From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f43.google.com (mail-wm1-f43.google.com [209.85.128.43]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E1465334C17 for ; Wed, 15 Apr 2026 16:23:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.43 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776270203; cv=none; b=pYd8qwXpWm6W4T1/DPsagS5cvkfdbvbBpVyJUuN+yC1nncDDhvJWW/CkxRopq2qrFXCDd3E64fCS+FBBPI+DCBTY5+kZh5JKA1O0SH8Px/As6ewhXsP9Omuuf1hsAGI7HBV0NAfs+2vNzbmxOpbJ1/1bdFn85LzGCtHnpqarlIo= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776270203; c=relaxed/simple; bh=GHCU+bbFUJa7ME8vQIA0RMnlQLkMVDn7IlOjIXvxDPY=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=iOE6Zq2XAGivg9JHABEOWIq9EmXMqJGhLAcFkNXzeiecNjbKJLYXZ4aCghq2uR/HU4KKbbQ1RBCqihWaXHXt0dGfrr61X+MbwnIbu7OQo5os2fMv+SDsDpGncx7nF6ln5b03X0cXrzH8ik3hHb+sajeOtGZlM9qNy8H3OhH9h4o= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=WjSSL+X6; arc=none smtp.client-ip=209.85.128.43 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="WjSSL+X6" Received: by mail-wm1-f43.google.com with SMTP id 5b1f17b1804b1-488a14c31eeso56591245e9.0 for ; Wed, 15 Apr 2026 09:23:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1776270200; x=1776875000; darn=vger.kernel.org; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:from:to:cc:subject:date:message-id:reply-to; bh=w5SisJyRtRtkzZampcjxbirVuB3MRSAAjgkwq2Gw8Sc=; b=WjSSL+X6JDeO2S1BJpPtDeL2FcKIOcUCqNlaWAg3Ek6pA7f9NijP0gKsEFzpqnIu0Y drSZ78NWNxOvopWtzq9Idch1n3hguQlSHyriTDYH2/Bp4ffESe5VG4MgIfOkr5ftl8YU IO237cT9BkEbPb4jvMqunRSqorKD9BWc7LCsF6g8RRxKqbnSeawGZx7GWLuw84B1SdsN oUhzkDNBzmFWapilsMRZ3UokwLgaua8tGpaH4eiTcjq2scK64xgIKhbR6lLg1FBx5FUT EmZgTnU25IVvHNn9V5MGg/kvMypvCze4oo+J918WMgmZlir+XNX/A0uLlpfP9zVVSYXu uhtA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1776270200; x=1776875000; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:x-gm-gg:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=w5SisJyRtRtkzZampcjxbirVuB3MRSAAjgkwq2Gw8Sc=; b=NQIwKjab9rr48bBOO4YgznpBz2C4dgLX+ccprWhP83TKoIS42ny+wf0mEVR67mwGAv O8pqVW6z7Q8GhmIwGgl9iMPsJSiqGEshMt0m9O/CntEl3q/mTSXH1QTJDsMyizJMO61F fPYBKFKIFl0kUqP0RhcIBRnwbp5o7pMhtY6QJrWC8tAGwEA4GLbdGKoSabNcYIuWdwwu XgGg3utwA/PS+JAAPcSMaYDrwLnSd9+pdxjYDTpXOdScKTrVNzxCEgFq27CTru2vCdO5 MH/HNE0c8VyVowONOMP9rnIEALVHrnMVqimuo+IcPV+Tr0TAuH1N7y701Um44CIuqhTa zq1g== X-Forwarded-Encrypted: i=1; AFNElJ9t26MV8Og8V0Ti3k9yLcWnE3eQBOgTLBzg+GviNlM9uWmzMnUYhVRqcx9dSpQkvn0fHYT0QA94ysKxGxk=@vger.kernel.org X-Gm-Message-State: AOJu0YxKALc8EIuvm2TyqT0BOsP4qDZKrOolE0BC0OjI5zr/NnHd33xV CiKFqFh940jKvDege4QhvJ030Hfg5JjDdrU9w28drgt5WSvjT4lOubB+ X-Gm-Gg: AeBDiesXq/YysdBqPy9gaPh4o2gKb0LpPIzbqndomCRtd3vnyaAPGJt3RA67q75t4LP T904hu/WxMq2QVwaf5PjQpDZMRXLaMd8bDsLlCo0BbHqjpBkEIp60Nu/tMjsmJAHU3RjT9NrKF+ jYKBgrOfzz2EW8gUDjfZ+vCPnmi/zOIYM4FjnF07Nf9KjOSC/CwEg5FCZkxHBeoiufMP+D8+xap 7kbGyroYEafQNFidi1MHwbOc8q5f5lX1xkPMQo/4VM/cr0pOjAQcMAiDJMiGAHDkDyH83f/BKrV 2Ei8TPRR24Fq8wds8O4N85bFudjWLUNpA4pNO1Zw9x0YTGuxgZvnQYhDYd5u/EShP70OiCnx7kB u4ud9NSp0Y7kLGk92yH5qAksss2Vwi5ZjNJ6kYj7itCYE6/NiPBM7aRdjvQspiWKWual2TVblBp l6iLEpxkfvTEItWzz7LSQ= X-Received: by 2002:a05:600c:8284:b0:488:d228:a133 with SMTP id 5b1f17b1804b1-488d683d280mr295721625e9.14.1776270200141; Wed, 15 Apr 2026 09:23:20 -0700 (PDT) Received: from localhost ([196.207.164.177]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-488f0eac687sm22601145e9.21.2026.04.15.09.23.19 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 15 Apr 2026 09:23:19 -0700 (PDT) Date: Wed, 15 Apr 2026 19:23:16 +0300 From: Dan Carpenter To: Yuho Choi Cc: Andy Shevchenko , Hans de Goede , Mauro Carvalho Chehab , Sakari Ailus , Greg Kroah-Hartman , Peter Zijlstra , Kees Cook , Josh Poimboeuf , Thomas Andreatta , linux-media@vger.kernel.org, linux-staging@lists.linux.dev, linux-kernel@vger.kernel.org Subject: Re: [PATCH v4] media: atomisp: gc2235: fix UAF and memory leak Message-ID: References: <20260403002319.12771-1-dbgh9129@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20260403002319.12771-1-dbgh9129@gmail.com> On Thu, Apr 02, 2026 at 08:23:19PM -0400, Yuho Choi wrote: > gc2235_probe() handles its error paths incorrectly. > > If media_entity_pads_init() fails, gc2235_remove() is called, which > tears down the subdev and frees dev, but then still falls through to > atomisp_register_i2c_module(). This results in use-after-free. > > If atomisp_register_i2c_module() fails, the media entity and control > handler are left initialized and dev is leaked. > > gc2235_remove() unconditionally calls media_entity_cleanup() and > v4l2_ctrl_handler_free(), but these are not initialized at every > error path in gc2235_probe(). > > Replace gc2235_remove() calls in the probe error paths with explicit > unwind labels that free only the resources initialized at each point > of failure, in reverse order of initialization. > > Fixes: a49d25364dfb ("staging/atomisp: Add support for the Intel IPU v2") > Signed-off-by: Yuho Choi > --- Thanks. LGTM! Reviewed-by: Dan Carpenter regards, dan carpenter