[PATCH] media: intel/ipu6: fix error pointer dereference
From: Ethan Tidmore
Date: Mon Feb 16 2026 - 19:34:47 EST
After confirming that isp->psys is an error pointer goto is called and
imminently goes to this code snippet below:
out_ipu6_bus_del_devices:
if (isp->psys) {
ipu6_cpd_free_pkg_dir(isp->psys);
ipu6_buttress_unmap_fw_image(isp->psys, &isp->psys->fw_sgt);
}
Since isp->psys is confirmed to be an error pointer not NULL, the
condition is true and the error pointer is dereferenced. So isp->psys
should be set to NULL before going to out_ipu6_bus_del_devices.
Fixes: 25fedc021985a ("media: intel/ipu6: add Intel IPU6 PCI device driver")
Signed-off-by: Ethan Tidmore <ethantidmore06@xxxxxxxxx>
---
drivers/media/pci/intel/ipu6/ipu6.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/media/pci/intel/ipu6/ipu6.c b/drivers/media/pci/intel/ipu6/ipu6.c
index 24238f8311a6..6e6b7d2a68ff 100644
--- a/drivers/media/pci/intel/ipu6/ipu6.c
+++ b/drivers/media/pci/intel/ipu6/ipu6.c
@@ -619,6 +619,7 @@ static int ipu6_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
psys_base, &psys_ipdata);
if (IS_ERR(isp->psys)) {
ret = PTR_ERR(isp->psys);
+ isp->psys = NULL;
goto out_ipu6_bus_del_devices;
}
--
2.53.0