Re: [PATCH v3 3/3] media: ipu-bridge: Add Sony IMX681

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Dangling secondary fwnode pointers upon unregistration leading to UAF
--

commit 14048fa470e12c0fb57d0c87c84bc92c1497b100
Author: Sergey Lebedev <lsa.uz@pm.me>

media: ipu-bridge: Add Sony IMX681

This patch adds support for the Sony IMX681 user-facing sensor to the IPU
bridge. It ensures the sensor can be properly connected in the graph by
mapping its ACPI identifier.

> diff --git a/drivers/media/pci/intel/ipu-bridge.c b/drivers/media/pci/intel/ipu-bridge.c
> index 7e65491faf6dc..68c2eb326f1dc 100644
> --- a/drivers/media/pci/intel/ipu-bridge.c
> +++ b/drivers/media/pci/intel/ipu-bridge.c
> @@ -97,6 +97,8 @@ static const struct ipu_sensor_config ipu_supported_sensors[] = {
>  	IPU_SENSOR_CONFIG("OVTI5675", 1, 450000000),
>  	/* Omnivision OV8856 */
>  	IPU_SENSOR_CONFIG("OVTI8856", 3, 180000000, 360000000, 720000000),
> +	/* Sony IMX681 */
> +	IPU_SENSOR_CONFIG("SONY0681", 1, 969600000),

[Severity: High]
This isn't a bug introduced by this patch, but there is a pre-existing issue
in the IPU bridge setup and teardown path.

In ipu_bridge_connect_sensor(), the ACPI device's secondary fwnode pointer is
manually assigned to point to the newly created software node:

    primary->secondary = fwnode;

Additionally, ipu_bridge_instantiate_ivsc() also sets the secondary fwnode
for the CSI device:

    set_secondary_fwnode(sensor->csi_dev, fwnode);

When an error occurs and err_free_swnodes is reached during module
initialization, or when ipu_bridge_unregister_sensors() is called during
teardown, the underlying software nodes are freed:

    software_node_unregister_node_group(sensor->group);

However, primary->secondary and the csi_dev secondary fwnode are never cleared
back to NULL. Does this leave dangling pointers that could lead to a
use-after-free if another subsystem iterates over or accesses the secondary
fwnodes after the group is unregistered?

>  	/* Sony IMX471 */
>  	IPU_SENSOR_CONFIG("SONY471A", 1, 200000000),

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260909203717.90605-1-lsa.uz@pm.me?part=3