From nobody Sun Jul 26 07:40:04 2026 Received: from mail-pl1-f178.google.com (mail-pl1-f178.google.com [209.85.214.178]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C815C262D0B for ; Wed, 8 Jul 2026 14:33:49 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.178 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783521231; cv=none; b=Z59S+WcGKPQPO1pidTHAUQAccx54E7oyZYQ1P7BYPlQpY5Ldvtfvys2+7evaJ8Q1pBQ5xOFnke0WBqh2ptZ9Z0XZlLFx0enQf4Hc+nXAbSQQ1lVe2lD3QrCTdUiVJLDhsyQo3g65G6VPY51hi2Zsaj1WcM60mdfrwqJ8tp+HDis= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783521231; c=relaxed/simple; bh=0UDqQtglcqACOUkBl+tP6mqomEhvOb5H4/SjQHIPDM0=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=l1/73Y6RyMynZ/x7GAmgv60UWHVBVuLVg9BusTIibrR3ucT31zCJ3k/8iPXnPKY3O0M9UhHdYb/bCGJacs/u3bWXHwgmSXwg0FxKCBn6UpkOiyiWrVLoRn+TINPxDVM4jf0+RjavNVB0Q1UMw3eo6zI3bDaMHTtMuFEjh6E3RUc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=YzGVUAM2; arc=none smtp.client-ip=209.85.214.178 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="YzGVUAM2" Received: by mail-pl1-f178.google.com with SMTP id d9443c01a7336-2c7cfa17fedso8307625ad.3 for ; Wed, 08 Jul 2026 07:33:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783521229; x=1784126029; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=Ou1FiOpvl68pVG0xzGeXE/RgdW+vLOyJ2K6VlrmSnA0=; b=YzGVUAM2ov5haWNKGgbgbKvjMU9uiYVCjx9AR//1wT9ZE7vobqrJJ8BW8xVi4qPcKy Vk8GJcj16ty6TwgfXq3hwjPoPERzZh4CsFyBGQdQ8XszSyTdvf1s/lYQV9pgo4XUqIML onRBX6KJbC3XSVmitcGTCRO0Yvj82B1nJrKY2LZHCwd8KK0zEiiqgB8bmAfiYHGZWts7 R61dqt8YdP+aFEXa3/cVnUMFC89Lee2Vmz5zgLQJMflXi5kDAGn8nzs4qeA+37LLobf8 xzNMgGenn6ec57FKncnvAoaUZz616tZdcdGM/9AeeLBePHCNVApeE10DI9/iCfZzoXPD KJUg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783521229; x=1784126029; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=Ou1FiOpvl68pVG0xzGeXE/RgdW+vLOyJ2K6VlrmSnA0=; b=HGpaaC64woKOhXX+BKFap+baALkLf+1bD/1wacHhMQp90IaNe2Ts/dlGaRlwuszcNg m46XWxGdfkkGgb8MJ11CxWr77L/SqsCg74U0+2w9LYSiFBb1bkeVtkEckq7ZxnVFqYK2 +FbkzSW5/rEgm0hftTqHfmzm+lgoAvzvDrI2RDIfHLl09arDllAROh+oVcFFLcPv7fty 4/Og4O5hfbbJ9oqRt5RjjVRUs9+EVJ6IX3H0nG7ZuMDtpKvS39JpXm4u/xbG0tlI7F2W am/sVwhDedZCOY5H8PSFpkNwts8oiBDssvUlPdSwCSUUaj+YrBuVWYO4XF6qbw6XA8L8 //fQ== X-Forwarded-Encrypted: i=1; AHgh+RpcCkh9U+9sNhKY05iaBo++MM9bBkJwHDNJ+lBAEajg8lfU0lrrUUc3bp+oXRSImZ/OESkW6720MMUGq5U=@vger.kernel.org X-Gm-Message-State: AOJu0Yx66KjGeEUkkou7xxNh/WYXtavKUVoukrmbYi04SJbu/mrGIl7e lMqeoE6jqnfXQodshUEnIbsyjz+f2QiItnpM7XXuCWAnc1zBZqw94QSp X-Gm-Gg: AfdE7ckQaCjOiibLQpnmS84W+P06tFezlWBRmN4KcPxzu313yzybaI5eCAdYOWrEA4K fGguJfLkX4UcdrBR2XYDFjgjXsBheyeHxRID6b+pbSIiOfXl0jErADq8FlvKjQwLEG+85pgZwHg i6+nG680+P/6Mzo9nACAzYQaRhLX2ps/DJqBs+B1nx6/SagZBjw8a/y7L1CQYKwnebyX1XB1nfP YAAFCLaFOjzlK4GBXSjKiFBdzOfFYCralaIuLLKK9ougdlp1ru2Ql/0BbdXgt1v2jEPerRTueB9 pHeGw7grNXKXH9k/gnomLt8MVil/G2RvfOqOkrpdcjQi4Wa8LHQr6WE1Dr98FmibOM9KHLhU9dV pOtgTinh7rRQqujz17Ne2FwnvcTF8zBa+nJ3ALK6oPzdsAf2dtPCRP25s6LgbL9TqAAoWf+/PsO sCtOTmXrbs6KOnmTn4Dy80PGfb3W74x6K5 X-Received: by 2002:a17:902:ef48:b0:2cc:fbf5:afaa with SMTP id