From: Dan Carpenter <error27@gmail.com>
To: oe-kbuild@lists.linux.dev, Sakari Ailus <sakari.ailus@linux.intel.com>
Cc: lkp@intel.com, oe-kbuild-all@lists.linux.dev,
linux-media@vger.kernel.org
Subject: [sailus-media-tree:metadata 98/105] drivers/media/pci/intel/ipu6/ipu6-isys-video.c:853 ipu6_isys_alloc_stream_firmware() error: double free of 'stream' (line 790)
Date: Thu, 9 Jul 2026 13:36:11 +0300 [thread overview]
Message-ID: <202607031449.9y46lBuM-lkp@intel.com> (raw)
tree: git://linuxtv.org/sailus/media_tree.git metadata
head: a6d4ce993bcd76851cfc7f28cc33aac011a30fa9
commit: 5bd6ad739336637aa65b270823cf43a5a8f2dcab [98/105] media: ipu6: Bridge the gap between streams in V4L2 and IPU6 firmware
config: x86_64-randconfig-161 (https://download.01.org/0day-ci/archive/20260703/202607031449.9y46lBuM-lkp@intel.com/config)
compiler: gcc-14 (Debian 14.2.0-19) 14.2.0
smatch: v0.5.0-9185-gbcc58b9c
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <error27@gmail.com>
| Closes: https://lore.kernel.org/r/202607031449.9y46lBuM-lkp@intel.com/
smatch warnings:
drivers/media/pci/intel/ipu6/ipu6-isys-video.c:853 ipu6_isys_alloc_stream_firmware() error: double free of 'stream' (line 790)
vim +/stream +853 drivers/media/pci/intel/ipu6/ipu6-isys-video.c
5bd6ad73933663 Sakari Ailus 2026-06-26 770 struct ipu6_isys_stream *
5bd6ad73933663 Sakari Ailus 2026-06-26 771 ipu6_isys_alloc_stream_firmware(struct ipu6_isys_csi2 *csi2,
5bd6ad73933663 Sakari Ailus 2026-06-26 772 struct v4l2_subdev_state *csi2_state,
5bd6ad73933663 Sakari Ailus 2026-06-26 773 struct v4l2_mbus_frame_desc *desc,
5bd6ad73933663 Sakari Ailus 2026-06-26 774 u8 vc)
5bd6ad73933663 Sakari Ailus 2026-06-26 775 {
5bd6ad73933663 Sakari Ailus 2026-06-26 776 struct device *dev = &csi2->isys->adev->auxdev.dev;
5bd6ad73933663 Sakari Ailus 2026-06-26 777 struct ipu6_isys_stream *stream;
5bd6ad73933663 Sakari Ailus 2026-06-26 778 struct v4l2_subdev_route *route;
5bd6ad73933663 Sakari Ailus 2026-06-26 779 int ret;
3c1dfb5a69cf83 Bingbu Cao 2024-01-31 780
5bd6ad73933663 Sakari Ailus 2026-06-26 781 stream = kzalloc(sizeof(*stream), GFP_KERNEL);
3c1dfb5a69cf83 Bingbu Cao 2024-01-31 782 if (!stream) {
5bd6ad73933663 Sakari Ailus 2026-06-26 783 ret = -ENOMEM;
5bd6ad73933663 Sakari Ailus 2026-06-26 784 goto err_free_stream;
3c1dfb5a69cf83 Bingbu Cao 2024-01-31 785 }
3c1dfb5a69cf83 Bingbu Cao 2024-01-31 786
5bd6ad73933663 Sakari Ailus 2026-06-26 787 ret = ida_alloc_max(&csi2->isys->streams, IPU6_ISYS_MAX_STREAMS - 1,
5bd6ad73933663 Sakari Ailus 2026-06-26 788 GFP_KERNEL);
5bd6ad73933663 Sakari Ailus 2026-06-26 789 if (ret < 0) {
5bd6ad73933663 Sakari Ailus 2026-06-26 @790 kfree(stream);
5bd6ad73933663 Sakari Ailus 2026-06-26 791 goto err_free_stream;
Double free on this error path.
