* [sailus-media-tree:metadata 98/105] drivers/media/pci/intel/ipu6/ipu6-isys-video.c:853 ipu6_isys_alloc_stream_firmware() error: double free of 'stream' (line 790)
@ 2026-07-03 6:33 kernel test robot
0 siblings, 0 replies; only message in thread
From: kernel test robot @ 2026-07-03 6:33 UTC (permalink / raw)
To: oe-kbuild; +Cc: lkp, Dan Carpenter
BCC: lkp@intel.com
CC: oe-kbuild-all@lists.linux.dev
CC: linux-media@vger.kernel.org
TO: Sakari Ailus <sakari.ailus@linux.intel.com>
tree: git://linuxtv.org/sailus/media_tree.git metadata
head: a6d4ce993bcd76851cfc7f28cc33aac011a30fa9
commit: 5bd6ad739336637aa65b270823cf43a5a8f2dcab [98/105] media: ipu6: Bridge the gap between streams in V4L2 and IPU6 firmware
:::::: branch date: 16 hours ago
:::::: commit date: 16 hours ago
config: x86_64-randconfig-161 (https://download.01.org/0day-ci/archive/20260703/202607031449.9y46lBuM-lkp@intel.com/config)
compiler: gcc-14 (Debian 14.2.0-19) 14.2.0
smatch: v0.5.0-9185-gbcc58b9c
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <error27@gmail.com>
| Closes: https://lore.kernel.org/r/202607031449.9y46lBuM-lkp@intel.com/
smatch warnings:
drivers/media/pci/intel/ipu6/ipu6-isys-video.c:853 ipu6_isys_alloc_stream_firmware() error: double free of 'stream' (line 790)
vim +/stream +853 drivers/media/pci/intel/ipu6/ipu6-isys-video.c
3c1dfb5a69cf83 Bingbu Cao 2024-01-31 769
5bd6ad73933663 Sakari Ailus 2026-06-26 770 struct ipu6_isys_stream *
5bd6ad73933663 Sakari Ailus 2026-06-26 771 ipu6_isys_alloc_stream_firmware(struct ipu6_isys_csi2 *csi2,
5bd6ad73933663 Sakari Ailus 2026-06-26 772 struct v4l2_subdev_state *csi2_state,
5bd6ad73933663 Sakari Ailus 2026-06-26 773 struct v4l2_mbus_frame_desc *desc,
5bd6ad73933663 Sakari Ailus 2026-06-26 774 u8 vc)
5bd6ad73933663 Sakari Ailus 2026-06-26 775 {
5bd6ad73933663 Sakari Ailus 2026-06-26 776 struct device *dev = &csi2->isys->adev->auxdev.dev;
5bd6ad73933663 Sakari Ailus 2026-06-26 777 struct ipu6_isys_stream *stream;
5bd6ad73933663 Sakari Ailus 2026-06-26 778 struct v4l2_subdev_route *route;
5bd6ad73933663 Sakari Ailus 2026-06-26 779 int ret;
3c1dfb5a69cf83 Bingbu Cao 2024-01-31 780
5bd6ad73933663 Sakari Ailus 2026-06-26 781 stream = kzalloc(sizeof(*stream), GFP_KERNEL);
3c1dfb5a69cf83 Bingbu Cao 2024-01-31 782 if (!stream) {
5bd6ad73933663 Sakari Ailus 2026-06-26 783 ret = -ENOMEM;
5bd6ad73933663 Sakari Ailus 2026-06-26 784 goto err_free_stream;
3c1dfb5a69cf83 Bingbu Cao 2024-01-31 785 }
3c1dfb5a69cf83 Bingbu Cao 2024-01-31 786
5bd6ad73933663 Sakari Ailus 2026-06-26 787 ret = ida_alloc_max(&csi2->isys->streams, IPU6_ISYS_MAX_STREAMS - 1,
5bd6ad73933663 Sakari Ailus 2026-06-26 788 GFP_KERNEL);
5bd6ad73933663 Sakari Ailus 2026-06-26 789 if (ret < 0) {
5bd6ad73933663 Sakari Ailus 2026-06-26 @790 kfree(stream);
5bd6ad73933663 Sakari Ailus 2026-06-26 791 goto err_free_stream;
5bd6ad73933663 Sakari Ailus 2026-06-26 792 }
5bd6ad73933663 Sakari Ailus 2026-06-26 793
5bd6ad73933663 Sakari Ailus 2026-06-26 794 stream->stream_handle = ret;
5bd6ad73933663 Sakari Ailus 2026-06-26 795 mutex_init(&stream->mutex);
5bd6ad73933663 Sakari Ailus 2026-06-26 796 init_completion(&stream->stream_open_completion);
5bd6ad73933663 Sakari Ailus 2026-06-26 797 init_completion(&stream->stream_close_completion);
5bd6ad73933663 Sakari Ailus 2026-06-26 798 init_completion(&stream->stream_start_completion);
5bd6ad73933663 Sakari Ailus 2026-06-26 799 init_completion(&stream->stream_stop_completion);
5bd6ad73933663 Sakari Ailus 2026-06-26 800 INIT_LIST_HEAD(&stream->queues);
5bd6ad73933663 Sakari Ailus 2026-06-26 801 stream->isys = csi2->asd.isys;
5bd6ad73933663 Sakari Ailus 2026-06-26 802 stream->asd = &csi2->asd;
5bd6ad73933663 Sakari Ailus 2026-06-26 803 stream->vc = vc;
