On Mon Sep 7 06:43:50 2026 +0800, Yibo Tan wrote:
> ipu_bridge_get_ivsc_acpi_dev() returns an ACPI device with a reference
> held. If no matching CSI device is found, ipu_bridge_check_ivsc_dev()
> drops that reference before passing the device to dev_err(). Concurrent
> CSI device and ACPI namespace removal can drop the other references,
> making this the final put. dev_err() then reads the freed struct
> acpi_device and its kobject name.
>
> This was reproduced without kprobes by racing normal CSI platform-device
> unregistration and ACPI configfs table removal against the production
> ipu_bridge_init() entry. KASAN reported the final free through
> device_release(), followed by invalid reads through _dev_err().
>
> Emit the error message while the lookup reference is still held, then
> drop the reference as before.
>
> Source reproducers and vulnerable/fixed serial logs, with only the build
> hostname redacted, are available at:
> https://github.com/kimaiden1984-boop/linux-ipu-bridge-acpi-uaf-reproducer
>
> The fixed target builds with W=1 on x86-64. This was not tested on
> physical IPU hardware. The tests establish runtime reachability but do
> not measure occurrence frequency on shipping systems or establish
> exploitability.
>
> Fixes: c66821f381ae ("media: pci: intel: Add IVSC support for IPU bridge
> driver")
> Cc: [email protected]
> Assisted-by: Codex:GPT-5
> Signed-off-by: Yibo Tan <[email protected]>
> Signed-off-by: Sakari Ailus <[email protected]>
Patch committed.
Thanks,
Sakari Ailus
drivers/media/pci/intel/ipu-bridge.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
---
diff --git a/drivers/media/pci/intel/ipu-bridge.c
b/drivers/media/pci/intel/ipu-bridge.c
index 0817216f72ea..63470be888ba 100644
--- a/drivers/media/pci/intel/ipu-bridge.c
+++ b/drivers/media/pci/intel/ipu-bridge.c
@@ -351,8 +351,8 @@ static int ipu_bridge_check_ivsc_dev(struct ipu_sensor
*sensor,
if (adev) {
csi_dev = ipu_bridge_get_ivsc_csi_dev(adev);
if (!csi_dev) {
- acpi_dev_put(adev);
dev_err(ADEV_DEV(adev), "Failed to find MEI or CVS CSI
dev\n");
+ acpi_dev_put(adev);
return -ENODEV;
}
_______________________________________________
linuxtv-commits mailing list -- [email protected]
To unsubscribe send an email to [email protected]
