[git:media_stage/master] media: v4l: async: Fix notifier list entry init

[Hans Verkuil]

This is an automatic generated email to let you know that the following patch 
were queued:

Subject: media: v4l: async: Fix notifier list entry init
Author:  Alexander Stein <alexander.st...@ew.tq-group.com>
Date:    Thu Mar 7 15:24:51 2024 +0100

struct v4l2_async_notifier has several list_head members, but only
waiting_list and done_list are initialized. notifier_entry was kept
'zeroed' leading to an uninitialized list_head.
This results in a NULL-pointer dereference if csi2_async_register() fails,
e.g. node for remote endpoint is disabled, and returns -ENOTCONN.
The following calls to v4l2_async_nf_unregister() results in a NULL
pointer dereference.
Add the missing list head initializer.

Fixes: b8ec754ae4c5 ("media: v4l: async: Set v4l2_device and subdev in async 
notifier init")
Cc: <sta...@vger.kernel.org> # for 6.6 and later
Signed-off-by: Alexander Stein <alexander.st...@ew.tq-group.com>
Signed-off-by: Sakari Ailus <sakari.ai...@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil-ci...@xs4all.nl>

 drivers/media/v4l2-core/v4l2-async.c | 2 ++
 1 file changed, 2 insertions(+)

---

diff --git a/drivers/media/v4l2-core/v4l2-async.c 
b/drivers/media/v4l2-core/v4l2-async.c
index 3ec323bd528b..6a7dcf43d712 100644
--- a/drivers/media/v4l2-core/v4l2-async.c
+++ b/drivers/media/v4l2-core/v4l2-async.c
@@ -563,6 +563,7 @@ void v4l2_async_nf_init(struct v4l2_async_notifier 
*notifier,
 {
        INIT_LIST_HEAD(&notifier->waiting_list);
        INIT_LIST_HEAD(&notifier->done_list);
+       INIT_LIST_HEAD(&notifier->notifier_entry);
        notifier->v4l2_dev = v4l2_dev;
 }
 EXPORT_SYMBOL(v4l2_async_nf_init);
@@ -572,6 +573,7 @@ void v4l2_async_subdev_nf_init(struct v4l2_async_notifier 
*notifier,
 {
        INIT_LIST_HEAD(&notifier->waiting_list);
        INIT_LIST_HEAD(&notifier->done_list);
+       INIT_LIST_HEAD(&notifier->notifier_entry);
        notifier->sd = sd;
 }
 EXPORT_SYMBOL_GPL(v4l2_async_subdev_nf_init);