From nobody Fri Apr 3 02:56:57 2026 Received: from mail-yw1-f178.google.com (mail-yw1-f178.google.com [209.85.128.178]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 35E65218ADD for ; Tue, 17 Feb 2026 00:34:39 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.178 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771288480; cv=none; b=t2WzeC4oD68luo5f0tz9KLJzuUNS4Lr+ifdWiN187C16pUAtEN1CDhb/kcBwIpoo9GMFxL3LPSVzcyj2n39S6trbXH5Re6KE/a+6a2rUOknKmhB/5sfUyo8w97jjMvvjG+dIKKTiBk6DYRxYO3VmGNvFjS7gH+s8cU6iSVGMre8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771288480; c=relaxed/simple; bh=LttrCdpZM3YSUWza+2RsIvYIbus6j3SXuPEBJ91o0D8=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=cEVQJVINRpDFxFUlibclBTvIn6SYVhLg4S+rsYqEzn7cZlKzTgI2nTI4TYxLJBA3t+IBRVrEmbsilWlhSpoKN0A+RbreOGMwAEVrV36zq+7fhYwfNtrsxmDSaZTsCKL9T44sogRhxBteBSX6fbCxH1h2qleL7Pxb+mp8LsYsP8Q= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Kpaag7Xk; arc=none smtp.client-ip=209.85.128.178 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Kpaag7Xk" Received: by mail-yw1-f178.google.com with SMTP id 00721157ae682-79628fb5c05so29612217b3.2 for ; Mon, 16 Feb 2026 16:34:39 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1771288478; x=1771893278; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=Av15tS5FkuU+C+tEk9o+/kI9EUUe3VgwmfVsp/gvxcA=; b=Kpaag7Xk7/zhnM/3+xqO5vRkst1PuwalPccpSj0FqbhSNxZ20W84PUr7dtI58GmAIc w6EHCCaGPu2dK3dY0dE7M6WM0qADv03s7iRpYc8270Ze0U6l5qO6d2wCT/NuX67kHu1u lgxZVsBhBQ3Lds3k5+CJPTUQZJJcdCYC1cGF1TeQyzuExeedyOcsrLNfwEBa92fCe8vM JCYpfKN/C0zAlAfYUNdvM6/g3OjPFFQDtEoU6aNhqWXxNx3WSSVYK4rRQrPHSIrfqP1I kr0/lR5blXxPllItV7rkZnmtpByU1JXwg3nys5cMg7EFR4aJvfOtzPXDg0Qiz0VPG6ye 86LA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1771288478; x=1771893278; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=Av15tS5FkuU+C+tEk9o+/kI9EUUe3VgwmfVsp/gvxcA=; b=CSx/bhXhBdnRXr8Ul7oDHYs6r0Ghp90qUO3mqSr+DFMgsaDY/Qr4vgABqwNGU0FY6V f3XFQ8R8pjXvpMV1NtJwlxB18p+MxF8/A1w5MJ86pCX10CKG6KyjrAjJgzt/bvRfg2QM GUJrFX7+nd4cUurPzuz5Ui9JWTKj3g4ssIn5rnlpA0m1+fFj8v2DX00ooLjnG+tg74hX 53GL7Cq8zyaqYyqrQgRPge82/lE2cpw5GIbaC3ZsLXWRME8fEFGpFptYa8uukrVupRjP sIVv7UkULBRDJraHOtiW2deDq7OTueLJeOaGfucSuw6yT+Lzpdklq2p5e/Xq3Vu1qD/l ryAQ== X-Forwarded-Encrypted: i=1; AJvYcCXpGVW2M7+6V6aXOr6QL2sxCsCNmOZg2RrvZJBGrgcJlpRlkKJFrl4pDEskeBa1uNbyLleCYkud/XFVYc0=@vger.kernel.org X-Gm-Message-State: AOJu0YwptdNb73gRRNscnfLF3QIPHdApN0S1cDfqWMPO0lst9UOtEmTa iuJ6s9qPY12W7HS8B/eofTjo/CbDblWMnJjZfgkklyqZe2FMDNyB529b X-Gm-Gg: