[PATCH] media: ipu6: Fix bus device use-after-free

[PATCH] media: ipu6: Fix bus device use-after-free

[Antti Laakso]

The ipu6_bus_del_devices() will uninitialize and free bus devices and
dereferencing isp->psys and isp->isys will lead to use-after-free.

While at it, remove unnecessary checks for isp->isys/psys.

Reported-by: Dan Carpenter <error27@gmail.com>
Fixes: 69ebb1bfc865 ("media: ipu6: Move isys fw mapping to pci_probe")
Signed-off-by: Antti Laakso <antti.laakso@linux.intel.com>
---
 drivers/media/pci/intel/ipu6/ipu6.c | 16 +++++++---------
 1 file changed, 7 insertions(+), 9 deletions(-)

diff --git a/drivers/media/pci/intel/ipu6/ipu6.c b/drivers/media/pci/intel/ipu6/ipu6.c
index 43d951735f72..b9a79181d736 100644
--- a/drivers/media/pci/intel/ipu6/ipu6.c
+++ b/drivers/media/pci/intel/ipu6/ipu6.c
@@ -836,6 +836,8 @@ static int ipu6_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 static void ipu6_pci_remove(struct pci_dev *pdev)
 {
 	struct ipu6_device *isp = pci_get_drvdata(pdev);
+	struct ipu6_mmu *isys_mmu = isp->isys->mmu;
+	struct ipu6_mmu *psys_mmu = isp->psys->mmu;
 	unsigned long dir;
 
 	devm_free_irq(&pdev->dev, pdev->irq, isp);
@@ -844,11 +846,9 @@ static void ipu6_pci_remove(struct pci_dev *pdev)
 	ipu6_cpd_free_pkg_dir(isp->psys);
 	ipu6_unmap_fw_region(isp->psys, dir);
 
-	if (isp->isys) {
-		ipu6_cpd_free_pkg_dir(isp->isys);
-		if (isp->isys->fw_sgt.nents)
-			ipu6_unmap_fw_region(isp->isys, dir);
-	}
+	ipu6_cpd_free_pkg_dir(isp->isys);
+	if (isp->isys->fw_sgt.nents)
+		ipu6_unmap_fw_region(isp->isys, dir);
 
 	vfree(isp->fw_code_region);
 	isp->fw_code_region = NULL;
@@ -862,10 +862,8 @@ static void ipu6_pci_remove(struct pci_dev *pdev)
 
 	release_firmware(isp->cpd_fw);
 
-	if (isp->psys)
-		ipu6_mmu_cleanup(isp->psys->mmu);
-	if (isp->isys)
-		ipu6_mmu_cleanup(isp->isys->mmu);
+	ipu6_mmu_cleanup(psys_mmu);
+	ipu6_mmu_cleanup(isys_mmu);
 }
 
 static void ipu6_pci_reset_prepare(struct pci_dev *pdev)
-- 
2.55.0

Re: [PATCH] media: ipu6: Fix bus device use-after-free

[Sakari Ailus]

Hi Antti,

Thanks for the patch.

On Thu, Sep 24, 2026 at 03:06:34PM +0300, Antti Laakso wrote:
> The ipu6_bus_del_devices() will uninitialize and free bus devices and
> dereferencing isp->psys and isp->isys will lead to use-after-free.
> 
> While at it, remove unnecessary checks for isp->isys/psys.
> 
> Reported-by: Dan Carpenter <error27@gmail.com>

Closes: https://lore.kernel.org/linux-media/aqlXAXcXvMM3HWtJ@stanley.mountain/T/#u

-- 
Sakari Ailus