[PATCH] staging: media: ipu7: add NULL checks before ipu7_mmu_cleanup() in remove

[PATCH] staging: media: ipu7: add NULL checks before ipu7_mmu_cleanup() in remove

[Alfie Varghese]

ipu7_pci_remove() calls ipu7_mmu_cleanup() on isp->isys->mmu and
isp->psys->mmu without checking whether isys or psys are valid
pointers. If ipu7_pci_probe() partially failed and left isys or psys
as NULL or an error pointer, the remove path will dereference a bad
pointer and crash the kernel.

The probe error cleanup path already guards these calls correctly with
IS_ERR_OR_NULL() checks. Apply the same guards in ipu7_pci_remove().

Signed-off-by: Alfie Varghese <alfievarghese22@gmail.com>
---
 drivers/staging/media/ipu7/ipu7.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/staging/media/ipu7/ipu7.c b/drivers/staging/media/ipu7/ipu7.c
index 310e3f24e571..41436f22c684 100644
--- a/drivers/staging/media/ipu7/ipu7.c
+++ b/drivers/staging/media/ipu7/ipu7.c
@@ -2637,8 +2637,10 @@ static void ipu7_pci_remove(struct pci_dev *pdev)
 	if (!IS_ERR_OR_NULL(isp->fw_code_region))
 		vfree(isp->fw_code_region);
 
-	ipu7_mmu_cleanup(isp->isys->mmu);
-	ipu7_mmu_cleanup(isp->psys->mmu);
+	if (!IS_ERR_OR_NULL(isp->isys) && !IS_ERR_OR_NULL(isp->isys->mmu))
+		ipu7_mmu_cleanup(isp->isys->mmu);
+	if (!IS_ERR_OR_NULL(isp->psys) && !IS_ERR_OR_NULL(isp->psys->mmu))
+		ipu7_mmu_cleanup(isp->psys->mmu);
 
 	ipu7_bus_del_devices(pdev);
 

Re: [PATCH] staging: media: ipu7: add NULL checks before ipu7_mmu_cleanup() in remove

[Dan Carpenter]

On Mon, Jul 13, 2026 at 10:51:27PM +0530, Alfie Varghese wrote:
> ipu7_pci_remove() calls ipu7_mmu_cleanup() on isp->isys->mmu and
> isp->psys->mmu without checking whether isys or psys are valid
> pointers. If ipu7_pci_probe() partially failed and left isys or psys
> as NULL or an error pointer, the remove path will dereference a bad
> pointer and crash the kernel.
> 
> The probe error cleanup path already guards these calls correctly with
> IS_ERR_OR_NULL() checks. Apply the same guards in ipu7_pci_remove().
> 
> Signed-off-by: Alfie Varghese <alfievarghese22@gmail.com>
> ---
>  drivers/staging/media/ipu7/ipu7.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/staging/media/ipu7/ipu7.c b/drivers/staging/media/ipu7/ipu7.c
> index 310e3f24e571..41436f22c684 100644
> --- a/drivers/staging/media/ipu7/ipu7.c
> +++ b/drivers/staging/media/ipu7/ipu7.c
> @@ -2637,8 +2637,10 @@ static void ipu7_pci_remove(struct pci_dev *pdev)
>  	if (!IS_ERR_OR_NULL(isp->fw_code_region))
>  		vfree(isp->fw_code_region);
>  
> -	ipu7_mmu_cleanup(isp->isys->mmu);
> -	ipu7_mmu_cleanup(isp->psys->mmu);
> +	if (!IS_ERR_OR_NULL(isp->isys) && !IS_ERR_OR_NULL(isp->isys->mmu))
> +		ipu7_mmu_cleanup(isp->isys->mmu);
> +	if (!IS_ERR_OR_NULL(isp->psys) && !IS_ERR_OR_NULL(isp->psys->mmu))
> +		ipu7_mmu_cleanup(isp->psys->mmu);

The original code here is fine.  It is the probe() function which is
is wrong.  See my blog on how to fix the probe() function.

https://staticthinking.wordpress.com/2022/04/28/free-the-last-thing-style/

regards,
dan carpenter