AZuq6aJaGppo2QVU+ZDDQKU+XIuDZshs6jcXebVXEmBiQHYcjgR/eibQXv3roetQ7KZ s5h6XTZ3w8glVmCnIGlgnIQfwfI0xFsFL8pwbMqB6511V2nENRQjSHy/dWmNtS59EmVc3qBcWss bLEV0OsvIlmhSQJ62bA/saxCZDouWZ9jsYYKCDVogYdTG1+5NA7+OhBvNf8x+RIhCJsYgr8+3Qn tv5rwpY8K77sBjTOEaXm/GlVGD2V4BqysGID5sy7W2J5NpKVJryzM04ORLilCYm0V6R6kSyqWB7 +/ikwII0R6v9LBxIeO8TC6CMdLXX5i8VWBQz/QHTuar00Z7+bAHBwmKDp7hxPoxU8ZqbjcK9Ohu 1QaiUzAXjyalkMstIYsoKQ3KriY4H7fxp09aBo9klRQ68KwRda74X/0Tbt8CnbmNKDLT2GN+5iZ mCexMHFPowuu3QFj+OH3AXMZiLybWMbv8gGR75goM/fJ64v2ZzrUjS6aUxc1yan21igrtpLi8ZM 2zE1T8t/01K/Bz9ryoAPilzknNo9yiwhtVEys91yKE= X-Received: by 2002:a05:690c:7085:b0:796:349f:6565 with SMTP id 00721157ae682-797a0cf03e6mr83614637b3.46.1771288478140; Mon, 16 Feb 2026 16:34:38 -0800 (PST) Received: from tux ([2601:7c0:c37c:4c00:e3a8:26f7:7e08:88e1]) by smtp.gmail.com with ESMTPSA id 00721157ae682-7966c195dccsm106030607b3.21.2026.02.16.16.34.37 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 16 Feb 2026 16:34:37 -0800 (PST) From: Ethan Tidmore To: Sakari Ailus , Bingbu Cao , Mauro Carvalho Chehab Cc: Tianshu Qiu , Hans Verkuil , linux-media@vger.kernel.org, linux-kernel@vger.kernel.org, Ethan Tidmore Subject: [PATCH] media: intel/ipu6: fix error pointer dereference Date: Mon, 16 Feb 2026 18:34:20 -0600 Message-ID: <20260217003420.47280-1-ethantidmore06@gmail.com> X-Mailer: git-send-email 2.53.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" After confirming that isp->psys is an error pointer goto is called and imminently goes to this code snippet below: out_ipu6_bus_del_devices: if (isp->psys) { ipu6_cpd_free_pkg_dir(isp->psys); ipu6_buttress_unmap_fw_image(isp->psys, &isp->psys->fw_sgt); } Since isp->psys is confirmed to be an error pointer not NULL, the condition is true and the error pointer is dereferenced. So isp->psys should be set to NULL before going to out_ipu6_bus_del_devices. Fixes: 25fedc021985a ("media: intel/ipu6: add Intel IPU6 PCI device driver") Signed-off-by: Ethan Tidmore --- drivers/media/pci/intel/ipu6/ipu6.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/media/pci/intel/ipu6/ipu6.c b/drivers/media/pci/intel/= ipu6/ipu6.c index 24238f8311a6..6e6b7d2a68ff 100644 --- a/drivers/media/pci/intel/ipu6/ipu6.c +++ b/drivers/media/pci/intel/ipu6/ipu6.c @@ -619,6 +619,7 @@ static int ipu6_pci_probe(struct pci_dev *pdev, const s= truct pci_device_id *id) psys_base, &psys_ipdata); if (IS_ERR(isp->psys)) { ret =3D PTR_ERR(isp->psys); + isp->psys =3D NULL; goto out_ipu6_bus_del_devices; } =20 --=20 2.53.0