3c1dfb5a69cf83 Bingbu Cao 2024-01-31 804
5bd6ad73933663 Sakari Ailus 2026-06-26 805 scoped_guard(spinlock_irqsave, &stream->isys->power_lock) {
5bd6ad73933663 Sakari Ailus 2026-06-26 806 stream->isys->streams_by_handle[stream->stream_handle] =
5bd6ad73933663 Sakari Ailus 2026-06-26 807 stream;
5bd6ad73933663 Sakari Ailus 2026-06-26 808 csi2->streams_by_vc[stream->vc] = stream;
3c1dfb5a69cf83 Bingbu Cao 2024-01-31 809 }
3c1dfb5a69cf83 Bingbu Cao 2024-01-31 810
5bd6ad73933663 Sakari Ailus 2026-06-26 811 list_add(&stream->csi2_entry, &csi2->streams);
3c1dfb5a69cf83 Bingbu Cao 2024-01-31 812
5bd6ad73933663 Sakari Ailus 2026-06-26 813 for_each_active_route(&csi2_state->routing, route) {
5bd6ad73933663 Sakari Ailus 2026-06-26 814 struct media_pad *vdev_pad =
5bd6ad73933663 Sakari Ailus 2026-06-26 815 media_pad_remote_pad_first(&csi2->asd.pad[route->source_pad]);
5bd6ad73933663 Sakari Ailus 2026-06-26 816 struct v4l2_mbus_frame_desc_entry *entry = NULL;
3c1dfb5a69cf83 Bingbu Cao 2024-01-31 817
5bd6ad73933663 Sakari Ailus 2026-06-26 818 for (unsigned int i = 0; i < desc->num_entries; i++) {
5bd6ad73933663 Sakari Ailus 2026-06-26 819 if (desc->entry[i].stream != route->sink_stream)
5bd6ad73933663 Sakari Ailus 2026-06-26 820 continue;
3c1dfb5a69cf83 Bingbu Cao 2024-01-31 821
5bd6ad73933663 Sakari Ailus 2026-06-26 822 entry = &desc->entry[i];
3c1dfb5a69cf83 Bingbu Cao 2024-01-31 823 break;
3c1dfb5a69cf83 Bingbu Cao 2024-01-31 824 }
3c1dfb5a69cf83 Bingbu Cao 2024-01-31 825
5bd6ad73933663 Sakari Ailus 2026-06-26 826 if (!entry) {
5bd6ad73933663 Sakari Ailus 2026-06-26 827 dev_dbg(dev, "cannot find stream %u in frame desc\n",
5bd6ad73933663 Sakari Ailus 2026-06-26 828 route->sink_stream);
5bd6ad73933663 Sakari Ailus 2026-06-26 829 ret = -EINVAL;
5bd6ad73933663 Sakari Ailus 2026-06-26 830 goto err_ida_free;
3c1dfb5a69cf83 Bingbu Cao 2024-01-31 831 }
3c1dfb5a69cf83 Bingbu Cao 2024-01-31 832
5bd6ad73933663 Sakari Ailus 2026-06-26 833 if (entry->bus.csi2.vc != vc)
5bd6ad73933663 Sakari Ailus 2026-06-26 834 continue;
3c1dfb5a69cf83 Bingbu Cao 2024-01-31 835
5bd6ad73933663 Sakari Ailus 2026-06-26 836 struct ipu6_isys_video *av =
5bd6ad73933663 Sakari Ailus 2026-06-26 837 container_of_const(vdev_pad, struct ipu6_isys_video,
5bd6ad73933663 Sakari Ailus 2026-06-26 838 pad);
3c1dfb5a69cf83 Bingbu Cao 2024-01-31 839
5bd6ad73933663 Sakari Ailus 2026-06-26 840 list_add(&av->aq.node, &stream->queues);
3c1dfb5a69cf83 Bingbu Cao 2024-01-31 841
5bd6ad73933663 Sakari Ailus 2026-06-26 842 stream->nr_output_pins++;
5bd6ad73933663 Sakari Ailus 2026-06-26 843 av->stream = stream;
3c1dfb5a69cf83 Bingbu Cao 2024-01-31 844 }
3c1dfb5a69cf83 Bingbu Cao 2024-01-31 845
3c1dfb5a69cf83 Bingbu Cao 2024-01-31 846 return stream;
3c1dfb5a69cf83 Bingbu Cao 2024-01-31 847
5bd6ad73933663 Sakari Ailus 2026-06-26 848 err_ida_free:
5bd6ad73933663 Sakari Ailus 2026-06-26 849 list_del(&stream->csi2_entry);
5bd6ad73933663 Sakari Ailus 2026-06-26 850 ida_free(&csi2->isys->streams, stream->stream_handle);
3c1dfb5a69cf83 Bingbu Cao 2024-01-31 851
5bd6ad73933663 Sakari Ailus 2026-06-26 852 err_free_stream:
5bd6ad73933663 Sakari Ailus 2026-06-26 @853 kfree(stream);
3c1dfb5a69cf83 Bingbu Cao 2024-01-31 854
5bd6ad73933663 Sakari Ailus 2026-06-26 855 return ERR_PTR(ret);
3c1dfb5a69cf83 Bingbu Cao 2024-01-31 856 }
3c1dfb5a69cf83 Bingbu Cao 2024-01-31 857
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2026-07-03 6:34 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-07-03 6:33 [sailus-media-tree:metadata 98/105] drivers/media/pci/intel/ipu6/ipu6-isys-video.c:853 ipu6_isys_alloc_stream_firmware() error: double free of 'stream' (line 790) kernel test robot
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.