d9443c01a7336-2ccfbf5b04emr1707785ad.20.1783521228922; Wed, 08 Jul 2026 07:33:48 -0700 (PDT) Received: from haichao.tail057a43.ts.net ([2001:da8:e000:1206:1b95:b995:f60c:5c67]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2ccc9bf7858sm29331485ad.23.2026.07.08.07.33.46 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 08 Jul 2026 07:33:48 -0700 (PDT) From: Ruoyu Wang To: sakari.ailus@linux.intel.com, bingbu.cao@intel.com Cc: tian.shu.qiu@intel.com, mchehab@kernel.org, hverkuil@kernel.org, linux-media@vger.kernel.org, linux-kernel@vger.kernel.org, Ruoyu Wang Subject: [PATCH] media: ipu6: Do not free aux device pdata after init Date: Wed, 8 Jul 2026 22:33:43 +0800 Message-ID: <20260708143343.3165299-1-ruoyuw560@gmail.com> X-Mailer: git-send-email 2.51.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" ipu6_bus_initialize_device() stores the isys/psys pdata pointer in struct ipu6_bus_device and initializes the auxiliary device. After that point, error unwinding must drop the auxiliary device reference and let ipu6_bus_release() free both the bus device and adev->pdata. The isys and psys init paths already call put_device() when MMU initialization fails, and ipu6_bus_add_device() calls auxiliary_device_uninit() on auxiliary_device_add() failure. Both paths therefore run the bus release callback. The extra kfree(pdata) in the callers can release the same object a second time. Remove the manual pdata frees after the auxiliary device has been initialized. This issue was found by a static analysis checker and confirmed by manual source review. Fixes: cb3117b074ae ("media: intel/ipu6: add IPU auxiliary devices") Signed-off-by: Ruoyu Wang --- drivers/media/pci/intel/ipu6/ipu6.c | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-) diff --git a/drivers/media/pci/intel/ipu6/ipu6.c b/drivers/media/pci/intel/= ipu6/ipu6.c index d033d46181692..5449a2006bcce 100644 --- a/drivers/media/pci/intel/ipu6/ipu6.c +++ b/drivers/media/pci/intel/ipu6/ipu6.c @@ -400,7 +400,6 @@ ipu6_isys_init(struct pci_dev *pdev, struct device *par= ent, &ipdata->hw_variant); if (IS_ERR(isys_adev->mmu)) { put_device(&isys_adev->auxdev.dev); - kfree(pdata); return dev_err_cast_probe(dev, isys_adev->mmu, "ipu6_mmu_init(isys_adev->mmu) failed\n"); } @@ -408,10 +407,8 @@ ipu6_isys_init(struct pci_dev *pdev, struct device *pa= rent, isys_adev->mmu->dev =3D &isys_adev->auxdev.dev; =20 ret =3D ipu6_bus_add_device(isys_adev); - if (ret) { - kfree(pdata); + if (ret) return ERR_PTR(ret); - } =20 return isys_adev; } @@ -444,7 +441,6 @@ ipu6_psys_init(struct pci_dev *pdev, struct device *par= ent, &ipdata->hw_variant); if (IS_ERR(psys_adev->mmu)) { put_device(&psys_adev->auxdev.dev); - kfree(pdata); return dev_err_cast_probe(&pdev->dev, psys_adev->mmu, "ipu6_mmu_init(psys_adev->mmu) failed\n"); } @@ -452,10 +448,8 @@ ipu6_psys_init(struct pci_dev *pdev, struct device *pa= rent, psys_adev->mmu->dev =3D &psys_adev->auxdev.dev; =20 ret =3D ipu6_bus_add_device(psys_adev); - if (ret) { - kfree(pdata); + if (ret) return ERR_PTR(ret); - } =20 return psys_adev; } --=20 2.51.0