[PATCH 2/2] media: ipu6: Check the ipu7 output pin queue before completing a buffer
From: David Carlier
Date: Sun Sep 27 2026 - 16:17:52 EST
A PIN_DATA_READY response for an unconfigured pin dereferences a NULL
output_pins_queue entry in interrupt context. Check the queue like the
ipu6 path does.
Fixes: f268203d74ff ("media: ipu6: Add ipu7 isr handler")
Signed-off-by: David Carlier <devnexen@xxxxxxxxx>
---
drivers/media/pci/intel/ipu6/ipu7-fw-isys.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/media/pci/intel/ipu6/ipu7-fw-isys.c b/drivers/media/pci/intel/ipu6/ipu7-fw-isys.c
index 19e063b22a15..dca9c8fbc3ac 100644
--- a/drivers/media/pci/intel/ipu6/ipu7-fw-isys.c
+++ b/drivers/media/pci/intel/ipu6/ipu7-fw-isys.c
@@ -638,7 +638,8 @@ static int ipu7_isys_isr_one(struct ipu6_bus_device *adev)
struct isys_fw_msgs, dummy);
ipu6_put_fw_msg_buf(ipu6_bus_get_drvdata(adev), isys_fw_msg);
- if (resp->pin_id < IPU6_ISYS_OUTPUT_PINS)
+ if (resp->pin_id < IPU6_ISYS_OUTPUT_PINS &&
+ stream->output_pins_queue[resp->pin_id])
ipu6_stream_buf_ready(stream, resp->pin_id,
resp->pin.addr, ts, 0);
else
--
2.55.0