_initialize_device() stores the isys/psys pdata pointer in
> struct ipu6_bus_device and initializes the auxiliary device. After that
> point, error unwinding must drop the auxiliary device reference and let
> ipu6_bus_release() free both the bus device and adev->pdata.
>
> The isys and psys init paths already call put_device() when MMU
> initialization fails, and ipu6_bus_add_device() calls
> auxiliary_device_uninit() on auxiliary_device_add() failure. Both paths
> therefore run the bus release callback. The extra kfree(pdata) in the
> callers can release the same object a second time.
>
> Remove the manual pdata frees after the auxiliary device has been
> initialized.
>
> This issue was found by a static analysis checker and confirmed by
> manual source review.
>
> Fixes: cb3117b074ae ("media: intel/ipu6: add IPU auxiliary devices")
> Signed-off-by: Ruoyu Wang <[email protected]>
> Signed-off-by: Sakari Ailus <[email protected]>
Patch committed.
Thanks,
Sakari Ailus
drivers/media/pci/intel/ipu6/ipu6.c | 10 ++--------
1 file changed, 2 insertions(+), 8 deletions(-)
---
diff --git a/drivers/media/pci/intel/ipu6/ipu6.c
b/drivers/media/pci/intel/ipu6/ipu6.c
index d033d4618169..5449a2006bcc 100644
--- a/drivers/media/pci/intel/ipu6/ipu6.c
+++ b/drivers/media/pci/intel/ipu6/ipu6.c
@@ -400,7 +400,6 @@ ipu6_isys_init(struct pci_dev *pdev, struct device *parent,
&ipdata->hw_variant);
if (IS_ERR(isys_adev->mmu)) {
put_device(&isys_adev->auxdev.dev);
- kfree(pdata);
return dev_err_cast_probe(dev, isys_adev->mmu,
"ipu6_mmu_init(isys_adev->mmu) failed\n");
}
@@ -408,10 +407,8 @@ ipu6_isys_init(struct pci_dev *pdev, struct device *parent,
isys_adev->mmu->dev = &isys_adev->auxdev.dev;
ret = ipu6_bus_add_device(isys_adev);
- if (ret) {
- kfree(pdata);
+ if (ret)
return ERR_PTR(ret);
- }
return isys_adev;
}
@@ -444,7 +441,6 @@ ipu6_psys_init(struct pci_dev *pdev, struct device *parent,
&ipdata->hw_variant);
if (IS_ERR(psys_adev->mmu)) {
put_device(&psys_adev->auxdev.dev);
- kfree(pdata);
return dev_err_cast_probe(&pdev->dev, psys_adev->mmu,
"ipu6_mmu_init(psys_adev->mmu) failed\n");
}
@@ -452,10 +448,8 @@ ipu6_psys_init(struct pci_dev *pdev, struct device *parent,
psys_adev->mmu->dev = &psys_adev->auxdev.dev;
ret = ipu6_bus_add_device(psys_adev);
- if (ret) {
- kfree(pdata);
+ if (ret)
return ERR_PTR(ret);
- }
return psys_adev;
}
_______________________________________________
linuxtv-commits mailing list -- [email protected]
To unsubscribe send an email to [email protected]
