diff options
| author | Myeonghun Pak <mhun512@gmail.com> | 2026-07-29 11:18:34 +0900 |
|---|---|---|
| committer | Hans Verkuil <hverkuil+cisco@kernel.org> | 2026-09-09 09:16:32 +0200 |
| commit | 4957d480a0c87cf3d024e6ff1f57d1222f9212cb (patch) | |
| tree | 780c2c32922d1c4b4f245f70f33c1d22ceed6e3d | |
| parent | b83651d321d4fd07979a59f359dcb0266391f17a (diff) | |
| download | linux-next-4957d480a0c87cf3d024e6ff1f57d1222f9212cb.tar.gz linux-next-4957d480a0c87cf3d024e6ff1f57d1222f9212cb.zip | |
media: stm32: csi: unregister async notifier on cleanup
stm32_csi_parse_dt() registers the async notifier before probe finishes.
If a later operation fails, the error path only cleans up the notifier's
connections. It does not unregister the notifier, leaving its entry on
the global notifier list after the devm-allocated csidev is freed.
The remove path has the same problem. A later async operation can then
walk the stale notifier entry and access freed memory.
Unregister the notifier before cleaning up its resources on both paths.
Fixes: dcb0f4c16be5 ("media: stm32: csi: addition of the STM32 CSI driver")
Cc: stable@vger.kernel.org
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
| -rw-r--r-- | drivers/media/platform/st/stm32/stm32-csi.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/media/platform/st/stm32/stm32-csi.c b/drivers/media/platform/st/stm32/stm32-csi.c index ecd0ed8e76b5..78c68cf90ffc 100644 --- a/drivers/media/platform/st/stm32/stm32-csi.c +++ b/drivers/media/platform/st/stm32/stm32-csi.c @@ -1059,6 +1059,7 @@ static int stm32_csi_probe(struct platform_device *pdev) return 0; err_cleanup: + v4l2_async_nf_unregister(&csidev->notifier); v4l2_async_nf_cleanup(&csidev->notifier); return ret; } @@ -1067,6 +1068,8 @@ static void stm32_csi_remove(struct platform_device *pdev) { struct stm32_csi_dev *csidev = platform_get_drvdata(pdev); + v4l2_async_nf_unregister(&csidev->notifier); + v4l2_async_nf_cleanup(&csidev->notifier); v4l2_async_unregister_subdev(&csidev->sd); pm_runtime_disable(&pdev->dev); |