Re: [PATCH] media: microchip-csi2dc: fix async notifier leak on probe error path
Eugen Hristev <[email protected]>
| Newsgroups | org.kernel.vger.linux-media,org.kernel.vger.linux-kernel |
|---|---|
| Message-ID | <[email protected]> |
On 8/8/26 12:07, Cong Nguyen wrote:
> csi2dc_of_parse() ends up calling csi2dc_prepare_notifier(), which
> registers the V4L2 async notifier with v4l2_async_nf_register(). The
> probe error label csi2dc_probe_cleanup_notifier is reached after
> csi2dc_of_parse() has already succeeded (e.g. when media entity init,
> csi2dc_power() or v4l2_async_register_subdev() fail), but it calls only
> v4l2_async_nf_cleanup() and never v4l2_async_nf_unregister().
>
> The notifier therefore stays chained in the global notifier_list while
> the enclosing struct csi2dc_device is freed, leading to list corruption
> and a use-after-free when the list is next walked.
>
> Unregister the notifier before cleaning it up on the error path,
> matching the teardown already done in csi2dc_remove().
>
> Fixes: 2de0b3c0f678 ("media: atmel: introduce microchip csi2dc driver")
> Cc: [email protected]
> Assisted-by: Claude:claude-opus-4
> Signed-off-by: Cong Nguyen <[email protected]>
> ---
Reviewed-by: Eugen Hristev <[email protected]>