[sailus-media-tree:metadata 98/105] drivers/media/pci/intel/ipu6/ipu6-isys-video.c:853 ipu6_isys_alloc_stream_firmware() error: double free of 'stream' (line 790)

tree:   git://linuxtv.org/sailus/media_tree.git metadata
head:   a6d4ce993bcd76851cfc7f28cc33aac011a30fa9
commit: 5bd6ad739336637aa65b270823cf43a5a8f2dcab [98/105] media: ipu6: Bridge the gap between streams in V4L2 and IPU6 firmware
config: x86_64-randconfig-161 (https://download.01.org/0day-ci/archive/20260703/[email protected]/config)
compiler: gcc-14 (Debian 14.2.0-19) 14.2.0
smatch: v0.5.0-9185-gbcc58b9c

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <[email protected]>
| Reported-by: Dan Carpenter <[email protected]>
| Closes: https://lore.kernel.org/r/[email protected]/

smatch warnings:
drivers/media/pci/intel/ipu6/ipu6-isys-video.c:853 ipu6_isys_alloc_stream_firmware() error: double free of 'stream' (line 790)

vim +/stream +853 drivers/media/pci/intel/ipu6/ipu6-isys-video.c

5bd6ad73933663 Sakari Ailus 2026-06-26  770  struct ipu6_isys_stream *
5bd6ad73933663 Sakari Ailus 2026-06-26  771  ipu6_isys_alloc_stream_firmware(struct ipu6_isys_csi2 *csi2,
5bd6ad73933663 Sakari Ailus 2026-06-26  772  				struct v4l2_subdev_state *csi2_state,
5bd6ad73933663 Sakari Ailus 2026-06-26  773  				struct v4l2_mbus_frame_desc *desc,
5bd6ad73933663 Sakari Ailus 2026-06-26  774  				u8 vc)
5bd6ad73933663 Sakari Ailus 2026-06-26  775  {
5bd6ad73933663 Sakari Ailus 2026-06-26  776  	struct device *dev = &csi2->isys->adev->auxdev.dev;
5bd6ad73933663 Sakari Ailus 2026-06-26  777  	struct ipu6_isys_stream *stream;
5bd6ad73933663 Sakari Ailus 2026-06-26  778  	struct v4l2_subdev_route *route;
5bd6ad73933663 Sakari Ailus 2026-06-26  779  	int ret;
3c1dfb5a69cf83 Bingbu Cao   2024-01-31  780  
5bd6ad73933663 Sakari Ailus 2026-06-26  781  	stream = kzalloc(sizeof(*stream), GFP_KERNEL);
3c1dfb5a69cf83 Bingbu Cao   2024-01-31  782  	if (!stream) {
5bd6ad73933663 Sakari Ailus 2026-06-26  783  		ret = -ENOMEM;
5bd6ad73933663 Sakari Ailus 2026-06-26  784  		goto err_free_stream;
3c1dfb5a69cf83 Bingbu Cao   2024-01-31  785  	}
3c1dfb5a69cf83 Bingbu Cao   2024-01-31  786  
5bd6ad73933663 Sakari Ailus 2026-06-26  787  	ret = ida_alloc_max(&csi2->isys->streams, IPU6_ISYS_MAX_STREAMS - 1,
5bd6ad73933663 Sakari Ailus 2026-06-26  788  			    GFP_KERNEL);
5bd6ad73933663 Sakari Ailus 2026-06-26  789  	if (ret < 0) {
5bd6ad73933663 Sakari Ailus 2026-06-26 @790  		kfree(stream);
5bd6ad73933663 Sakari Ailus 2026-06-26  791  		goto err_free_stream;

Double free on this error path.

5bd6ad73933663 Sakari Ailus 2026-06-26  792  	}
5bd6ad73933663 Sakari Ailus 2026-06-26  793  
5bd6ad73933663 Sakari Ailus 2026-06-26  794  	stream->stream_handle = ret;
5bd6ad73933663 Sakari Ailus 2026-06-26  795  	mutex_init(&stream->mutex);
5bd6ad73933663 Sakari Ailus 2026-06-26  796  	init_completion(&stream->stream_open_completion);
5bd6ad73933663 Sakari Ailus 2026-06-26  797  	init_completion(&stream->stream_close_completion);
5bd6ad73933663 Sakari Ailus 2026-06-26  798  	init_completion(&stream->stream_start_completion);
5bd6ad73933663 Sakari Ailus 2026-06-26  799  	init_completion(&stream->stream_stop_completion);
5bd6ad73933663 Sakari Ailus 2026-06-26  800  	INIT_LIST_HEAD(&stream->queues);
5bd6ad73933663 Sakari Ailus 2026-06-26  801  	stream->isys = csi2->asd.isys;
5bd6ad73933663 Sakari Ailus 2026-06-26  802  	stream->asd = &csi2->asd;
5bd6ad73933663 Sakari Ailus 2026-06-26  803  	stream->vc = vc;
3c1dfb5a69cf83 Bingbu Cao   2024-01-31  804  
5bd6ad73933663 Sakari Ailus 2026-06-26  805  	scoped_guard(spinlock_irqsave, &stream->isys->power_lock) {
5bd6ad73933663 Sakari Ailus 2026-06-26  806  		stream->isys->streams_by_handle[stream->stream_handle] =
5bd6ad73933663 Sakari Ailus 2026-06-26  807  			stream;
5bd6ad73933663 Sakari Ailus 2026-06-26  808  		csi2->streams_by_vc[stream->vc] = stream;
3c1dfb5a69cf83 Bingbu Cao   2024-01-31  809  	}
3c1dfb5a69cf83 Bingbu Cao   2024-01-31  810  
5bd6ad73933663 Sakari Ailus 2026-06-26  811  	list_add(&stream->csi2_entry, &csi2->streams);
3c1dfb5a69cf83 Bingbu Cao   2024-01-31  812  
5bd6ad73933663 Sakari Ailus 2026-06-26  813  	for_each_active_route(&csi2_state->routing, route) {
5bd6ad73933663 Sakari Ailus 2026-06-26  814  		struct media_pad *vdev_pad =
5bd6ad73933663 Sakari Ailus 2026-06-26  815  			media_pad_remote_pad_first(&csi2->asd.pad[route->source_pad]);
5bd6ad73933663 Sakari Ailus 2026-06-26  816  		struct v4l2_mbus_frame_desc_entry *entry = NULL;
3c1dfb5a69cf83 Bingbu Cao   2024-01-31  817  
5bd6ad73933663 Sakari Ailus 2026-06-26  818  		for (unsigned int i = 0; i < desc->num_entries; i++) {
5bd6ad73933663 Sakari Ailus 2026-06-26  819  			if (desc->entry[i].stream != route->sink_stream)
5bd6ad73933663 Sakari Ailus 2026-06-26  820  				continue;
3c1dfb5a69cf83 Bingbu Cao   2024-01-31  821  
5bd6ad73933663 Sakari Ailus 2026-06-26  822  			entry = &desc->entry[i];
3c1dfb5a69cf83 Bingbu Cao   2024-01-31  823  			break;
3c1dfb5a69cf83 Bingbu Cao   2024-01-31  824  		}
3c1dfb5a69cf83 Bingbu Cao   2024-01-31  825  
5bd6ad73933663 Sakari Ailus 2026-06-26  826  		if (!entry) {
5bd6ad73933663 Sakari Ailus 2026-06-26  827  			dev_dbg(dev, "cannot find stream %u in frame desc\n",
5bd6ad73933663 Sakari Ailus 2026-06-26  828  				route->sink_stream);
5bd6ad73933663 Sakari Ailus 2026-06-26  829  			ret = -EINVAL;
5bd6ad73933663 Sakari Ailus 2026-06-26  830  			goto err_ida_free;
3c1dfb5a69cf83 Bingbu Cao   2024-01-31  831  		}
3c1dfb5a69cf83 Bingbu Cao   2024-01-31  832  
5bd6ad73933663 Sakari Ailus 2026-06-26  833  		if (entry->bus.csi2.vc != vc)
5bd6ad73933663 Sakari Ailus 2026-06-26  834  			continue;
3c1dfb5a69cf83 Bingbu Cao   2024-01-31  835  
5bd6ad73933663 Sakari Ailus 2026-06-26  836  		struct ipu6_isys_video *av =
5bd6ad73933663 Sakari Ailus 2026-06-26  837  			container_of_const(vdev_pad, struct ipu6_isys_video,
5bd6ad73933663 Sakari Ailus 2026-06-26  838  					   pad);
3c1dfb5a69cf83 Bingbu Cao   2024-01-31  839  
5bd6ad73933663 Sakari Ailus 2026-06-26  840  		list_add(&av->aq.node, &stream->queues);
3c1dfb5a69cf83 Bingbu Cao   2024-01-31  841  
5bd6ad73933663 Sakari Ailus 2026-06-26  842  		stream->nr_output_pins++;
5bd6ad73933663 Sakari Ailus 2026-06-26  843  		av->stream = stream;
3c1dfb5a69cf83 Bingbu Cao   2024-01-31  844  	}
3c1dfb5a69cf83 Bingbu Cao   2024-01-31  845  
3c1dfb5a69cf83 Bingbu Cao   2024-01-31  846  	return stream;
3c1dfb5a69cf83 Bingbu Cao   2024-01-31  847  
5bd6ad73933663 Sakari Ailus 2026-06-26  848  err_ida_free:
5bd6ad73933663 Sakari Ailus 2026-06-26  849  	list_del(&stream->csi2_entry);
5bd6ad73933663 Sakari Ailus 2026-06-26  850  	ida_free(&csi2->isys->streams, stream->stream_handle);
3c1dfb5a69cf83 Bingbu Cao   2024-01-31  851  
5bd6ad73933663 Sakari Ailus 2026-06-26  852  err_free_stream:
5bd6ad73933663 Sakari Ailus 2026-06-26 @853  	kfree(stream);

Second free.

3c1dfb5a69cf83 Bingbu Cao   2024-01-31  854  
5bd6ad73933663 Sakari Ailus 2026-06-26  855  	return ERR_PTR(ret);
3c1dfb5a69cf83 Bingbu Cao   2024-01-31  856  }

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki