[PATCH v1 0/4] media: ipu6: A few defensive fixes for ipu7 buttress, fw-com and mmu paths

[Manik Bajpai <manik.bajpai@intel.com>]

This series fixes several bugs found while reviewing the ipu7 buttress
power on/off, fw-com and mmu paths: a boot-config leak on a queue memory
allocation failure, a skipped cleanup step on a buttress power on/off
timeout, unchecked firmware-supplied queue indices used in pointer
arithmetic in ipu7_fw_com_get_token(), and a missing "is this iova mapped"
check in ipu6_mmu_iova_to_phys() that could dereference an invalid pointer
for an unmapped iova.

A related fix for a missing NULL check on the output pin queue in the ipu7
isr was dropped from this series, since an equivalent patch is already on
the list:

https://lore.kernel.org/linux-media/20260927201631.153126-2-devnexen@gmail.com/

Manik Bajpai (4):
  media: ipu6: Free boot config on queue memory alloc failure
  media: ipu6: Always run cleanup in ipu7 power on/off on timeout
  media: ipu6: Validate fw-com queue indices before use
  media: ipu6: Fix NULL deref in ipu6_mmu_iova_to_phys()

 drivers/media/pci/intel/ipu6/ipu6-buttress.c | 24 ++++++++++++--------
 drivers/media/pci/intel/ipu6/ipu6-mmu.c      | 11 ++++++++-
 drivers/media/pci/intel/ipu6/ipu7-boot.c     |  1 +
 drivers/media/pci/intel/ipu6/ipu7-fw-com.c   | 14 +++++++++++-
 drivers/media/pci/intel/ipu6/ipu7-fw-com.h   |  5 +++-
 drivers/media/pci/intel/ipu6/ipu7-fw-isys.c  |  7 +++---
 6 files changed, 47 insertions(+), 15 deletions(-)

-- 
2.53.0