Re: [PATCH] media: intel/ipu6: fix error pointer dereference

[Sakari Ailus]

Hi Ethan,

Thanks for the patch.

On Mon, Feb 16, 2026 at 06:34:20PM -0600, Ethan Tidmore wrote:
> After confirming that isp->psys is an error pointer goto is called and
> imminently goes to this code snippet below:
> 
> out_ipu6_bus_del_devices:
> 	if (isp->psys) {
> 		ipu6_cpd_free_pkg_dir(isp->psys);
> 		ipu6_buttress_unmap_fw_image(isp->psys, &isp->psys->fw_sgt);
> 	}
> 
> Since isp->psys is confirmed to be an error pointer not NULL, the
> condition is true and the error pointer is dereferenced. So isp->psys
> should be set to NULL before going to out_ipu6_bus_del_devices.
> 
> Fixes: 25fedc021985a ("media: intel/ipu6: add Intel IPU6 PCI device driver")

Add:

Cc: stable@xxxxxxxxxxxxxxx

> Signed-off-by: Ethan Tidmore <ethantidmore06@xxxxxxxxx>
> ---
>  drivers/media/pci/intel/ipu6/ipu6.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/media/pci/intel/ipu6/ipu6.c b/drivers/media/pci/intel/ipu6/ipu6.c
> index 24238f8311a6..6e6b7d2a68ff 100644
> --- a/drivers/media/pci/intel/ipu6/ipu6.c
> +++ b/drivers/media/pci/intel/ipu6/ipu6.c
> @@ -619,6 +619,7 @@ static int ipu6_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
>  				   psys_base, &psys_ipdata);
>  	if (IS_ERR(isp->psys)) {
>  		ret = PTR_ERR(isp->psys);
> +		isp->psys = NULL;

There are a number of checks for IS_ERR_OR_NULL() in error handling;
instead of setting psys to NULL here I'd add the same test to the condition
after out_ipu6_bus_del_devices:.

>  		goto out_ipu6_bus_del_devices;
>  	}
>  

-- 
Kind regards,

Sakari Ailus