5bd6ad73933663 Sakari Ailus 2026-06-26 792 }
5bd6ad73933663 Sakari Ailus 2026-06-26 793
5bd6ad73933663 Sakari Ailus 2026-06-26 794 stream->stream_handle = ret;
5bd6ad73933663 Sakari Ailus 2026-06-26 795 mutex_init(&stream->mutex);
5bd6ad73933663 Sakari Ailus 2026-06-26 796 init_completion(&stream->stream_open_completion);
5bd6ad73933663 Sakari Ailus 2026-06-26 797 init_completion(&stream->stream_close_completion);
5bd6ad73933663 Sakari Ailus 2026-06-26 798 init_completion(&stream->stream_start_completion);
5bd6ad73933663 Sakari Ailus 2026-06-26 799 init_completion(&stream->stream_stop_completion);
5bd6ad73933663 Sakari Ailus 2026-06-26 800 INIT_LIST_HEAD(&stream->queues);
5bd6ad73933663 Sakari Ailus 2026-06-26 801 stream->isys = csi2->asd.isys;
5bd6ad73933663 Sakari Ailus 2026-06-26 802 stream->asd = &csi2->asd;
5bd6ad73933663 Sakari Ailus 2026-06-26 803 stream->vc = vc;
3c1dfb5a69cf83 Bingbu Cao 2024-01-31 804
5bd6ad73933663 Sakari Ailus 2026-06-26 805 scoped_guard(spinlock_irqsave, &stream->isys->power_lock) {
5bd6ad73933663 Sakari Ailus 2026-06-26 806 stream->isys->streams_by_handle[stream->stream_handle] =
5bd6ad73933663 Sakari Ailus 2026-06-26 807 stream;
5bd6ad73933663 Sakari Ailus 2026-06-26 808 csi2->streams_by_vc[stream->vc] = stream;
3c1dfb5a69cf83 Bingbu Cao 2024-01-31 809 }
3c1dfb5a69cf83 Bingbu Cao 2024-01-31 810
5bd6ad73933663 Sakari Ailus 2026-06-26 811 list_add(&stream->csi2_entry, &csi2->streams);
3c1dfb5a69cf83 Bingbu Cao 2024-01-31 812
5bd6ad73933663 Sakari Ailus 2026-06-26 813 for_each_active_route(&csi2_state->routing, route) {
5bd6ad73933663 Sakari Ailus 2026-06-26 814 struct media_pad *vdev_pad =
5bd6ad73933663 Sakari Ailus 2026-06-26 815 media_pad_remote_pad_first(&csi2->asd.pad[route->source_pad]);
5bd6ad73933663 Sakari Ailus 2026-06-26 816 struct v4l2_mbus_frame_desc_entry *entry = NULL;
3c1dfb5a69cf83 Bingbu Cao 2024-01-31 817
5bd6ad73933663 Sakari Ailus 2026-06-26 818 for (unsigned int i = 0; i < desc->num_entries; i++) {
5bd6ad73933663 Sakari Ailus 2026-06-26 819 if (desc->entry[i].stream != route->sink_stream)
5bd6ad73933663 Sakari Ailus 2026-06-26 820 continue;
3c1dfb5a69cf83 Bingbu Cao 2024-01-31 821
5bd6ad73933663 Sakari Ailus 2026-06-26 822 entry = &desc->entry[i];
3c1dfb5a69cf83 Bingbu Cao 2024-01-31 823 break;
3c1dfb5a69cf83 Bingbu Cao 2024-01-31 824 }
3c1dfb5a69cf83 Bingbu Cao 2024-01-31 825
5bd6ad73933663 Sakari Ailus 2026-06-26 826 if (!entry) {
5bd6ad73933663 Sakari Ailus 2026-06-26 827 dev_dbg(dev, "cannot find stream %u in frame desc\n",
5bd6ad73933663 Sakari Ailus 2026-06-26 828 route->sink_stream);
5bd6ad73933663 Sakari Ailus 2026-06-26 829 ret = -EINVAL;
5bd6ad73933663 Sakari Ailus 2026-06-26 830 goto err_ida_free;
3c1dfb5a69cf83 Bingbu Cao 2024-01-31 831 }
3c1dfb5a69cf83 Bingbu Cao 2024-01-31 832
5bd6ad73933663 Sakari Ailus 2026-06-26 833 if (entry->bus.csi2.vc != vc)
5bd6ad73933663 Sakari Ailus 2026-06-26 834 continue;
3c1dfb5a69cf83 Bingbu Cao 2024-01-31 835
5bd6ad73933663 Sakari Ailus 2026-06-26 836 struct ipu6_isys_video *av =
5bd6ad73933663 Sakari Ailus 2026-06-26 837 container_of_const(vdev_pad, struct ipu6_isys_video,
5bd6ad73933663 Sakari Ailus 2026-06-26 838 pad);
3c1dfb5a69cf83 Bingbu Cao 2024-01-31 839
5bd6ad73933663 Sakari Ailus 2026-06-26 840 list_add(&av->aq.node, &stream->queues);
3c1dfb5a69cf83 Bingbu Cao 2024-01-31 841
5bd6ad73933663 Sakari Ailus 2026-06-26 842 stream->nr_output_pins++;
5bd6ad73933663 Sakari Ailus 2026-06-26 843 av->stream = stream;
3c1dfb5a69cf83 Bingbu Cao 2024-01-31 844 }
3c1dfb5a69cf83 Bingbu Cao 2024-01-31 845
3c1dfb5a69cf83 Bingbu Cao 2024-01-31 846 return stream;
3c1dfb5a69cf83 Bingbu Cao 2024-01-31 847
5bd6ad73933663 Sakari Ailus 2026-06-26 848 err_ida_free:
5bd6ad73933663 Sakari Ailus 2026-06-26 849 list_del(&stream->csi2_entry);
5bd6ad73933663 Sakari Ailus 2026-06-26 850 ida_free(&csi2->isys->streams, stream->stream_handle);
3c1dfb5a69cf83 Bingbu Cao 2024-01-31 851
5bd6ad73933663 Sakari Ailus 2026-06-26 852 err_free_stream:
5bd6ad73933663 Sakari Ailus 2026-06-26 @853 kfree(stream);
Second free.
3c1dfb5a69cf83 Bingbu Cao 2024-01-31 854
5bd6ad73933663 Sakari Ailus 2026-06-26 855 return ERR_PTR(ret);
3c1dfb5a69cf83 Bingbu Cao 2024-01-31 856 }
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
reply other threads:[~2026-07-09 10:36 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202607031449.9y46lBuM-lkp@intel.com \
--to=error27@gmail.com \
--cc=linux-media@vger.kernel.org \
--cc=lkp@intel.com \
--cc=oe-kbuild-all@lists.linux.dev \
--cc=oe-kbuild@lists.linux.dev \
--cc=sakari.ailus@linux.intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox