Re: [PATCH v1 00/11] media: intel/ipu6: bounds, leak, and error handling fixes

[Antti Laakso]

Hi Valerii,
On Fri, Oct 23, 2026 at 07:55:28PM +0000, Valerii Sokolov wrote:
> This series fixes bugs in the Intel IPU6 input system (ISYS), Buttress,
> DMA/MMU and firmware interface code:
> 
>  1    Move the vb2_is_busy() check from VIDIOC_TRY_FMT to VIDIOC_S_FMT, so
>       TRY_FMT never returns -EBUSY and S_FMT can no longer overwrite
>       av->pix_fmt with an unvalidated format while buffers are allocated.
>  2    Return firmware message buffers to the free pool when sending a
>       stream start or capture command fails.
>  3    Bound the number of input and output pins in
>       ipu6_isys_fw_pin_cfg().
>  4    Clamp the crop top offset in ipu6_isys_csi2_set_sel().
>  5    Only call auxiliary device ISRs for interrupts that belong to them.
>  6    Release the firmware context when ipu6_fw_com_open() fails.
>  7-10 DMA/MMU fixes: an IOVA leak and a silently ignored mapping failure
>       in the scatterlist mapping helpers, a missing DMA unmap of the dummy
>       L2 page table, and a dev_err(NULL, ...).
> 11    Log the correct frame sequence number on EOF (debug only).
> 
> Patches 1, 3, 4 and 8 are tagged for stable. The other fixes address
> bounded leaks or cosmetic issues.
> 
> The IPU7 code recently added to this driver appears to have the same
> issues as patches 3 and 11 (ipu7_isys_fw_pin_cfg() and
> ipu7_isys_isr_one()). I have left those alone as I have no IPU7 hardware
> to test on.
> 
> Testing: each patch was build-tested with W=1 on top of
> media-committers/next, and the series was runtime-tested on a Raptor
> Lake laptop (Lenovo ThinkPad X1 Carbon Gen 11, OV2740 sensor).
> 
> Signed-off-by: Valerii Sokolov <valerii.sokolov@xxxxx>
> 
> Valerii Sokolov (11):
>   media: intel/ipu6: move busy check to ipu6_isys_vidioc_s_fmt_vid_cap()
>   media: intel/ipu6: fix firmware message buffer leak on send failure
>   media: intel/ipu6: check pin bounds in ipu6_isys_fw_pin_cfg()
>   media: intel/ipu6: clamp crop top offset in ipu6_isys_csi2_set_sel()
>   media: intel/ipu6: check irq_status mask before calling subdevice ISR
>   media: intel/ipu6: clean up fwctx on ipu6_fw_com_open() failure
>   media: intel/ipu6: fix IOVA leak on first entry failure in
>     ipu6_dma_map_sg()
>   media: intel/ipu6: return an error from ipu6_dma_map_sgtable() on
>     failure
>   media: intel/ipu6: unmap the dummy L2 page table in ipu6_mmu_destroy()
>   media: intel/ipu6: pass the device to dev_err() in ipu6_mmu_unmap()
>   media: intel/ipu6: fix EOF sequence logging in ipu6_isys_isr_one()
> 
>  drivers/media/pci/intel/ipu6/ipu6-buttress.c   |  3 ++-
>  drivers/media/pci/intel/ipu6/ipu6-dma.c        |  9 ++++++---
>  drivers/media/pci/intel/ipu6/ipu6-fw-isys.c    | 10 ++++++++--
>  drivers/media/pci/intel/ipu6/ipu6-isys-csi2.c  |  2 ++
>  drivers/media/pci/intel/ipu6/ipu6-isys-queue.c |  4 +++-
>  drivers/media/pci/intel/ipu6/ipu6-isys-video.c |  7 ++++---
>  drivers/media/pci/intel/ipu6/ipu6-mmu.c        |  5 +++--
>  7 files changed, 28 insertions(+), 12 deletions(-)
> 
> 
> base-commit: d7e7bca7169873b46e857c025c10f3336c1258d8
> -- 
> 2.56.0
> 
>

Reviewed-by: Antti Laakso <antti.laakso@xxxxxxxxxxxxxxx>