Re: [PATCH] media: staging/ipu7: Fix pdata double free in init error paths

[Guangshuo Li]

Hi kernel test robot,

Thanks for the report.

On Sun, 3 May 2026 at 22:52, kernel test robot <lkp@xxxxxxxxx> wrote:
>
> Hi Guangshuo,
>
> kernel test robot noticed the following build errors:
>
> [auto build test ERROR on staging/staging-testing]
>
> url:    https://github.com/intel-lab-lkp/linux/commits/Guangshuo-Li/media-staging-ipu7-Fix-pdata-double-free-in-init-error-paths/20260501-032323
> base:   staging/staging-testing
> patch link:    https://lore.kernel.org/r/20260430053820.446080-1-lgs201920130244%40gmail.com
> patch subject: [PATCH] media: staging/ipu7: Fix pdata double free in init error paths
> config: i386-allyesconfig (https://download.01.org/0day-ci/archive/20260503/202605032224.WHCEx7uc-lkp@xxxxxxxxx/config)
> compiler: gcc-14 (Debian 14.2.0-19) 14.2.0
> reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260503/202605032224.WHCEx7uc-lkp@xxxxxxxxx/reproduce)
>
> If you fix the issue in a separate patch/commit (i.e. not just a new version of
> the same patch/commit), kindly add following tags
> | Reported-by: kernel test robot <lkp@xxxxxxxxx>
> | Closes: https://lore.kernel.org/oe-kbuild-all/202605032224.WHCEx7uc-lkp@xxxxxxxxx/
>
> All errors (new ones prefixed by >>):
>
>    drivers/staging/media/ipu7/ipu7.c: In function 'ipu7_isys_init':
> >> drivers/staging/media/ipu7/ipu7.c:2176:33: error: passing argument 1 of 'ERR_CAST' makes pointer from integer without a cast [-Wint-conversion]
>     2176 |                 return ERR_CAST(ret);
>          |                                 ^~~
>          |                                 |
>          |                                 int
>    In file included from include/linux/cleanup.h:6,
>                     from include/linux/acpi.h:11,
>                     from drivers/staging/media/ipu7/ipu7.c:6:
>    include/linux/err.h:102:64: note: expected 'const void *' but argument is of type 'int'
>      102 | static inline void * __must_check ERR_CAST(__force const void *ptr)
>          |                                                    ~~~~~~~~~~~~^~~
>    drivers/staging/media/ipu7/ipu7.c: In function 'ipu7_psys_init':
>    drivers/staging/media/ipu7/ipu7.c:2221:33: error: passing argument 1 of 'ERR_CAST' makes pointer from integer without a cast [-Wint-conversion]
>     2221 |                 return ERR_CAST(ret);
>          |                                 ^~~
>          |                                 |
>          |                                 int
>    include/linux/err.h:102:64: note: expected 'const void *' but argument is of type 'int'
>      102 | static inline void * __must_check ERR_CAST(__force const void *ptr)
>          |                                                    ~~~~~~~~~~~~^~~
>
>
> vim +/ERR_CAST +2176 drivers/staging/media/ipu7/ipu7.c
>
>   2125
>   2126  static struct ipu7_bus_device *
>   2127  ipu7_isys_init(struct pci_dev *pdev, struct device *parent,
>   2128                 const struct ipu_buttress_ctrl *ctrl, void __iomem *base,
>   2129                 const struct ipu_isys_internal_pdata *ipdata,
>   2130                 unsigned int nr)
>   2131  {
>   2132          struct fwnode_handle *fwnode = dev_fwnode(&pdev->dev);
>   2133          struct ipu7_bus_device *isys_adev;
>   2134          struct device *dev = &pdev->dev;
>   2135          struct ipu7_isys_pdata *pdata;
>   2136          int ret;
>   2137
>   2138          ret = ipu7_isys_check_fwnode_graph(fwnode);
>   2139          if (ret) {
>   2140                  if (fwnode && !IS_ERR_OR_NULL(fwnode->secondary)) {
>   2141                          dev_err(dev,
>   2142                                  "fwnode graph has no endpoints connection\n");
>   2143                          return ERR_PTR(-EINVAL);
>   2144                  }
>   2145
>   2146                  ret = ipu_bridge_init(dev, ipu_bridge_parse_ssdb);
>   2147                  if (ret) {
>   2148                          dev_err_probe(dev, ret, "IPU bridge init failed\n");
>   2149                          return ERR_PTR(ret);
>   2150                  }
>   2151          }
>   2152
>   2153          pdata = kzalloc_obj(*pdata);
>   2154          if (!pdata)
>   2155                  return ERR_PTR(-ENOMEM);
>   2156
>   2157          pdata->base = base;
>   2158          pdata->ipdata = ipdata;
>   2159
>   2160          isys_adev = ipu7_bus_initialize_device(pdev, parent, pdata, ctrl,
>   2161                                                 IPU_ISYS_NAME);
>   2162          if (IS_ERR(isys_adev)) {
>   2163                  dev_err_probe(dev, PTR_ERR(isys_adev),
>   2164                                "ipu7_bus_initialize_device isys failed\n");
>   2165                  kfree(pdata);
>   2166                  return ERR_CAST(isys_adev);
>   2167          }
>   2168
>   2169          isys_adev->mmu = ipu7_mmu_init(dev, base, ISYS_MMID,
>   2170                                         &ipdata->hw_variant);
>   2171          if (IS_ERR(isys_adev->mmu)) {
>   2172                  ret = PTR_ERR(isys_adev->mmu);
>   2173                  dev_err_probe(dev, ret,
>   2174                                "ipu7_mmu_init(isys_adev->mmu) failed\n");
>   2175                  put_device(&isys_adev->auxdev.dev);
> > 2176                  return ERR_CAST(ret);
>   2177          }
>   2178
>   2179          isys_adev->mmu->dev = &isys_adev->auxdev.dev;
>   2180          isys_adev->subsys = IPU_IS;
>   2181
>   2182          ret = ipu7_bus_add_device(isys_adev);
>   2183          if (ret)
>   2184                  return ERR_PTR(ret);
>   2185
>   2186          return isys_adev;
>   2187  }
>   2188
>
> --
> 0-DAY CI Kernel Test Service
> https://github.com/intel/lkp-tests/wiki

The build failure is caused by my use of ERR_CAST(ret) after caching
PTR_ERR(isys_adev->mmu) / PTR_ERR(psys_adev->mmu) into the integer variable
ret. ERR_CAST() expects an error pointer, not an integer error code.

I will fix this in v2 by returning ERR_PTR(ret) instead.

Thanks,
Guangshuo