In v4l2_async_test_notify() if the registered_async callback or the
complete notifier returns an error the subdev is not unregistered.
This leave paths where v4l2_async_register_subdev() can fail but
leave the subdev still registered.

Add the required calls to v4l2_device_unregister_subdev() to plug
these holes.

Signed-off-by: Alban Bedel <[email protected]>
---
 drivers/media/v4l2-core/v4l2-async.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/drivers/media/v4l2-core/v4l2-async.c 
b/drivers/media/v4l2-core/v4l2-async.c
index ceb28d4..43393f8 100644
--- a/drivers/media/v4l2-core/v4l2-async.c
+++ b/drivers/media/v4l2-core/v4l2-async.c
@@ -121,13 +121,19 @@ static int v4l2_async_test_notify(struct 
v4l2_async_notifier *notifier,
 
        ret = v4l2_subdev_call(sd, core, registered_async);
        if (ret < 0 && ret != -ENOIOCTLCMD) {
+               v4l2_device_unregister_subdev(sd);
                if (notifier->unbind)
                        notifier->unbind(notifier, sd, asd);
                return ret;
        }
 
-       if (list_empty(&notifier->waiting) && notifier->complete)
-               return notifier->complete(notifier);
+       if (list_empty(&notifier->waiting) && notifier->complete) {
+               ret = notifier->complete(notifier);
+               if (ret < 0) {
+                       v4l2_device_unregister_subdev(sd);
+                       return ret;
+               }
+       }
 
        return 0;
 }
-- 
2.8.2

Reply via email to